Cockpit Voice Recorders

DAD 498: Audio Forensics — Week 14

Today’s Topics

History of flight recording
How CVRs work
Recovery and legal protocols
Three case studies
Future directions

I. History of Flight Recording

From railroad ledgers to solid-state memory

The Problem: Crashes Without Answers

Early accidents left investigators guessing
No record of crew actions or voice
Wreckage alone couldn’t explain everything
Systematic recording seemed impossible

Early Milestones

1839 — Babbage proposes railroad crash recorder
1939 — Hussenot & Beaudouin: optical film recorder (France)
1942 — Finnish “Mata Hari”: metal foil styli recorder
1953–54 — Ryan patent; David Warren proposes CVR (Australia)
1965 — Recorders moved to the tail (empennage)

Modern Solid-State CVRs

1972 — Regulations prohibit pilot erasure of CVR
Early 1990s — Tape replaced by solid-state memory
Today — 2-hour buffer, four channels, crash-survivable
Painted bright orange (not black) for recovery visibility

Discussion

Why did pilots resist CVR mandates early on?
How do disasters shape aviation safety rules?
Should CVR recordings ever be made public?

“Why did pilots resist?” — Unions worried about privacy and disciplinary use of recordings. The nondisclosure laws and strict CVR Group protocols were partly a response to this concern, designed to ensure CVR data is used for safety investigation only, not punitive action.

“How disasters shape rules?” — Regulatory change in aviation is nearly always reactive. The DeHavilland Comet crashes drove Warren’s proposal; later crashes drove mandatory installation. This pattern — tragedy → investigation → new rule — is consistent throughout aviation safety history.

“Should CVRs be made public?” — Federal law prohibits release of CVR audio, though transcripts can be released. The argument against release is that public dissemination could chill candid cockpit communication. A counterargument is accountability and public interest.

II. How CVRs Work

Four channels, two hours, crash-survivable

Four Recording Channels

Channel 1 — Pilot’s headset microphone
Channel 2 — Copilot’s headset microphone
Channel 3 — Cockpit area microphone (ceiling-mounted)
Channel 4 — Intercom / passenger address system

The Memory Buffer Loop

Records continuously, overwrites oldest data
Minimum 2 hours of audio retained
Older units: 30-minute loop only
Starts recording when aircraft is powered up

The CVR operates as a circular buffer — it is always recording, but only the most recent two hours are retained. This means that in a short flight that ends in a crash, the entire flight may be captured. On longer flights, only the final two hours are available. A critical operational implication: if a CVR is left powered after an accident, it may overwrite the accident data. This is why NTSB protocol requires immediate deactivation on arrival at the scene.

The fact that it activates when the aircraft powers up — before the flight data recorder begins recording during takeoff — means it often captures pre-flight checklists, crew discussions, and cockpit preparation. This can be significant in investigations of maintenance-related accidents.

Citation: Maher, R.C. Principles of Forensic Audio Analysis, Ch. 10.

Survivability Engineering

Mounted in the tail (empennage) since 1965
Bright orange for recovery visibility
Withstands: extreme G-forces, fire, deep water
The microphone doesn’t survive — the data does
Underwater locator beacon: 30-day battery

CVRs are engineered to survive what the aircraft cannot. They are placed in the tail because crash physics tend to be less severe there than at the nose. The casing must withstand 3,400 G of impact force, fire at 1,100°C for 30 minutes, and water pressure equivalent to a depth of 6,000 meters.

A common misconception worth addressing: the microphone itself is almost certainly destroyed in a crash. What survives is the solid-state memory module — the audio was already digitized and written to it during the flight. The cutaway diagram shows the layers protecting those chips: steel housing, thermal insulation, a thermal block, and the crash-survivable memory unit at the center. By the time the aircraft hits the ground, the microphone has done its job. The chips just need to stay intact and readable.

The underwater locator beacon (ULB) emits a 37.5 kHz acoustic pulse to help recovery crews find the device in water — but its 30-day battery life was challenged dramatically by the MH370 disappearance, where the search lasted over two years.

Citation: Maher, R.C. Principles of Forensic Audio Analysis, Ch. 10.

CVR internal components

Discussion

Why is the cockpit area microphone forensically significant?
What are the limitations of a 2-hour buffer?
How does recorder placement in the tail affect what gets captured?

“CAM significance?” — The area microphone picks up sounds that headset mics miss: airframe vibrations, structure-borne sounds, background noise that can reveal engine state, mechanical failures, and environmental conditions. In the USAir 427 case we will see shortly, the CAM captured the “clunks and rattles” that ultimately identified the rudder defect.

“2-hour buffer limitations?” — Any flight longer than 2 hours will not have the takeoff captured. This is relevant for long-haul flights where the accident may have roots in decisions made at departure. Air France 447 was on an 11-hour overnight flight; only the final 2 hours were available.

“Tail placement?” — The tail is the most survivable location, but it also means the recording is somewhat distant from some engine and wing events. Structure-borne sounds travel through the airframe and may be attenuated or altered by the distance.

III. Recovery & Legal Protocols

Chain of custody in the cockpit

FDR and CVR from Air France Flight 447 recovered from the Atlantic Ocean, 2011

This image shows the actual FDR and CVR from Air France Flight 447, recovered from the Atlantic Ocean in 2011 — nearly two years after the crash. When the investigation team first located the recorders on April 26, 2011, only the chassis of the FDR was found; the protected memory module wasn’t recovered until May 1. The CVR was located and salvaged the following day, May 2. The team then spent a full year analyzing the data before completing the accident report in 2012.

This is a useful image to hold in mind throughout this section. Despite sitting at 3,800 meters depth for two years, the memory modules survived. The protocols that follow — immediate deactivation, no on-scene playback, packing water-recovered units in fresh water — exist precisely to protect data that has already survived the unsurvivable.

Immediate Steps at the Scene

Deactivate CVR immediately (pull circuit breakers)
Do NOT play back or open at the scene
If found in water: pack in fresh water, keep submerged
Ship directly to NTSB headquarters, Washington DC
Source: Cockpit Voice Recorder Handbook for Aviation Accident Investigations

Chain of Custody

Assigned to a single CVR specialist at NTSB
Full extraction without filters — no processing yet
Transcription done by a formal CVR Group
CVR Group includes: FAA, manufacturer, pilot unions

Transcription Rules

Document facts only: words and sounds
No interpretation in the official transcript
All participants sign nondisclosure agreements
Unauthorized release is a federal offense

Discussion

Why are pilot union reps included in the CVR Group?
What conflicts arise between transparency and nondisclosure?
How does “no interpretation” in the transcript shape the investigation?

“Why pilot unions?” — Unions negotiated to be in the room partly to protect members from disciplinary use of recordings, and partly to provide expertise in interpreting aviation jargon and normal cockpit communication patterns. Their presence is both a safeguard and a form of participatory oversight.

“Transparency vs. nondisclosure?” — Families of victims, journalists, and the public often push for release of CVR audio. The NTSB argues that releasing audio would make crews less candid in cockpits. The families of Germanwings 9525 victims were particularly vocal about wanting to hear what happened. This tension has no easy resolution.

“No interpretation in transcript?” — It keeps the document neutral but can frustrate analysts who want to note ambiguities. It also means the same transcript can later support very different interpretive theories.

IV. Case Studies

Three accidents, three roles for CVR analysis

Germanwings Flight 9525 (2015)

Airbus A320 crashed in the French Alps
150 people killed — no survivors
Captain locked out of cockpit mid-flight
Copilot deliberately crashed the aircraft

Germanwings: What the CVR Captured

Captain’s urgent knocking — then attempts to break the door
Copilot’s slow, steady breathing throughout the descent
No response to air traffic control
Passenger screams in the final seconds

USAir Flight 427 (1994)

Boeing 737 crashed near Pittsburgh
132 people killed — no survivors
CVR captured unusual mechanical sounds
Led to major Boeing 737 inspection program

USAir 427: “Clunks and Rattles”

CVR captured unusual structure-borne vibrations
NTSB reproduced sounds in laboratory experiments
Matched: rudder power control unit (PCU) failure
Cause: sudden rudder reversal — “rudder hardover”

Forensic acoustic analysis of the CVR revealed specific “clunks and rattles” in the seconds before the crash. NTSB specialists conducted extensive laboratory experiments, moving a Boeing 737 rudder through various positions and failure modes while recording the resulting structure-borne vibrations through the airframe microphone. They eventually reproduced the exact sounds from the accident recording — matching the acoustic signature to a rudder PCU failure mode that caused the rudder to suddenly deflect fully in the direction opposite to pilot input. This “rudder hardover” was the cause of the crash. The investigation also implicated an identical defect in another 737 crash (United 585) that had occurred three years earlier.

Citation: Maher, R.C. Principles of Forensic Audio Analysis, Ch. 10.

Diagram of Boeing 737 rudder PCU showing the valve mechanism

Execuflight Flight 1526 (2015)

Beechcraft King Air crashed near Akron, Ohio
9 people killed — no survivors
No flight data recorder on board
Old analog CVR in poor condition

Execuflight: Engine Whine as Evidence

No FDR — CVR was the only recorder
Engine turbine whine captured on recording
Whine frequency → turbine speed → throttle setting
Crew failed checklist; should have aborted the approach

With no FDR to provide engine parameters, investigators turned to the CVR audio itself for performance data. The turbine engines of a King Air produce a characteristic high-frequency whine whose pitch correlates with turbine rotational speed. Forensic audio specialists analyzed this whine to extract RPM data, then converted that to throttle settings and engine performance at each phase of the approach. The analysis showed that the crew had not followed proper checklists and had continued an approach that should have been aborted due to an impending aerodynamic stall.

The CVR thus served double duty: as a speech recorder and as an inadvertent flight data recorder. This case also demonstrated an important forensic principle: sounds that seem like background noise often carry significant technical information.

Citation: Maher, R.C. Principles of Forensic Audio Analysis, Ch. 10.

Discussion

How does each case use CVR audio differently?
What would investigators have missed without the CVR?
What ethical questions does Germanwings raise about pilot privacy?

“Different uses?” — Germanwings: speech and physiological sounds proving intent. USAir 427: structure-borne vibrations identifying mechanical defect. Execuflight: background engine sounds serving as substitute flight data. Each shows the CVR as a multi-dimensional forensic tool, not just a voice recorder.

“Without CVR?” — Germanwings: investigators might have assumed catastrophic mechanical failure; the deliberate act could have been obscured. USAir 427: the investigation already took four years with the CVR; without it, the rudder defect might never have been identified. Execuflight: without both recorders, a definitive cause would have been nearly impossible.

“Pilot privacy in Germanwings?” — Lubitz’s mental health records were legally protected in Germany. The question of how much airlines and regulators should be able to access pilot medical records, and whether continuous monitoring might prevent such tragedies, has reshaped European aviation regulations since 2015.

V. Future Directions

When the box can’t be found

The Recovery Problem

Air France 447: 2 years to recover CVR (deep Atlantic)
MH370: still missing — CVR never recovered
Deep water, remote terrain, vast debris fields
Locator beacon battery lasts only 30 days

Proposed Solutions

Automatic ejection — CVR ejects and floats before impact
Satellite streaming — Real-time transmission to orbit
Extended beacons — Longer battery, stronger signal
Some aircraft already carry upgraded systems post-MH370

Discussion

Does real-time streaming change the privacy calculus for CVRs?
Would streaming have solved the MH370 mystery?
Who should have access to streamed flight data?

“Privacy calculus?” — If voice data is streamed to satellites in real time and stored on remote servers, the strict nondisclosure protections that currently apply to CVRs become more complex. Who controls the data? Under what circumstances can it be accessed? The protection currently comes partly from physical custody of a single device.

“Would streaming have solved MH370?” — Almost certainly yes: if the flight’s final position data and cockpit audio had been transmitted in real time, the aircraft would have been found within days. This is a powerful argument for the technology.

“Who has access?” — Airline? Government? NTSB? Manufacturer? The governance question is unresolved and would vary by country. This parallels questions about cloud storage of sensitive data in other domains.

Key Takeaways

CVRs capture 4 channels in a 2-hour crash-survivable loop
Strict protocols protect both evidence integrity and pilot privacy
CVR audio can prove intent, identify mechanical faults, and substitute for missing data
Recovery limitations are driving a shift toward real-time transmission

Coming Up Thursday

Major case studies in depth
Air France 447: cognitive bias in the cockpit
MH370: satellite pings and the limits of acoustic evidence
CVR transcripts as a dataset: the Noort study