CAT.GEN.MPA.195 Handling of flight recorder recordings: preservation, production, protection and use

PRESERVATION OF RECORDED DATA FOR INVESTIGATION

(a)The operator should establish procedures to ensure that flight recorder recordings are preserved for the investigating authority.

(b)These procedures should include:

(1)instructions for flight crew members to deactivate the flight recorders immediately after completion of the flight and inform relevant personnel that the recording of the flight recorders should be preserved. These instructions should be readily available on board; and

(2)instructions to prevent inadvertent reactivation, test, repair or reinstallation of the flight recorders by operator personnel or during maintenance or ground handling activities performed by third parties.

REMOVAL OF RECORDERS IN CASE OF AN INVESTIGATION The need for removal of the recorders from the aircraft is determined by the investigating authority with due regard to the seriousness of an occurrence and the circumstances, including the impact on the operation.

INSPECTIONS AND CHECKS OF RECORDINGS

(a)The operator should perform an inspection of the FDR recording and the CVR recording every year unless one or more of the following applies:

(1)If the flight recorder records on magnetic wire or uses frequency modulation technology, the time interval between two inspections of the recording should not exceed 3 months.

(2)If the flight recorder is solid-state and the flight recorder system is fitted with continuous monitoring for proper operation, the time interval between two inspections of the recording may be up to 2 years.

(3)In the case of an aircraft equipped with two solid-state flight data and cockpit voice combination recorders, where

(i)the flight recorder systems are fitted with continuous monitoring for proper operation, and

(ii)the flight recorders share the same flight data acquisition, a comprehensive inspection of the recording needs only to be performed for one flight recorder position. The inspection of the recordings should be performed alternately so that each flight recorder position is inspected at time intervals not exceeding 4 years.

(4)Where all the following conditions are met, the inspection of the FDR recording is not needed:

(i)the aircraft flight data is collected in the frame of a flight data monitoring (FDM) programme;

(ii)the data acquisition of mandatory flight parameters is the same for the FDR and for the recorder used for the FDM programme;

(iii)an inspection similar to the inspection of the FDR recording and covering all mandatory flight parameters is conducted on the FDM data at time intervals not exceeding 2 years; and

(iv)the FDR is solid-state and the FDR system is fitted with continuous monitoring for proper operation.

(b)the operator should perform every 5 years an inspection of the data link recording;

(c)The operator should perform, at time intervals not exceeding 2 years, an inspection of the recording of flight recorders other than an FDR, which are installed on an aircraft, in order to ensure compliance with CAT.IDE.A.191 or CAT.IDE.H.191.

(d)When installed, the aural or visual means for preflight checking of the flight recorders for proper operation should be used on each day when the aircraft is operated. When no such means is available for a flight recorder, the operator should perform an operational check of this flight recorder at intervals not exceeding 150 flight hours or 7 calendar days of operation, whichever is considered more suitable by the operator.

(e)The operator should check every 5 years, or in accordance with the recommendations of the sensor manufacturer, that the parameters dedicated to the FDR and not monitored by other means are being recorded within the calibration tolerances and that there is no discrepancy in the engineering conversion routines for these parameters.

INSPECTION OF THE FLIGHT RECORDERS’ RECORDINGS FOR ENSURING SERVICEABILITY

(a)The inspection of recorded flight parameters usually consists of the following:

(1)Making a copy of the complete recording file.

(2)Converting the recording to parameters expressed in engineering units in accordance with the documentation required to be held.

(3)Examining a whole flight in engineering units to evaluate the validity of all mandatory parameters — this could reveal defects or noise in the measuring and processing chains and indicate necessary maintenance actions. The following should be considered:

(i)when applicable, each parameter should be expressed in engineering units and checked for different values of its operational range — for this purpose, some parameters may need to be inspected at different flight phases; and

(ii)(only applicable to an FDR) if the parameter is delivered by a digital data bus and the same data are utilised for the operation of the aircraft, then a reasonableness check may be sufficient; otherwise a correlation check may need to be performed:

(A)a reasonableness check is understood in this context as a subjective, qualitative evaluation, requiring technical judgement, of the recordings from a complete flight; and

(B)a correlation check is understood in this context as the process of comparing data recorded by the flight data recorder against the corresponding data derived from flight instruments, indicators or the expected values obtained during specified portion(s) of a flight profile or during ground checks that are conducted for that purpose.

(4)Retaining the most recent copy of the complete recording file and the corresponding recording inspection report that includes references to the documentation required to be held.

(b)When performing the inspection of an audio recording from a flight recorder, precautions need to be taken to comply with CAT.GEN.MPA.195(f)(1a). The inspection of the audio recording usually consists of:

(1)checking that the flight recorder operates correctly for the nominal duration of the recording;

(2)examining samples of in-flight audio recording from the flight recorder for evidence that the signal is acceptable on each channel and in all phases of flight; and

(3)preparing and retaining an inspection report.

(c)The inspection of the DLR recording usually consists of:

(1)Checking the consistency of the data link recording with other recordings for example, during a designated flight, the flight crew speaks out a few data link messages sent and received. After the flight, the data link recording and the CVR recording are compared for consistency.

(2)Retaining the most recent copy of the complete recording and the corresponding inspection report.

(d)When inspecting images recorded by a flight recorder, precautions need to be taken to comply with CAT.GEN.MPA.195(f)(3a). The inspection of such images usually consists of the following:

(1)checking that the flight recorder operates correctly for the nominal duration of the recording;

(2)examining samples of images recorded in different flight phases for evidence that the images of each camera are of acceptable quality; and

(3)preparing and retaining an inspection report.

MONITORING AND CHECKING THE PROPER OPERATION OF FLIGHT RECORDERS — EXPLANATION OF TERMS For the understanding of the terms used in AMC1 CAT.GEN.MPA.195(b):

(a)‘operational check of the flight recorder’ means a check of the flight recorder for proper operation. It is not a check of the quality of the recording and, therefore, it is not equivalent to an inspection of the recording. This check can be carried out by the flight crew or through a maintenance task.

(b)‘aural or visual means for preflight checking the flight recorders for proper operation’ means an aural or visual means for the flight crew to check before the flight the results of an automatically or manually initiated test of the flight recorders for proper operation. Such a means provides for an operational check that can be performed by the flight crew.

(c)‘flight recorder system’ means the flight recorder, its dedicated sensors and transducers, as well as its dedicated acquisition and processing equipment.

(d)‘continuous monitoring for proper operation’ means for a flight recorder system, a combination of system monitors and/or built-in test functions which operates continuously in order to detect the following:

(1)loss of electrical power supply to the flight recorder system;

(2)failure of the equipment performing acquisition and processing;

(3)failure of the recording medium and/or drive mechanism; and

(4)failure of the recorder to store the data in the recording medium as shown by checks of the recorded data including, as reasonably practicable for the storage medium concerned, correct correspondence with the input data. However, detections by the continuous monitoring for proper operation do not need to be automatically reported to the flight crew compartment.

CVR AUDIO QUALITY Additional guidance material for performing the CVR recording inspection may be found in the document of the French Bureau d’Enquêtes et d’Analyses, titled ‘Guidance on CVR recording inspection’ and dated October 2018 or later.

USE OF AUDIO RECORDINGS FOR MAINTAINING OR IMPROVING SAFETY

(a)The procedure related to the handling of audio recordings from flight recorders and of their transcripts should be documented and signed by all parties (aircraft operator, crew member representatives nominated either by the union or the crew themselves, maintenance personnel representatives if applicable). This procedure should take into account Regulation (EU) 2016/679 and as a minimum, define:

(1)the method to obtain the consent of all crew members and maintenance personnel concerned;

(2)an access and security policy that restricts access to audio recordings from flight recorders and their transcripts to specifically authorised persons identified by their position;

(3)a retention policy and accountability, including the measures to be taken to ensure the security of audio recordings from flight recorders and their transcripts and their protection from misuse. The retention policy should specify the period of time after which such audio recordings and identified transcripts are destroyed;

(4)a description of the uses made of audio recordings from flight recorders and their transcripts ;

(5)the participation of flight crew member representatives in the assessment of audio recordings from flight recorders and their transcripts;

(6)the conditions under which advisory briefing or remedial training should take place; this should always be carried out in a constructive and non-punitive manner; and

(7)the conditions under which actions other than advisory briefing or remedial training may be taken for reasons of gross negligence or significant continuing safety concern.

(b)Each time an audio recording file from a flight recorder is read out under the conditions defined by CAT.GEN.MPA.195(f)(1):

(1)parts of the audio recording file that contain information with a privacy content should be deleted to the extent possible, and it should not be permitted that the detail of information with a privacy content is transcribed; and

(2)the operator should retain, and when requested, provide to the competent authority:

(i)information on the use made (or the intended use) of the audio recording file; and

(ii)evidence that the persons concerned consented to the use made (or the intended use) of the audio recording file.

(c)The safety manager or the person identified by the operator to fulfil this role should be responsible for the protection and use of audio recordings from flight recorders and their transcripts, as well as for the assessment of issues and their transmission to the manager(s) responsible for the process concerned.

(d)In case a third party is involved in the use of audio recordings from flight recorders, contractual agreements with this third party should cover the aspects enumerated in (a) and (b).

INSPECTION OF AUDIO RECORDINGS FOR ENSURING SERVICEABILITY

(a)When an inspection of the audio recordings from a flight recorder is performed for ensuring audio quality and intelligibility of recorded communications:

(1)the privacy of the audio recordings should be ensured (e.g. by locating the replay equipment in a separated area and/or using headsets);

(2)access to the replay equipment should be restricted to specifically authorised persons identified by their position;

(3)provision should be made for the secure storage of the recording medium, the audio recording files and copies thereof;

(4)the audio recording files and copies thereof should be destroyed not earlier than 2 months and not later than 1 year after completion of the inspection of the audio recordings, except that audio samples with no privacy content may be retained for enhancing this inspection (e.g. for comparing audio quality);

(5)only the accountable manager of the operator and, when identified to comply with ORO.GEN.200, the safety manager should be entitled to request a copy of the audio recording files.

(b)The conditions enumerated in (a) should also be complied with if the inspection of the audio recordings is subcontracted to a third party. The contractual agreements with the third party should explicitly cover these aspects.

USE OF FDR DATA FOR AN FDM PROGRAMME The use of FDR data in the framework of an FDM programme may be acceptable if it fulfils the conditions set by sub-paragraph (f)(2) of CAT.GEN.MPA.195.

USE OF IMAGES FROM THE FLIGHT CREW COMPARTMENT FOR MAINTAINING OR IMPROVING SAFETY

(a)The procedure related to the handling of images of the flight crew compartment that are recorded by a flight recorder should be documented and signed by all parties involved (aircraft operator, crew member representatives nominated either by the union or the crew themselves, maintenance personnel representatives if applicable). This procedure should take into account Regulation (EU) 2016/679 and, as a minimum, define the following aspects:

(1)the method to obtain the consent of all crew members and maintenance personnel concerned;

(2)an access and security policy that restricts access to the image recordings to specifically authorised persons identified by their position;

(3)a retention policy and accountability, including the measures to ensure the security of the image recordings and their protection from misuse. The retention policy should specify the period of time after which such image recordings are destroyed;

(4)a description of the uses made of the image recordings;

(5)the participation of flight crew member representatives in the assessment of the image recordings;

(6)the conditions under which advisory briefing or remedial training should take place; this should always be carried out in a constructive and non-punitive manner; and

(7)the conditions under which actions other than advisory briefing or remedial training may be taken for reasons of gross negligence or significant continuing safety concern.

(b)Each time an image recording file from a flight recorder that contains images of the flight crew compartment is read out for purposes other than ensuring the serviceability of that flight recorder:

(1)images that contain information with a privacy content should be deleted to the extent possible, and it should not be permitted that the detail of information with a privacy content is transcribed; and

(2)the operator should retain, and when requested, provide the competent authority with:

(i)information on the use made (or the intended use) of this image recording file; and

(ii)evidence that the crew members concerned consented to the use made (or the intended use) of the flight crew compartment images.

(c)The safety manager or the person identified by the operator to fulfil this role should be responsible for the protection and use of images of the flight crew compartment that are recorded by a flight recorder, as well as for the assessment of issues and their transmission to the manager(s) responsible for the process concerned.

(d)In case a third party is involved in the use of images of the flight crew compartment that are recorded by a flight recorder, contractual agreements with this third party should cover the aspects enumerated in (a) and (b).

INSPECTION OF IMAGES OF THE FLIGHT CREW COMPARTMENT FOR ENSURING SERVICEABILITY

(a)When images of the flight crew compartment recorded by a flight recorder are inspected for ensuring the serviceability of the flight recorder, and any body part of a crew member is likely to be visible on these images, then:

(1)the privacy of the image recordings should be ensured (e.g. by locating the replay equipment in a separated area);

(2)access to the replay equipment should be restricted to specifically authorised persons identified by their position;

(3)provision should be made for the secure storage of the recording medium, the image recording files and copies thereof;

(4)the image recording files and copies thereof should be destroyed not earlier than 2 months and not later than 1 year after completion of the inspection of the image recordings. Images that do not contain any body part of a person may be retained for enhancing this inspection (e.g. for comparing image quality); and

(5)only the accountable manager of the operator and, when identified to comply with ORO.GEN.200, the safety manager should be entitled to request a copy of the image recording files.

(b)The conditions enumerated in (a) should also be complied with if the inspection of the image recording is subcontracted to a third party. The contractual agreements with the third party should explicitly cover these aspects.

FLIGHT CREW COMPARTMENT If there are no compartments to physically segregate the flight crew from the passengers during the flight, the ‘flight crew compartment’ in point (f) of CAT.GEN.MPA.195 should be understood as the area including:

(a)the flight crew seats;

(b)aircraft and engine controls;

(c)aircraft instruments;

(d)windshield and windows used by the flight crew to get an external view while seated at their duty station; and

(e)circuit breakers accessible by the flight crew while seated at their duty station.