Crash-protected recorders: what ED-112A and ED-155 require

Two standards, two classes of aircraft

EUROCAE ED-112A is the Minimum Operational Performance Specification for crash-protected airborne recorder systems: flight data, cockpit audio, images and data-link recording, for transport aircraft. It is the document behind the ETSO and TSO authorisations that an installed recorder carries, and it covers far more than survivability — recording duration, mandatory parameters, interfaces, data recovery.

ED-155 is its counterpart for lightweight flight recording systems: the same intent, on a reduced crash-protection envelope, for aircraft where the full transport-category unit makes no sense — general aviation, rotorcraft, unmanned platforms, and increasingly light aircraft fitted voluntarily.

Which one applies is not a technical choice. It comes from the airworthiness and operational rules for the aircraft class and mission, and it is settled by the regulator long before anyone opens a datasheet. What the standards do is define, in testable terms, what the word "survivable" is allowed to mean.

Anatomy of a crash-protected recorder

A crash-protected recorder solves two unrelated problems at once. It has to work for years in an aircraft — that is a DO-160 and MIL-STD-810 question, the ordinary environmental qualification every airborne box goes through. And its memory has to survive an accident that destroys the aircraft, which is a completely different engineering problem.

The second problem is solved by concentrating all the protection in one place: the crash-survivable memory unit. Inside it, the solid-state memory sits in a sealed cavity, wrapped in a high-temperature insulator and a thermal block whose job is to absorb the energy of the fire rather than let it reach the memory. All of that lives inside a machined shell, stainless steel or titanium.

The consequences of that architecture run deeper than mechanics. Since the electronics are sacrificial, the recording has to be readable from the memory alone, extracted in a laboratory with the original boards gone. And since power disappears without warning, the last seconds of a flight — the most valuable ones — must already be committed to non-volatile memory. A file format that only becomes valid when it is closed, or an index written at the end, is a design defect in this context, not a subtlety.

The survivability tests, one by one

The ED-112A crash-survivability sequence is deliberately brutal, and each test stands for a real accident mechanism rather than an abstract safety factor.

Two things are worth noticing in that table. The fire tests are the ones that size the design: memory dies survive nowhere near 1 100 °C, so the whole game is delaying heat — sixty minutes of flame, then ten hours of soak — and delay costs insulation, which costs volume and mass. And the tests are not independent: the standard defines a test sequence on specimens, so a module that has already been crushed and burned is the one that then goes into the water.

Being found: underwater locating devices

Surviving is useless if the recorder is never recovered. An underwater locating beacon is fixed to the part that survives — never to the sacrificial chassis — and activates on contact with water, emitting an acoustic tone at 37.5 kHz that a search vessel can track with a towed hydrophone.

Under ED-112A the beacon has a 90-day operating life, extended from the earlier 30 days after the search campaigns of the 2000s made the limit painfully concrete. For large aeroplanes on extended over-water routes, the rules add a second, lower-frequency device attached to the airframe itself, on the reasoning that a large structure is easier to find than a small box.

On the maintenance side, a beacon is a scheduled item: its battery has a limited service life and has to be replaced on a defined interval, which is one of the few recurring costs a recorder carries through its life.

What has to be recorded, and for how long

• Flight data: the mandatory parameter list comes from the operational rules for the aircraft class, not from the recorder, with a typical retention of 25 hours.
• Cockpit audio: two hours historically, and 25 hours for aeroplanes newly certified in Europe under the recent rules — check the requirement applicable to your aircraft and date.
• Images and data link: separate recording classes in ED-112A, with their own duration and quality requirements.
• Combined recorders merge functions in one unit; some installations require two independent recorders, and separation on the airframe is itself part of the safety argument.
• An independent power supply keeps cockpit audio recording for a defined period after the aircraft supply is lost — the point being to capture the final seconds, when the aircraft electrical system is already failing.

Notice what is not on that list: bit rate. A crash recorder is not a performance product. What is specified is integrity, duration and the certainty that what was recorded can be read back — and the accident investigation only ever cares about the last few minutes.

Where ED-155 stops

ED-155 keeps the structure of ED-112A and lowers the envelope. The crash-protection levels are reduced across the board, the fire and immersion exposures are less severe, and the deep-sea pressure requirement of the transport-category unit does not carry over. In exchange, a lightweight recorder weighs a fraction of an ED-112A unit — around 3.3 kg for a complete system rather than the mass of a transport-category recorder — which is what makes it installable on a light helicopter or a UAV at all.

The trap is the word "lightweight". An ED-155 recorder is crash protected: it is qualified against a defined set of impact, crush, fire and immersion tests, and its memory is inside a protected module exactly like its bigger sibling. It is not a black box in the marketing sense, and it is not an ordinary mission recorder with a stronger case. When you compare two units, compare the qualification evidence, not the vocabulary — and always against the current edition of the standard, since the levels are revised.

Designing against these numbers

• Mass is protection. Every gram of shell and insulation is survivability you keep and payload you lose, and there is no clever way out of that trade — only careful shaping of the protected cavity.
• Memory density fights the cavity. More capacity means more dies, more volume to protect, more surface to insulate. Capacity is never free on a crash recorder.
• The write path is a survivability feature: short buffers, frequent commits, redundancy inside the module, and a layout that stays readable when the file was never closed.
• Recovery must be documented. An investigation authority may open that module years later, possibly without the manufacturer — the extraction procedure is part of the product.
• Every change to the protected module reopens the qualification. Crash tests are destructive, so the evidence is built on specimens and a defined sequence, and a modification is answered with a delta analysis or a statement of similarity, not with an opinion.

Reading the paperwork

A crash-protected recorder is sold with its evidence. The useful questions are always the same: which edition of ED-112A or ED-155, which classes of recording, which tests were performed on which specimens, what the declared performance is, and which authorisation the unit holds. A datasheet claiming crash protection without a test matrix behind it is a claim, not a qualification.

That paperwork is also what survives the programme. Twenty years later, the aircraft is still flying, the recorder is still installed, and the qualification file is the only thing that explains why anyone should trust the memory inside it.