ED-112B: what changed since ED-112A for crash-protected recorders

From ED-112A to ED-112B

EUROCAE ED-112A, published in September 2013, is the minimum operational performance specification for crash-protected airborne recorder systems: flight data, cockpit voice, images and data link messages. ED-112B replaces it. Prepared by EUROCAE working group 118, it was published in 2023; its Change 1, approved in December 2024, reworked the survival criteria and the sea tests, and EUROCAE now issues the standard as one document integrating that change.

The architecture is kept and extended: a common section, sections for deployable recorders, combination recorders and the recorder independent power supply, then one part per recording function. ED-112B adds a section on the transmission of flight recorder data and a fifth part, on recording the flight crew machine interface. Its foreword lists the other changes: a harmonised structure, wider coverage of ground support and investigator equipment, expanded cockpit voice requirements and audio quality assessment, updated flight data parameter tables, a much revised image recorder part with screen capture, and the removal of the flight data recorder types.

What does not change: the crash envelope

The mechanical and thermal tests that define a crash-protected memory module are carried over at the same levels. For a fixed recorder:

The crush force is applied at a minimum of four points, faces and main diagonals included — seven tests for a cuboid module — and the fluid immersion test closes the two fire sequences, unless the memory has been tested against the fluids separately. A design qualified to ED-112A therefore starts from known ground: what changes is the water.

The sea, tested for 90 days

ED-112B organises the survival demonstration of a fixed recorder in four sequences. Three start with the same mechanical tests — impact, shear and tensile on the beacon attachment, penetration, crush — and end with the high-temperature fire, the low-temperature fire or the deep-sea pressure test. The fourth is new: sea water immersion with the module open.

Deep-sea pressure stays at 60 MPa, the pressure at about 6 000 m, but for 90 days instead of 30. Because hyperbaric chambers that hold pressure for three months are rare, Change 1 allows an alternative on the same module, kept closed: 24 hours at pressure, 90 days in warm sea water, then 24 hours at pressure again. The standard gives its reasoning — warm water corrodes faster, and the second pressure test shows whether corrosion has weakened the shell.

The open immersion assumes the worst case at sea: the armour breached in the accident. The module is opened and filled with sea water, the memory stays inside it, and the whole stays 90 days at 1 to 3 m, between 25 and 35 °C. What is tested is no longer the seal of the shell but the memory, its board and its connections in salt water. The standard accepts a demonstration instead, if the recording medium can be shown to resist sea water; in practice, the test is often the shorter path.

The recovery criteria are explicit. After the high-temperature fire, deep-sea and immersion sequences, the data must come back with simple repairs only, such as replacing the harness of the protected module, without re-soldering memory devices. After the low-temperature fire, the memory devices may be removed and read separately.

Cockpit audio: up to 25 hours, and measured intelligibility

In 2016, ICAO adopted a standard calling for cockpit voice recorders that keep the last 25 hours, for aeroplanes over 27 000 kg engaged in commercial air transport or international general aviation, with a first certificate of airworthiness issued on or after 1 January 2022. ED-112A, published in 2013, predates that decision; ED-112B includes the provisions for it. It defines six classes of cockpit voice recorder by duration: 30 minutes, 60 minutes, 2, 10, 15 and 25 hours.

Audio quality is now measured with the Speech Transmission Index of IEC 60268-16. The test applies to the recorder itself, on every channel where it digitises the audio or alters a digital input, for instance by down-sampling, and each channel must reach the minimum index the standard sets for it.

Flight data: tables updated, types removed

The flight data part keeps its role: record the parameters needed to determine flight path, speed, attitude, engine power, configuration and operation. Its parameter tables are updated, and the references to the recorder types of ICAO are gone, because ICAO no longer distinguishes them. The list of parameters an aircraft must record still comes from the operational rules for its class, not from the recorder standard.

Images: screen capture comes in

The image recorder part is largely rewritten. Besides cameras, it now covers screen capture: recording what the crew's electronic displays show, after the signal leaves the source equipment. A screen capture system records everything displayed, blank fields included, at the resolution and colours the crew sees, and the positions of virtual switches such as a button on a touch screen. If it records every page of a display, it must show which page was actually on screen. An image recorder keeps at least 2 hours, or the duration of the data link or flight data function it replaces.

The standard keeps its order of preference: a parameter recorded explicitly by the flight data recorder is more accurate and more usable than the same value read from an image. Lightweight image recorders remain in ED-155.

Recording what the crew sees and touches

Part V, on the flight crew machine interface, is new. Flight data and voice recorders say what the aircraft did and what the crew said, but rarely what the crew saw on the displays and which controls they operated. The new part covers the electronic displays, selections on touch screens, head-up displays and enhanced vision systems, and the operation of switches and selectors.

• The means can be combined: the flight data recorder for switch positions, screen capture, image recorders, bus recorders, cameras.
• The recording includes the primary flight displays at least.
• The relative timing between these recordings must be known within 0.25 s.
• A switch held for less than 250 ms may not be recorded; the standard recommends holding the signal longer than the action itself.
• Screen capture alone is not enough: it does not see physical switches and selectors.

Flight data sent off the aircraft

The new Section 6 covers the transmission of flight recorder data, meant to recover data quickly when an aircraft is lost in deep water, in mountains or in areas hard to reach. It supplements the onboard recorders and does not replace them. It defines two classes:

• Class T, triggered: the system keeps at least 20 minutes of history in a buffer and starts transmitting within 1 second of a triggering event, history and live data together.
• Class C, continuous: the system transmits in near real time from before take-off, over a link able to carry at least 1.2 times the rate at which data are produced.

Five types say what is transmitted: cockpit voice, flight data, data link, images or flight crew machine interface. The system needs non-volatile memory, must not disturb the onboard recorders, and the ground system that receives the data is outside the scope of the standard.

Download tools: what investigators can expect

ED-112B separates ground support equipment, which operators use to download serviceable recorders, from accident investigator recorder equipment, which reads damaged recorders and recordings that may have been erased. It sets rules on both, to balance cyber security against access for investigators:

• Encrypted links between the tool and the recorder are allowed.
• Tools supplied to investigation authorities must not encrypt the data they download, and must decrypt data an operator chose to encrypt.
• Those tools require no password, except for functions that permanently erase recordings, and that password is documented for the investigators.
• Tools supplied to operators must protect the replay of audio and images with a password managed by the operator.
• The equipment should be available when the recorder enters service, with sample memory devices to check that it works.

For a manufacturer, the recovery chain becomes part of compliance: the recorder is not finished until an investigator can read it, years later, without asking anyone.

What it means for a programme

1. Read the edition — and the Change — named in your certification basis or contract. ED-112B with Change 1 is not the same set of sea tests as ED-112B without it.
2. Reuse what can be reused. Impact, penetration, crush and fire levels have not moved, so existing ED-112A evidence can support a delta analysis, provided the test sequences and specimens match what ED-112B asks for.
3. Plan for the sea. The sea tests take at least three months, plus the pressure tests and the recovery; they set the end date of a qualification campaign. Start them early, and plan a specimen to open.
4. Check the audio channels against the Speech Transmission Index, and size the memory for the cockpit voice class your aircraft needs.
5. Supply investigator tools that need no password and do not encrypt, and document the erase password.
6. Screen capture, crew interface recording and data transmission apply only when your rules require them: ED-112B says how, not whether.