At 1:49 a.m. Universal Time on June 1, 2009, the pilots of Air France Flight 447 from Rio de Janeiro to Paris radioed to Brazilian air traffic controllers as they were leaving their airspace. They had entered a communications dead zone over the South Atlantic Ocean; it would be another two hours before the jet could contact a human on the ground. For the seasoned captain flying the Airbus A330, this was a routine handoff, and although the plane was heading into a thunderstorm, there was nothing to suggest anything was amiss. “Air France four-four-seven, contact Atlantic center,” the captain repeated back to the control center. And then, he left the cockpit for a scheduled rest break—another normal practice on this 11-hour run. A relief pilot joined the copilot at the controls.
Those were the last words anyone heard from the cockpit or from the 228 souls aboard, who never made it to their destination. That is, until two years later, when, from depths of 13,000 feet at the bottom of the ocean, the same team behind the discovery of the Titanic dredged up a pair of metal boxes from the wreckage of the plane, each about the size of a shoe box. If the recordings they housed had survived the punishing conditions at the bottom of the sea, they could solve the mystery of what happened to Flight 447.
The search to date had been one of the biggest and costliest in the history of airline crashes, costing the industry more than $30 million. This latest mission, using autonomous submersibles that combed the ocean floor, was to be the final attempt before authorities would pull the plug on more expensive undersea investigations.
Black boxes—which are actually orange, not black, to aid in discovery—are remarkably resilient; they’re built to withstand fires of 2,000 degrees Fahrenheit and an impact of 3,400 times the force of Earth’s gravity, roughly a velocity of 310 mph. (Humans can withstand roughly 5 Gs before passing out.) Within them, they contain critical information about a plane’s last moments. Still, they had never been recovered after having been submerged for so long in such depths. Once the boxes arrived under police escort at a Paris laboratory, investigators quickly found that aside from some minor damage, the data was intact.
By May 2011 the final moments of the Air France flights had emerged, revealing a series of mishaps, each of which could have been survivable—but instead spiraled into a deadly crash. First, a cloud of ice pellets struck the jet, freezing its speedometers, known as pitot tubes. Loud alarms blasted the cockpit, and the pilots began to panic. The alarms stopped a minute later, after a backup system for the speedometer kicked in. But the copilot had pitched the plane up, causing it to stall, and he spent the last minutes of the flight trying to raise the nose of the Airbus 330, the reverse of what pilots are taught to do. The plane dropped like a stone at a rate of 12,000 feet per minute. Seconds before impact, the transcript reveals the pilots still could not understand, or believe, what they were seeing. One of the pilots was heard saying: “[expletive] we’re going to crash! It’s not true! This can’t be happening!” The last words on the tape were “We’re dead.”
The verdict appeared to be pilot error, but it wasn’t so simple. “It was just mind-boggling,” said David Learmount, a former pilot for the British air force and an air safety expert. How could trained pilots, flying a state-of-the-art jet for a world-class airline, make such a basic mistake? One unsettling explanation was that pilots operating the advanced “fly-by-wire” jetliners, where much of flying is controlled by computers, simply weren’t prepared to fly a plane manually and recover from a stall at cruising altitude.
It was a wake-up call to the airline industry of the dangers of over-reliance on automation. Because of what the black boxes had yielded, the industry soon adopted new training procedures for pilots worldwide on how to handle emergencies at 35,000 feet, such as a high-altitude stall.
The recovery of AF 447 black boxes was one of the greatest success stories in the history of plane crash investigations. But to many observers, it also demonstrated the limitations of this technology. Why had it taken so long to find the plane? Black boxes come equipped with automatically activated underwater locator beacons that emit a sound, once a second, that can be picked up by sonar—but only for 30 days. Then, the bigger question: In an age when your cellphone can track you anywhere in the world, why aren’t we streaming data from planes in real time? It is a question that has plagued the industry ever since.
It crashed without any explanation, without any witnesses, and without any survivors—really a baffling mystery.
The origins of the first black box flight recorder—essential equipment on all the world’s civilian airliners since the 1960s—are the direct result of the failure of another aviation first. In 1952, the British-built De Havilland Comet was the first jetliner to enter commercial flight. In a short time, some of these planes inexplicably fell from the sky. As the toll mounted, pilots and other aviation experts rallied to find the cause.
One such expert was Australian research scientist David Warren, who spent his days designing fuel tanks at a government-run aeronautical research lab in Melbourne. The son of missionaries, he grew up in Australia’s remote Northern Territory. The country’s aviation industry was in its infancy, and in 1934, when Warren was nine years old, his father was killed in a crash of a small propeller plane en route to his new parish in Sydney. Warren—who died at age 85 in 2010—always insisted that this loss had no influence on his quest to develop one of the most vital tools in aviation safety. But it certainly attested to the risks of early flying.
Warren was also a radio hobbyist. In 1953, when he was asked to help with a scientific panel looking into the Comet failures, his curiosity was piqued by a German invention he spied at a trade fair. Called the “Minifon,” it was billed as the world’s first pocket recorder; in appearance it bears an uncanny resemblance to a Sony Walkman. To Warren, the potential of this little gizmo in aviation safety was obvious: “The idea came to me after a major crash of a Comet in 1953,” he later told a television reporter. “It crashed without any explanation, without any witnesses, and without any survivors—really a baffling mystery.
“I had seen the first miniature recorder and I put the two ideas together. I thought, ‘If a businessman had been using one of these on the plane and we could find it in the wreckage and played it back, we’d know what caused this.’”
That may be the “aha” moment in the black box story, but Warren’s boss was unimpressed. “I was told to ‘get on with blowing up fuel tanks’ and to pass the idea to someone else,” Warren told a BBC interviewer years later. He persisted, finally getting more support to build a prototype that was unveiled to Australian authorities in 1958—to scathing criticism from the powers that be. (“This recorder would yield more expletives than explanations,” was one such reaction.)
Warren’s invention could have stayed in limbo but for a chance encounter with the U.K.’s top aviation official, who, on a visit to Warren’s lab, spotted the prototype and grasped its importance. He flew Warren to England for a demo to a far warmer reception than he had received in his native country. A British manufacturer snapped up the rights, but it would still take nearly 10 years before these devices would be mandatory for flights in the major aviation nations. And Warren wasn’t the only one working toward this goal—devices to capture flight data like airspeed and altitude were already in the works during and after World War II. In the United States, a University of Minnesota engineering professor, James Ryan, patented a flight recording device in 1953, but it didn’t include a mechanism to capture voices in the cockpit.
Sean Payne, an accident investigator at the National Transportation Safety Board who’s studied the history of flight recorders, says the driving principle of capturing data in flight goes all the way back to the Wright brothers. (“Apparently on their first flight they had some kind of clock that recorded the number of propeller revolutions per minute.”) But it’s Warren, Payne says, who is credited with the idea of a cockpit voice recorder being installed in an aircraft.
Meanwhile, unsolved plane crashes continued to erode public confidence in flying. (The Comet, which was grounded in 1954 after two more fatal crashes—three in 12 months—was ultimately retired from commercial service several years later, after investigators determined that cracks in the fuselage caused by metal fatigue had caused the jets to explode midflight.) Despite their initial coolness to the idea, after yet another fatal air crash in 1960, Australian authorities relented and became the first in the world to mandate that all aircraft carry both data and voice recorders; the United States followed in 1964, and by 1967 all planes operating in the United States and most other major aviation nations were equipped with the devices.
The very first one that went to market was produced by U.K. firm S. Davall & Sons and dubbed a “red egg” because of its round shape and scarlet color (to help locate them at a crash site). Since then, all black boxes, no matter where they’re made, are covered in the bright hue known as “safety orange” to make them stand out, but it was the “black box” moniker, which is pilot slang for electronics equipment, that took hold. The earliest iterations were crude, relying on foil or magnetic tapes with unreliable sound quality and limited measurements of parameters, for basic information like the airplane’s speed and altitude. Later versions moved to solid state recorders with a memory board that would be harder to destroy—but that happened decades later, in the 1990s, and older planes still have the analog models. NTSB’s Payne says that he occasionally sees those vintage models in crashes he’s been assigned to around the world.
The cockpit voice recorder is sometimes useful for what it doesn’t show.
Black boxes soon proved how durable—and invaluable—they are. Aside from flight AF 447, there have been hundreds of other aviation accidents where the boxes survived punishing conditions and yielded a trove of valuable information. After TWA Flight 800 exploded over the Long Island Sound 12 minutes after taking off from JFK in 1996, terrorism or fire from nearby military jets were first deemed the likeliest culprits. But the cockpit voice recorder had a couple of gaps, which later helped prove what happened: A spark had caused a nearly empty fuel talk to erupt in flames and cut off power to the recorders and other avionics right before the plane broke apart. “The cockpit voice recorder is sometimes useful for what it doesn’t show,” says Christine Negroni, an air crash investigator and author of the book The Crash Detectives.
This was also the case in 1988, when Pan Am Flight 103 carrying 259 passengers and crew exploded and broke apart over Lockerbie, Scotland, days before Christmas. The recovered voice recorder provided an important clue, since it continued recording for a split second after the power had been cut off, enough time to capture the sound of the bomb that had been placed in the cargo area of the plane to destroy the aircraft. More recently, the black boxes recovered after the Lion Air Flight 610 (October 2018) and Ethiopian Airlines Flight 302 (March 2019) Boeing 737 MAX crashes showed that flight control software that repeatedly pushed the jet’s nose down was a factor in both crashes, leading the FAA to order Boeing to update its software.
The “black box” is actually a pair: a cockpit voice recorder, or CVR, which uses microphones in the pilots’ headsets and the center of the cockpit to record sounds from the last two hours of each flight (after which it’s taped over by the next flight’s recording, unless it’s needed for an investigation) and the flight data recorder (FDR) that collects information via sensors installed all over the plane for a wide range of parameters, including speed, altitude, and outside temperature. (The Federal Aviation Administration requires commercial planes to record a minimum of “11 to 29 parameters,” depending on the size of the aircraft.) Each one weighs about 10 to 15 pounds. One way to explain their working relationship: If the FDR tells you what happened, the CVR helps explain why it happened. (“It’s the human element,” Payne says of the CVR.) But the boxes are attractive to airlines for another reason: They can last up to 30 years, don’t require much maintenance, and are relatively affordable—under $20,000 per unit.
The recorders, encased in titanium or steel, are in the tail of the plane for maximum protection. (When a plane crashes, it typically goes down nose first, so most of the damage is in the front of the plane.) Well before they’re installed they’ve survived rigorous tests. The crucial cylinder that contains the memory boards is shot out of an air cannon and smashed against a target. It is subjected to a 500-pound weight with a pin attached to it, which is dropped onto the unit from a height of 10 feet. Researchers attempt to destroy the FDR by crushing it, putting it in a fire, saturating it in jet fuel, and submerging it in a pressurized saltwater tank in order for the box to be able to emit a signal in 20,000 feet of water. All of the preparation is, inarguably, effective: Never has a recovered black box been so badly damaged that it yields no usable data.
When they are retrieved from an accident scene, the boxes—as indestructible as they are—must be handled with extreme care. A team of specialists places them in a secure container (sometimes under police escort, as in the case of AF 447); in underwater crashes, the boxes are stored in a cooler of water to protect them from air until they arrive at a specialized lab equipped to download and analyze the information, a process that can take up to several months to complete. Not all countries have the facilities, and in these cases, the boxes are shipped thousands of miles away to the leading labs in the United States, France, and elsewhere. Experts—airline representatives, plane manufacturers, and NTSB specialists—arrive to analyze the data, with full investigations taking roughly 18 months.
It would be impossible to overstate the importance of this breakthrough.
As durable and cost-effective as black boxes are, they are not without their shortcomings. The most glaring is the time and expense lost in retrieving the boxes, which could be avoided if the industry moved to a system in which data could be transmitted from black boxes to a satellite during a flight.
The technology exists, but the airline industry—concerned about costs and completely overhauling existing systems to accommodate streaming large amounts of data—hasn’t rushed to embrace it. (Fatal crashes are so rare, industry experts argue, that it’s a matter of cost-benefit analysis.) But there are various moves afoot to nudge them along: The International Civil Aviation Organization (ICAO) has mandated that by the end of 2023 the airlines must demonstrate they’re equipped for “timely recovery of flight data” from an aircraft.
Another motivation: It has been almost 10 years since Malaysia Airlines flight 370 disappeared from radar on a flight from Kuala Lumpur to Beijing on March 8, 2014, just as it passed into Vietnamese airspace. The 777 plane and the 239 people aboard have never been found, and MH 370 remains the biggest unsolved mystery in aviation history.
This failure is among the reasons why Honeywell, the leading maker of black boxes for 60 years, is proposing a “black box in the sky,” embracing the notion of live streaming of data from the aircraft to the ground via a network of satellites. Others have also pushed for the underwater locators to have longer battery life and wider range; others still have called for the implementation of a backup recording device to be ejected from the aircraft before impact.
There is also industry momentum to lengthen the recording time. The NTSB is behind the push for 25-hour cockpit voice recordings, the same length of time that flight data recorders collect their readings, which European nations have already mandated. Another proposal to install cameras in the cockpit would provide an additional backup.
Still, resistance from the cockpit over privacy concerns has been fierce—much as it was around 70 years ago when David Warren started working on the first CVR. He wasn’t unsympathetic, though. “At first it seems like Big Brother listening,” he once said. “But when they [pilots] realize that this record is scrubbed out right after the flight, they come around.”
Many pilots would agree that the black box has made their job much safer. “It would be impossible to overstate the importance of this breakthrough,” says John Cox, a U.S. airline pilot and head of an aviation safety consultancy. “It gave us objective data that was impossible to ignore.”
So if all the data we need will be streamed in real time, will we see the end of the black box as we know it? Perhaps eventually, says the NTSB’s Payne, but no time soon. In the meantime, a set of black boxes on every plane is a effective backup—and one of the reasons commercial aviation is so safe. “Among other things, airlines can use the data recorded from each safely landed flight to identify problems before they turn deadly,” Payne says. The most recent statistics show that commercial aviation just had one of the safest years in its history in 2022, with five fatal accidents out of 32.2 million flights for the year.
Some experts, such as former NTSB member and aviation safety consultant John Goglia, say the black box technology has worked so well—and the instances where it hasn’t are so rare—that the industry shouldn’t rush to reinvent it. “The data they’ve given us has been able to solve almost any accident, anywhere in the world,” he says. “That’s an incredible record.”
