Crash Survivable Memory and the Board Around It

A flight data recorder is built to survive a crash and then to explain it. The board inside a recorder is therefore designed around two requirements that rarely appear together: it must acquire and store data reliably while the aircraft is flying normally, and it must preserve that data through impact, fire, pressure and prolonged immersion. Everything about the electronics follows from the second requirement, because the storage medium and its enclosure dominate the design.

What the Recorder Has to Capture

The mandatory parameter set covers flight controls, engine parameters, aircraft configuration and, on modern types, a very large number of additional channels sampled at high rates. The acquisition front end receives analogue voltages, discrete signals and digital buses, and it must timestamp every sample against a common clock so that the recorded data can be correlated after an event.

The board also has to survive its own failure. A channel that stops recording must be detectable, and the design normally includes a built-in test that injects a known signal into the acquisition path and verifies that it arrives. A recorder that silently stops recording is worse than one that reports a fault, because it produces false confidence.

Data Storage and Retention

Crash survivable memory is usually flash, packaged with the processor on a board that is itself enclosed in a crash protected enclosure. The memory is written continuously and managed so that the oldest data is overwritten once the buffer is full, which means the file system has to tolerate power removal at any moment without losing the structure it depends on.

Power interruption is a normal event in a crash, so the write strategy has to be designed for it. Data is committed in blocks with checksums and sequence numbers, so that an incomplete block can be identified and skipped on recovery. Our component tolerance and reliability notes describe how the mechanical and thermal stresses on the assembly are assessed.

Surviving the Crash Environment

The environmental requirement is defined by standards that specify impact shock, penetration, static crush, fire and deep water immersion. The enclosure meets most of it, but the board is what has to keep functioning through the shock, so its mechanical design matters. Large components are restrained, the board is mounted so that it cannot flex, and the connectors are locked rather than relying on friction.

Thermal protection is provided by insulation around the memory rather than by the board itself, but the board’s thermal mass and its thermal path matter. During a fire the internal temperature rises until the insulation is overwhelmed, and the design aims to delay that point long enough for the recorded data to survive. Components with a low thermal mass and a high temperature rating are preferred, and the layout keeps the memory away from anything that would conduct heat into it quickly.

Acquisition Electronics and Noise

The acquisition board converts the analogue channels with enough resolution and accuracy that a small control input movement is visible in the record. That requires a stable reference and a conversion architecture that does not introduce its own errors, and it requires the analogue section to be isolated from the digital section in the layout, even though both are on the same board.

A continuous ground plane with the analogue circuits placed over one region of it and the digital circuits over another is the arrangement that works, provided the heavy return currents from the power supply do not run beneath the sensitive area. Where the recorder is powered from the aircraft bus, the supply is filtered and protected against the transients that a large electrical system produces, and the protection belongs at the connector with a defined return path.

Power, Redundancy and Monitoring

A recorder may be powered from more than one bus so that a single electrical failure does not stop the recording. Where that is the case, the two feeds are combined so that neither can back feed the other, and each is protected independently. The transition between them must be transparent, because a gap in the record is a gap in the evidence.

Monitoring is continuous. Supply voltages, internal temperature, memory health and the status of each acquisition channel are recorded alongside the flight data, which allows an investigator to distinguish a sensor fault from a recording fault. Designing that into the board, rather than adding it to the software afterwards, means providing the measurement points and the references that make it possible.

Testing and Qualification

Qualification is performed on the complete unit rather than on the board, but the board has to be designed so that it can pass. Shock, penetration, crush, fire and immersion tests are performed on units containing recorded data, and the data is then recovered and verified. A board that passes the mechanical tests but has a marginal memory interface will fail that final verification.

On the electrical side, the acquisition accuracy is verified against traceable references across the temperature range, and the built-in test is exercised to confirm that it detects a deliberately introduced fault. Our design release checklist places those checks in the review sequence.

Board Level Redundancy and Built-In Test

Some recorders duplicate the acquisition path so that a single failed component cannot stop the recording. That redundancy has to be real rather than nominal, which means the two paths must not share a power rail, a clock or a connector pin. Two paths that converge on the same regulator or the same connector are one path with a spare part attached.

The built-in test is the other half of the same idea. Injecting a known signal at the sensor input and verifying that the correct value arrives in memory proves the whole chain, not just the converter. The injection points have to be designed into the board, with a switch or a precision resistor that the processor can enable, and the test arranged so that it does not disturb the recording while it runs.

Connectors, Wiring and Installation

The recorder is connected to the aircraft wiring through a connector that carries dozens or hundreds of signals, and that connector is a significant part of the assembly. Pin assignment should keep the sensitive analogue inputs away from discrete high current outputs, and the connector itself should be keyed so that it cannot be mated incorrectly. The mass of the harness must be carried by the shell rather than by the pins, which is a mechanical decision the board has to accommodate.

Where the recorder is mounted on a rack rather than on a structure, the mounting arrangement determines the shock it experiences. A tray that flexes amplifies the input rather than attenuating it, so the mounting is designed to be stiff and the board fixed at enough points that it cannot resonate at a frequency the shock spectrum excites. Our component tolerance and reliability notes describe how those loads are assessed.

FAQ

Why is the memory packaged separately from the rest of the electronics? Because the crash survivable memory has to tolerate impact, crush and fire that the rest of the board does not, so it is enclosed in its own insulated enclosure with the processor that writes to it.

What voltage does the acquisition front end usually handle? It depends on the aircraft, with a wide range of analogue and discrete inputs. The key requirement is not the range but the accuracy and the timestamping.

How is a recording fault detected? By the built-in test that injects a known signal, by monitoring the memory, and by recording the health of each channel alongside the data itself.