Every commercial jet from the Boeing 737 to the Airbus A350 carries two crash-survivable recorders that investigators retrieve after every serious accident. Despite the nickname, neither is black — they are painted aviation orange so search teams can spot them in green jungle, blue sea or grey wreckage. Here is what each one records, how it survives, and how MH370 reshaped the rules.
Browse fixed-wing airlinersThe flight recorder is painted high-visibility orange — sometimes labelled "International Orange" or "aviation orange" — chosen because the colour holds up against the most likely backgrounds at a crash site. The "black box" nickname dates from World War II RAF radio kit and stuck through the 1960s in journalist usage, by which time the recorders themselves were already orange. Both ICAO Annex 6 and FAA TSO-C124 explicitly specify the high-visibility coating.
Sit on a ramp at any major airport and you can sometimes see the recorders being swapped during heavy maintenance — bright orange cylinders the size of a large coffee tin. The orange paint is more than decoration: it is part of the certification.
Modern aircraft carry two physically separate boxes, often combined into a single Combined Voice and Data Recorder (CVDR) on newer types but always treated as two functional units in the regulations.
The FDR captures aircraft state. Early FDRs on the Comet and 707 etched a handful of parameters onto a metal foil with a stylus — barely a dozen channels. ICAO Annex 6 today mandates 88 parameters for new aircraft as a floor; the FAA's 14 CFR 121.344 raises that to 88 for narrowbodies and 91 for widebodies; EUROCAE ED-112A and the latest EASA CS-25 push modern types past 1,000 recorded parameters. Anything safety-relevant is on the list:
Sampling rates vary per channel — control inputs sample at 4–16 Hz, slower-moving parameters like altitude at 1 Hz. Storage is solid-state flash memory; the recorder must retain at least the last 25 hours of operation under EASA CS-25 / FAA equivalents, well beyond the duration of any commercial sector.
The CVR has four audio channels: the captain's headset, the first officer's headset, the public-address / interphone, and a cockpit area microphone (CAM) mounted in the overhead panel that captures background sound — switch clicks, warning horns, engine note, crew conversation. The CAM channel is what lets investigators reconstruct sequences of cockpit actions even when nothing is on the radio.
CVRs used to run on a 30-minute loop, erasing oldest audio first. The crash of Helios Airways flight 522 in 2005 — a slow depressurisation lasting over an hour — fell entirely off the CVR before the crash, and EASA pushed for a 2-hour mandate that became standard from 2010. In 2021 EASA went further: new aircraft delivered into EU operators from 1 January 2021 require 25-hour CVRs to match the FDR retention. The FAA proposed a matching rule in 2024 and finalised a 25-hour CVR mandate in 2024 for newly produced aircraft.
The recording medium — a solid-state crash-protected memory module (CSMU) — is the core of the unit. The CSMU is a stainless-steel-and-titanium drum, about 12 cm tall, packed with insulating ceramic and a memory board at its centre. Around the CSMU sits the electronics deck that handles inputs in normal flight; that deck is consumed in most serious crashes and the CSMU is what investigators recover.
ICAO Annex 6 and EUROCAE ED-112A specify the survivability envelope every modern recorder must meet:
Bolted to the front of every recorder is the Underwater Locator Beacon (ULB), a battery-powered transducer that activates on water contact and emits a 37.5 kHz acoustic pulse roughly once per second. Detectable from about 2 km away by hydrophones towed behind a search vessel, the ULB is the difference between a recovery and a lost recorder.
The original mandate was 30 days of beacon life. The Air France 447 search in 2009 ran out the clock — the recorders pinged on the Atlantic seabed for 30 days while ships above could not localise them, and the actual recovery came almost two years later via remotely operated submersibles working from drift-track analysis. After MH370 disappeared in 2014, ICAO mandated 90-day ULBs on the fuselage of all aircraft authorised for overwater operation, plus a separate low-frequency 8.8 kHz beacon detectable from 10 km. The 90-day rule took effect in 2018 for new builds and on retrofit schedules for existing fleets.
Recorders sit in the aft fuselage, typically above the rear pressure bulkhead or in the tail cone. Tail-mounted location maximises survivability: the tail tends to break free in nose-first impacts, the structure absorbs the worst of the deceleration before the recorder zone, and post-crash fires are usually fed from the wing fuel tanks well forward of the tail. On a 737 the FDR and CVR sit just aft of the rear galley behind a removable panel; on an A330 they live in the upper-tail compartment accessed by a service door on the rudder fairing.
Three manufacturers dominate the market: Honeywell (the SSCVR/SSFDR series), L3Harris (formerly L-3 Aviation Recorders, with the FA-2100 line), and Curtiss-Wright Avionics & Electronics (the Fortress series). GE Aviation produces the recorders used on many Airbus types under their flight-data heritage business. Each unit weighs roughly 10 kg and draws a few watts in normal operation. List price is in the $15,000–$25,000 range per recorder, though airlines buy them as part of the airframe spec.
The art of recorder recovery has produced some of aviation's most demanding salvage operations:
Recovering a recorder from the seabed two years after the fact is not a long-term answer. ICAO's Global Aeronautical Distress and Safety System (GADSS) framework — adopted 2016, with phased mandates since 2018 — requires that every commercial flight broadcast its position at no worse than 15-minute intervals in normal flight, and at 1-minute intervals once the aircraft enters distress. Operators meet this with satellite-based ADS-B (Aireon), Iridium short-burst data, or Inmarsat SwiftBroadband.
A separate strand of work covers streaming flight data — pushing FDR-equivalent parameters to a ground server during the flight, so the data exists independently of the physical recorder. Trials have run with Airbus, Iridium and several flag carriers; the bandwidth and cost have kept it from becoming a global mandate, but the trajectory is clear. The 2030s will likely see the physical orange box demoted to a backup for telemetry that already lives on the ground.
Once a recorder reaches the lab — typically AAIB in the UK, BEA in France, NTSB in the U.S. — the CSMU is opened, the memory removed, and a forensic image taken before any read. Investigators replay the FDR through manufacturer-supplied software that visualises every parameter on a synchronised time axis, and align it with the CVR's CAM audio. A modern reconstruction can answer "what did the autopilot do in the second before the upset?" to within 250 ms. Reports are public — the BEA's AF447 final report and the NTSB's Asiana 214 report are both freely downloadable and worth reading as worked examples.
Parameter counts, survivability specs and ULB requirements reflect ICAO Annex 6 Part I Amendment 40, EUROCAE ED-112A, FAA 14 CFR 121.343/344 and EASA CS-25 as of 2026.