Civil Aviation Order 103.19 Instrument 2007

The central concept is the flight data recorder, a crash‑survivable device that continuously records specified aircraft performance and systems parameters. The instrument distinguishes between two classes of aircraft: those over 29,000 kg maximum take‑off weight (linked to certification date) and all others. The heavier class must record twenty parameters; the lighter class need record only six. The six mandatory parameters for all aircraft are: time, altitude, airspeed, vertical acceleration, heading, and press‑to‑transmit for each transceiver. The additional fourteen parameters for heavier aircraft include pitch and roll attitude, engine thrust, flap position, longitudinal and lateral acceleration, undercarriage squat switch, thrust reverser status, leading edge device position, angle of attack (if a sensor is fitted), pitch trim, and control surface positions (column, wheel, rudder). Each parameter is defined with a required range (e.g., altitude from -1,000 ft to maximum certificated altitude), a minimum accuracy (e.g., vertical acceleration ±0.2g stabilised, ±10% transient), and a maximum recording interval (e.g., vertical acceleration every 0.125 seconds, heading every 1 second). The instrument incorporates by reference the FAA’s Technical Standards Order C51a (or later amendment) for component compliance, covering the recording unit, acquisition unit, sensors, and accessories. The TSO sets performance standards for the recorder as a whole, including crash survivability, fire resistance, and data integrity. An additional concept is correlation between the flight data recorder readings and the pilot in command’s instruments for airspeed, altitude, and heading. The correlation must cover the full airspeed range, the altitude range to the aircraft’s limit, and 360 degrees of heading. It may be established on the ground as appropriate. The underwater locating device is a separate component that must be approved and mounted so it is unlikely to be separated from the recorder by crash impact. The instrument references FAA Advisory Circular AC 21‑10 for acceptable performance standards. The automatic crash‑stop concept requires the recorder to cease recording within ten minutes after impact and to disable any data erasure feature. This contrasts with earlier practice where the recorder continued running until manually stopped, risking overwriting of accident data. The colour and reflective tape requirement (bright orange or bright yellow container, reflective tape) aids post‑accident location, especially underwater. The power supply concept requires the recorder to draw from the bus with the highest reliability for its operation, but not at the expense of essential or emergency loads. The vertical acceleration sensor must be rigidly attached and positioned longitudinally either within the approved centre of gravity limits or at a distance forward or aft not exceeding 25% of the aircraft’s mean aerodynamic chord. The record container (non‑ejectable) must be located as far aft as practicable to minimise crash‑impact rupture and subsequent fire damage, but need not be aft of the pressurised compartment and must not be where an aft‑mounted engine could crush it upon impact.

The instrument directly affects aircraft operators who are required by CAO 20.18 to install a flight data recorder. This includes operators of Australian registered aircraft used in regular public transport, charter, aerial work, or any operation where CAO 20.18 mandates an FDR. The scope is not limited to airlines; it encompasses any operator of an aircraft that must carry an FDR under the separate order. The specific parameter requirements and system specifications impose compliance obligations on maintenance organisations that install, test, and certify flight data recorder systems. They must ensure the recorder meets TSO‑C51a, that the underwater locating device is approved, that the colour and reflective tape are correct, that the automatic crash‑stop function is working, and that the correlation with pilot instruments is established and documented. Flight crew are affected because the instrument requires a means of monitoring valid data recording on a system control panel accessible for pre‑flight check. Pilots must verify that the recorder is operational before each flight, adding a standard pre‑flight item. Manufacturers and modifiers of aircraft who seek an initial Australian certificate of airworthiness after 1 January 1984 are prohibited from installing analogue recorders with mechanically inscribed mediums. This affects the supply chain for new aircraft or major modifications. Accident investigators are indirect beneficiaries: the instrument aims to ensure that post‑accident data is of sufficient quality and survivability to assist in determining the cause of accidents. However, the instrument does not confer any rights on investigators; it merely establishes the technical standard that should produce usable data. CASA is the regulator that enforces compliance through the CAR 1988 framework, including checking installations during airworthiness certification and surveillance. Manufacturers of flight data recorders are affected because the instrument effectively mandates compliance with US FAA TSO‑C51a, meaning only TSO‑approved equipment can be fitted. This limits the range of alternative products and may increase costs if TSO‑approved devices are more expensive or less available than non‑approved equivalents. The instrument does not impose any direct obligations on passengers, the general public, or other third parties. The compliance burden falls disproportionately on operators of smaller aircraft that must carry an FDR but are now subject to the same six‑parameter minimum as heavier aircraft, albeit without the additional fourteen parameters. For older aircraft with existing installations approved before the relevant grandfather dates, the instrument provides some relief from retrofitting, but that relief is finite and may not cover future modifications.

The instrument imposes a set of duties on the operator and the person responsible for the aircraft’s airworthiness. There is no explicit grant of rights in the instrument; it is a regulatory standard that creates obligations, not entitlements. The primary duty is to ensure that any flight data recorder installed in compliance with CAO 20.18 meets the technical specifications in Schedule 1. This duty is absolute: the recorder must record at least the required parameters at the prescribed ranges, accuracies, and intervals. There is no discretion to substitute alternative parameters or to use a recorder that does not meet TSO‑C51a, subject to the limited transitional provisions. The operator must also ensure that the recorder system includes a monitoring means that presents valid‑data information on the system control panel, and that this panel is accessible for pre‑flight check by the flight crew. That implies a duty on the operator to train flight crew to perform the check and to document that it was performed. The operator must also ensure the recorder container is painted bright orange or bright yellow and has reflective tape affixed. The operator must ensure that an approved underwater locating device is fitted and installed so it is unlikely to separate from the recorder. The operator must ensure the automatic crash‑stop function works (stopping within ten minutes and preventing data erasure), unless the installation was approved before 1 January 1986 (in which case the duty is to deactivate the recorder as soon as practicable after an accident). The operator must ensure the recorder receives power from the bus with maximum reliability for the recorder without jeopardising essential or emergency loads. The vertical acceleration sensor must be installed within the prescribed location criteria. The record container must be located as far aft as practicable, not in locations where an aft‑mounted engine could crush it. The operator must also establish and document a correlation between the flight data recorder readings of airspeed, altitude, and heading and the pilot’s instruments, covering the full airspeed range, altitude range, and 360 degrees of heading. The correlation may be done on the ground. The operator has a duty to maintain the correlation over time, especially if instruments or sensors are replaced. The instrument does not grant the operator any right to deviate from these standards, nor does it provide a mechanism for seeking exemptions (that would be under separate CASA policy). The operator’s main practical rights are implicit: to rely on the transitional savings for pre‑1984 and pre‑1986 installations, and to use TSO‑C51a equipment as meeting the required standard. The instrument also gives the operator a right to use the note on press‑to‑transmit: if the installation was approved before 1 January 1984 and time correlation with the cockpit voice recorder can be established, the operator need not modify the recorder to record that parameter. In effect, the instrument creates a compliance safe harbour for earlier installations that are still serviceable, but that safe harbour is not a right to continue indefinitely if the aircraft undergoes major modification or if the recorder is replaced.

The instrument itself does not set out specific penalties or enforcement mechanisms. It is made under the Civil Aviation Regulations 1988, and any breach of a Civil Aviation Order is a breach of the regulations. The CAR 1988 create offences for non‑compliance with a Civil Aviation Order, including directions made under subreg 21A(1). The Civil Aviation Act 1988 provides for civil penalties and infringement notices for contraventions. A person who operates an aircraft without a compliant flight data recorder, or with a recorder that does not meet the parameters or system requirements of this order, may be liable to enforcement action by CASA. This could include suspension or revocation of the aircraft’s certificate of airworthiness, a direction to ground the aircraft, and monetary penalties. For operators under an air operator’s certificate, non‑compliance could jeopardise the certificate itself. The instrument’s incorporation of TSO‑C51a means that using a recorder not meeting that standard is a breach, even if the recorder otherwise provides equivalent performance. The transitional provisions do not create a blanket amnesty; they only excuse certain non‑compliance for installations approved before specified dates. For example, an analogue recorder installed after 1 January 1984 on an aircraft receiving its initial Australian certificate of airworthiness after that date is simply prohibited, and its continued use would be a breach. The instrument does not provide a defence of reasonable mistake or due diligence; it is a strict liability regulatory order. The automatic crash‑stop requirement: for installations approved before 1 January 1986, the note says they need not be modified, but if such an aircraft is involved in an accident, the operator must deactivate the recorder as soon as practicable after the aircraft comes to rest. Failure to do so could be a separate breach, although the instrument is not the direct source of that duty - it would arise under the general obligation to follow the order’s intent. CASA may also use the instrument’s detailed technical requirements to issue enforceable directions under other provisions. There is no right of appeal within the instrument itself; any challenge to enforcement would be through the Administrative Appeals Tribunal or the Federal Court under general administrative law. The instrument does not create criminal offences such as fraud or falsification of data; those would be covered by other laws. The practical enforcement risk is highest for operators who retrofit a non‑compliant recorder, fail to perform the pre‑flight check, or neglect to maintain the correlation documentation. The instrument’s precision - specifying exact parameters, ranges, accuracies, and intervals - makes it relatively easy for CASA to identify a breach during an audit or inspection. The cost of compliance (buying TSO‑C51a equipment, painting containers, installing underwater locators, running correlation tests) is a sunk cost that operators cannot avoid if they wish to operate legally.

The instrument operates as part of a hierarchy: it is made under the CAR 1988, which itself is made under the Civil Aviation Act 1988. The instrument is expressly contingent on Civil Aviation Order 20.18, which triggers the requirement to fit a flight data recorder. Without that trigger, this order imposes no duty. CAO 20.18 likely specifies which aircraft types and operations must carry an FDR; this order then fills in the technical details. The instrument also cross‑references Technical Standards Order C51a (or later amendment) from the US Federal Aviation Administration. That TSO is a performance standard for flight recorders. By requiring compliance with TSO‑C51a, the instrument effectively adopts a foreign regulatory standard as part of Australian law. If the FAA amends TSO‑C51a, the instrument’s reference to ‘or later amendment’ means the amended standard automatically applies, unless CASA issues a new instrument to vary or revoke this one. This creates a degree of regulatory dependency: Australian operators must keep abreast of US FAA changes. The instrument also references Federal Aviation Regulations Part 25 sections 25.1323, 25.1325, and 25.1327 (airspeed, altitude, and magnetic direction instruments) for the accuracy requirements of data sources supplied to the flight data recorder system. This is another US‑sourced requirement. The instrument’s note on underwater locating devices references FAA Advisory Circular AC 21‑10, which provides acceptable performance standards. Advisory circulars are not mandatory in US law, but the note indicates that complying with that AC would satisfy the ‘approved’ requirement. However, the instrument does not mandate that exact AC; it says ‘acceptable performance standards are described in’ it. An operator could use an alternative standard if CASA approves it. The instrument also interacts with State and Territory workplace health and safety laws to the extent that flight data recorders may contain hazardous materials (e.g., batteries, certain sensors). Installation and maintenance must comply with those laws. The instrument does not interact directly with privacy laws because flight data recorders capture aircraft performance data, not personal information of passengers or crew (though some parameters, like control inputs, could be attributed to a specific pilot, but the instrument does not address privacy). There is no interaction with evidence laws; the recorder data may be used in accident investigations and legal proceedings, but the instrument does not govern admissibility. The instrument’s grandfathering provisions may interact with continuing airworthiness management regulations that require modifications to meet current standards unless an exemption exists. The instrument provides limited exemptions for pre‑1984 and pre‑1986 installations, but those exemptions are specific to the parameter and crash‑stop requirements. They do not exempt the operator from the general duty to maintain the recorder in a serviceable condition. Finally, the instrument is likely complemented by other Civil Aviation Orders addressing cockpit voice recorders (CAO 103.17 or similar) and by Advisory Circulars issued by CASA providing guidance on compliance.

This instrument, made on 17 December 2007 and commencing the day after registration, is a complete repeal and substitution of the earlier Civil Aviation Order 103.19. The instrument does not provide any detail about the prior version or the reasons for substitution. The historical background can be inferred from the notes within the instrument: the prohibition on analogue recorders with mechanically inscribed mediums has been in force since 1 January 1984, and industry was notified in July 1983. The automatic crash‑stop requirement has been in force since 1 January 1986, with a note that installations approved before that date need not be modified. The instrument preserves those previous effective dates, suggesting that the 2007 version codified existing practice rather than introducing new obligations. There is no indication that the instrument has been amended since 2007. The user’s legislation text is the instrument as originally made. No subsequent amending instruments are included. The instrument’s commencement is the day after registration on the Federal Register of Legislation, which would have occurred in late December 2007. The instrument does not include a sunset clause or review date. As a legislative instrument under the Legislation Act 2003, it may be subject to periodic review by the Office of Parliamentary Counsel, but no such review is mentioned. The instrument’s repeal and substitution power under subregulation 21A(1) of CAR 1988 means CASA can amend or replace it at any time without legislation. Operators should monitor for any new instrument that might update the parameter list, incorporate a different TSO version, or modify the grandfathering provisions. The instrument does not include transitional provisions beyond those already noted, so any future amendment could apply immediately unless it includes its own savings. The 2007 instrument was a consolidation; it may have reflected changes in aircraft technology, accident investigation lessons, or alignment with international standards (ICAO Annex 6 requires flight recorders to meet certain specifications). However, the instrument itself does not state the rationale. For a practising lawyer or compliance professional, the absence of amendment history in the source text means one cannot rely on this instrument alone to know whether later amendments exist. A search of the Federal Register of Legislation is necessary to confirm the current status.

The instrument’s source text does not reference any litigation history, and there are no court cases mentioned in the provided text. As a technical regulatory instrument, it is unlikely to have been the subject of frequent litigation. Most enforcement actions for non‑compliance would be administrative (e.g., CASA issuing a direction or suspension) rather than criminal prosecutions that would be reported in case law. Any challenge to the validity of the instrument under the Legislation Act 2003 or the Civil Aviation Act 1988 would be rare. The instrument’s clear and prescriptive language (parameters, ranges, colours, locations) leaves little room for interpretive disputes. Litigation could arise if CASA took enforcement action and the operator argued that the recorder still met the safety objectives despite a technical deviation, but the instrument does not provide a safety‑equivalence defence. The notes and transitional provisions might be litigated if an operator claimed an installation was approved before a certain date and CASA disagreed. However, no such cases are known from the source. The incorporation of US FAA standards could lead to disputes if the FAA amended TSO‑C51a and the Australian operator had not kept up, but that would be a compliance issue, not a litigation one. The instrument is a bare‑bones technical standard; it is not the kind of legislation that generates significant case law. For a deep dive, it is sufficient to note that there is no litigation history evident from the source, and any cases that do exist would be found in the Administrative Appeals Tribunal or the Federal Court, but they are not referenced or suggested by the instrument.

Several provisions in the instrument are easy to overlook or misinterpret. The two‑tier parameter requirement is not based solely on weight. Paragraph 1.2 applies to aircraft of maximum take‑off weight in excess of 29,000 kg which (a) receives its initial Australian certificate of airworthiness after 1 July 1977, or (b) is of a type first certificated in its country of manufacture after 30 September 1969. That means a heavy aircraft with a type certificate dated before 30 September 1969 could be subject to only parameters 1-6, even if it weighs more than 29,000 kg, provided it received its initial Australian certificate of airworthiness before 1 July 1977. The instrument does not define ‘initial issue Australian certificate of airworthiness’ - is that for the specific individual aircraft or the type? The wording ‘receives its initial issue Australian certificate of airworthiness after 1 July 1977’ suggests each individual aircraft’s first certificate, not the type. So a heavy aircraft built in 1975 and imported to Australia after 1 July 1977 would need the full 20 parameters, even though it is older. That is a trap for operators of imported vintage heavy aircraft. The press‑to‑transmit parameter (No 6) is mandatory for all aircraft, but the note says installations approved before 1 January 1984 that do not record it need not be modified if time correlation with the cockpit voice recorder can be established. The note appears permissive, but it only applies to installations approved before that date. Any new installation or replacement after that date must record press‑to‑transmit. The analogue recorder prohibition is absolute for new aircraft, but note that paragraph 2.2 says analogue type recorders which employ mechanically inscribed recording mediums will not be approved for fitment to aircraft which receive their initial issue Australian certificate of airworthiness after 1 January 1984. The wording is ‘will not be approved’, not ‘must not be installed’. The effect is the same: CASA will not approve the fitment. But if an operator installed such a recorder without approval, it would be non‑compliant. The automatic crash‑stop requirement (paragraph 2.7) has a complicated grandfathering. The note says installations approved before 1 January 1986 need not be modified, but then adds ‘providing that, should the aircraft be involved in an accident, the recorder is deactivated as soon as practicable after the aircraft comes to rest.’ This creates an operational duty that only arises post‑accident. The operator must have procedures in place to ensure someone (crash crew, fire fighters, etc.) knows how to deactivate the recorder. The instrument does not specify how this duty is to be fulfilled. The correlation requirement (paragraph 2.9) is mandatory and must cover the full airspeed range, full altitude range, and 360 degrees of heading. It may be established on the ground as appropriate, but the operator must keep a record of the correlation. The correlation must be between the flight data recorder readings and the pilot in command’s instruments, taking into account correction factors. If the pilot’s instruments are replaced or recalibrated, the correlation must be re‑established. The vertical acceleration sensor location (paragraph 2.11) is precise: within the approved centre of gravity limits, or at a distance forward or aft of these limits that does not exceed 25% of the aircraft’s mean aerodynamic chord. Operators may need to calculate the mean aerodynamic chord and determine the sensor’s position. The sensor must be rigidly attached - any flex could affect acceleration readings. The record container location (paragraph 2.12) says ‘as far aft as practicable, but need not be aft of the pressurised compartment’. It also says ‘must not be located where an aft‑mounted engine may crush the container upon impact.’ For aircraft with multiple engine configurations, the operator must consider the worst‑case impact scenario. The power supply requirement (paragraph 2.10) says the recorder must receive its electrical power from the bus that provides the maximum reliability for operation of the flight data recorder without jeopardising service to essential or emergency loads. This may require an engineering assessment of which bus is most reliable. Essential loads include flight controls, instruments, etc. The recorder must not compromise those, so it cannot be on the same bus as critical systems if a failure could bring both down. The underwater locating device must be ‘approved’ and installed so it is not likely to be separated from the recorder by crash impact. The note references FAA AC 21‑10, but CASA may have its own approval process. Operators should verify that the device is actually approved for use in Australia, not just US‑approved. The colour requirement is ‘bright orange or bright yellow’ and reflective tape must be affixed. There is no specified shade or standard for ‘bright’. Operators should use paint that meets MIL‑STD or similar, but the instrument does not mandate a standard. Enforcement discretion may apply, but it is a gotcha if the colour is not considered bright enough. Finally, the instrument does not specify a data retention period, format, or download procedure. Those are dealt with by other regulations or by accident investigation standards. But operators may assume that the recorder automatically does everything; in fact, they must ensure the data is recoverable and that the system is maintained so that data is not lost before download.

Compliance begins with determining whether the aircraft is subject to CAO 20.18. If not, this order does not apply. If yes, the operator must identify which of the two classes the aircraft falls into: aircraft over 29,000 kg MTOW meeting the certification date criteria (need parameters 1-20), or all others (need parameters 1-6). For each parameter, the operator must verify that the installed flight data recorder can measure and record within the specified range, with the required accuracy, and at or below the maximum recording interval. This includes checking that the recorder meets TSO‑C51a for the recording unit, acquisition unit, sensors, and accessories. If the recorder is TSO‑C51a approved, compliance with many of the range/accuracy/interval requirements is presumptively met, but the operator should still confirm the specific parameter outputs, especially for niche parameters like angle of attack (if fitted) and control surface positions. The operator must ensure the recorder system includes a monitoring means on a system control panel accessible for pre‑flight check by the flight crew. That means the cockpit must have a visual indicator (e.g., a light or display) showing that valid data is being recorded. The operator must include this check in the pre‑flight procedures and train pilots accordingly. The recorder container must be painted bright orange or bright yellow and have reflective tape affixed. The operator should use a durable paint that matches the common aviation standard (e.g., safety orange or international orange). The reflective tape should be to an appropriate standard (e.g., 3M Scotchlite or equivalent). An approved underwater locating device must be fitted. The operator should obtain from the manufacturer a statement that the device is approved by CASA or meets an acceptable standard (the FAA AC is one acceptable means). The device must be installed so it is unlikely to separate from the recorder in a crash; that may require a separate mounting bracket or strap. The automatic crash‑stop feature must be tested to ensure it stops the recorder within ten minutes after crash impact and prevents data erasure. For installations approved before 1 January 1986 that are grandfathered, the operator must have a post‑accident procedure to deactivate the recorder as soon as practicable. That procedure should be documented and communicated to ground crew and emergency responders. The power supply must come from the bus that provides maximum reliability for the recorder without jeopardising essential or emergency loads. An electrical load analysis should confirm the chosen bus. The vertical acceleration sensor must be rigidly attached and located within the approved CG limits or within 25% of mean aerodynamic chord forward or aft. The operator must calculate the sensor’s actual station and compare it to the CG envelope and the MAC. The record container must be located as far aft as practicable, not aft of the pressurised compartment (if any), and not where an aft‑mounted engine could crush it. For aircraft with tail‑mounted engines, that may require a different location. A correlation must be established between the FDR readings of airspeed, altitude, and heading and the pilot’s instruments, covering the full operating range. The operator should document the correlation method (e.g., ground tests for heading, flight tests or manufacturer data for airspeed and altitude) and keep the records with the aircraft’s continuing airworthiness records. The correlation should be checked after any instrument change or major maintenance. For the press‑to‑transmit parameter, if the aircraft is an older installation (approved before 1 January 1984) that does not record it, the operator must ensure that time correlation with the cockpit voice recorder can be established. That likely means a common time reference or a cross‑correlation procedure. Finally, the operator should ensure that no analogue recorder with mechanically inscribed medium is fitted if the aircraft received its initial Australian certificate of airworthiness after 1 January 1984. If such a recorder is found, it must be replaced. Overall, compliance requires a detailed engineering review of the aircraft’s FDR installation against every paragraph of Schedule 1. A compliance checklist covering each parameter’s range, accuracy, interval, and the system requirements in paragraphs 2.1 to 2.12 is essential. The operator should also consider that the instrument’s cross‑references to TSO‑C51a and FAR Part 25 mean any future changes to those US standards automatically apply. Regular monitoring of FAA and CASA publications is advisable. The cost of compliance is significant: painting, reflective tape, underwater locator, possible relocation of sensors, correlation tests, and potential replacement of non‑TSO recorders. For older aircraft, the grandfathering provisions may reduce immediate costs, but they are not permanent and may not cover future modifications. The operator should weigh the cost of compliance against the value of the aircraft and the remaining operational life.