Solid-state flight recorder teardown

A look at a relatively modern (only 10 year old) solid-state flight recorder.
Tape based flight recorder teardown : • Flight Data recorder t...

[@bborkzilla]

Wind River and their stupid "license" stickers. They tried to insist we put them on the CPU card of a satellite I worked on. Never mind that the damn stickers would outgas like crazy and the that the payload was basically optical and couldn't tolerate any garbage like that. Plus they wanted $100K plus another $20K per developer per year for the privilege of running VxWorks. Never again.

[@mikeselectricstuff]

..so just tell them you put the stickers on... how would they ever find out ?

[@Madbot_]

they send a satellite with all the money they make on VxWorks

[@cnvogel]

...the license may allow them to show up any time, for an audit, on the satellite... ;-)

[@Madbot_]

they sent a man up there just to do it

[@bborkzilla]

We ended up sticking them to a piece of paper that went into a binder and then into a box of related documentation. We put all kinds of extra-sticky tape over the lot to make sure nobody could try to reuse them on another product and deprive Wind River of their precious revenue. Greedy bastards.

[@SarahWattCA]

I've seen some people say that they wonder why they don't build planes out of the same stuff flight recorders are made of. So I guess planes would be a lot safer if we potted the passengers with fire retardants after boarding.

[@John_Ridley]

It'd all work fine as long as the passengers don't have a problem with being exposed to 2000G deceleration.

[@Keith_Ward]

"exposed" > subjected ;-)

[@themaconeau]

Innocently experimented on ...

[@pepper669]

Or maybe passengers should be made out of cheap plastic material. Would also save considerable weight.

[@C86-x5r]

The plane might also have problems getting off the ground

[@bvs1q]

would be so cool to use that can (before it was cut open) as like usb external storage if you could bodge a interface for it toegether. coolest memory stick ever xd

[@TheEPROM9]

I would suggest using NMAP to scan the Ethernet port as that will find any IP addresses in use as well as the ports that the IP address uses. You will need Linux for it, not sure if NMAP is available for Windows. If you have not already use Wireshark. That will allow you to analyze any packets it releases.

[@Kevin-rc5ec]

Yeah, I use it on my windows machine. nmap.org/book/inst-windows.html I'd really love to see what kind of information it has in it!

[@superdau]

When arp scans don't give you anything (he did that), there's not much point in searching for IP addresses. Most likely that thing doesn't even run IP.

[@Jaredo66]

Yep most likely not IP based. I would think there would be a sequence of "commands" you would have to send it to wake it up. Like a secret door knock code, once done then it'll talk to you. Even then it's going to be some specialized protocol.

[@ivanatora]

Why it would not run IP? TCP/IP is widely used in modern vehicles. I have a friend writing software for Mercedes dashboards and he says ethernet is everywhere around the car. I saw a video on the eevblog where some Audi guy talked about their lunar rover (competing for the google xprize). He also confirmed various ethernet connected modules in the rover.

[@GertvandenBerg]

+ivanatora sometimes raw ethernet frames might be simpler? No need for an IP stack and you can still easily use a laptop to talk to it... (running a sniff on the port in Wireshark when it is connected might give an idea of what it tries to talk?)

[@adriansmith31]

I have a CVR from an RAF Nimrod. Works of 28V DC and only draws about half an amp. There's a single RS232 interface on the front which I presume is for extracting the audio but I've been unsuccessful to get any kind of signals on the connector. The unit appears to be working as there is activity on all the chips as seen on an oscilloscope but no waveforms on the data port...

[@RWBHere]

I wonder what Mike's reaction would be if he was told that those shiny granules were diamond?

[@Lion_McLionhead]

Would be interesting to find out where the military plane flew, based on data in the flight recorder.

[@basroos_snafu]

You might try to put an ethernet hub (not a switch) between the device and your router. Connect a pc to the hub, install WireShark and you can capture all the traffic in between.

[@dawn1berlitz]

i wonder if the memory module is required for boot or this device is using a token ring based type networking

[@AttieGrande]

Didn't one of the 2Mbit ICs and it's opposite look a little burnt?

[@jboard146]

as others have stated try nmap and try all of the private subnets. (192.168.0.0/16, 127.16.0.0/12, and 10.0.0.0/8.) it it run overnight. You way also want to try listening with wireshark to see if it is putting any traffic out.

[@Okurka.]

172, not 127.

[@Fan119]

why did you remove some of the stickers containing firmware version/etc that were on some of the chips?

[@AureliusR]

Probably to see either the chip numbers or to see if they were quartz-windowed or not.

[@magdalenajirova5745]

Dear Mike, please try to pronounciate somewhat better when shooting videos. Keep in mind that not only native speakers want to understand your speech. Nevertheless, thanks for your videos; they rocks!

[@RinoaL]

the blank connectors may be to hold the caps for the other connectors.

[@AureliusR]

That's the stupidest thing I've ever heard.

[@riiwind]

yup got it!

[@RinoaL]

***** stupidist thing youve ever heard? well then what do they do with the connector caps? you cant have those flopping around in an aircraft.

[@spaculo]

Indeed, the chains are even connected to the dummies.

[@AureliusR]

Rinoa Super-Genius As Mike said multiple times, this is clearly designed to go into many different aircraft. They are clearly blanks for other possible options.

[@bkopietz]

I did software work for another brand of recorder. It used TFTP for up/download and the IP address was 10.1.1.1. It didn't support ARP or ping because the Ethernet connection was only meant to connect a computer for downloading. It would have never been connected to an actual network with other traffic. Before TFTP could be used, you had to connect to a different port and command the unit into service mode which stopped recording and enabled TFTP.

[@davidmaiolo]

bkopietz hopefully he reads your comment and can further investigate

[@QuadDerrick]

that would be something

[@springford9511]

You till need ARP unless perhaps you use hard coded MAC addresses in each end.

[@NicholasAndre1]

This sounds most plausible. Was the command to disable the recorder also sent over Ethernet?

[@bkopietz]

@@NicholasAndre1 Yes

[@GadgetAddict]

All of a sudden a task force arrives at your home saying they started getting pings from a flight recorder!

[@mattikaki]

Interesting video, thanks. Could you please zoom slightly out as it is hard to follow when you are too near the object and shake the item. Thanks.

[@DedmenMiller]

patent US6706966 seems to be a never recorder as it has 1.5GB of internal storage.. but it also has ethernet.. and " The default URL of the homepage is 192.168.0.2 which is pre-set at the factory but which can be changed as shown in FIG. 14" but that can be changed easily so i suppose they have changed it... also take a look at www.curtisswrightds.com/products/electronic-systems/crash-protected-recorders/ their models look very similear to yours

[@mbirth]

I hope the powdery stuff wasn't asbestos…

[@chrisvighagen]

looked more like bentonite clay. Asbestos is a fibrous mineral material. And while it is really fire resistant, it would not be used today as it is incredibly dangerous to handle. Besides there are better fire resistant materials today. Like Areo gels.

[@kg4boj]

It's called "castable refactory cement" It's the same stuff they use in fire resistant safes, IIRC it's mostly plaster of paris with a little portland cement.

[@1001ewaste]

Flight recorder from a Panavia Tornado, a lot of avionics upgrades have been carried out across the global fleet for numerous reasons.

[@TheEPROM9]

nmap.org/download.html Found a Windows version of it, have not tested it so I don't know if it is any good. However you can always run Linux in a VM.

[@coondogtheman]

Very cool teardown Mike. Would it be possible to use that flash module as a thumb drive and store files on it? That's what I'd use it for.

[@roeshambeau1035]

I am curious. Perhaps the fire proofing in the tube was asbestos? For your health's sake, I hope not.

[@foreignautomobiles]

I was thinking the same thing, it looks like asbestos. Hopefully he was wearing a decent mask at least. Even i wear a half face respirator while working with compressed asbestos gaskets.

[@WobblycogsUk]

Unlikely, the item was built in the UK which banned the use of blue and brown asbestos in 1985 and white asbestos in 1992 long before this was built. More likely it was some sort of clay.

[@foreignautomobiles]

Ok, thats good. I still find the occasional asbestos gasket/insulation in cars. Its probably some sort of bentonite clay or something.

[@trcostan]

I looked like a form of rock wool to me. And that sand was prob very dry to act as a desiccant for the memory.

[@tbbw]

i think it was just some form of crystal. What ther doing in that memory module is to protect it against heat so they have layers of heat isolators and i think those balls are the last line of isolators and i'm pritty sure they are there to isolate the chips from heat better then air would.

[@bee2k01]

As a plane, this video intrigues and terrifies me at the same time. Hopefully the only reason my black boxes would be removed is because they're expired... And not because... Y'know....

[@AureliusR]

as a plane?!

[@stonent]

If you install Wireshark on your laptop you can watch the network traffic with the protocol analyzer. If it has an IP address it should show up in the traffic. Wind River makes RTOS systems (realtime OS) which may be linux based. So there is the possibility of some sort of information being output on a pin somewhere.

[@benbird3364]

Wind river isn't linux based, it's its own thing.

[@liamharrison3]

+someusguysmusic probably vxworks which isn't Linux. just like your netgear router and the Mars rovers!

[@cnvogel]

Wireshark is a great tool, I second this recommendation (some people like NetworkMonitor under Windows, which is inferior for decoding traffic support.microsoft.com/en-us/kb/933741). As a typical computer starts broadcasting a lot of things when an Ethernet connection comes up, I'd try to have a small desktop-switch in between your computer (running wireshark) and the flight-recorder. Turn on the switch, let all the applications (apple MDNS, windows networking, DHCP requests, ...) settle down for a minute, then start capturing with wireshark, then turn on the flight-recorder. That way, you don't record too much crap in your packet captures. If you find anything interesting, put the .cap-file up somewhere :-). Just watch for any packets the flight recorder might emit when powering up, but it may be anything, not just IP. On the other hand, the vendor claims (at least for their *newer* models) that it uses standard networking protocols, and has an integrated webserver... www.curtisswrightds.com/products/electronic-systems/crash-protected-recorders/fortressimagine.html#tabbed-table2 ...but those are the ones that have Gigabit Ethernet, and still need 45 seconds to download. So those probably have GByte of storage.

[@stonent]

+Ben Bird They do have a Linux distribution. www.windriver.com/products/linux/

[@GertvandenBerg]

+Christian Vogel just filtering out your own MAC address also helps (less stuff to filter from can be useful though)

[@NonEuclideanTacoCannon]

I'm sort of late here, but the glass sandy stuff at 14:40 are actually tiny ceramic balls with vacuum inside. It's a great insulator.

[@oriole8789]

It's super annoying to have to scroll through a sea of... not so thoughtful.. comments, just to find interesting pieces of info haha. KZbin and its troll army lol. These types of devices are likely to run the VxWorks RTOS due to its very small memory footprint. I've looked into decompiling parts of VxWorks when attempting to explore the firmware on my scope and it was just very annoying due to a lack of any publically available documentation (intentional for sure lol). I did have some success though. Google "Reverse Engineering VxWorks Firmware: WRT54Gv8" where a guy does that for router firmware. If anything, you may learn some new techniques for the future. Also nice to see them use Nichicon PM caps (those brown ones) since that's all I've been using myself for doing repairs. For the flash memory, I'd just try to read the chips out directly. I wonder if the data would be encrypted. My gut feeling is that it wouldn't be, because that would make it much harder to reconstruct if chunks are missing. However, I'd say that it would be logical for them to use some kind of data reduncancy mechanism other than strict mirroring of data since that's inefficient. Like a RAID5/6 parity structure - so that the part of the total data you're trying to access isn't localized to specific chips. Smaller overhead and still means that all data is recoverable despite some of the chips being unreadable.

[@vapgames]

What a wonderfully overengineered flashdrive.

[@RizLazey]

vapgames overengineered and oversized ssd*

[@avypath]

"damn, i dropped my keys off the empire state building AGAIN..."

[@DoogieLabs]

You should be able to use wireshark and a network hub (it must be a hub and not a switch) to maintain link and an active capture. After you've started the capture, power up the flight recorder. You might see it try and DHCP out and attempt to get an address, or it may broadcast some packets from its static address. - Might work anyway without a hub and a crossover cable just like you've got there, I have been successful that way as well.

[@youser23]

are the "glass beads" maybe silica gel?

[@NonEuclideanTacoCannon]

Super late here, but the glass beads are vacuum spheres, and they're ceramic. Great insulator.

[@madinatore]

maybe the glass/sand is supposed to prevent destruction of the components from a g-shock?

[@thaalsmythic8731]

desiccant? Or phase change thermal energy absorber? Could try heating and/or wetting it.

[@frtard]

Maybe they might be used similar to this: www.google.ch/patents/US6456240 "The action of this tubular protection member 704 is to convey or conduct higher frequency shock wave components around the enclosed electronic circuit elements rather than allow shock wave interaction with the electronic circuit elements..." "Preferably any empty or void spaces within the tubular protection member 704, spaces such as are indicated at 728 and 730 in FIG. 7, are filled with a potting or casting material to add both wiring support and strength/rigidity to the overall FIG. 7 assembly." "...said tubular enclosure member is comprised of reinforcing fiberglass and includes a void space-filling epoxy and glass bead material."

[@frtard]

Damn KZbin comments not handling new lines anymore? WTF

[@madinatore]

yay I guessed right! where is the teddy?

[@cleverca22]

a packet sniffer like wireshark may find its IP, if it sends any packets out on its own

[@Debraj1978]

If a militatry flight data recorder can have wire corrections, why not my board, which only runs a cooling fan. I tried to reason with my customer, but he will not agree.

[@hotplatelabs]

Much of the networking advice given so far in the comments seems misguided. Your best bet with a totally unknown device like this is to run a packet sniffer like Witeshark or tcpdump while the device is booting. Hopefully you'll then be able to see it ARPing for its default gateway or another host it thinks might be on the LAN with it. If it doesn't emit any frames of its own volition then things get more complicated :P

[@reeceevmez4208]

Made in Dorset Christchurch just down the road from me

[@MrFreeElectron]

manufacturer : sensitive electronics. mike : where's me angle grinder ....

[@iamdarkyoshi]

Would have been really funny to open the nuclear warfare proof data containment unit and find a USB flash drive inside. But those things are piss poor in terms of reliability

[@thediemaster]

I know the company I work for does have boards with wind river stickers on them. those boards are a vxworks OS also running on a Motorola power PC type processor and boot and talk via serial and Ethernet. very similar setup to this.

[@drgalaxy]

There was at least one other sale of this model by eBay seller 'rays-tek' claiming it was scrap from an RAF Tornado. Interestingly the listing was in Staffordshire which up until about 10 years ago had an RAF station involved in maintenance. That eBay user has some more aviation goodies we might enjoy watching you tear down :-)

[@1001ewaste]

Nice find, that seller seems to have plenty of Tonka toy goodies especially from the now scrapped F.3.

[@SpringDivers]

I think that M-Systems DiskOnChip is a complete solid state disk. It looks like an MD2202-D64 which 64MB of storage.

[@kylegordon]

If you use Wireshark, you can capture all the traffic from the device. It may not talk IP, but nevertheless Wireshark can capture the raw ethernet frames, and more.

[@douro20]

Seagate used to use flex-core PCBs like that in some of their hard disks.

[@PicaDelphon]

you secure the Caps on the Blank Sockets do they Don't bounce around in flight..

[@DextersTechLab]

excellent teardown as always Mike. Will be interesting to see if anyone can help with looking at any stored data.

[@stefantrethan]

Sure beats that drain pipe for a pen holder.

[@VaporheadATC]

NSN means National Stock Number, not NATO Stock Number. Just FYI. Nice vid. EDIT: It looks like NSN also means NATO. My mistake.

[@ToniT800]

Interesting construction, especially if you compare it to the black box of Russian SU-25, which was shot down by Turkey.

[@Graham_Langley]

Those glass beads could well be hollow to give some thermal insulation. I've come across such beads used as filler in potting compounds.

[@warmfreeze]

they use two different TYPES of flash memory for redundancy.. all modern CVR/FDR have this.. i work on airplanes that are fly-by-wire.. each control surface has 4 computers controlling it and each and every computer is made by a completely different manufacturer for redundancy, they do this so if one type of computer fails for any reason the next computer will never have the same failure..

[@firestorm_v1playsgames157]

I'd resolder the DOC(Disk-on-chip), and reconnect the core unit back together. I've used DOC units to boot embedded devices before and that might explain the reason for the lack of activity on the ethernet port. You may be getting physical link but since the FDR's not booting, you may not get any response from it. Reassemble it completely, and then boot it and see if you get any activity, like ARPs or any kind of connection attempts originating from the FDR.

[@trilexfix]

I can only image one day getting the responsibly of fixing a black box from a plane crash where several families of deceased loved ones are waiting for.

[@wdavem]

Good. Glad to see the newerish flight recorders aren't made like the modern plastic toy crap other professional gear has become!!!

[@christophers6034]

I wonder if the blank connectors are there to keep all versions of the device at the same weight and/or shape.

[@XOIIOXOIIO]

Awesome, I need to get myself a flight recorder some day. I wonder what the manufacturing process is like for that flex-rigid construction, I've never seen anything like that before. That can will also make one hell of a cool pen/screwdriver holder. I hope some progress can be made on the ethernet connection front.

[@SupremeRuleroftheWorld]

i have checked the NSN, it is used in some newer (refurbished) DC-10 planes, most notably the tanker version.

[@Landrew0]

A google search of the NSN (NATO Stock Number) seems to indicate an NIIN assignment date of March 17, 2010.

[@arcadeuk]

Great video Mike, I love seeing well engineered stuff like this

[@Daniel-ib5bx]

That board was so dodgy... how can something like that not have a final version board in it. There's mod wires all over that thing.

[@UrtSP]

At 12:31 , it look like asbestos insulation.

[@zedman442]

Would be interesting to see if you could pull any data of those chips, they could have some baseline encryption on them though. Nice tear down.

[@Robert.K]

Hi! Those PCBs looks like they have some nice coating on them. What would be best to use for coating on a PCB used in a humid environment? I'm thinking of waterproofing the headlight modules in my car.

[@monad_tcp]

Of course they are not going for density, I bet they are 4x redundancy, all chips with different operating temperatures. pretty neat actually !

[@tagno25]

Use wireshark, and exclude the mac address of your laptop "!(eth.src == aa:bb:cc:dd:ee:ff)"

[@RIGeek.]

I assume that critical data might be stored on the SLC DOMs and non-critical data might get stored on the flash media.

[@notwutuc]

would use a software called firefly to download the fdr and cvr data over an ethernet connection. Some planes have more than one recorder, bother recorders will be networked so they share data

[@timturner7609]

anyone remember his ebay name? id quite like to have that orange tube

[@timturner7609]

although, shipping to the states would likely be prohibitively expensive

[@Blowcrafter]

i guess there are many plane crashes in you area? :P

[@cuckingfunt9353]

He shoots them down.... Mikes house sits in the middle of Britain's Bermuda triangle.

[@Tugnar]

Fascinating insights, very much appreciate the effort taken for these videos. Concise and to the point, thank you very much.

[@stm3252]

Probably was manufactured to be installed on flight simulator ( it's a guess because the marking "level D").

[@FrozenHaxor]

Gotta love the quality of military spec gear.

[@tobortine]

My first guess would be 192.168.0.1 isn't it always that ;-)

[@sbreheny]

I'm surprised that they don't have a layer of water around the memory to use the tremendous ability of water to absorb heat while keeping the temp below 100C.

[@ddegn]

I know I'm a year late but water will only keep things below 100C if there's a way for water vapor to escape. They wouldn't be able to seal off the electronics as well if they needed to leave a path for the water vapor to escape.

[@DoRC]

I'm guessing the glass beads are for heat insulation.

[@patw52pb1]

And cushioning support for impact resistance, similar to sand. The glass spheres are also lightweight, non-conductive, non-absorptive, heat/fire/flame resistant, chemical/solvent resistant and reflective.

[@frollard]

13:00 would that fiber goop not be asbestos based?

[@cnerde]

Sold in 2007, so no.

[@HeathHunnicutt]

Could the ethernet be AFDX?

[@hariboob]

The blank connector you mention at the start is and earthing connector

[@coddingslug1778]

doc i dont know why but u sound like painless 360 u tuber.

[@blank7921]

My guess is the glass like beads are some form of desiccant incase it gets wet. I also bet the memory inside is redundant so each module is just a clone of each other. Then if one gets damaged the others are still able to be removed and read back.

[@WobblycogsUk]

Grab a copy of Wireshark and have a listen to what is happening on the ethernet port. Your computer is talking to the device so you should be able to pick up some interesting information.

[@rkan2]

Found eBay listing for the same NSN for a Tornado (which I also thought it could be for) flight data recorder.. google ebay id 131622930631 That listing ended on 25 Oct, 2015 so probably won't be there forever.

[@richfiles]

Teledyne is known for making those tiny little metal can relays. Fran Blanche was trying to build an Apollo AGC DSKY replica, and learned that Teledyne made the tiny latching relays used to drive each segment of the EL displays of the unit. Sadly, the things are expensive/scarce.

[@LamezLames]

Perhaps, you could give your computer a static address, open your subnet to 255.0.0.0, and use Angry IP Scanner to scan the network for any response. I would image IMCP might be disabled, but you could also do a port scan with nmap. The question is what network class do you choose? Maybe Class C?

[@KrYnoMoReGames1]

i would imagine it would use a manually configured IP address, I don't think it would be in the 24 Subnet range, The OS might be also on the solid state drive that was not connected and it sent the data to a satellite, using the onboard memory to store the data as a cache, Try it with the drive plugged in, If that will not work some new planes use Ethernet to communicate with the recorder so if you get no data out from it, it could be only data in

[@dsfs17987]

now search YT for "su-24 flight recorder" (Russian one, that Turks shot down last year) to see what "supposedly" is in Russian military aircraft...

[@iPelaaja1]

Only 10 years old but looks 20-30 years old... But a friend of mine did say automotive engineering is much more interesting, because you can actually try new things. In aerospace engineering reinventing something means huge amounts of testing, verification, approvals etc.

[@IOTechnology155]

mh370

[@ncc74656m]

I've got a Lockheed Aeronautical Systems Model 209(e) FDR I'm hoping to get some documentation for if anyone has any to scan and share.

[@TheElectr0nicus]

Informative Video how they are made : kzbin.info/www/bejne/Z3-ukGNobMpjq5Ym8s

[@budude2]

Wouldn't the 'glass beads' be a desiccant? Like those "Don't Eat" packs you get with electronics..

[@DRjoin55]

I've just been repairing a Tornado unit today.

[@ghosttwo2]

@15m looks like silica gel probably to keep it dry inside.

[@jasongladen82]

Does it emit any Ethernet packets at all on boot up? If So could pastebin a wireshark log? Is there a Mac address encoded? What happens if you send a wake on lan packet. or ping with a Static ARP set?

[@WizzRacing]

You will more of these for sale as the use in Private planes for ADS systems grows... If they start encryption if FR24 gets their way then all the airports large and small would have to spend a fortune to the new standard...

[@PlasmaHH]

You might be able to use zmap to get it to respond to something. But maybe it is not even talking IP but something more proprietary? Or maybe you broke it and the transceiver is just not getting its dhcp discover to you...

[@dima4983]

they are probably using some kind of chemical process to get the potting off, i don't believe they would make it that hard for themselves

[@zakqwy]

Try putting some of the spherical glass material under a microscope. Might be glass bubbles. Pretty neat tech.

[@gregf9160]

Fire-proof safes are filled with ground or finely powdered glass as it doesn’t conduct heat and dissipates it so it doesn’t reach the contents of the safe. I’d imagine this stuff is quite hazardous if ingested or inhaled.

[@MRooodddvvv]

NMAP IT !

[@patw52pb1]

Most likely a proprietary protocol, meaning Nmap, Wireshark or most any publicly available analyzer will not work.

[@AureliusR]

I highly doubt it's proprietary. There's no reason.

[@patw52pb1]

***** If this flight data recorder was used in a military application it is a very good possibility.

[@John_Ridley]

If it's used in military, it's guaranteed not to be proprietary.

[@patw52pb1]

John Ridley At least for the US that is not a completely accurate statement. I have worked on several military systems that employed a proprietary transport protocol and required an specific interface cable connected to a DTU that was connected to a PC/notebook over RS-232, USB, or Ethernet with specific software to access and decode flight data or cockpit voice recorder data.

[@guygustavson2346]

Fire up a ethernet sniffer liker wireshark and look at the ARP traffic, that should tell you what IP's it wants to talk to.

[@springford9511]

Someone below mentioned hollow glass beads but here is a link to a supplier and details. www.aircraftspruce.com/catalog/cmpages/bubbles.php They are light and may provide insulation. Mentions not inhaling as a good idea.