A flight recorder is painted orange so it can be found. In a crash the outer box can be crushed or burned. The part that has to survive is a small armoured cylinder of memory inside it. That cylinder is built to a published test list. If search teams never find it, the tests do not matter.
The recorder does not survive because the whole box is tough. It survives because the flight data sits in a small crash-survivable memory unit bolted inside that box. Investigators can live with a melted outer case, but they need that inner cylinder.
That split — outer box versus inner cylinder — is how the system works. The tests the cylinder must pass are set out in EUROCAE ED-112 and later updates. The numbers are harsh on purpose, but still have limits. A recorder can pass every lab test and still fail if it is never found, or if it sits in a slow fire longer than the insulation can take.
It is not black
Non-deployable recorder cases are painted a bright international orange and carry reflective material. The colour is a search aid. “Black box” is leftover slang from early electronics, not a paint specification.
There are usually two recorders, sometimes combined in one housing. The flight data recorder keeps a timed stream of aircraft parameters: speed, altitude, heading, control positions, engine readings. Modern units log far more channels than the old minimums. The cockpit voice recorder keeps the last stretch of microphone audio from the flight deck — typically two hours on current rules for many aircraft — and overwrites the oldest sound as it goes. Some aircraft also keep data-link messages on the same protected hardware.
Both boxes are usually mounted in the tail. That is not because the tail is safe. It is because, in many impact sequences, the tail is the last large piece to hit, so the odds of a readable cylinder are slightly better there than in the nose.
What has to live
Older recorders used magnetic tape. Current ones use solid-state memory boards. Those boards sit at the centre of a sandwich.
Closest in is a thin aluminium housing around the memory stack. Around that is a thick layer of high-temperature silica insulation, on the order of an inch. Outside that is a shell of stainless steel or titanium. The rest of the recorder — circuit cards, connectors, the ordinary electronics that talk to the aircraft while it is flying — is not built to the same standard. In a severe accident those parts are often scrap. If the memory stack is intact, the wreckage of the outer box does not matter.
The tests hit that memory stack is set in an order.
First comes impact: about 3,400 g for a few milliseconds, like firing the unit from an air cannon into a target. Then a heavy steel pin is dropped onto its weakest side. After that, thousands of pounds of crush force are held on each axis for minutes.
After that, we have the fire tests. Fire is normally done in two tests. One is a fuel fire around 1,100°C for an hour. The other is a lower heat fire, about 260°C, held for many hours, because wreckage can keep smouldering.
The unit is also soaked in aircraft fluids and then in seawater, and pressed as if it were about 6,000 metres under water — roughly 20,000 feet.
The point of the sequence is not that every crash looks like the lab. The point is that the memory must still be readable after a stack of insults that resemble a crash.
Those limits are why people say the box is “indestructible.” It is not. It is qualified to a list.
How the data gets there
While the aircraft is intact, sensors and microphones feed the recorders through the airframe’s wiring. If electrical power from the generators fails, a dedicated battery is supposed to keep recording for a defined stretch so the last moments are not blank. After impact, nobody needs the recorder to keep running. They need the chips not to have been cooked, crushed, or shorted into nonsense.
Reading the unit is a laboratory job. Accident agencies dry, open, and image the memory. They do not plug the bent box back into an aircraft and press play.
Water is a search problem
If the wreckage is in the sea, an underwater locator beacon on the recorder is supposed to start pinging when it hits water. The common beacon frequency is 37.5 kHz. Older batteries were specified for about 30 days. Rules written for later installations pushed that minimum toward 90 days. The ping is not a radio shout across an ocean. Ships and towed hydrophones have to be in range. Layers of water at different temperatures can bend the sound. After the battery dies, the cylinder is a mute orange object on the seafloor.
Air France Flight 447, which went into the Atlantic in 2009, shows both facts at once. The recorders were found almost two years later, at a depth of about 4,000 metres. The memory could still be read. The delay was finding them, not a failure of the armour.
If the recorder is never found, it has not done its job. Malaysia Airlines Flight 370 made that plain. A test standard can harden a box. It cannot tell searchers where the wreck is.
Where the design still loses
Slow heat is the known weak point. A short, violent fuel fire is what the one-hour 1,100°C test is for. A recorder buried in wreckage that stays hot for many hours can cook past the insulation. Investigation reports have described voice and data recorders destroyed by prolonged heat rather than by the first flash. The standard itself includes a second, longer, cooler fire test because the first test is not the whole fire.
Impact geometry can also beat the lab. The penetration and crush tests pick axes and loads. A spike of wreckage through an unlucky line can still ruin the stack.
Salt water after recovery is a handling problem. Teams often keep a soaked unit wet until the lab can control the drying. Pulling a recorder out of the sea and leaving it in air can start corrosion that the dive did not finish.
None of that means the device is theatre. Accident agencies report that a large majority of crash-damaged recorders can still be read when they are recovered. The design works often enough to be worth the weight. It is not a promise that every future wreck will yield audio.
What the survival is for
The recorder exists so the next aircraft can be changed. Investigators reconstruct a timeline: what the engines were doing, what the controls were doing, what was said. The output is a safety recommendation, not a courtroom scene, even when courts later use the same file.
That purpose is why the orange paint, the tail placement, and the pinger exist. Survival of data is useless if the search ends when the battery dies.
The public phrase “the black box will tell us everything” is too large. A voice recorder is not a full cabin recording. A data recorder is only as good as the sensors that were working. Some accidents destroy the aircraft in a way that still leaves the last seconds ambiguous. Some wrecks are never found.
Deployable recorders — units designed to break free and float — exist as a separate design path. They have their own colour and trigger rules. Most airliners still carry the fixed orange boxes in the tail.
The mechanism, restated
A flight recorder survives a crash by protecting one small part. The aircraft can break apart. The outer case can break apart. What has to last is the memory stack inside a steel or titanium shell, wrapped in silica insulation.
That stack is tested for a violent impact, fire, crushing force, and deep water pressure. Orange paint helps people spot the wreckage. A pinger helps ships hear it underwater — for a few weeks, not forever.
The design fails when the box is never found, or when heat lasts longer than the insulation. That is the mechanism: a protected memory unit, not an indestructible black box.
Sources: EUROCAE, ICAO, BEA, NTSB, FAA.
