GM1 ORO.AOC.130 Flight data monitoring

GM1 ORO.AOC.130 Flight data monitoring – aeroplanes

CAA ORS9 Decision No. 15

IMPLEMENTATION OF AN FDM PROGRAMME

Flight data monitoring is defined in Annex I to this Regulation. It should be noted that the requirement to establish a FDM programme is applicable to all individual aircraft in the scope of ORO.AOC.130, not to a subset selected by the operator.

(a) FDM analysis techniques

(1) Exceedance detection

(i) FDM programmes are used for detecting exceedances, such as deviations from flight manual limits, standard operating procedures (SOPs), or good airmanship. Typically, a set of core events establishes the main areas of interest that are based on a prior assessment of the most significant risks by the operator. In addition, it is advisable to consider the following risks: risk of runway excursion or abnormal runway contact at take-off or landing, risk of loss of control in flight, risk of airborne collision, and risk of collision with terrain.

Examples: low or high lift-off rotation rate, stall warning, ground proximity warning system (GPWS) warning, flap limit speed exceedance, fast approach, high or low on glideslope, heavy landing.

(ii) Trigger logic expressions may be simple exceedances such as redline values. The majority, however, are composites that define a certain flight mode, aircraft configuration or payload-related condition. Analysis software can also assign different sets of rules dependent on airport or geography. For example, noise sensitive airports may use higher than normal glideslopes on approach paths over populated areas. In addition, it might be valuable to define several levels of exceedance severity (such as low, medium and high).

(iii) Exceedance detection provides useful information, which can complement that provided in crew reports.

Examples: reduced flap landing, emergency descent, engine failure, rejected take- off, go-around, airborne collision avoidance system (ACAS) or GPWS warning, and system malfunctions.

(iv) The operator may also modify the standard set of core events to account for unique situations they regularly experience, or the SOPs they use.

Example: to avoid nuisance exceedance reports from a non-standard instrument departure.

(v) The operator may also define new events to address specific problem areas. Example: restrictions on the use of certain flap settings to increase component life.

(2) All-flights measurements

FDM data are retained from all flights, not just the ones producing significant events. A selection of parameters is retained that is sufficient to characterise each flight and allow a comparative analysis of a wide range of operational variability. Emerging trends and tendencies may be identified and monitored before the trigger levels associated with exceedances are reached.

Examples of parameters monitored: take-off weight, flap setting, temperature, rotation and lift-off speeds versus scheduled speeds, maximum pitch rate and attitude during rotation, and gear retraction speeds, heights and times.

Examples of comparative analyses: pitch rates from high versus low take-off weights, good versus bad weather approaches, and touchdowns on short versus long runways.

(3) Statistics

Series of data are collected to support the analysis process: these usually include the numbers of flights flown per aircraft and sector details sufficient to generate rate and trend information.

(4) Investigation of incidents flight data

Recorded flight data provide valuable information for follow-up to incidents and other technical reports. They are useful in adding to the impressions and information recalled by the flight crew. They also provide an accurate indication of system status and performance, which may help in determining cause and effect relationships.

Examples of incidents where recorded data could be useful:

— high cockpit workload conditions as corroborated by such indicators as late descent, late localizer and/or glideslope interception, late landing configuration;

— unstabilised and rushed approaches, glide path excursions, etc.;

— exceedances of prescribed operating limitations (such as flap limit speeds, engine overtemperatures); and

— wake vortex encounters, turbulence encounters or other vertical accelerations.

It should be noted that recorded flight data have limitations, e.g. not all the information displayed to the flight crew is recorded, the source of recorded data may be different from the source used by a flight instrument, the sampling rate or the recording resolution of a parameter may be insufficient to capture accurate information.

(5) Continuing airworthiness

Data of all-flight measurements and exceedance detections can be utilised to assist the continuing airworthiness function. For example, engine-monitoring programmes look at measures of engine performance to determine operating efficiency and predict impending failures.

Examples of continuing airworthiness uses: engine thrust level and airframe drag measurements, avionics and other system performance monitoring, flying control performance, and brake and landing gear usage.

(b) FDM equipment

(1) General

FDM programmes generally involve systems that capture flight data, transform the data into an appropriate format for analysis, and generate reports and visualisation to assist in assessing the data. Typically, the following equipment capabilities are needed for effective FDM programmes:

(i) an on-board device to capture and record data on a wide range of in-flight parameters;

(ii) a means to transfer the data recorded on board the aircraft to a ground-based processing station;

(iii) a ground-based computer system to analyse the data, identify deviations from expected performance, generate reports to assist in interpreting the read-outs, etc.; and

(iv) optional software for a flight animation capability to integrate all data, presenting them as a simulation of in-flight conditions, thereby facilitating visualisation of actual events.

(2) Airborne equipment

(i) The flight parameters and recording capacity required for flight data recorders (FDR) to support accident investigations may be insufficient to support an effective FDM programme. Other technical solutions are available, including the following:

(A) Quick access recorders (QARs). QARs are installed in the aircraft and record flight data onto a low-cost removable medium.

(B) Some systems automatically download the recorded information via secure wireless systems when the aircraft is in the vicinity of the gate. There are also systems that enable the recorded data to be analysed on board while the aircraft is airborne.

(ii) Fleet composition, route structure and cost considerations will determine the most cost-effective method of removing the data from the aircraft.

(3) Ground replay and analysis equipment

(i) Data are downloaded from the aircraft recording device into a ground-based processing station, where the data are held securely to protect this sensitive information.

(ii) FDM programmes generate large amounts of data requiring specialised analysis software.

(iii) The analysis software checks the downloaded flight data for abnormalities.

(iv) The analysis software may include: annotated data trace displays, engineering unit listings, visualisation for the most significant incidents, access to interpretative material, links to other safety information and statistical presentations.

(1) FDM process

Typically, operators follow a closed-loop process in applying an FDM programme, for example:

(i) Establish a baseline: initially, operators establish a baseline of operational parameters against which changes can be detected and measured.

Examples: rate of unstable approaches or hard landings.

(ii) Highlight unusual or unsafe circumstances: the user determines when non- standard, unusual or basically unsafe circumstances occur; by comparing them to the baseline margins of safety, the changes can be quantified.

Example: increases in unstable approaches (or other unsafe events) at particular locations.

(iii) Identify unsafe trends: based on the frequency and severity of occurrence, trends are identified. Combined with an estimation of the level of severity, the risks are assessed to determine which may become unacceptable if the trend continues.

Example: a new procedure has resulted in high rates of descent that are nearly triggering GPWS warnings.

(iv) Mitigate risks: once an unacceptable risk has been identified, appropriate risk mitigation actions are decided on and implemented.

Example: having found high rates of descent, the SOPs are changed to improve aircraft control for optimum/maximum rates of descent.

(v) Monitor effectiveness: once a remedial action has been put in place, its effectiveness is monitored, confirming that it has reduced the identified risk and that the risk has not been transferred elsewhere.

Example: confirm that other safety measures at the aerodrome with high rates of descent do not change for the worse after changes in approach procedures.

(2) Analysis and follow-up

(i) FDM data are typically compiled every month or at shorter intervals. The data are then reviewed to identify specific exceedances and emerging undesirable trends and to disseminate the information to flight crews.

(ii) If deficiencies in pilot handling technique are evident, the information is usually de-identified in order to protect the identity of the flight crew. The information on specific exceedances is passed to a person (safety manager, agreed flight crew representative, honest broker) assigned by the operator for confidential discussion with the pilot. The person assigned by the operator provides the necessary contact with the pilot in order to clarify the circumstances, obtain feedback and give advice and recommendations for appropriate action. Such appropriate action could include re-training for the pilot (carried out in a constructive and non-punitive way), revisions to manuals, changes to ATC and airport operating procedures.

(iii) Follow-up monitoring enables the effectiveness of any corrective actions to be assessed. Flight crew feedback is essential for the identification and resolution of safety problems and could be collected through interviews, for example by asking the following:

(A) Are the desired results being achieved soon enough?

(B) Have the problems really been corrected, or just relocated to another part of the system?

(iv) All events are usually archived in a database. The database is used to sort, validate and display the data in easy-to-understand management reports. Over time, this archived data can provide a picture of emerging trends and hazards that would otherwise go unnoticed.

(v) Lessons learnt from the FDM programme may warrant inclusion in the operator’s safety promotion programmes. Safety promotion media may include newsletters, flight safety magazines, highlighting examples in training and simulator exercises, periodic reports to industry and the CAA. Care is required, however, to ensure that any information acquired through FDM is de-identified before using it in any training or promotional initiative.

(vi) All successes and failures are recorded, comparing planned programme objectives with expected results. This provides a basis for review of the FDM programme and the foundation for future programme development.

(d) Preconditions for an effective FDM programme

(1) Protection of FDM data

The integrity of FDM programmes rests upon protection of the FDM data. Any disclosure for purposes other than safety management can compromise the voluntary provision of safety data, thereby compromising flight safety.

(2) Essential trust

The trust established between management and flight crew is the foundation for a successful FDM programme. This trust can be facilitated by:

(i) early participation of the flight crew representatives in the design, implementation and operation of the FDM programme;

(ii) a formal agreement between management and flight crew, identifying the procedures for the use and protection of data; and

(iii) data security, optimised by:

(A) adhering to the agreement;

(B) the operator strictly limiting data access to selected individuals;

(D) ensuring that operational problems are promptly addressed by management.

(3) Requisite safety culture

Indicators of an effective safety culture typically include:

(i) top management’s demonstrated commitment to promoting a proactive safety culture;

(ii) a non-punitive operator policy that covers the FDM programme;

(iii) FDM programme management by dedicated staff under the authority of the safety manager, with a high degree of specialisation and logistical support;

(iv) involvement of persons with appropriate expertise when identifying and assessing the risks (for example, pilots experienced on the aircraft type being analysed);

(v) monitoring fleet trends aggregated from numerous operations, not focusing only on specific events;

(vi) a well-structured system to protect the confidentiality of the data; and

(vii) an efficient communication system for disseminating hazard information (and subsequent risk assessments) internally and to other organisations to permit timely safety action.

(e) Implementing an FDM programme

(1) General considerations

(i) Typically, the following steps are necessary to implement an FDM programme:

(A) implementation of a formal agreement between management and flight crew;

(B) establishment and verification of operational and security procedures;

(D) selection and training of dedicated and experienced staff to operate the programme; and

(E) commencement of data analysis and validation.

(ii) An operator with no FDM experience may need a year to achieve an operational FDM programme. Another year may be necessary before any safety and cost benefits appear. Improvements in the analysis software, or the use of outside specialist service providers, may shorten these time frames.

(2) Aims and objectives of an FDM programme

(i) As with any project there is a need to define the direction and objectives of the work. A phased approach is recommended so that the foundations are in place for possible subsequent expansion into other areas. Using a building block approach will allow expansion, diversification and evolution through experience.

Example: with a modular system, begin by looking at basic safety-related issues only. Add engine health monitoring, etc. in the second phase. Ensure compatibility with other systems.

(ii) A staged set of objectives starting from the first week’s replay and moving through early production reports into regular routine analysis will contribute to a sense of achievement as milestones are met.

Examples of short-term, medium-term and long-term goals:

(A) Short-term goals:

— establish data download procedures, test replay software and identify aircraft defects;

— validate and investigate exceedance data; and

— establish a user-acceptable routine report format to highlight individual exceedances and facilitate the acquisition of relevant statistics.

(B) Medium-term goals:

— produce an annual report — include key performance indicators;

— add other modules to the analysis (e.g. continuing airworthiness); and

— plan for the next fleet to be added to programme.

— network FDM information across all of the operator’s safety information systems;

— ensure FDM provision for any proposed alternative training and qualification programme (ATQP); and

— use utilisation and condition monitoring to reduce spares holdings.

(iii) Initially, focusing on a few known areas of interest will help prove the system’s effectiveness. In contrast to an undisciplined ‘scatter-gun’ approach, a focused approach is more likely to gain early success.

Examples: rushed approaches, or rough runways at particular aerodromes. Analysis of such known problem areas may generate useful information for the analysis of other areas.

(3) The FDM team

(i) Experience has shown that the ‘team’ necessary to run an FDM programme could vary in size from one person for a small fleet, to a dedicated section for large fleets. The descriptions below identify various functions to be fulfilled, not all of which need a dedicated position.

(A) Team leader: it is essential that the team leader earns the trust and full support of both management and flight crew. The team leader acts independently of others in line management to make recommendations that will be seen by all to have a high level of integrity and impartiality. The individual requires good analytical, presentation and management skills.

(B) Flight operations interpreter: this person is usually a current pilot (or perhaps a recently retired senior captain or instructor), who knows the operator’s route network and aircraft. This team member’s in-depth knowledge of SOPs, aircraft handling characteristics, aerodromes and routes is used to place the FDM data in a credible context.

(C) Technical interpreter: this person interprets FDM data with respect to the technical aspects of the aircraft operation and is familiar with the power plant, structures and systems departments’ requirements for information and any other engineering monitoring programmes in use by the operator.

(D) Gate-keeper: this person provides the link between the fleet or training managers and flight crew involved in events highlighted by FDM. The position requires good people skills and a positive attitude towards safety education. The person is typically a representative of the flight crew association or an ‘honest broker’ and is the only person permitted to connect the identifying data with the event. It is essential that this person earns the trust of both management and flight crew.

(E) Engineering technical support: this person is usually an avionics specialist, involved in the supervision of mandatory serviceability requirements for FDR systems. This team member is knowledgeable about FDM and the associated systems needed to run the programme.

(F) Replay operative and administrator: this person is responsible for the day- to-day running of the system, producing reports and analysis.

(ii) All FDM team members need appropriate training or experience for their respective area of data analysis. Each team member is allocated a realistic amount of time to regularly spend on FDM tasks.