FLIGHT OPERATIONS
QUALITY ASSURANCE PROGRAM
CONTENTS
FOREWORD
CHAPTER 1 FLIGHT
OPERATIONS QUALITY ASSURANCE PROGRAM
(FOQA)
SECTION 1 INTRODUCTION
1. Purpose
2. Background
3. References
4. Definitions
SECTION 3 OVERVIEW
5. Purpose and Objectives
6. Conceptual Elements
7.
Program Application
8.
Program Benefits
9.
Management
CHAPTER 2 FOQA PROGRAM PLANNING AND DESIGN
SECTION 1 FOQA PROGRAM ELEMENTS
10. FOQA Elements Illustration
11. FOQA Program
12. Airborne System
13. Ground System
14. Process Systems
15. Interfacing
Systems
SECTION 2 ORGANIZATION AND MANAGEMENT
16. Organization
17. Data Use Agreements
18. Data
Protection and Security Considerations
SECTION 3 HARDWARE AND SOFTWARE SYSTEMS
19. Airborne System Configurations
20. Data Event Categories
21. Parameters and Exceedance Levels
22. Retrieval Equipment and Options
23. Ground
Playback Equipment Configurations
SECTION 4 OPERATING PROCESSES
24. Data Collection and Retrieval
25. Data Reduction and Analysis
26. Exceedance and Event Trend Assessment
27. Data Feedback and Resultant Actions
28. Trends and Records Retention
29. Software
Considerations
SECTION 5 STAFFING CONSIDERATIONS
30. Staffing Estimates
31. Outside Service Options
SECTION 6 PROGRAM DESIGN
32. Total System Development
33. Airborne System Development
34. Ground System Development
35. Operating Processes
36. Protection Processes
CHAPTER 3 PROGRAM
IMPLEMENTATION CONSIDERATIONS
SECTION 1 PHASE I --- PREPARATION
37. Implementation Schedule, Priorities and Organization
38. System Hardware, Software and Process Development
39. Equipment Installation and Checkout
40. Analysis
Software Debugging
SECTION 2 PHASE II -- TRIAL DEMONSTRATION AND EVALUATION
41. Data Quality Assurance
42. Event Envelope Review and Revision
43. Software Evaluation and Modification
44. Procedural
Validation
SECTION 3 PHASE III - FLIGHT OPERATIONS EVALUATION
45. Event Envelope Validation
46. Trend Data Base Integrity Review
47. Validation of Exceedance Review and Action Procedures
48. Confirmation of Data Feedback Procedures
SECTION IV PHASE IV – FOQA PROGRAM OPERATION
CHAPTER 4 PLANNING FOR ECAA PARTICIPATION
49. Review of Program Policies and Procedures
50. Data Trends and Program Operation
Feedback
APPENDIX FOQA DEVELOPMENT
PLAN
FOREWORD
Since
the utilization of operations flight data for safety enhancement of human
factors is not prevalent among Egyptian air carrier operators, non-Egyptian
operators were used as an informational study base for this advisory circular.
This
report provides initial guidance and recommendations for development and
implementation of a Flight Operations Quality Assurance Program (FOQA) within
the Egyptian air carrier environment.
The ECAA will assist any interested carrier with the development of
their individualized program.
CHAPTER 1 FLIGHT OPERATIONS QUALITY ASSURANCE
PROGRAM (FOQA)
SECTION 1 INTRODUCTION
1. PURPOSE: This Egyptian Advisory
Circular (EAC) provides information and guidance that can be used by air
carrier certificate holders, operating under Egyptian Civil Aviation
Regulations (ECARs), Part 121, who elect to develop a FOQA Program to enhance
flight safety. The FOQA Program is
voluntary, but implementation is strongly recommended. This program affords a carrier the
opportunity to implement a Voluntary Disclosure Reporting Program.
Note:
Refer to Partnership 2000 Informational Bulletin for complete guidance.
This EAC is
primarily intended for use by an operator's flight operations and flight safety
departments. FOQA Programs analyze
data collected during flight for a pilot's self-improvement, the improvement of
airline operations and training, and to increase the safety level of the
national airspace system.
Note:
Information from cockpit voice recorders is not used in the FOQA
Program.
The
ECAA encourages certificate holders to develop and implement FOQA Programs as a
tool for continuously monitoring and evaluating operational practices and
procedures. The ECAA has stated
that public safety is enhanced if deficiencies are identified and immediately
corrected upon discovery by the certificate holder rather than discovery by the
ECAA. FOQA Programs are designed
to provide quantitative and objective information necessary to identify these
deficiencies.
The
definitions and program elements outlined in this EAC are consistent with
successful programs implemented by a large number of non-Egyptian air carriers.
2. BACKGROUND: The ECAA recognizes
that air carriers perform their services with the highest possible degree of
safety. In support of this safety
objective, the ECAA has publicly endorsed FOQA Programs as a means to enhance
training programs, flight crew performance, operating efficiency, air traffic
control, aircraft/airport design, and other safety related programs.
The
FOQA Program is based on the premise that air carriers have the primary
responsibility for continuously monitoring their operations and ensuring that
they are safe and in compliance with current operating standards and the
ECARs. The FOQA Program will
assist certificate holders in identifying and addressing operational
deficiencies and trends that are not generally detectable with other procedures
or programs. The availability of
certain FOQA Program data to certificating authorities, manufacturers, and
airport operators will contribute to improving the overall safety and
efficiency in areas related to their specific objectives.
FOQA
users agree that insights derived from these programs have prevented serious
incidents/accidents and led to improved operating efficiencies. Manufacturers of large jet transports
have also endorsed FOQA as a means to enhance safety by improving operating
procedures, crew training, and aircraft design.
A
FOQA Program not only helps to identify and correct deficiencies in flight crew
training and operating procedures, but also leads to the development of an
automated industry safety database.
Inter-airline sharing of FOQA information will enhance the level of
safety for all participants.
3. REFERENCES:
A FOQA study report entitled, “Air Carrier Voluntary Flight Operational Quality
Assurance Program”, prepared by the Flight Safety Foundation, located in the
United States, is the basis for the information contained in this EAC. The ECAA encourages air carriers to
review this report regardless of whether or not they intend to implement a FOQA
Program.
SECTION
2 DEFINITIONS AND
GLOSSARY
4A. Airborne Data Acquisition Equipment:
Electronic data processing equipment that satisfies a wide range of
requirements for aircraft flight data recording. It provides acquisition and signal conditioning for a
variety of aircraft parameter sensor types and performs conversions for
transfer of data to a Digital Flight Data Recorder (DFDR), or other device. The most common types are:
1) Flight
Data Acquisition Unit (FDAU): Used with original ECAA-mandated DFDRs. It was designed to accept analog data
inputs per ARINC 573 design specifications.
2) Digital
Flight Data Acquisition Unit (DFDAU): Second-generation processing equipment
that accepts digital data (ARINC 429) and includes microprocessors that can be
programmed to analyze data and generate reports. Units that meet ARINC 717 design specifications are available
but have limited solid-state storage capacity.
3) Flight
Data Interface Unit (FDIU): Performs functions similar to a DFDAU.
4) Digital
Flight Data Acquisition Card (DFDAC): A single circuit card that performs the
function of a DFDAU and provides processed data to the DFDR.
4B. Aircraft Integrated Monitoring
Systems (AIMS): A class of airborne data acquisition and management
systems, with varying capabilities, that provides recorded flight data on the
operation/performance of the aircraft, engine and on-board systems. Data systems that are included in this
definition are:
1) Aircraft
Integrated Data Systems (AIDS);
2) Aircraft
Condition Monitoring System (ACMS);
3) Auxiliary
Data Acquisition System (ADAS);
4) Flight
Data Acquisition and Management System (FDAMS); and,
5) Aircraft
Recording and Monitoring System (ARMS).
4C. ARINC Communication and Reporting
System (ACARS): An addressable digital data-link that permits two-way
communication of information on an ARINC Very High Frequency (VHF) radio
network. Data sent and received on
the ACARS network reduces communication errors and decreases the number of
required voice transmissions by flight crews, thus enabling them to better
focus on other flight duties.
4D. Data De-Identification: Removal
of any recorded information that could be associated with a particular flight,
date, or crewmember.
4E. Data Management Unit (DMU):
Performs the same functions as an acquisition unit. It provides advanced
capabilities for on-board analysis, report generation, and data transfer to
peripheral devices. Expanded
solid-state memory provides substantial storage for in-flight reports. In most cases, DMU software programs
accommodate floppy disks.
4F. Data Transcription: A software
process that transforms recorded data into synchronized frames of binary bits
that are representative of the bit sequence originally fed to the recorder by
the FDAU or DFDAU. Data recorded
on a flight recorder is encoded, generally in Harvard biphase or bipolar
format. In other words, Data
Transcription is an analog recording of a digitally encoded data stream.
4G. Data Validation: A process that
reviews the event report data to ensure it was not generated as a result of
erroneous data or damaged sensors.
4H. Event Levels: Classifies the
degree of exceedance, from the established norm, into two or more severity
categories.
4I. Exceedance Envelope: Defines the
limits that will trigger an exceedance report for a particular operational
event.
4J. Exceedance Plot: A
two-dimensional plot of the exceedance and event-related flight parameters
recorded during several minutes of flight.
4L. Flight Operations Quality Assurance
(FOQA): A program that obtains and analyzes data recorded in-flight. The analyses and resulting follow-up
actions lead to an improvement in flight crew performance, training
programs/operating procedures, air traffic services procedures, airport
maintenance/design, and aircraft operation/design.
4M. Quick Access Recorder (QAR):
Records AIMS data and has provisions for quick extraction of data on a medium
that is easily transportable.
4N.
Glossary
·
ACMS - Aircraft Condition
Monitoring System
·
AIDS - Aircraft Integrated
Data System
·
AIMS - Aircraft Integrated
Monitoring System
·
ATS - Air Traffic Services
·
DFDAU - Digital Flight Data
Acquisition Unit
·
DFDR - Digital Flight Data
Recorder
·
DMU - Data Management Unit
·
DRU - Data Recovery Unit
·
FDAU - Flight Data
Acquisition Unit
·
FOQA - Flight Operations
Quality Assurance
·
IEP - Internal Evaluation
Program
·
OQAR - Optical Quick Access
Recorder
·
QAR - Quick Access Recorder
·
STC - Supplemental Type
Certificate
·
TC - Type Certificate
SECTION
3 OVERVIEW
3. PURPOSE
AND OBJECTIVES OF A FLIGHT OPERATIONS QUALITY
ASSURANCE PROGRAM:
To improve flight safety by providing information and insight into the total flight
operations environment through selective automated recording and analysis of
data generated during in-flight operations. Analysis of data will reveal situations requiring improved
operating and training procedures, equipment, or supporting infrastructure.
Current FOQA users
have indicated that integrating the FOQA process into routine operations
enhances flight safety and operational efficiencies. Information derived from FOQA Programs is also able to
complement engineering/maintenance programs.
ECAA-mandated
DFDRs record data on flight crew performance, weather, aircraft systems, engine
operation and Air Traffic Services (ATS) for use during accident
investigations. One element
missing from this process is quantitative information concerning operational
incidents, which occur more frequently, and are often the precursors of
accidents. Accident statistics
indicate that approximately 70 percent of worldwide hull-loss accidents
involved flight crew errors.
However, these errors are often linked to other accident-enabling
factors. A FOQA Program can
detect, analyze, and correct these factors, thus reducing the overall risk to
flight operations.
The
specific objectives of a FOQA Program are to:
i.
Collect operational flight data to identify
improvements necessary in training programs, ATS, and aircraft/airport design;
ii. Evaluate
and review the performance of flight crews;
iii. Compare
the collected data with established procedures and standards;
iv. Develop
exceedance information;
v. Perform
trend analyses of exceedances to evaluate corrective actions and measure
performance over a period of time; and
vi. Use
analyzed data in formal awareness and feedback programs to enhance safety in
the following areas:
·
Flight procedures;
·
Flight training procedures;
·
Crew performance during all phases of flight;
·
Air Traffic Services procedures;
·
Cockpit crew interface with aircraft systems; and
·
Aircraft/airport design and maintenance.
Feedback
Flight Safety
Flight Training
Flight Standards
Quality Assurance
Engineering/Maintenance
ATS/Airports
Operating Environment
Manufacturers
|
|
Cruise Performance Report
|
|
Troubleshooting/
Engineering Analysis
|
|
6. CONCEPTUAL
ELEMENTS OF A FOQA PROGRAM:
Figure 1
Figure 1 illustrates the flow and processing
of FOQA data recorded in-flight and the air carrier organizations involved in
FOQA management.
7. PROGRAM
APPLICATION: FOQA Programs are recommended, on a voluntary
basis, to all Part 121 operators of large jet transport aircraft. Other operators, with capabilities to
monitor FOQA parameters, are also encouraged to implement a FOQA Program.
8.
PROGRAM BENEFITS: A FOQA Program will provide the data and
analyses necessary to implement:
·
Modifications to operating procedures and training
programs;
·
Revisions to ATS procedures;
·
Fuel savings resulting from use of airborne winds
and temperatures for flight planning;
·
Improved engine and aircraft performance
assessment;
·
Improved weather analyses;
·
Monitoring of Ground Proximity Warning Systems
(GPWS), Traffic and Collision-Avoidance Systems (TCAS), Windshear Warning
Systems, and Autopilot Systems;
·
Resurfacing of rough runways; and
·
Support of aircraft certification and research
programs.
Vice President
Flt. Operations
|
|
9. MANAGEMENT: The management
organizational structure of FOQA Programs (Figure 2) should be established
within flight-operations related departments. These departments are better equipped to address the safety
priorities associated with FOQA.
CHAPTER 2
FOQA PROGRAM PLANNING AND DESIGN
This
chapter describes the general process for development of a FOQA Program. Design considerations include not only
the FOQA Program, but also the interfacing systems that might already be
on-board the aircraft.
SECTION 1 FOQA PROGRAM ELEMENTS
10. FOQA
ELEMENTS ILLUSTRATION
Figure 3
11. FOQA PROGRAM: Composed of three
major elements: airborne, ground, and process
systems. The airborne and ground
elements consist of hardware and software components. The process element supplies the methodology by which the
data is produced and analyzed.
12. AIRBORNE SYSTEM: May have a
variety of parts depending on operator hardware choices, the airplane data
systems provided by the manufacturer, and the systems added to the basic
airplane. Regardless of the
configuration, the basic purpose of the airborne hardware/software is
acquisition and storage of data for later processing and analysis.
15. INTERFACING SYSTEMS: In most
FOQA applications, particularly in advanced-technology (glass-cockpit)
aircraft, the FOQA Program will depend on input from other data systems in the
airplane. In older,
unsophisticated fleets, many measurements will continue to be derived from an
interface with the DFDR. Modern
aircraft rely on dedicated aircraft digital data buses for data inputs and the
airborne subsystem selects the desired data from a myriad of bus
information. Individual parameters
on these complex data buses number in the thousands.
SECTION 2 ORGANIZATION AND MANAGEMENT
16. ORGANIZATION: The organization
and management of FOQA Programs should be established within a
flight-operations related department.
There are currently many program variations depending on how long the
program has been established, personnel agreements, aircraft system
capabilities, airline organization, and other factors.
Many
FOQA activities are conducted jointly with other routine airline
activities. Several established
programs have ground processing and analysis facilities (located in a
maintenance area) that serve both maintenance and FOQA functions. Approximately
one third of FOQA users have PCs dedicated to FOQA data processing. This is particularly true of operators
beginning with a small FOQA management structure. Varying degrees of management participation and expertise
are utilized in the event review and feedback action processes required to
address negative trends.
FOQA
activities are conducted outside normal airline operations because of the
commitment to address FOQA data with a high degree of confidentiality and
control. The duties and
responsibilities of the FOQA Program Manager are based on control and use of
event data. Specific activities
may include:
·
Administration of the program and liaison with
pilot groups;
·
Establishment and control of program
policies/procedures;
·
Event evaluation and follow-up;
·
Feedback/coordination of safety trends;
·
Maintenance/security of trend and exceedance
databases;
·
Software maintenance and configuration control;
·
Software modifications related to event categories
and trigger levels; and
·
Coordination of critical operations data with
maintenance/engineering..
17. DATA
USE AGREEMENTS: Formal agreements are generally required between the
airlines and cockpit crew associations.
Agreements have existed since flight data recorders were required by
1950s legislation to support government investigations of accidents and
incidents. Expanded uses of DFDR
data in FOQA Programs have resulted in modifications to the language of these
agreements. In most cases, the
agreements are general and focus on protection of the flight crew from punitive
action. The most common provisions
of these agreements are:
·
Individual protection;
·
Data use;
·
Data access;
·
Use of data with ACARS; and
·
Crewmember identification.
Recent
agreements have been very specific and discuss how the data is processed,
managed, evaluated, de-identified, and retained. Most agreements lack definitive language concerning
circumstances in which a crewmember would be identified or contacted. This is usually subject to a company
and labor review on a case-by-case basis and always involves a FOQA
representative appointed by the pilot group.
18. DATA
PROTECTION AND SECURITY CONSIDERATIONS: The issue of data
protection and security is sensitive and focuses on data that can be identified
with a particular airline, flight, date, or cockpit crew. Any use of identified data for
purposes other than safety enhancement is counterproductive to achieve program
goals. Restrictions placed on
identified data arise from pilot and management agreements. Management must honor these agreements
and preclude use of the data for punitive action, thus ensuring that safety
improvements, provided by the program, are preserved.
Management's
responsibilities include the identification/investigation of operations
irregularities and the modification of operations, procedures, and training
when deemed necessary. This can
only be accomplished if there is an information flow from the involved cockpit
crews that provides insight into the causal factors associated with an event. Thus, labor and management usually agree
on a set of policies and procedures to control and restrict access to any data
that is considered sensitive.
These policies and procedures govern all processing of the data after an
event has been identified. They
determine when and how the data is to be used, who will have access, and the
time frame/format for retention.
Confidentially,
Anonymity and De-identification, are terms relevant to the use of FOQA data.
Confidentiality
assures that only authorized personnel have access to FOQA data. Documented provisions outline rules and
procedures to ensure full examination of exceedance events.
Anonymity
precludes identification under any circumstances. However, in order to enhance safety and when deemed
appropriate, cockpit crews should have the opportunity to provide additional
information.
De-identification
removes crew names, flight numbers, dates, and airline identities from the
database.
A
FOQA Program must operate in an environment that encourages the voluntary
submission of additional information as each situation may suggest.
PROTECTION
CONSIDERATIONS
Data
control is accomplished by restricting access to the data. These controls include:
·
Locked and restricted entry to data playback and
analysis facilities;
·
Passwords for analysis software applications and
database files;
·
De-identification of data;
·
Limited dissemination of identified reports and
plots; and
·
Selection of personnel with a high degree of
integrity.
Note:
Airlines should coordinate the selection of key FOQA participants with their pilot
groups to maintain effective working relationships.
Data
de-identification should include airline, flight number, date, and
cockpit crew. Data may be in a
computer file or in a collection of detachable data strips that have been
removed from the event reports.
Identifying information should be retained only until the event has been
analyzed and understood. It should
be securely stored and physically separated from the data printout or plot.
SECURITY
CONSIDERATIONS
Security
must be maintained with data that is retained beyond the period required to
investigate an operational event.
This period may vary to accommodate individual airline requirements and
philosophies. The sensitivity of
information is reduced when it cannot be identified with a particular flight,
thus diminishing security requirements.
SECTION
3: HARDWARE AND SOFTWARE SYSTEMS
18. Airborne
System Configurations: Airborne
system vary greatly depending on the manufacturer of the aircraft, date of
manufacture and the equipment selected to be installed on the aircraft. Appendix 2 gives a detailed
explanation of the different types of airborne systems installations.
The
reporting available is dependent on the type of system installed. The typical report options that are
available include:
These
are not considered FOQA reports and mostly involve engine and aircraft systems
information used by the airlines for maintenance. Exceedance reports also would be generated if a programmed
maintenance parameter limitation is exceeded. For example, engine pressure ratio (EPR), exhaust gas
temperature (EGT), engine overspeed, and vertical acceleration are all examples
of parameters with operational limitations that trigger a maintenance action
report. Typically, 50-60 routine
reports are programmed to meet user needs and, for several systems, as many as
100 reports may be established.
Several systems can be temporarily reprogrammed with additional
parameters for special trending or troubleshooting. This is useful for investigation of system irregularities
that may occur only during flight.
Data compression
within the DMU has increased QAR recording capacity. Data compression requires complex mathematical processing of
the variations in a parameter to reduce the data that must be recorded. For example, a parameter that remains
stable for several hours, such as altitude, could be recorded as two data
points and an intervening time, thus reducing significantly the amount of tape
that would be required to record this one parameter for the same period.
20. DATA EVENT CATEGORIES:
Operational conditions selected for monitoring and review. These conditions include a broad range
of aircraft and engine system characteristics, such as, system and mode status,
performance limitations, flight control system inputs and responses, rates of
change, and event duration.
For
example, an event category could be "rate of descent on
approach." Typically, several
subevents would be defined within this category and would become progressively
less tolerant of deviations as the aircraft descends to the ground. Some events are aircraft-specific
either because they are only applicable on certain aircraft, or associated with
a unique flight control or flight management system.
In maintenance,
the selection of events will focus on:
·
System information related to maintenance
reliability;
·
Manufacturers' warranties;
·
Aircraft and engine performance documentation for
operational usage compliance, e.g., Extended Twin-Engine Operations (ETOPS) or
autoland systems; and,
·
Systems troubleshooting.
Most
maintenance-oriented conditions, including exceedance levels, are programmed for
documentation purposes. Many
parameters are only recorded periodically, however, critical parameters are
monitored constantly for exceedances, particularly those that affect the
engines or aircraft structural integrity.
In
contrast, the monitoring of flight operations variables will focus almost
totally on situational exceedances that vary by phase of flight. The primary concern is operational
excursions of the aircraft and flight control systems from standard operating
procedures. Most of these require
the sensing of multiple parameters, although the exceedance trigger is
generally a single parameter. Some
variables are simply the operating limitations of the aircraft, but most relate
to the training and operating policies/procedures of the individual operator.
Analyzing
safety issues in accidents/incidents and proposing subsequent exceedance
categories will assist in the development of event categories. Current FOQA event categories have
evolved from those identified by initial FOQA users. Subsequent users incorporated modifications and expansions
to these categories. The events
adopted by most users parallel standard training and flight-check syllabi. However, generating practical event
envelope limits has required appreciable trial and error in the collection of
empirical flight data. Many other
events are monitored only for maintenance. While event categories are relatively consistent across a
user's fleet, every user does not monitor all event categories and many
experienced users continue to adjust thresholds on several parameters.
MOST COMMON EVENTS
21. PARAMETERS AND EXCEEDANCE LEVELS:
A parameter is a measurable variable that supplies information regarding the
status of a system or subsystem.
As an example of the relationship of parameters to events, consider an
event category called "excessive pitch rate on takeoff
rotation." On older aircraft,
pitch rate data is not available directly and must be derived by monitoring
pitch-attitude variations. Also,
the air-ground sensor (squat switch) data is needed to determine when the
aircraft leaves the ground. In
this case, data from three parameters (pitch-attitude, time, and air-ground
sensors) would be required to define a single event.
Users have limits in
selecting an ideal set of variables to monitor. The number and types available for a particular aircraft are
based on:
·
Mandatory DFDR parameters;
·
Parameters provided by the aircraft manufacturer as
part of the basic system configuration;
·
Parameters selected as change/request options on
new aircraft purchases; and
·
Fleet modifications.
Required
DFDR data has a specific set of parameters with specific sample rates and
accuracies. These parameters are
cross-utilized by distinct data acquisition units that separate the ECAA
required data from voluntary FOQA data.
The availability of critical parameter signals influence how specific
aircraft can be used in a FOQA Program.
Most current users selected Data Acquisition/Management Systems with
extended parameter wiring at the time of aircraft purchase.
22. RETRIEVAL EQUIPMENT AND OPTIONS:
Although there are several options for removal of recorded data from the
aircraft, there are limited options for retrieving FOQA data. Data can be retrieved through QAR
magnetic tape cassettes, optical disk, floppy disk, data loader, printer, CRT
display or data link. Because of
the earlier availability of tape systems and the ease of data removal, many
current FOQA operators use tape QARs.
Spares can be maintained on the aircraft to facilitate data cassette
exchanges at line stations.
There
are no special equipment requirements for manual removal of a cassette, but
there is a requirement in the ground system for a Data Recovery Unit
(DRU). The DRU serves as a data
input reader when it is interfaced with the ground playback system. These units usually can be used with
PCs and are supplied by the QAR manufacturer.
23. GROUND PLAYBACK EQUIPMENT:
Transforms the raw digital flight records into usable form for review and
trending. This equipment has
extensive variations and is usually capable of handling a variety of recorded
data formats and recorder types.
The
DFDR and FDAU manufacturers initially developed the playback equipment to
process FOQA data. The original
equipment used mainframe computers, but current technology allows PC based
processing and analysis.
Basic
functions of the playback equipment are similar, regardless of specific devices
selected. Data readers/recovery
units read and transfer the data from the recorded medium; computer processors
and storage devices receive, reformat, and store the data; and dedicated
processors, programmed with software applications, transcribe and analyze the
information. Data storage is accomplished
with magnetic tape, floppy disks, optical disks, hard drives, or solid-state
memory. Peripheral output devices
include printers, plotters, strip chart recorders, and CRT displays. The restrictions on the handling of
FOQA data influence the organization/operation of playback facilities and
equipment selection.
SECTION
4 OPERATING PROCESSES
24. DATA COLLECTION AND RETRIEVAL:
There are two basic approaches to recording FOQA data. One method is to record raw data
in-flight for the selected parameters and then process the data using a ground
replay station for event exceedance analysis. The second method is to record data and perform real-time
in-flight analysis only when an exceedance occurs. This has the advantage of substantially reducing the data
that must be processed and reviewed on the ground, but has the disadvantage of
losing expanded pre-event and post-event information that might be useful for
complete understanding of an event.
Raw-data
recording requires most users to use data compression or intermittent recording
because of limited QAR capacity.
Full recording is common for takeoff, initial climb, and
approach/landing. Intermittent
recordings are normally made during cruise flight.
In-flight
recording and analysis requires on-board equipment that is programmed to record
selected events and associated limits.
Such equipment and capacity is found only with state-of-the-art systems.
During operation, a full set of programmed parameters is continuously scanned,
in real-time, and the data is transferred to a short-term buffer memory in the
DMU for temporary storage. During
scanning, the parameters are evaluated for event exceedances. If an event is triggered, a segment of
the stored pre-event parameter data is recorded, along with the actual and
post-event data. The amount of
recorded data is variable and can be programmed to be as much as plus or minus
three minutes from the exceedance time.
These are referred to as event snapshots because the data provides only
a short, bracketed view of the event.
Most users prefer full in-flight recording and ground analysis, in
addition to event snapshots, to insure that all of the historical data is
available for later detailed analysis.
Routine
retrieval of data from the aircraft is accomplished by removal/replacement of a
QAR cassette. The operator’s
maintenance personnel usually conduct this procedure. The cassettes must be removed daily because they contain a
limited amount of data; otherwise, previously recorded data could be
overwritten with new data. Spare
cassettes may be stocked on the aircraft or at maintenance line stations.
25. DATA REDUCTION AND ANALYSIS:
Data reduction involves processes required to convert the data into a format
that is easily reviewed. The type
and degree of ground processing depends on the medium and format in which the
data has been recorded.
Transcription
transforms the recorded data format into a binary bit stream that is
reformatted and synchronized to the original FDAU or DMU data structure. The transcribed file is stored on
magnetic tape, optical disk, floppy disk, or other medium. It is then analyzed by software
applications that apply conversion algorithms to the appropriate binary data
words to produce engineering unit values (parameters). These values are then compared to event
limits for exceedance evaluation.
Usually
the software applications are purchased from the equipment manufacturers, but
occasionally, users develop customized applications. In either case, these applications offer a variety of
procedures that can be customized to meet the needs of an individual operator.
Most
FOQA users install software programs that automatically scan the transcribed
data for event exceedances and other programmed data generated during
flight. This analysis could
require 30-40 minutes, depending on the efficiency of the software and the
processing power of the playback computer. Event reports are automatically generated as the
transcription files are scanned.
Scanning may be accomplished overnight while the facilities are
unattended. The format of the
event reports can be a blocked listing of pertinent flight information or a
flight profile reproduction of selected event-related parameters. The posted information will generally
include flight number, date, aircraft tail number, flight origination/destination,
time of event, and category of event.
In
addition to data processing and generation of event reports, software analysis
applications must perform other functions. Options for data display include flight profile plots,
engineering unit listings, and multiple parameter x-y graphs. Graphic cockpit
symbols and color three-dimensional (3-D) flight simulation may be the most
effective methods to communicate flight path and profile information for pilot
feedback and training.
26. EXCEEDANCE AND EVENT TREND
ASSESSMENT: Each user should develop procedures that follow organizational
structure and management requirements.
The most important element is strict adherence to established review and
action procedures. Committee
participation in this review must include cockpit crew representation.
The
FOQA Manager should perform a daily review of the event reports generated from
the previous day's processing operation.
In most instances, only the more serious alert level event reports would
be generated as full reports. Most
of the events will fall into a less significant category and will be fed
automatically to the trending database.
It may be preferable to print only special category events accompanied
by a tabular event listing of peak parameter values for all other types. The objective in each case is to
concentrate on the more serious events.
In practice, relatively few events exceed the bounds of operational
tolerance.
Procedures
are necessary to review and validate the event reports. Technically and operationally qualified
individuals should conduct these reviews.
After
validation, the event is evaluated to determine if trend analysis is required
or if it is an excursion warranting further review and possible feedback from
the crew. If there is any
indication that the aircraft may have suffered structural stress, engine
damage, or other adverse problems, the appropriate engineering or maintenance
department should be notified immediately. If feedback from the cockpit crew is necessary, several
alternative procedures may be followed.
Users can establish a formal process of committee review to reach a
consensus on the need to contact the crew. Alternatively, a user may simply provide the event
information to the Chief Pilot and request that he identify and contact the
crew for feedback.
Although
not all FOQA users employ committees to make the crew-contact decision, all
users should have some form of event-review committee that meets periodically
to discuss events and trends.
These committees would typically be composed of management
representatives from flight operations, flight training, flight standards,
flight safety, performance engineering, and representatives from the pilot
group. The schedule for these
committee meetings varies among users, but is usually monthly. However, serious events should be
resolved immediately. Any
additional concerns should also be discussed during the committee meeting and
further action taken when appropriate.
27. DATA
FEEDBACK AND RESULTANT ACTIONS: Corrective actions may
be reflected in revised training methods, pilot bulletins, pilot briefings,
company procedures, ATS procedures, flight standards procedures, airport
bulletins, and navigational chart improvements. In some cases, modification to training programs or
operational policies and procedures may be required.
Fleet
training managers and check airmen should also be involved in the timely
dissemination of operational changes.
Periodic reviews of negative trends are conducted in much the same way
as other flight safety or quality assurance processes.
28. TRENDS AND RECORDS RETENTION:
The value of FOQA Programs is the early identification of flight trends that
indicate a deterioration of operational integrity. Users permit this data to be used only for safety
enhancement purposes and obtaining vital operational information that would
otherwise be unavailable. Trend
data is used to indicate when and where operational changes are necessary. The trend databases are arranged to
enable the user to evaluate trends for each event severity level. Selected individual identifying
characteristics are removed, but data may still be associated with an aircraft
type, flight origin, destination, and month. The database may be analyzed using an off-the-shelf software
application or a multipurpose user developed program. Trend capabilities are usually designed into the FOQA
analysis applications offered by equipment manufacturers and suppliers. These software applications apply,
sort, and trend information by keywords.
FOQA
data may be retained in one or more of the following categories: identified,
trend, or archived.
Identified
Data generally has associated records that could be
correlated to a specific flight.
All FOQA data falls into this category when it is initially
reviewed. The retention period
should be as brief as possible.
Operators may choose to retain all aircraft raw data or only peak
exceedance values.
Trend
Data is usually retained for several years. It is maintained on tape or disk drives
and may be linked to a mainframe computer storage system. Data includes peak values for the
related events, as well as, a wide range of flight and event related elements. However, trip and date information are
not included.
Archived
Data is retained for special studies that might be
considered important later as a result of a new safety issue or reexamination
of a previous one. De-identified
data is particularly valuable in exploring unresolved issues as additional
information becomes available. To
satisfy these objectives, the archived data generally is the complete raw data
records.
29. SOFTWARE CONSIDERATIONS: The
continued effectiveness and value of a FOQA Program are dependent on its
ability to adapt to changing fleet compositions, system configurations, flight
operating procedures, and operational variations.
Menu-driven
edit programs are provided as standard packages or options for most of the
referenced requirements.
Ground-based analysis software options may include:
·
Menu-driven instructions only, for which the
operator must do the programming;
·
Starter kits that provide a complete set of basic
parameter tables and event algorithms with instructions for further expansion;
or
·
Complete event program packages customized to
operator requirements.
SECTION
5 STAFFING CONSIDERATIONS
30. STAFFING ESTIMATES:
In establishing FOQA Program staffing, an airline must consider whether to
conduct in-house data analysis or contract with an outside service. This decision depends largely on the
scope (objectives, fleet composition, and aircraft data source capabilities) of
the FOQA Program. Users have found
that existing staff can operate a FOQA Program for up to 20 aircraft. Experience has demonstrated that one
additional person is needed for each 20 additional aircraft and a dedicated
ground station, operated by specialists, is required for more than 20 aircraft.
31. OUTSIDE SERVICE OPTIONS: Some
users may contract for data analysis services because of limited resources,
program scope, or various other reasons.
SECTION 6 PROGRAM DESIGN
An
operator’s objectives must be considered when designing a FOQA Program. These objectives lead to decisions in
formulating design specifications, selection of equipment, and developing
processes.
32. TOTAL SYSTEM DEVELOPMENT:
Management decisions regarding the fundamental size, scope, and operation of
the program must to be discussed early in the design process. Operators should realize that the
second-level systems are developed from the preliminary design decisions. Considerations for total-system
development include:
·
Fleet Analysis -- Requires identification of
aircraft type, aircraft retention periods, current and future restraints on
FOQA applications, and required fleet coverage.
·
FOQA Reporting Needs -- Requires identification of
desired reports and content, the definition of events, and parameters to be
measured, recorded, processed, and analyzed. This process will lead to identification of equipment needs
for both airborne and ground systems.
·
Required Recording Devices -- Requires definition
of recording level technology required on each aircraft to achieve FOQA
objectives.
·
Other Recorder Systems and Reporting Needs -- If
other data systems, such as ACMS, maintenance, engine, and ACARS systems are in
use or contemplated, they should be evaluated as FOQA data sources and, if
appropriate, included in an integrated data processing plan.
·
Data Retrieval Methods -- Includes identification
of data removal and transmission (to ground station) procedures.
·
On-board vs. Ground Data Processing -- Raw data may
be processed entirely by a ground station or processed on-board the aircraft
using complex equipment. The added
on-board complexity offers some attractive benefits such as data compression
(storage capacity), reduced time to identify problems, retrieval process
simplification, and flexibility in program modifications.
·
Centralized vs. Multiple Ground Stations --
Concentration of all data processing within one department (e.g., maintenance)
tends to drive the FOQA analytical procedure into a large centralized facility.
In these cases, the requirement for a
limited access facility near flight operations management and safety
organizations should also be considered.
Other programs permit widely separated hub locations where each has
access to the FOQA data. These are
usually PC-based systems, particularly if they are combined with on-board
processing and simplified reporting/display requirements.
·
Management of Data Processing Function(s) -- FOQA
data may be processed with data required by other applications. In this case, processing is usually
assigned to the maintenance organization.
FOQA data may also be separated (either in the retrieval process or
after initial reduction) and sent to a FOQA dedicated facility for processing
completion. In this case,
processing is usually assigned to flight operations or the safety organization.
·
Software and Software Changes -- Software
applications can be purchased off-the-shelf, contracted for development, or
produced internally. If the
airline has the capability, it should consider in-house software
development. This will ease
interpretation of results and permit changes to the on-board and ground station
software quickly and at a reduced cost.
Smaller airlines will probably elect to purchase most of their software.
Note: All software
applications should have an in-house capability to amend exceedance limits.
·
Costs -- The airborne system can be implemented
with the addition of a QAR and a PC-based ground station at reasonable cost. If measurements must be added beyond
those provided by the ECAA-mandated DFDR, developing a FOQA system for the
earlier generation aircraft could increase costs substantially. Conversely, acquisition of newer
aircraft with engine or ACMS data capability adds little to the additional cost
of a FOQA system.
33. AIRBORNE SYSTEM DEVELOPMENT:
Airborne systems must be compatible with the total system. These systems depend on the type of
aircraft, the operations manual for the aircraft, and the operator’s flight
operations policies and procedures.
The following criteria must be considered during development of the
airborne system:
·
Event Categories -- Selected to meet reporting
requirements.
·
Parameters -- Measurements that will support the
analysis algorithms for each event category. Frequency of recording must be established for each
parameter.
·
Exceedance Limits -- Must be set for each event
category.
·
Data Format -- Must be identified.
·
Recording Capacity -- Flight data capacity
requirements and flight intervals between downloads must be determined.
·
Recording Medium -- Choices include magnetic tape,
optical disk, and solid-state memory.
·
Data Compression -- Continuous or intermittent
depending upon on-board or ground processing.
·
On-Board Software Changes --A means for altering
and loading the software must be selected.
·
Data Quality -- Procedures to protect the quality
of the data must be determined, including frequency of calibrations and
self-check methods.
·
On-board Hardware and Software -- Requirements must
be selected.
·
Ground Support Equipment -- Requirements for
maintenance and troubleshooting must be established.
34. GROUND SYSTEM DEVELOPMENT: The
ground system must also be compatible with the total system. The following criteria must be
considered during ground system development:
·
Airborne System Compatibility -- Must be
maintained, particularly in data format, exceedance event and parameter
selection, recording medium, on-board software development/change, and the
hardware chosen for data acquisition and management. If a DMU is included, as part of the on-board hardware, the
ground system will usually prepare the input data.
·
Flight Record Processing Capacity -- The amount and
type of flight data to be processed in the start-up and mature program will
affect the selection of ground system hardware. Additional consideration must be given during hardware
selection if the ground system will use non-FOQA data.
·
Transcription Software -- Converts raw recorded
data into engineering units.
·
Analysis Software -- Runs the various analysis
routines that produce the required reports, such as exceedance event time
histories (either tabulated or plotted), trend data, and management reports.
·
Video Displays -- Includes the monitors and
software necessary for the data processing and analysis functions and special
displays, such as, data plots, flight path graphics and cockpit display
simulations. The latter displays
are particularly important if access to the FOQA data is provided routinely to
cockpit crews.
35. OPERATING PROCESSES: Required
functions should be initially defined for the airborne/ground systems, and then
assigned to an organization or individual. Following these actions, a functional diagram should be
prepared to include the following flows:
·
Data Retrieval Flow -- Responsibility and
procedures for removal, transmission, and storage of FOQA data and storage
devices.
·
Data Reduction Flow -- Responsibility and
procedures for data flow through the reduction process, including the
transmission and storage of data following the reduction process.
·
Data Analysis Flow -- Responsibility and procedures
for FOQA data analysis. If the
reduction and analysis functions are performed at the same location and by the
same organization, the two processes may be developed jointly.
·
Report Action Flow -- Responsibility and procedures
for report preparation, dissemination, analysis, and report-generated actions,
including frequency and agendas for committee meetings.
·
Management Action and Follow-Up Flow -- Developed
either as a separate process or as part of the report action flow to assign
responsibility for actions initiated by the internal organizations receiving
the reports.
·
Data Storage Flow -- Responsibility and procedures
for data retention, including storage facilities, storage media, retention
periods, and protection of data from unauthorized access.
36. PROTECTION PROCESSES: Established
to protect airline management and flight crews from legal action when
infractions of ECARs or operational policies and procedures are discovered
through the FOQA Program. These
processes also protect flight crews from punitive actions by airline management
and both, airlines and crews, from punitive actions by the ECAA.
Note:
The ECAA has stated that it will not use FOQA data for certificate or
disciplinary action except in egregious cases that have occurred due to gross
negligence or where there has been a willful disregard for safety or the ECARs.
Protective
procedures should be designed with the following components:
·
Airline Management/Prior Agreements -- Aimed at
defining party roles in the operation of a FOQA Program.
·
Confidentiality -- Ensures that airline or crew
names are not associated with any FOQA data except through rigid controls
employing a minimal number of reputable individuals.
·
Anonymity -- Ensures that any identification of
flight number and/or flight crews with specific FOQA flight data, necessary
during an analysis, is eliminated permanently, at the earliest possible time,
and in accordance with any applicable airline/pilot agreement.
·
Crew Contact
-- Defines the appropriate conditions for contact with a specific flight
crew or individual crewmember following an exceedance event. Appropriate use of information derived
from this contact is also defined.
·
Data Access and Control -- Includes procedures to
identify data requiring protection and assignment of overall responsibility for
data protection.
·
Record Retention and/or Destruction -- Defines the
safeguards during the data retention period and the responsibility for data
destruction.
CHAPTER 3 FOQA IMPLEMENTATION CONSIDERATIONS
This
chapter describes four phases of recommended procedures for implementation of a
FOQA Program.
Phase
I -- Includes overall planning to implement the total program and
detailed preparation for Phases II and III.
Phase
II -- A brief trial demonstration and evaluation
testing the system designed in Phase I, evaluating all operational aspects, on
one or more aircraft, and developing the operating/protective processes.
Phase
III -- A flight operations evaluation that adds more
aircraft of the same type to the program until a database, sufficient for
program validation, is accumulated.
Phase
IV -- Begins when the degree of expertise will
support a continuing program in all technical and management respects. It should begin with the aircraft
tested in Phase II and III and will expand to add the aircraft numbers and
types determined by the program plan.
As each new type of aircraft is introduced, it will likely be necessary
to employ a Phase II/Phase III type entry period for the evaluation of
technical variations.
SECTION 1 PHASE I --- PREPARATION
Airline
management must approve development of a FOQA Program or definitive planning
during Phase I. The system
design drivers should be identified and developed as discussed in Chapter 2,
Section 6. This phase must define
the desired product and develop plans for the subsequent phases. The plan will be a living document
requiring periodic updating.
Management approval should occur before equipment purchases are
committed and again before starting Phase II.
37. IMPLEMENTATION SCHEDULE, PRIORITIES
AND ORGANIZATION: These elements should be developed for the entire
program. Airline departments that
will be involved in the program, or those that will be data users should be
identified and a special implementation organization established.
Representation
should involve flight safety, training, flight standards,
engineering/maintenance, and the pilots' association. One or more employees, who understand the operator’s present
data systems, should also be assigned to the group. The organization should function as a steering committee
with support personnel assigned for specialized tasks. Initially, this group will define
system drivers, operating processes, and protection processes. Additionally, it will determine the
FOQA budget and, as implementation proceeds, the organization will become
responsible for long-term operation.
38. SYSTEM
HARDWARE, SOFTWARE AND PROCESS DEVELOPMENT: Should be tailored
specifically for Phase II demonstrations and should also support the elements
of the mature system. Equipment
and software for the airborne and ground systems are specified and acquired in
quantities necessary to support the program through Phase III. Operating processes necessary for Phase
I and II must be completed.
Protection process development should begin, but completion is not
required until the end of Phase II.
39. EQUIPMENT
INSTALLATION AND CHECKOUT: Installation of airborne and ground systems
will require the assistance of hardware and software suppliers.
ECAA
certification of the airborne equipment must be planned and accomplished after
the first flight of the modified aircraft. When the ground station is operable, testing of analysis
software can begin, although the airborne system may require additional work.
40. ANALYSIS SOFTWARE DEBUGGING:
Debugging and ground trials of the analysis software and operating processes
are the final steps in Phase I.
The services of the software supplier(s) will again be necessary. Phase I ends with a system readiness
evaluation prior to the first data flight.
SECTION 2 PHASE II -- TRIAL DEMONSTRATION
AND EVALUATION
In
this phase, management pilots on routine flights operate the aircraft. Data is obtained in a realistic
environment to verify the operational aspects of the airborne and ground
systems together with the operating processes. This small-scale evaluation confirms that the system is
ready for operation and expansion.
Operational and protection processes will have been tested and
completed. Agreements between
management and labor organizations will have been finalized.
41. DATA QUALITY ASSURANCE: This is the
first task of Phase II. It must be
determined that accurate/valid data is recorded in-flight and processed by the
ground system in acceptable formats.
42. EVENT ENVELOPE REVIEW AND REVISION:
Ensures that algorithms for each event category are functional and that the
exceedance levels have been properly set to capture desired events without
producing large volumes of inconsequential data. This requires careful review by the operations personnel
responsible for setting the limitations.
This task continues through Phase III to ensure that the fully
operational system will have little need for further change.
43. SOFTWARE EVALUATION AND
MODIFICATION: Identifies and corrects problems in the airborne and ground
systems software. Close
cooperation among the designers of the software and the ground system operators
is vital.
44. PROCEDURAL
VALIDATION: Reviews and refines:
·
The operational management of the program;
·
Data protection procedures; and
·
Data protection processes.
Completion
of this step and an overall readiness review will lead to Phase III.
SECTION 3 PHASE III - FLIGHT OPERATIONS
EVALUATION
This
phase generates sufficient data, under realistic conditions, to reveal latent
problems not found in prior testing.
Corrections made during Phase II will be evaluated. The databases and procedures designed
during Phases II and III must be free of errors because a change in any data
characteristic will make the before and after change results incompatible. Trend analysis, in particular, will be
disrupted.
44. EVENT ENVELOPE VALIDATION:
A continuation of the Phase II activity, which should continue until optimal
event categories, parameters, and limits, have been demonstrated.
46. TREND DATA BASE INTEGRITY REVIEW:
Occurs when sufficient data has been collected to permit tracking of flight
conditions and situations over a period of time. Evaluating the suitability of trend data, in at least two
levels of severity, and correction of the data generating processes, are
completed during this review.
47. VALIDATION OF EXCEEDANCE REVIEW AND
ACTION
PROCEDURES: Developed in Phase II, these procedures are
re-examined to assure that exceedances are properly analyzed and procedures to
contact cockpit crews are adequate.
Also, remedial action and follow-up processes should be reviewed for
satisfactory operation and adherence to prescribed protection rules.
48. CONFIRMATION OF DATA FEEDBACK
PROCEDURES: Conveys FOQA results to cockpit crews and confirms improvements
have occurred. If not properly
implemented, management's exposure to potential liability may be increased.
SECTION 4 PHASE IV -- FOQA PROGRAM
OPERATION
A
prerequisite for this phase is management's approval of the program following a
comprehensive readiness review.
Additional commitments of company resources might be required to
implement the operator’s total FOQA Program. The decision should be based on satisfactory results
obtained during Phase II and Phase III.
A
mature program will have four primary functions:
·
Data collection;
·
Data analysis and review;
·
Data trends; and
·
Data feedback and resultant action.
CHAPTER 4 PLANNING FOR ECAA PARTICIPATION
49. REVIEW
OF PROGRAM POLICIES AND PROCEDURES: A
review of the FOQA Program’s policies and procedures should be accomplished
after implementation is complete.
Additionally, the operator should provide periodic updates to the ECAA
during FOQA Program development.
50. DATA TRENDS AND PROGRAM OPERATION
FEEDBACK: Periodic review of trends and lessons learned from the FOQA
Program will help the airline and ECAA inspectors decide where to concentrate
safety efforts. Information used in
these reviews should be de-identified according to company procedures. The focus should be on trends rather
than specific flight data and exceedances. The ECAA Inspector should be considered a resource to help
coordinate the FOQA Program with other ECAA programs, such as Air Traffic
Services, airports, engineering, and maintenance.
APPENDIX 1 FOQA Development Plan
The
following material provides information that that will assist operators with
the development of a FOQA Program.
This information may be modified to meet individual requirements.
1. GENERAL
The primary system
components utilized in FOQA Programs are:
Airborne
Data-Recording Equipment---Acquires and captures the necessary
in-flight information; and
Ground-Based
Analysis Stations---Processes the digital flight recorder
data. Ground systems are used to
transform exceedance information into the appropriate format for analysis, and
generate various reports and visualizations to assist with interpreting
exceedances.
The
ground-based analysis stations produce information on any detected exceedances
that represent deviations from normal operating envelopes or exceptional
conditions. The flight data
analysis component of the ground-based station categorizes operational events
to be flagged by defining a set of parameters that indicate normal operating
envelopes.
There
are two categories describing special events where parameters deviate from
established thresholds:
·
Alerts---Indicate serious deviations; and
·
Detects---Indicate minor deviations.
Any
flight that has been flagged for further consideration is first screened to
validate the quality and integrity of the collected data and to filter-out any
marginal or transitory irregularities. After this validation step, the
remaining special events are analyzed to determine if subsequent processing
should include trend analysis or additional action, e.g., immediate
notification of engineering or maintenance personnel if any potential damage to
the aircraft was identified; reviews to identify corrective measures; and/or
crew feedback. Data analysts
manually perform this processing to determine if a significant event has
occurred. Reports are generated that provide information on the nature of the identified
event, categorization of event parameters, and pertinent flight
information. A variety of tools
are provided by the various ground-based systems for the interpretation and
visualization of identified special events, including plots of flight profiles
and event parameters.
At
the conclusion of the process, the data can be retained based upon
airline-established categorization.
Normal flights are typically archived and those identified as alert or
detect events are stored in historical databases. The ground-based stations also include the capability to
apply the appropriate protective procedures, such as de-identification of pilot
and specific flight information, to prevent misuse of data and/or reports. A ground-based system may be programmed
to include trend analysis capabilities that use historical databases to
identify prior similar deviations.
This information is useful for determining patterns that may require
further exploration.
The
parameters for detecting exceedances are based upon those provided by the data
capturing, recording, and storage capabilities of the DFDR. The associated thresholds for these
parameters vary by the type of aircraft, standard operating procedures, phase
of flight, and duration of the event.
For example, the threshold of selected parameters may be defined for
various altitudes, e.g., 1,000, 500, 250, and 100 feet, during landing mode
events. Additional information
used in the analysis includes general parameters about the aircraft type and
historical information used for trend analysis.
Currently,
about 40 to 50 event categories are typically defined based on a strategy of
identifying those that would have the greatest potential for safety and
performance considerations.
Approximately 30 to 40 parameters are assessed for these events during
various phases of flight. The
event categories and associated parameters have evolved in a trial and error
process using empirical flight data and are subject to continual evaluation and
modification.
FOQA
PROGRAM GOALS AND OBJECTIVES
Ø
Define the FOQA Program Goals and Objectives
The
following objectives are applicable to all FOQA Programs:
·
Collect operational flight data to identify needed
improvements in training programs, the ATS system, aircraft/airport design, and
evaluation/improvement of flight crew performance;
·
Compare the collected data with established
procedures and standards to identify needed improvements and develop exceedance
information;
·
Perform trend analyses of exceedances to evaluate
corrective actions and measure performance over time; and,
·
Use analyzed data in formal awareness and feedback
programs to enhance safety in the following areas:
¨
In-flight procedures;
¨
Flight training procedures;
¨
Crew performance during all phases of flight;
¨
Air Traffic Services procedures;
¨
Cockpit crew/aircraft systems interface; and
¨
Aircraft and airport design/maintenance.
Ø
Summarize Program Protective
Provisions That Will Ensure Acceptance By All Participants, Including Pilot
Associations.
3. FOQA PROGRAM ELEMENTS
Ø
Describe the Following Specific
FOQA Program Elements
Airborne
System
Describe
the airborne system configuration and indicate the equipment to be installed in
the aircraft. Discuss maintenance
policies for the airborne system.
Ground
System
Describe
the ground-based system including hardware and software.
Other
Equipment
Describe
any other FOQA components such as downlink of data from aircraft to ground
stations; trend analysis software, etc.
Organization
Describe
the supporting organization and management.
Indicate
the duties and responsibilities of associated personnel for administration;
data collection and retrieval; data security and protection; data reduction and
analysis; assessment of exceedances and trends; corrective actions and
feedback; data trends; record retention, etc.
Describe
committees/teams tasked for such activities as technical advice; monitoring and
evaluation of the program and data; liaison with pilot associations; and event
reviews.
FOQA
Program
Describe
the concept of a FOQA Program.
Data
Protection and Security
Describe
the data use agreement with flight crew associations for individual protection
and data use.
Describe
methods for protecting the data, controlling access, assuring confidentiality
and de-identification; crew contact; record retention; and data safeguards.
Event
Classifications and Definitions
Define
the categories/classifications to be used for events. Describe the process for defining and maintaining events of
interest and associated parameters.
Collection
and Retrieval
Describe
how data will be recorded (i.e., raw flight data vs. record only exceedance
data), the transport of data from aircraft to ground station, and logistics.
Data
Reduction and Analysis
Describe
how the recorded data will be transformed into the desired data quality and
integrity standards. Include data
classification and verification of events.
Exceedance
Review and Evaluation
Describe
procedures to review and evaluate event reports; reporting needs; notification
of appropriate personnel, i.e., cockpit crews, engineering/maintenance departments,
training, etc.; resolution of exceedances; determination of corrective actions;
feedback loop; and periodic summaries of events.
Trends
and Record Retention
Describe
procedures for maintaining information for trend analysis (including databases),
detection of trends, periodic reporting, evaluation of identified trends,
corrective actions, and feedback.
Data
Usage
Describe
any additional anticipated usage of FOQA data.
Glossary
Define
all acronyms used in the program:
4.
REFERENCES
Ø
Include documentation of reference material
utilized during program development.
APPENDIX 2 HARDWARE
AND SOFTWARE SYSTEMS
AIRBORNE SYSTEM
CONFIGURATIONS: FOQA Programs use data provided by one of several on-board data
management systems. These data
management systems were known initially as Aircraft Integrated Data Systems
(AIDS). They became known as
Aircraft Integrated Monitoring Systems (AIMS) when their capabilities were
expanded to include flight operations data and include Aircraft Condition
Monitoring Systems (ACMS), Auxiliary Data Acquisition System (ADAS), and Flight
Data Acquisition and Management System (FDAMS). AIMS is used in this EAC as a general reference to data
management systems.
Additional Parameter
Sensors
|
|
Flight Data
Acquisition Unit
|
|
ECAA DFDR SYSTEM
COMPONENTS
FOQA SYSTEM COMPONENTS
|
|
Although
the early AIMS met the basic requirements to record and receive data, they were
deficient in two important aspects.
First, they were limited in their capability to adapt to changes in data
requirements. Second, AIMS had
limited on-board processing capability, thus preventing a timely alert of
important exceedances. In most
basic configurations, the airborne system components interface with the
ECAA-mandated DFDR to derive data.
Figure 4 illustrates an early configuration.
Figure 4
Elementary
FOQA Airborne Recording System Configuration
The aircraft
sensors in Figure 4 meet the parameters required by the relevant ECAR. The additional sensors provide selected
system information to evaluate the particular events chosen for review.
An
FDAU acquires and processes the parameter data into a digitized data stream for
recording by the DFDR. The second
FDAU provides additional capacity and maintains separation (buffering) of FOQA
data for QAR storage.
The
most common equipment for recording FOQA data is a QAR. This unit contains magnetic tape
cartridges or cassettes that can be removed and replaced quickly, and is
usually accessible from the cockpit.
Early QARs had little, if any, processing capability. The flight-hour capacity
of these recorders varies as a function of data rates and data frame formats,
but falls short of airline operational requirements, even under the best of
circumstances. Newer optical disk
QARs provide expanded storage capacity.
Airborne
configurations fall into two categories, based on the applicable ARINC data
system design specification:
1)
ARINC Characteristic 573, Aircraft Integrated Monitoring Systems, and
2)
ARINC Characteristic 717, Flight Data Acquisition and Recording System.
ARINC 573 AIMS CONFIGURATIONS
This
FDAU specification is applicable to first-generation DFDRs installed on the
L-1011, DC-10, A-300, B-737, and early B-747 aircraft. For this generation of aircraft, the
aircraft sensor signals are usually analog and require considerable signal
processing by the FDAU. The selected flight data parameters are generally
hard-wired to the FDAU and aircraft downtime is required to reconfigure data
input requirements.
Flight Data Acquisition
Unit
|
|
Flight Data Acquisition
Unit
|
|
Auxiliary Data
Acquisition Unit
|
|
Mandatory
Flight
Recorder
|
|
Aircraft Integrated Monitoring System Configuration (ARINC 573 SYSTEM)
Figure 5
The
DMU component processes and stores selected exceedance reports but performs
limited real-time data analysis.
The unit may be programmed to perform multiple functions, such as
increasing the data rate to the QAR.
Independent processors and signal conditioning permit processing the
mandatory data, including aircraft system and operational data.
The
cockpit Flight Data Entry Panel (FDEP) is used by the cockpit crew to enter
pertinent flight information, such as aircraft number, trip number, date, time,
and gross weight. There is also an event button to mark occurrences that the
crew may want analyzed following the flight.
The Control and
Display Unit (CDU) serves as an input and output device to allow a ground
operator to program the DMU options for report generation, recovery of
flight-generated reports, and other maintenance information. The printer provides routine
maintenance and engineering reports, flight data reports, and system
troubleshooting queries.
The
Auxiliary Data Acquisition Unit (ADAU) is a low-capacity FDAU capable of
processing special or unusual data signals.
ARINC 717 AIMS
CONFIGURATIONS
Because
of the dramatic increase in parameters and capabilities, these are considered
second-generation data management systems. The major changes in aircraft design, including glass
cockpits, greatly influenced and enhanced the AIMS concept. Avionics systems and subsystems
manufacturers expanded digital data interfaces to communicate with each other
and aircraft data systems according to the ARINC 429 Digital Information
Transfer Standard (DITS). These
digital data buses provide ready access to multiple system parameters that
reflect the operation of the aircraft, engines, and their associated systems.
This
FDAU specification applies to B-757, B-767, MD11, MD80, A-320, A-330, A-340,
later model B-747 and B-737 aircraft, and others. Figure 6 illustrates a typical ARINC 717 AIMS configuration.
Other Aircraft
Data Systems
|
|
Digital FDAU
Processor 1
Processor 2
|
|
Aircraft Flight Data Acquisition and Recording
System (ARINC 717 System)
Figure
6
Except
for the FDAU, the system components in this configuration are similar to those
of earlier generations. A Digital
FDAU (DFDAU), which still acquires data from the aircraft's digital data buses,
has superseded the FDAU and conversion-processing requirements have been
reduced substantially. This allows
the DFDAU to handle all the functions previously accomplished by the FDAU and
DMU. Dual independent processors,
contained within a single unit, maintain separation of the ECAA-required DFDR
data and voluntary FOQA data.
Microprocessor architecture provides some capability to detect, analyze,
and report pre-established events.
When provided with the required parameters, microprocessors also can be
programmed to recognize specific phases of flight, generate reports, and
control the QAR.
The QAR
flight-hour capacity problems were increased by the additional data provided by
the DFDAU. Output data rate to the
QAR doubled from the standard 64 words per second to 128 words per second. Users welcomed the improved data rate,
however, it increased the frequency of cassette removals.
Parameters,
exceedance reports, and other logic modifications for the earlier DFDAUs
frequently involve reprogramming of Programmable Read Only Memory (PROM)
circuit chips. In most cases, the
manufacturer must accomplish this because specialized equipment is required
The
Control and Display Unit (CDU) displays/prints maintenance or exceedance
reports. Limited report format and
event process changes also may be accomplished. These report the status and values of user-selected
parameters for specific phases of flight.
Typically, reports are generated for takeoff, climb, cruise, descent,
and approach and landing.
CURRENT PRODUCTIONS SYSTEMS -- ARINC 717
AIMS
State-of-the-art
AIMS are referenced by different acronyms and labels depending on the specific
manufacturer or aircraft type. For
example, the Boeing 747-400 system is called an Aircraft Information Management
System (AIMS). The McDonnell
Douglas MD-11 system is called an Auxiliary Data Acquisition System (ADAS) and
that of the Airbus-330/A-340 is called an Aircraft Recording and Monitoring
System (ARMS). Another
manufacturer has selected the term Flight Data Acquisition and Management
System (FDAMS).
Current AIMS far
surpass the capabilities of the earlier configurations. The newer designs are functionally
similar, but manufacturers' approaches to user-oriented options vary
considerably. Capability has
expanded because the advanced design now allows most of the individual aircraft
systems to interface in the common language of the ARINC 429 Digital
Information Transfer Standard (DITS).
Continued advances in computer memory capacity, processors, and system
designs also have contributed to the improvement of earlier ARINC 717 AIMS.
These
new designs (Figure 7) optimize the relationships and efficiencies of multiple
systems that cross-utilize information from a number of other systems to
control their own operational modes and responses. These interfaces have always been necessary, but the
required information was not generally available from a centralized source and,
in many cases, was generated redundantly.
The DITS concept has grown and many of these systems now are identified
as data management systems and interface through their digital data buses
with the aircraft. Among the more
familiar systems are the Flight Management Computer (FMC), ACARS, Fuel-Quantity
Indicator (FQI), Air-Data Computer (ADC), and Engine Indication and
Crew-Alerting System (EICAS).
The
number of DITS data buses for a particular aircraft depends on the systems
installed, but typically range from 40-50 and can provide 3,000-4,000
parameters for AIMS. The AIMS do
not use all the parameters available at any given time. The FOQA Programs use a subset of the
AIMS selections.
The
DMU performs all of the functions previously described and provides additional
advanced on-board processing and expanded operator programming flexibility,
however, acquiring, analyzing and sorting of aircraft systems information and
distributing of the results to user-selected devices remain primary
functions. The unit acquires
selected parameters from the multiple data sources, evaluates the data based on
user-defined requirements, detects predefined event conditions, and stores the
selected event information within the DMU or QAR (or transmits it to the ground
via ACARS). The information may be
recorded in American Standard Code for Information Interchange (ASCII) format
for direct generation of post-flight reports or as raw flight data
records. The DMU allows real-time
retrieval of selected data on the cockpit printer or post-flight retrieval
through the MCDU.
State-of-the-Art
AIMS System Configuration
A user first
selects the operational events and the associated parameters to be
monitored. These requirements are
programmed on a ground data processing station, using software provided by the
system supplier, and stored on a floppy disk. The floppy disk information is programmed onto the DMU disk
drive. The floppy may be used to
upload software modifications to the DMU or to download flight reports stored
in the solid-state memory. These
reports provide information on multiple parameters relevant to the event recorded.
Figure
7
