GOOD PRACTICE
ON THE OVERSIGHT
OF FLIGHT DATA MONITORING
PROGRAMMES
Version
Good Practice document
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
2
Contents
Contents ............................................................................................................................................
Note ...................................................................................................................................................
Executive Summary ..........................................................................................................................
Denition of terms ...........................................................................................................................
I. Background ....................................................................................................................................
1. The objectives of an FDM programme ................................................................................................. 7
A tool for the operator to monitor its operational safety ..................................................................7
The role of aNational Aviation Authority ...........................................................................................7
A component of the operator’s Management System ........................................................................7
The “safety culture” (or “just culture”) presupposition ......................................................................8
2. ICAO Standards and Recommended Practices ..................................................................................... 8
3. European Regulation ............................................................................................................................. 8
Air operation rules ................................................................................................................................8
Flight Data Monitoring for Alternative Training and Qualication Programmes .............................9
Flight Data Monitoring for the serviceability of aight data recorder ...........................................10
Oversight role of NAA-MS ..................................................................................................................10
4. Guidance on FDM ................................................................................................................................. 11
Guidance material of the International Civil Aviation Organisation ................................................ 11
Guidance material of the UK Civil Aviation Authority ......................................................................11
Guidance material of U.S. Federal Aviation Administration .............................................................11
Guidance material of Global HFDM....................................................................................................11
II. What to check .............................................................................................................................
1. For all FDM programmes ..................................................................................................................... 13
Principle 1: basic requirement ...........................................................................................................13
Principle 2: responsibilities.................................................................................................................14
Principle 3: objectives .........................................................................................................................14
Principle 4: analysis techniques ..........................................................................................................15
Principle 5: tools for analysis, assessment and process control .......................................................16
Principle 6: safety communication .....................................................................................................17
Principle 7: ocial safety investigation requirements .....................................................................18
Principle 8: integration of FDM with occurrence reporting .............................................................18
Principle 9: data recovery ...................................................................................................................19
Principle 10: data retention ................................................................................................................19
Principle 11: data protection ..............................................................................................................20
Principle 12: condentiality procedure .............................................................................................20
Principle 13: airborne equipment ......................................................................................................21
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
3
2. FDM programmes supporting an ATQP .............................................................................................. 21
Principle A-1: FDM as afeedback loop to the ATQP .........................................................................21
Principle A-2: eective FDM programme before starting the ATQP ................................................22
Principle A-3: advanced FDM programme for extending the ATQP ................................................22
Principle A-4: data gathering and exchange .....................................................................................23
3. FDM programmes for alleviating FDR operational checks ................................................................ 24
Principle B-1: monitoring the quality of FDR parameters ................................................................. 24
III. Examples of FDM oversight in practice .....................................................................................
1. FDM and Management System ........................................................................................................... 25
2. Before and between safety audits ...................................................................................................... 25
3. Auditors ................................................................................................................................................ 25
4. The FDM questions .............................................................................................................................. 26
IV. The larger picture ......................................................................................................................
1. Integration of FDM oversight into operator’s Management System ................................................ 27
2. Use of FDM data for training: how to assess it is appropriate? ......................................................... 27
3. Preservation of FDM data in the case of asafety investigation ........................................................ 28
4. Level of access to FDM programme data by an inspector ................................................................. 28
5. Coordination with NAA safety promotion functions ......................................................................... 29
Annex – Examples of acceptable and unacceptable situations ..................................................
Annex : Regulation and guidance related to Flight data monitoring and safety management
1. ICAO Provisions .................................................................................................................................... 33
2. European regulation and guidance material ..................................................................................... 34
Annex : Safety Culture and Just Culture .......................................................................................
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
4
Note
This document was produced by the members of the European Authorities coordination group on FDM (EAFDM).
Information on the EAFDM can be consulted at http://www.easa.europa.eu/safety-and-research/european-au-
thorities-coordination-group-on-ight-data-monitoring-EAFDM.php
According to its terms of reference, the EAFDM is avoluntary partnership between the European Aviation Safety
Agency (EASA) and National Aviation Authorities of EASA Member States, with the following objectives:
- to foster actions by National Aviation Authorities of EASA Member States which contribute to improving the im-
plementation of FDM Programmes and to making FDM programmes more safety eective
- to contribute to ahigh and uniform level of safety in Europe
- to contribute to abetter overview of air transport operational safety in Europe
The EAFDM is also open to observers and advisers from National Aviation Authorities of States who are not mem-
bers of EASA.
The experts that contributed to this document were from the following authorities:
´ Austro Control (Austria)
´ BCAA (Belgium)
´ TraFi (Finland)
´ DGAC (France)
´ IAA (Ireland)
´ ULC (Poland)
´ INAC (Portugal)
´ AESA (Spain)
´ FOCA (Switzerland)
´ CAA (United Kingdom)
´ EASA
´ GCAA (UAE, observer)
According to its terms of reference, the EAFDM is avoluntary and independent safety initiative. Therefore
this document should not be considered as ocial guidance from any of the authorities taking part in the
EAFDM.
If you would like to give your comments or afeedback on this document, please write to [email protected]pa.eu.
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
5
Executive Summary
This document is intended to provide good practice
1
for National Aviation Authorities on the oversight of air-
craft operators’ FDM programmes.
Flight data monitoring (FDM) can be apowerful tool for an operator to improve and monitor its operational
safety. Although it is only required by European air operation rules for large aeroplanes (over 27 000 kg max-
imum certicated take-o mass), it has proved to be very benecial for operators of lighter aeroplanes and
operators of helicopters.
National Aviation Authorities of EASA Member States are responsible for the oversight of the Management Sys-
tems of their approved Air Operator Certicate (AOC) holders, including their FDM programme.
The European Authorities coordination group on FDM (EAFDM) would like to oer practical guidance on how
to eectively oversee FDM programmes, and therefore it decided to gather the experience of its members and
make it available to National Aviation Authorities.
This good practice document aims at providing advice on the principles to be checked.
This good practice document was prepared with the European air operations rules in mind, as well as the state
of play of FDM in Europe. However, it is believed that the content of this document can be of use for National Avi-
ation Authorities that are not members of EASA.
It is understood that implementing the good practice oered by this document could present challenges to both
National Aviation Authorities and operators who are less experienced in the eld of FDM. Aphased approach
may be taken in such cases with aview to achieve higher standards in the long term.
1 This document is not an EASA acceptable means of compliance or an EASA guidance material.
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
6
Denition of terms
The following denitions are provided for the acronyms that are used in this document:
AOC
Air Operator Certicate
ASR
Air Safety Report
ATQP
Alternative Training and Qualication Programme
CAA
Civil Aviation Authority
CFIT
Controlled ight into terrain
EAFDM
European Authorities coordination group on Flight Data Monitoring
EASA
European Aviation Safety Agency
FDA
Flight Data Analysis
FDM
Flight Data Monitoring
ICAO
International Civil Aviation Organisation
LOC-I
Loss of control in ight
MAC
Mid-air collision
MCTOM
Maximum certicated take-o mass
NAA(s)
National Aviation Authority(ies)
NAA-MS
National Aviation Authority of an EASA Member State
RE
Runway excursion
SMS
Safety Management System (term used by ICAO)
SOP
Standard Operating Procedure
SSP
State Safety Programme
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
7
I. Background
. The objectives of an FDM programme
A tool for the operator to monitor its operational safety
According to Commission Regulation (EU) 965/2012, “Flight Data Monitoring (FDM) means the proactive and
non-punitive use of digital ight data from routine operations to improve aviation safety”. Together with are-
porting system, FDM is avital part of awell-functioning Management System for an aircraft operator, and it acts
as one of the main data sources for monitoring the operational safety level.
In addition, many mature FDM programmes have beneted operators through the feedback of representative
FDM derived information to their training departments and ight crews. Aformalised and recognised approach
to linking FDM with training is employing an FDM programme as part of the deployment of an Alternative Train-
ing and Qualication Programme (ATQP).
The role of aNational Aviation Authority
European regulations expect the competent authority to have oversight of the Management Systems of their air-
craft operators. An important element thereof is how the FDM data is used and analysed by the aircraft operator
in order to dene adequate measures for safety improvement and assurance.
Also, the oversight of FDM programmes by an NAA-MS can feed into its State Safety Programme (SSP) by provid-
ing information on the general level of implementation of the FDM programmes by aircraft operators.
A component of the operator’s Management System
FDM was described in EU OPS as acomponent of an operator’s accident prevention and ight safety programme.
With the advent of the concept of the (Safety) Management System, FDM is anatural data source for the Man-
agement System.
Therefore the use of FDM programmes by aircraft operators is normally checked in the frame of the Manage-
ment System oversight.
Note:
According to Regulation (EC) 216/20082, Annex IV, 8.a.4, ‘the operator must implement and
maintain amanagement system to ensure compliance with these essential requirements
for operations and aim for continuous improvement of this system’. The term ‘Management
System’ used throughout this document is considered to encompass the ICAO concept of ‘safety
management system’3.The essential elements of the Management System of an aircraft operator
are described in ORO.GEN.200. They include, among others:
“(a)(3) the identication of aviation safety hazards entailed by the activities of the operator, their evaluation and
the management of associated risks, including taking actions to mitigate the risk and verify their eectiveness;”
2 Regulation (EC) 216/2008 ‘on common rules in the eld of civil aviation and establishing aEuropean Aviation Safety Agency’ (commonly called the
‘Basic Regulation’).
3 The principle of the Management System concept is that organisations can integrate the new safety risk management elements into their existing
system of management. It is oering more exibility since organisations may still refer to their SMS, QMS or SQMS etc., as long as they can
demonstrate that the provisions of Part ORO are met. This is also considered in line with systems thinking: in reality, the organisation should have
only one management system, which entails specic features to control the processes and requires feedback channels and interactions between
processes and with third parties. The better all these elements are integrated the better the organisation will manage risks.
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
8
The “safety culture” (or “just culture”) presupposition
An FDM programme is intrinsically non-punitive, featuring as part of apositive safety culture. As such it has to
function within ajust culture and the operator’s overall responsibilities related to its Management System.
This means that in cases of gross negligence or asignicant continuing safety concern, the decision to sanction
an individual ight crew member may be in part based on FDM data, however such adecision has to be made
within the Management System framework and procedures and require preliminary safety assessment by the
Safety Manager.
. ICAO Standards and Recommended Practices
ICAO Annex 6 Part I(International Commercial Air Transport– Aeroplanes) contains aStandard requiring an op-
erator of an aeroplane of amaximum certicated take-o mass (MCTOM) in excess of 27 000 kg to have an FDM
programme ‘as part of its safety management system’ (this concept is encompassed by the Management System
described in ORO.GEN.200). Annex 6 Part Ialso contains acorresponding Recommended Practice for operators
of aeroplanes of an MCTOM exceeding 20 000 kg.
ICAO Annex 6 Part III (International Operations– Helicopters) contains aRecommended Practice recommending
aFDM programme for operators of helicopters of an MCTOM exceeding 7 000 kg or apassenger seating cong-
uration of more than 9.
Relevant provisions of ICAO Annex 6 are copied in Annex 2 of this document.
ICAO Annex 19 (Safety Management) contains provisions on the implementation of aManagement System and
of aState safety oversight system.
. European Regulation
Air operation rules
Paragraph ORO.AOC.130 of Commission Regulation (EU) 965/2012, Annex III (Part ORO) contains the imple-
menting rule requiring an FDM programme for aeroplanes with an MCTOM of over 27 000 kg and operated for
commercial air transport. Commission Regulation (EU) 965/2012 is applicable in all EASA Member States since
29 October 2014.
AMC1 ORO.AOC.130 of EASA Executive Director (ED) Decision 2012/017/R contains acceptable means of compli-
ance for the implementation of paragraph ORO.AOC.130 of the implementing rules. AMC1 ORO.AOC.130 covers
the following aspects:
´ Use of FDM information
´ Flight Data Monitoring Analysis Techniques
´ Flight Data Monitoring Analysis, Assessment and Process Control Tools
´ Education and Publication
´ Accident and incident data requirements
´ Company occurrence reporting scheme
´ Data recovery strategy
´ Data retention strategy
´ Data Access and Security policy
´ Procedure Documentation
´ Airborne systems and equipment
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
9
In addition, more detailed guidance material has been introduced into GM1 ORO.AOC.130 of EASA ED Decision
2012/017/R.
Note:
In June 2013 EASA published Notice of Proposed Amendment (NPA) 2013-10 on Helicopter
oshore operations. The Comments Response Document (CRD) 2013-10 was published in August
2014. It contains adraft requirement that whenever operating ahelicopter equipped with aight
data recorder (FDR) for oshore commercial air transport, the operator shall establish an FDM
programme.
Flight Data Monitoring for Alternative Training and Qualication Programmes
Operational requirements applicable to an Alternative Training and Qualication Programme (ATQP)
4
are laid
down in Commission Regulation (EU) 965/2012, Annex III (Part ORO), paragraph ORO.FC.A.245. An acceptable
means of compliance is provided by EASA ED Decision 2012/017/R, AMC1 ORO.FC.A.245.
AMC1 ORO.FC.A.245 outlines that the purpose of FDM for ATQP is to enable the operator to:
´ provide data to support the implementation of ATQP and justify changes to the ATQP;
´ establish operational and training objectives based upon an analysis of the operational environment;
´ monitor the eectiveness of ight crew training and qualication.
Indeed, the ATQP should include afeedback loop in order to measure if the overall targets of training are being
achieved. An FDM programme is expected as abasis for such afeedback loop.
Note:
Adapting the ight crew training programme nearest to the specic needs of the operator should
allow them to better grasp the risks they face, mitigate them and improve safety.
The identication of the training needs is reliant on an evidence base which may also include data such as:
´ occurrence reports;
´
internal audits of real operating conditions (Line-oriented evaluation and line-oriented quality evaluation);
´ information feedback from instructors and examiners;
The operator should establish aprocedure for data handling to ensure the condentiality of individual ight crew
members.
An ATQP needs acertain degree of data coverage in order to function properly. FDM data collection should reach
aminimum of 60% for all relevant ights conducted by the operator before ATQP approval is granted.
An advanced FDM programme is required when an extension to the ATQP is requested.
Note:
According to AMC1 ORO.FC.A.245, ‘an advanced FDM programme is determined by the level
of integration with other safety initiatives implemented by the operator, such as the operator’s
Management System. The programme should include both systematic evaluations of data from
an FDM programme and ight crew training events for the relevant crews. Data collection should
reach aminimum of 80 % of all relevant ights and training conducted by the operator. This
proportion may be varied as determined by the competent authority.’
It is important to account for the fact that the development of unique items of training/monitoring in an ATQP
requires time, in terms of gathering evidence from data, the practicalities of implementation of new training,
4 An ATQP gives an operator the possibility to establish an alternative training and checking programme that should maintain at least an equivalent or
improved level of ight crew prociency to the existing operational training requirements. ATQPs oer an increased scope for developing training
initiatives; in such programmes, the syllabus for the training is specically adapted to the organization and its operations and aircraft eet.
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
10
assessing potential associated risks and establishing success/failure etc. Thus astaged approach to this may
be needed with short term and long term goals set out at the start, with aprocess to modify these if justied
through experience, as the programme develops.
Flight Data Monitoring for the serviceability of aight data recorder
Commission Regulation (EU) 965/2012, Annex IV (Part CAT) contains in paragraph CAT.GEN.MPA.195 arequire-
ment that the aircraft operator maintains the serviceability of the ight recorders through operational checks.
Acceptable means of compliance are provided by EASA ED Decision 2012/018/R paragraph AMC1 CAT.GEN.
MPA.195. This paragraph recommends an annual inspection of the FDR recording, however in the case where
the aircraft is subject to an FDM programme this could be relaxed. For this alleviation to be acceptable, the data
source of FDR mandatory ight parameters and of FDM data should be the same, the FDR should be tted with
reliable built-in-test equipment (most solid-state FDRs are, but magnetic tape FDRs are not) and the integrity of
the FDR mandatory ight parameters should be monitored by the FDM programme.
Hence, under certain conditions, an FDM programme can be an acceptable substitute for the annual inspection
of the FDR recording.
Oversight role of NAA-MS
The oversight role of the NAAs-MS is as dened in Commission Regulation (EU) 965/2012.
According to Article 3 of this Regulation, Member States shall ensure that the competent authority has the nec
-
essary capability to ensure the oversight of all persons and organisations covered by their oversight programme,
including sucient resources to full the requirements of the Aviation Regulations.
Personnel of the authority are required to carry out certication and oversight tasks like the performing of au-
dits, investigations, assessments, inspections, including ramp inspections and unannounced inspections and any
other task to grant aproper oversight of air operators.
Annex II (Part ARO- authority requirements for air operations) contains more specic requirements. The over-
sight role includes the surveillance that an operator has established and maintained aight data monitoring
programme.
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
11
. Guidance on FDM
Guidance material of the International Civil Aviation Organisation
ICAO Flight Data Analysis Programmes Manual (ICAO Doc 10 000) provides general guidance on what an FDM
programme usually consists of, the prerequisites for an eective FDM programmes and how it can be established.
Guidance material of the UK Civil Aviation Authority
CAP 739, Flight Data Monitoring (Second edition June 2013).
This document outlines good practice relating to rst establishing and then obtaining
worthwhile safety benets from an operator’s Flight Data Monitoring (FDM) programme.
Guidance material of U.S. Federal Aviation Administration
U.S. Department of Transportation, FAA– Advisory Circular No: 120-82.
This advisory circular (AC) provides guidance on “developing, implementing, and operating a
Flight Operational Quality Assurance (FOQA) program”. FOQA is the term used by the FAA for FDM.
Guidance material of Global HFDM
Helicopter Flight Data Monitoring, Industry Best Practice (April 2012).
This document provides guidance on FDM specically for helicopter operators.
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
12
II. What to check
This section oers anumber of checks that can be done during an audit or an inspection, to help gain assurance
that the FDM programme is implemented correctly and when applicable, properly used for the ATQP. This list
is only indicative and it is not exhaustive. Since the EAFDM is avoluntary and independent safety initiative, the
checks proposed in this section should not be confused with ocial requirements or guidance.
Note 1:
The provisions taken as areference in this section for proposing checks are ORO.AOC.130 and
AMC1 ORO.AOC.130 as published on 27 November 2014.
Note 2:
It is unlikely that an auditor will have sucient time to cover all of the aspects of an FDM
programme detailed in this section, during asingle audit. Nor will such coverage be necessarily
needed on aregular basis. However, it is recommended that astructured approach is followed
by determining what particular aspects need to be checked in advance as part of the pre-
audit preparation and on an ‘as relevant’ basis during the audit e.g. for specic safety issues
or certain aspects relating to FDM’s integration in the management system. Further to this it is
recommended that to support an eective assessment, aircraft operators are asked to provide
recent examples (as relevant to the line of discussion) to support their declared policies and
processes.
Note 3:
It is important that the auditors involved in the oversight of FDM programmes have knowledge
and experience sucient to assess the responses of the operators and derive meaningful
conclusions.
Note 4:
This section proposes aseries of checks that are distinguished as ‘basic’ [B] or ‘advanced’ [A].
These are guidelines to help the auditors when overseeing FDM programmes with dierent
levels of maturity. Any operator with an FDM programme is expected to be able to provide
satisfactory responses to the ‘basic’ checks proposed. However, as the operator programme
matures, it is expected that more advanced aspects of the FDM programme will be explored.
Once the ‘basic’ capability of the FDM programme is established, it is recommended that
the aspects covered under the ‘advanced’ checks are introduced, as relevant, and checked
accordingly. ‘Potential consequences of no activity’ have been noted for the ‘advanced’ checks
to highlight the importance and need for FDM programmes to evolve to tackle those aspects. In
any case, the auditor is advised to give consideration to the level of maturity of the operator FDM
programme that is audited and adapt the use of these proposed checks accordingly.
Note 5:
The implementation of an ATQP implies the need for amature FDM programme. Therefore:
• No distinction is made between basic and advanced checks in subsection 2 related to ATQP;
and
• An operator with an ATQP would be expected to be able to reply satisfactorily to advanced
questions in subsection 1.
Likewise, no distinction is being made between checks in subsection 3 (FDM programmes for
alleviating FDR serviceability checks).
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
13
. For all FDM programmes
The principles that are recommended for check are based on paragraph ORO.AOC.130 of the Air Operation re-
quirements
5
, Part ORO, as well as the related acceptable means of compliance AMC1 ORO.AOC.130.
Principle : basic requirement
ORO.AOC. Flight data monitoring— aeroplanes
“(a) The operator shall establish and maintain aight data monitoring system, which shall be integrated in its
management system, for aeroplanes with amaximum certicated take-o mass of more than 27 000 kg.
(b) The ight data monitoring system shall be non-punitive and contain adequate safeguards to protect the
source(s) of the data.”
Check:
a.
[B]Statement of safety objectives, including adherence to just/safety culture principles in the implementa-
tion of the Management System, signed by the accountable manager.
b. [B]Safety policy statement explicitly addressing the use of FDM data for identifying, monitoring and miti-
gating safety risks, signed by the accountable manager. This should mention that no punitive use of FDM
data is made at the FDM programme level (refer to Section I.1).
c. [B]Statement on the general condition of use and protection of the FDM data.
d.
[B]The ight crew members have access to the safety policy statement and the corresponding documents
signed by the accountable manager.
e.
[B]Flight data for all aeroplanes with MCTOM of over 27 000 kg are scanned and analysed on aregular
basis
f.
[B]Evidence of analysis since the introduction of aeet or of developing the FDM programme for any new
eet
g. [B]Inclusion of the FDM programme into the Management System processes.
Note 1:
The term “ight data monitoring programme” was replaced by “ight data monitoring system”
in ORO.AOC.130. Although this term is not common, it is understood that this still applies to
the notion of an FDM programme. For the purposes of clarity, EASA Opinion 06-2012 proposes
to reinstate the original term “ight data monitoring programme” in ORO.AOC.130. The
corresponding Regulation has not yet been adopted by the European legislator, however for the
purposes of this document, the term “FDM programme” is used.
Note 2:
ORO.AOC.130 requires that the FDM programme is “integrated in the operator’s management
system”. ORO.GEN.200 requires that this Management System includes, among others:
“(a)(3) the identication of aviation safety hazards entailed by the activities of the operator, their
evaluation and the management of associated risks, including taking actions to mitigate the risk
and verify their eectiveness;”
As detailed in AMC1 ORO.GEN.200(a)(1)(2)(3)(5) and AMC1 ORO.GEN.200(a)(3), this means
that the aircraft operator should have aprocess to manage its safety risk. Hence, the FDM
programme outputs should be used for safety risk management, as part of its integration into
the Management System.
5 Refer to Commission Regulation (EU) 965/2012 laying down technical requirements and administrative procedures related to air operations.
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
14
Principle : responsibilities
AMC ORO.AOC. Flight data monitoring– aeroplanes
“(a) The safety manager, as dened under AMC1-ORO.GEN.200(a)(1), should be responsible for the identication
and assessment of issues and their transmission to the manager(s) responsible for the process(es) concerned. The
latter should be responsible for taking appropriate and practicable safety action within areasonable period of
time that reects the severity of the issue.”
Check:
a. [B]Inclusion of FDM in the safety manager’s responsibilities.
b. [B]How does the operator assure themselves that the time allocated to their safety personnel/number of
personnel on the FDM programme is adequate, given the operator’s activity and eet size?
c. [B]Safety risk internal information process which includes:
i. Allocation of responsibility for discovery and transmission.
ii. In case of an agreement with athird party to analyse data that details the operator’s overall responsibil-
ity: What is the timeframe for reporting? Are the analysis needs specied? Who are the recipients inside
the operator? Who is doing the data quality checks? (e.g. see Principle 4g. Principle 5b and Principle 5c).
d. [B]Evidence on agiven example, of timely action by the responsible manager after being informed.
e.
[A]How is FDM knowledge transferred to new sta/successors? Is FDM included in sta succession
planning? Potential consequence of no activity: Following sta turnover, FDM programme loses key
knowledge impacting upon its standards and development, with negative impact on the operator’s man-
agement system.
Note 1:
The safety manager is dened both for complex operators (AMC1-ORO.GEN.200(a)(1)) and for
non-complex operators (AMC1 ORO.GEN.200(a)(1);(2);(3);(5)), in general he/she is the person
responsible for managing and facilitating the oversight of safety.
The responsibilities of the nominated persons identied by ORO.AOC.135 include implementing
safety actions to address issues identied by the safety manager.
Note 2:
Some Operators may have contracted the processing of ight data to an external company (FDM
service provider). However, the overall responsibility for the FDM programme and integrating
it into their Management System lies with the operator. Therefore, the scope of the support
by aservice provider should be clearly dened, and there should be evidence that the aircraft
operator’s FDM programme is integrated with its Management System. In addition, agreements
with the FDM service provider or aformal policy should cover, when applicable, the protection of
FDM data.
Principle : objectives
AMC ORO.AOC. Flight data monitoring– aeroplanes
“(b) An FDM programme should allow an operator to:
(1) identify areas of operational risk and quantify current safety margins;
(2) identify and quantify operational risks by highlighting occurrences of non-standard, unusual or unsafe
circumstances;
(3) use the FDM information on the frequency of such occurrences, combined with an estimation of the level
of severity, to assess the safety risks and to determine which may become unacceptable if the discovered trend
continues;
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
15
(4) put in place appropriate procedures for remedial action once an unacceptable risk, either actually present or
predicted by trending, has been identied; and
(5) conrm the eectiveness of any remedial action by continued monitoring.”
Check:
a.
[B]Policy Statement & Procedures on hazard identication methods and risk management includes the
FDM programme (as part of the operator’s Management System).
b. [B]In case the FDM data analysis has been subcontracted to athird party, the operator has the ownership
of the specications for the FDM events and measurements.
c. [B]Evidence of use of FDM data together with other sources to identify and assess operational risks
d. [B]Evidence on agiven type of incident that FDM data were used to quantify the safety margins.
Principle : analysis techniques
AMC ORO.AOC. Flight data monitoring– aeroplanes
“(c) FDM analysis techniques should comprise the following:
(1) Exceedance detection: searching for deviations from aircraft ight manual limits and standard operating pro-
cedures. Aset of core events should be selected to cover the main areas of interest to the operator. Asample list
is provided in Appendix 1 to AMC1 ORO.AOC.130. The event detection limits should be continuously reviewed
to reect the operator’s current operating procedures.
(2) All ights measurement: asystem dening what is normal practice. This may be accomplished by retaining
various snapshots of information from each ight.
(3) Statistics- aseries of data collected to support the analysis process: this technique should include the number
of ights own per aircraft and sector details sucient to generate rate and trend information. “
Check:
a. [B]Exceedence detection program tailored to operating standards i.e. SOPs in general and aircraft type.
b. [A ] Exceedence detection program tailored to specic operating scenarios: for example, the category of
approach, specic aerodromes, IFR/VFR, winter operations. Potential consequence of no activity: FDM
event detections are not representative of operational context and genuine event occurrences may be
missed due to inappropriate event thresholds.
c.
[B]FDM programme adapted to existing and new operational risks/safety issues/ safety priorities, e.g.
events thresholds and/or measurements to support monitoring:
i.
Existing issues/risks, changing safety issues and operational changes (such as new SOPs, new missions,
new population of pilots)
ii. Common operational issues identied by the European Aviation Safety Plan and the State Safety Plan
d. [A]Review process in place to keep up to date and history of changes. Potential consequence of no activi-
ty: FDM program does not evolve and is not synchronised with the operator’s risks. The FDM programme
has no traceability, limiting internal oversight and the operator is unable to interpret historical reports.
e.
[A]The all ights measurements (E.g. speed at touchdown) cover the FDM events (existing and new) when
possible e.g. for monitoring normality and quality of operations. Potential consequence of no activity:
Limited understanding and analysis of normal operations (e.g. plotting and analysing the distribution of
specic ight data measurements for all ights) for identifying/monitoring new/existing risks. Inability to
rationalise existing events (e.g. their thresholds) that may be tailored to SOPs versus actual operational
results that may fall outside the scope of what can be captured by these events. Lack of monitoring qual-
ity of performance beyond SOPs to support continuous improvement.
f.
[B]Support statistics compiled, for instance including number of ights own or scanned by the FDM pro-
gramme (by departure and arrival aireld and by eet), in order to be able to compute rates.
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
16
g.
[A]Are operational departments and aircraft system experts involved when necessary in the design of new
events or in setting event threshold? Potential consequence of no activity: FDM sta do not have the full
context/information necessary to optimise the development and use of certain events.
h.
[A]How are FDM events/all ights measurements tested and evaluated? Potential consequence of no ac-
tivity: Issues that are expected to be captured by events/all ights measurements are not, giving afalse
result or hidden errors introduced into the system with uncontrolled consequences.6.
i. [B]Statistical analyses used to monitor safety levels and trends.
ii.
[B]Where data sample size is not sucient for statistical analyses, how else is the data used for safety
analysis?
Note:
Some FDM software packages may not oer the capability to dene all-ight measurements.
While it is advisable to select aproduct that has the all-ight measurement capability, some
products do not oer this. In such cases it is recommended to follow up whether the operator is
deriving alternative solutions, and involving the FDM software provider when necessary.
Principle : tools for analysis, assessment and process control
AMC ORO.AOC. Flight data monitoring– aeroplanes
“(d) FDM analysis, assessment and process control tools: the eective assessment of information obtained from
digital ight data should be dependent on the provision of appropriate information technology tool sets.”
Check:
a.
[B]Provision of dedicated analysis software (in the operator premises or accessible by the operator, for in-
stance in the case where FDM data processing is subcontracted)
b. Initial validation process used (e.g. integrity of FDM les).
i.
[B] Does the operator conduct basic data quality checks following data replay and software analysis of
the events /‘all ights measurements’, e.g.
1. For the time period of the data replayed, for agiven aircraft, is the number of ights extracted from
the data the same as the number based on operator ight logs?
2. Does each replayed ight le contain all the expected phases of ight?
3.
If applicable, do they review whether their FDM ‘all ights measurements’ produce values for each
ight as expected?
ii. [A]Is the operator aware of the validation processes (and how they work) of the software? Potential con-
sequence of no activity: Limited investigative capacity in identifying technical issues with the output of
the software for resolution by the software provider. Assumed quality standards leading to unsatisfac-
tory results.
c. [B]Data verication and validation process:
i.
[B]Evidence of validation of the quality of ight parameters used for the FDM events (consistency and
accuracy);
ii. [B]How are ‘nuisance’ events tracked and sorted out?
iii. [B]Validation of FDM events triggered by the system;
d. [B]Data displays– traces and listings, other visualisations.
6 The logic for FDM events can sometimes involve dependencies based on assumptions in the system e.g. an FDM event linked to the system denition
of the cruise ight phase (such as turbulence in cruise)– if the cruise phase of agiven ight does not conform to this system denition as expected
(i.e. the denition is not met), then the turbulence event associated will not trigger, even if the other relevant event trigger conditions are met.
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
17
e.
[B]The FDM analyst(s) has access to interpretive material, such as weather data, aircraft ight manuals,
ight plans, airport charts, to support their analysis.
f. [B]How is contextual data integrated into the assessment process of occurrences together with FDM?
g.
[B]Links with other safety information and safety processes, such as the internal reporting system, the
training programme.
h.
[B] The software has the technical capability to dene various levels of access to the data. If not, how does
the operator overcome this?
i. [B]The operator can adjust the denition of FDM events and all ights measurements in atimely manner
(by themselves or through athird party).
j. [B]Is the Operator aware of how the FDM events/ all ight measurements work and their limitations? Ev-
idence on arelevant example.
Principle : safety communication
AMC ORO.AOC. Flight data monitoring– aeroplanes
“(e) Education and publication: sharing safety information should be afundamental principle of aviation safety
in helping to reduce accident rates. The operator should pass on the lessons learnt to all relevant personnel and,
where appropriate, industry.”
Check:
a. [B]FDM ndings are communicated to relevant parties once discovered.
i. Is there an adequate means to report important messages outside of the regular reporting processes?
ii.
Does the FDM reporting cover the safety priorities identied by the operator? E.g. from their risk register.
b.
[B]Examples of means of distribution of safety messages (e.g. Newsletter or ight safety magazine, ur-
gent safety communications.)
c. [A]Does the operator follow-up to check the uptake of FDM messages, e.g.
i.
Do FDM trends correlate with the uptake of safety messages by ight crew members as expected? Ex-
ample: after communication on agiven safety issue and recommendations to the ight crews, apositive
event trend can be observed in the FDM data.Potential consequence of no activity: Operator is unable to
determine whether their safety communications have been eective.
d.
[B]Simulator/training feedback: are lessons-learnt fed back to training? Is any feedback taken into account
from the training function e.g. areas to monitor?
e.
[B]Do the ight crew have the opportunity to request and view their own data, e.g. for aspecic ight
where they were the handling pilots? Is assistance provided for interpretation of the ight data?
f.
[B]Evidence that operational departments (for example, maintenance, ground operations) receive relevant
information for their area of responsibility.
g.
[B]Presentation of FDM-based safety performance indicators (SPIs): How are the SPIs contextualised and
what is done to support the recipients in understanding their context? Are the SPIs relevant?
h.
[A]The operator engages with external stakeholders (e.g. aviation authorities) to inform them of relevant
safety issues (e.g. ATC vectoring causing unstable approaches or other ongoing risks with ATC or an aer-
odrome). Potential consequence of no activity: Industry/the regulator does not benet from potentially
unique insights into safety issues that are common/new in industry. Likewise the operator does not ben-
et from the experiences of the rest of industry/the regulator on topics relevant to them.
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
18
Principle : ocial safety investigation requirements
AMC ORO.AOC. Flight data monitoring– aeroplanes
“(f) Accident and incident data requirements specied in CAT.GEN.MPA.195 take precedence over the require-
ments of an FDM programme. In these cases the FDR data should be retained as part of the investigation data
and may fall outside the de-identication agreements.”
Check:
a.
[B]Procedures in the Operations Manual to retain and protect original FDR data where an accident or ase-
rious incident has taken place
b.
[B]The case of an ocial safety investigation is included in the condentiality procedure (refer to Principle 12).
Note 1:
In case of an accident or aserious incident, it is helpful to preserve all the FDM data of the
occurrence ight, since there can be more ight parameters recorded or the sampling rate may
be higher.
Note 2:
Because of numerous cases of non-preservation of ight recorder recordings following serious
incidents (resulting in recording overruns), it is advisable to have more specic provisions on
preservation of FDR and FDM recordings included in the Operations Manual. These provisions
should cover as aminimum the case of an accident or aserious incident.
Principle : integration of FDM with occurrence reporting
AMC ORO.AOC. Flight data monitoring– aeroplanes
“(g) Every crew member should be responsible to report events. Signicant risk-bearing incidents detected by
FDM should therefore normally be the subject of mandatory occurrence reporting by the crew. If this is not the
case then they should submit aretrospective report that should be included under the normal process for report-
ing and analysing hazards, incidents and accidents.”
Check:
a.
[B]Means of conrming if an FDM exceedence detection has been the subject of an internal occurrence
report (e.g. acrew safety report or air safety report) and vice versa.
b.
[B] Procedure for assessing internal occurrence reports using FDM data to help determine whether they
should be subject to mandatory reporting to the NAA.
i. How does the operator determine when analysis of FDM data is needed?
c. [B]Procedures for requesting an internal occurrence report if needed.
Note 1:
The principle stated in (g) should be applicable to all the internal reporting programmes of
the operator, and not just be limited to those occurrences for which reporting to the NAA is
mandatory.
Note 2:
Although not all FDM events will necessarily require an MOR to the NAA, it is up to the operator
to assess if an occurrence (detected through FDM, internal occurrence reporting or other
channels) needs to be reported to their NAA. Please note that the enforcement of retrospective
reports can potentially be counterproductive as it can impact upon the credibility and condence
in the FDM programme. Therefore due care needs to be taken. Direct crew contacts can often
yield even more useful information in atrusting environment versus forced crew reports in
anon-trusting environment.
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
19
Principle : data recovery
AMC ORO.AOC. Flight data monitoring– aeroplanes
“(h) The data recovery strategy should ensure asuciently representative capture of ight information to main-
tain an overview of operations. Data analysis should be performed suciently frequently to enable action to be
taken on signicant safety issues.”
Check:
a.
[B]Statement on recovery objectives and targets: what is the data collection rate (ights scanned versus
ights own; what is the delay between ight and analysis (in particular when the analysis is subcontract
-
ed), for example on one individual aircraft: when was the latest ight for this aircraft collected for FDM?
When was the latest ight for this aircraft scanned by FDM software?
i. Note: if the operator has an ATQP programme, is the relevant target for data collection being met?– see
section 2, ‘FDM programmes supporting an ATQP’.
b. [B]The operator has in place procedures for the timely download and analysis of data
c. [B]How does the operator determine arepresentative sample? (for example, proportion of aeet, of air-
craft at each base, ight destinations, etc. scanned by FDM).
i. In the cases of small % recovery, does the entire data sample get analysed?
d. [B] Method used to achieve timely processing and targets.
e. [B]What process (for example in the maintenance programme or the MEL) does the operator have to fol-
low-up on the serviceability of the FDM recorder?
f. [B]Recent FDM data- is there enough data? Is any one of the main airelds operated or any eet missing
in these?
Principle : data retention
AMC ORO.AOC. Flight data monitoring– aeroplanes
“(i) The data retention strategy should aim to provide the greatest safety benets practicable from the available
data. Afull dataset should be retained until the action and review processes are complete; thereafter, areduced
dataset relating to closed issues should be maintained for longer-term trend analysis. Programme managers
may wish to retain samples of de-identied full-ight data for various safety purposes (detailed analysis, train-
ing, benchmarking etc.).”
Check:
a. [B]Statement on data retention policy, including, if data eventually needs to be de-identied:
i.
Identication period (period during which the identication of individuals in the dataset is still possible
by authorised personnel);
ii. De-identication policy and timescales.
b. [B]Clear policy for FDM data retention in case of an occurrence subject to mandatory reporting to the na-
tional aviation authorities.
c.
[B]Dataset relating to closed issues or for retrospective analysis: How does the operator assure themselves
that they have enough information for trending over agiven eet, agiven aireld, agiven season etc., as
appropriate.
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
20
Principle : data protection
AMC ORO.AOC. Flight data monitoring– aeroplanes
“(j) The data access and security policy should restrict information access to authorised persons. When data
access is required for airworthiness and maintenance purposes, aprocedure should be in place to prevent dis-
closure of crew identity.”
Check:
a. [B]Access policy statement, including:
i. List of persons/posts with access, data views, their use of data;
ii. Procedure for secure Continued Airworthiness use of FDM data;
iii. Procedure for secure use of FDM data for training.
b. [B]In case where FDM is subcontracted, data access policy of the subcontractor.
Principle : condentiality procedure
AMC ORO.AOC. Flight data monitoring– aeroplanes
“(k) The procedure to prevent disclosure of crew identity should be written in adocument, which should be
signed by all parties (airline management, ight crew member representatives nominated either by the union or
the ight crew themselves). This procedure should, as aminimum, dene:
(1) the aim of the FDM programme;
(2) adata access and security policy that should restrict access to information to specically authorised persons
identied by their position;
(3) the method to obtain de-identied crew feedback on those occasions that require specic ight follow-up for
contextual information; where such crew contact is required the authorised person(s) need not necessarily be
the programme manager or safety manager, but could be athird party (broker) mutually acceptable to unions
or sta and management;
(4) the data retention policy and accountability including the measures taken to ensure the security of the data;
(5) the conditions under which advisory brieng or remedial training should take place; this should always be
carried out in aconstructive and non-punitive manner;
(6) the conditions under which the condentiality may be withdrawn for reasons of gross negligence or signi-
cant continuing safety concern;
(7) the participation of ight crew member representative(s) in the assessment of the data, the action and review
process and the consideration of recommendations; and
(8) the policy for publishing the ndings resulting from FDM.”
Check:
a. [B]There is awritten procedure addressing all the bullet points of AMC1 ORO.AOC.130(k), i.e. the ‘proce-
dure to prevent disclosure of crew identity’;
b.
[B]Does this written procedure cover all operations under the AOC? Are copies readily available to ight
crew members? Did the safety manager and ight crew representatives sign this procedure?
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
21
Principle : airborne equipment
AMC ORO.AOC. Flight data monitoring– aeroplanes
“(l) Airborne systems and equipment used to obtain FDM data should range from an already installed full quick
access recorder (QAR), in amodern aircraft with digital systems, to abasic crash-protected recorder in an older
or less sophisticated aircraft. The analysis potential of the reduced data set available in the latter case may reduce
the safety benets obtainable. The operator should ensure that FDM use does not adversely aect the servicea-
bility of equipment required for accident investigation.”
Check:
a.
[B]Procedure for the safe storage and handling of the recording media. Documentation needed for data
decoding (i.e. Data Frame Layout documentation7). Documentation on installation, test and maintenance
procedures for the FDM recorder.
b.
[B]Procedures to ensure serviceability of the FDR if it is used for FDM, in light of any additional wear on
FDR.
c.
[A]There is an entry for the FDM recorder (normally the QAR) in the Minimum Equipment List which is
compliant with CS-MMEL8, Item 31-31-3(Quick Access Recorder).Potential consequence of no activity: Air-
craft can be grounded if theFDM recorder is discovered to be unserviceable, without any lead time to
rectify the problem.
Note 1:
The checks proposed here are maintenance-related, therefore the NAA should incorporate them
into the appropriate audits.
Note 2:
According to the Certication Specications and Guidance Material for Master Minimum
Equipment List (CS-MMEL), the recommended QAR rectication interval is category C, meaning
that corrective action should be done within 10 days of the discovery of the defective QAR.
. FDM programmes supporting an ATQP
This section discusses aspects that need to be considered on FDM as part of an ATQP in context of the points out-
lined in AMC1 ORO.FC.A.245.
Principle A-: FDM as afeedback loop to the ATQP
AMC ORO.FC.A. Alternative training and qualication programme
“(a) Alternative training and qualication programme (ATQP) components
The ATQP should comprise the following:
(…)
(5) Afeedback loop for the purpose of curriculum validation and renement, and to ascertain that the pro-
gramme meets its prociency objectives.
(i) The feedback should be used as atool to validate that the curricula are implemented as specied by the ATQP;
this enables substantiation of the curriculum, and that prociency and training objectives have been met. The
feedback loop should include data from operations ight data monitoring, the advanced ight data monitoring
(FDM) programme and LOE/LOQE programmes.
7 Documentation that presents the necessary information to convert FDM binary data into parameters expressed in engineering units.
8 Annex to EASA ED Decision 2014/004/R
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
22
(…)
(7) (…)
(ii) (…)The purpose of an FDM or advanced FDM programme for ATQP is to enable the operator to:
(A) provide data to support the programme’s implementation and justify any changes to the ATQP;
(B) establish operational and training objectives based upon an analysis of the operational environment; and
(C) monitor the eectiveness of ight crew training and qualication. “
Check:
a.
Evidence that trends and safety ndings identied with the FDM programme are reected in the train-
ing programme. (Example of asafety issue highlighted by aseries of occurrence reports, either through
the mandatory reporting to the NAA or through the internal occurrence reporting system.). Timeframe
between identication of atrend or asafety nding and inclusion in the training programme where
applicable.
b.
Evidence that the FDM programme is used to support the understanding of operations (e.g. operational
practices and risks) and establish training objectives.
c.
Evidence that the results of changes to the training programme are, when applicable, followed up through
the FDM programme.
Principle A-: eective FDM programme before starting the ATQP
AMC ORO.FC.A. Alternative training and qualication programme
“(a) Alternative training and qualication programme (ATQP) components
The ATQP should comprise the following:
(…)
(7) Adata monitoring/analysis programme consisting of the following:
(i) Aight data monitoring (FDM) programme as described in AMC1 ORO.AOC.130. Data collection should reach
aminimum of 60 % of all relevant ights conducted by the operator before ATQP approval is granted. This pro-
portion may be increased as determined by the competent authority. “
Check:
a.
All the individual aircraft involved in the ATQP are included in the FDM programme, regardless of their
MCTOM
b.
The principles (note: in this document they are numbered 1 to 13 in part 1 of section II), as presented in
AMC1 ORO.AOC.130 are applied
c.
Data collection rate of the FDM programme is higher than the baseline determined by the competent au-
thority (at least 60%) when considering all ights of aircraft involved in the ATQP.
d. Are all routes and bases covered by the FDM programme?
Principle A-: advanced FDM programme for extending the ATQP
AMC ORO.FC.A. Alternative training and qualication programme
“(a) Alternative training and qualication programme (ATQP) components
The ATQP should comprise the following:
(…)
(7) Adata monitoring/analysis programme consisting of the following:
(i) …
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
23
(ii) An advanced FDM when an extension to the ATQP is requested: an advanced FDM programme is determined
by the level of integration with other safety initiatives implemented by the operator, such as the operator’s safety
management system. The programme should include both systematic evaluations of data from an FDM pro-
gramme and ight crew training events for the relevant crews. Data collection should reach aminimum of 80 %
of all relevant ights and training conducted by the operator. This proportion may be varied as determined by
the competent authority.”
Check:
a.
All the individual aircraft involved in the ATQP are included in the FDM programme, regardless of their
MCTOM
b. Data collection rate of the FDM programme is higher than the baseline value set by the NAA
c.
Means to ensure that the data collection rate can stay above the baseline value set by the NAA (at least
80%) and that the data is representative of all operations (e.g. do certain routes that are seldom own re-
quire better coverage, are data samples representative for any given route).
d.
Is there asystem in place to collect data from ight simulator training devices and/or feedback from train-
ing for use by the FDM programme? What is the process for using such data and determining what safety
areas need to be monitored through the FDM programme?
Principle A-: data gathering and exchange
AMC ORO.FC.A. Alternative training and qualication programme
“(a) Alternative training and qualication programme (ATQP) components
The ATQP should comprise the following:
(…)
(7) Adata monitoring/analysis programme consisting of the following:
(i) …
(ii)…
(iii) Data gathering: the data analysis should be made available to the person responsible for ATQP within the or-
ganisation. The data gathered should:
(A) include all eets that are planned to be operated under the ATQP;
(B) include all crews trained and qualied under the ATQP;
(C) be established during the implementation phase of ATQP; and
(D) continue throughout the life of the ATQP.”
Check:
a.
Procedures and means for atwo-way communication between the FDM team and the ATQP manager and
records thereof.
b.
Content and format of the information provided by the FDM team to the ATQP manager e.g. update re-
ports; feedback on specic ATQP items, identication of new emerging issues.
c. Can an example of communication between the FDM team and the ATQP manager be provided?
d.
Aircraft not subject to ORO.AOC.130 that are included in the ATQP programme: are they covered by the
(advanced– as discussed in the AMC) FDM programme?
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
24
“(iv) Data handling: the operator should establish aprocedure to ensure the condentiality of individual ight
crew members, as described by AMC1 ORO.AOC.130. “
Check:
a. If the FDM access policy addresses the access rights of the ATQP manager.
b. Procedure in case it was determined that aight crew member needs corrective training: refer to Princi-
ple 12
. FDM programmes for alleviating FDR operational checks
Principle B-: monitoring the quality of FDR parameters
AMC CAT.GEN.MPA.(b) Preservation, production and use of ight recorder recordings
“Whenever arecorder is required to be carried, the operator should:
perform an annual inspection of FDR recording and CVR recording, unless one or more of the following applies:
(1)...
(2) Where the following conditions are met, the FDR recording inspection is not needed:
(i) the aircraft ight data are collected in the frame of aight data monitoring (FDM) programme;
(ii) the data acquisition of mandatory ight parameters is the same for the FDR and for the recorder used for the
FDM programme;
(iii) the integrity of all mandatory ight parameters is veried by the FDM programme; and
(iv) the FDR is solid-state and is tted with an internal built-in-test equipment sucient to monitor reception and
recording of data.”
Check:
a.
Data acquisition of the FDM airborne equipment: is it the same as the data acquisition of the FDR, or does
it capture data from the same sources as the sources used for the mandatory ight parameters of the FDR?
b.
Procedures to monitor the integrity of ight parameters in the FDM programme. Do they cover all man-
datory FDR parameters and follow the guidance provided in GM1 CAT.GEN.MPA.195(b)? Is an inspection
report available?
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
25
III. Examples of FDM oversight in practice
A questionnaire was distributed to give an overview of current practice in FDM oversight. Five NAAs-MS respond-
ed and some good practice extracted from their replies is presented here.
. FDM and Management System
The oversight of FDM is not conducted in isolation, but in the frame of the oversight of the aircraft operator’s
Management System of which the FDM programme is acomponent.
Therefore all responders indicated that they did not conduct standalone FDM oversight audits.
. Before and between safety audits
In order to be able to assess how the FDM data is used and analysed by the aircraft operator, aNational Aviation
Authority of an EASA Member State (NAA-MS) may want to have access to the safety meetings where the FDM
events and trends are reviewed, or to get copies of the minutes of these meetings. Awareness of recent safety is-
sues at the aircraft operators and how they were solved should help making the audit questions more relevant
and focussed. Access to the Safety Manager is away to follow up on safety issues between safety audits.
One NAA-MS indicated that their methodology between ight safety audits is mainly to observe the operator’s
safety oversight in action, to ensure that there are suitable managers and processes, agood reporting culture
supported by FDM, adverse trends are addressed, and there is suitable feedback to pilots. The Inspector will at-
tend the operator’s safety meetings on asample basis, where occurrence reports and FDM matters are discussed.
He/she will also have regular meetings with the operator’s senior management where current issues will be dis-
cussed and he/she will have access to information from Inspectors who line y with the operator.The Inspector
will be on the circulation list for the regular FDM report circulated to management and for safety information
circulated to pilots. The Inspector will also attend operator training meetings on asample basis, where FDM and
occurrence reports should be used to determine training requirements, especially when the operator has set up
an ATQP.
Another NAA-MS mentioned monthly meetings between the Inspector and his/her assigned operators, during
which events including details of FDM data are discussed.
. Auditors
In most NAAs-MS, the Inspectors don’t have specic training on FDM. However it is recommended for an eec
-
tive FDM programme assessment that Inspectors receive at least basic training on FDM, and get when needed
the assistance of an FDM expert to prepare the audit.
Note:
In addition to the prerequisite requirements of an Inspector (such as ight operations and
management system), basic FDM training would typically include apresentation of relevant
implementing rules, AMC and GM, general explanations on how FDM events and FDM all-ight
measurements work, and an overview of other guidance material. Knowledge of FDM software
would also be benecial.
One NAA-MS indicated that they have safety management and ight safety specialists that can get involved if the
assigned Inspector asks for their support.
Another NAA-MS explained that their Inspectors have ight operations management or training experience,
hence they have been involved in operator FDM programmes. In addition an FDM course is included in the
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
26
Inspectors’ initial training. One Inspector has specialised in FDM and carries out visits to operators with the as-
signed Inspector on an irregular basis.
. The FDM questions
A number of NAAs-MS have developed aquestionnaire based on the points enumerated in AMC1 ORO.AOC.130.
It is advised not to limit the questions strictly to checking that policies and procedures are established. Asample
check of afew concrete examples related to the recent history of operation of the aircraft operator will help in
getting abetter assessment of if the aircraft operator is actually implementing the FDM programme in aproper
way, and integrating FDM data with other safety data sources. In any case, how advanced the questioning is can
depend on the maturity of the FDM programme: see Section II.
One NAA-MS indicated that the Inspector usually prepares alist of topics and questions for the ight safety au-
dit, varied depending on his/her observations and current issues with the specic aircraft operator and other
aircraft operators.
According to another NAA-MS, the FDM questions are customised to take into account the particular safety
objectives of the audited aircraft operator, the experience of the aircraft operator with FDM, the nature of oper-
ations (scheduled or unscheduled ight, day or night operation, short or long range, etc.), and the case where
an operator has implemented an ATQP (which must be supported by an FDM programme or an advanced FDM
programme).
Typically, copies of agreements with pilot representatives, policy documents covering FDM data handling, con-
dentiality agreements and procedures, evidence of acommunication channel from the FDM team to the pilots
and the management are also checked. The NAA-MS may also require copies of the meeting minutes or other
evidence that regular meetings were held covering FDM and safety issues (safety action group, safety review
group, etc.).
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
27
IV. The larger picture
. Integration of FDM oversight into operator’s Management
System
Because FDM aims at continuous improvement of the overall safety performance of an operator, it should be in-
tegrated in the operator’s Management System. Ideally, where multiple systems are utilized to identify hazards
and manage risk they should be integrated to maximize their combined eectiveness and reduce duplicated pro-
cesses for greater system eciency.
An FDM programme held remote from the Management System of an operator would result in substandard per-
formance and inhibit continuous improvement. Moreover, information from other Management System data
sources gives context to the ight data which will, in return, provide quantitative information to support analysis
that otherwise would be based on reports, which provide limited information. Occurrence reporting, mainte-
nance, ATC and ight planning are just afew of the areas that could benet.
In addition to the daily interactions between the FDM programme and the Management System, the aircraft op-
erator should have processes in place to ensure that the FDM programme remains ecient and reliable. This
includes:
´
performance indicators (e.g. time to detect events, time to process and analyse data, data recovery rate,
number/rate of events detected/analysed, etc.);
´
The follow-up of events detected by the ight data monitoring programme (level of safety, trends, imple-
mentation of corrective and preventive actions, etc.);
´
feedback on the eectiveness of the FDM programme (use/usefulness of the FDM data for the risk assess-
ment, level of understanding by the pilots/instructors of the FDM summaries or statistics);
´ Internal audits (compliance with procedures, capability to take into account new identied risks, etc.).
. Use of FDM data for training: how to assess it is appropriate?
When using FDM data for training:
´
The training should be focused at correcting asafety issue, which as aconsequence will reduce the cor-
responding FDM event rate. However it is undesirable to create atrend to “y the FDM prole” i.e. pilots
ying according to FDM events thresholds in contradiction with procedures and good airmanship. The
complete denition of an FDM event’s trigger logic does not need to be provided to trainees, and the
training content should highlight the actual risk and safety defences rather than FDM events generated
by the FDM programme.
´
“Raw” FDM data from an FDM programme are often not adequate on their own for use in atraining
programme. This is because FDM data may provide accurate information on what happened, but not
necessarily on why it happened. FDM data usually need to be complemented with occurrence reports or
other sources.
´
Sucient data analysis should have been carried out to identify the extent of the safety issue, i.e. the
eets aected, the population of pilots aected and their prole, the location and time where it is more
likely to occur, and any necessary contextual information. To be eective, additional training should be
directed to where it is needed.
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
28
. Preservation of FDM data in the case of asafety investigation
ICAO Annex 13 on Accident and Incident Investigations gives the authority’s investigator the entitlement to ac-
cess to all data and evidence that are relevant for the investigation. In Europe, these principles were transposed
to Regulation (EU) 996/2010. This Regulation applies, among others, to the ocial investigations of accidents
and serious incidents which have occurred in Europe, or where an EASA Member State is involved as State of the
Operator (see Article 3).
Article 11:
“2. Notwithstanding any condentiality obligations under the legal acts of the Union or national law, the inves-
tigator-in- charge shall in particular be entitled to:
…
(c) have immediate access to and control over the ight recorders, their contents and any other relevant
recordings;
…
(g) have free access to any relevant information or records held by the owner, (…), the operator or the manufac-
turer of the aircraft,...”
Article 13:
“3. Any person involved shall take all necessary steps to preserve documents, material and recordings in rela-
tion to the event…”
Article 15:
“1. The sta of the safety investigation authority in charge, or any other person called upon to participate in or
contribute to the safety investigation shall be bound by applicable rules of professional secrecy”
Subsequently, it is advised that the FDM data le pertaining to an accident or aserious incident is integrally pre-
served and made available on request by the ocial safety investigation authority.
Care should also be taken of the condentiality of the ocial safety investigation.
In addition, in the particular case where the ight data recorder (FDR) is used for the FDM programme, AMC1
ORO.AOC.130 indicates that:
“(f) Accident and incident data requirements specied in CAT.GEN.MPA.195 take precedence over the require-
ments of an FDM programme. In these cases the FDR data should be retained as part of the investigation data
and may fall outside the de-identication agreements. “
The principles enumerated here above should be reected in the FDM programme procedures and in any inter-
nal memorandum of understanding on FDM. The sta involved with the FDM programme should be aware of
these principles.
. Level of access to FDM programme data by an inspector
With FDM integrated with the Management System as stated in ORO.AOC.130, the NAA needs to be able to see
clear demonstrable evidence of proper process and specic examples to support this. For example, with regard
to safety risk management, the inspector may need to ask the operator to demonstrate how they control par-
ticular risks (as part of the operator’s safety risk management) and as such how FDM is used to support this.
In some cases it could be necessary for the operator to show via an example, how aparticular FDM indicator
works/is used to monitor certain risks and how incidents or trends are followed up and contextualised with oth-
er information.
The Inspector has the following provisions based on Commission Regulation (EU) No 965/2012:
Article 2
Denitions
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
29
For the purposes of this Regulation:
‘…
5. Personnel authorised by the competent authority to carry out certication and/or oversight tasks shall be empow-
ered to perform at least the following tasks:
(a) examine the records, data, procedures and any other material relevant to the execution of the certication and/
or oversight task;
(b) take copies of or extracts from such records, data, procedures and other material;
…’
In the operating rules, it states:
‘ORO.GEN.140 Access
(a) For the purpose of determining compliance with the relevant requirements of Regulation (EC) No 216/2008 and
its Implementing Rules, the operator shall grant access at any time to any facility, aircraft, document, records, data,
procedures or any other material relevant to its activity subject to certication, whether it is contracted or not, to
any person authorised by one of the following authorities:
(1) the competent authority dened in ORO.GEN.105;
….’
The above help support an ‘evidence-based’ approach in the audit. Of course due care needs to be taken when
exercising such privileges, with regard to the relevance of requesting to see certain information and the useful-
ness, if applicable, in gathering it. The NAA is not responsible foran operator’s management system. Note: Any
information needed for safety investigation needs to be sought through the proper channels and processes, rath-
er than on an ad-hoc basis.
If safety intelligence is collected to support oversight, it needs to be at amature level that has been formed as
aresult of aproper operator safety risk management system process, involving all relevant sources of data (not
just FDM, as this can lack context).
. Coordination with NAA safety promotion functions
As safety promotion can be an eective way to enhance safety, many NAAs have engaged in various safety
promotion initiatives with their aircraft operators. Such safety promotion initiatives may include FDM-related
matters
9
.
There should be amutual understanding of the respective missions and constraints of the safety oversight
function and the safety promotion function inside an NAA. Care should be taken not to adversely aect safety
promotion initiatives.
In practice:
´
Inspectors have to be informed of any safety promotion initiative run at their NAA covering FDM (such as
an FDM forum) in case someone contacts them concerning this topic;
´
Inspectors may also learn of the conclusions of safety promotion initiatives that are of interest for improv-
ing the oversight of FDM programmes. However any such information should usually be de-identied so
that they cannot be used against aparticular aircraft operator;
´
The NAA sta in charge of asafety promotion initiative encompassing FDM should have access to the
ndings related to FDM made by Inspectors, so that they can adjust the programme of the initiative ac-
cordingly. Alternatively, Inspectors may be invited to give ade-identied summary of ndings related to
FDM made during the last audit/inspection period at ameeting of the safety promotion initiative.
9 Refer to EAFDM’s ‘Guidance for National Aviation Authorities, Setting up anational Flight Data Monitoring forum’.
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
30
Annex – Examples of acceptable and
unacceptable situations
Note:
The below table is not proposed (and not suitable) as areadily applicable means of assessment.
It only outlines the concept of an NAA’s previous idea which was used, only in part, to help
rationalise responses to a‘one-o’ FDM audit questionnaire. Adetailed review of the FDM
aspects to check is oered in Section II.
FDM Principle Description of Acceptable Description of Unacceptable Safety Hazard
. For all FDM programmes
Principle Basic
requirement:
Full resourcing and management
drive behind system
Miserable resourcing and no
management commitment. FDM
is primarily used to monitor
and sanction ight crews. FDM
programme is not endorsed by the
accountable manager.
Ineective oversight and
management of hazards
Principle
Responsibilities:
Clear understanding of
responsibilities leading to full
implementation
Lack of acceptance of responsibility.
No actions taken and no concern.
Ineective management of hazards
due to failure to take responsibility.
Principle
Objectives:
Clear objectives and full process
Lack of clarity and hit and miss
processes
Ineective understanding and
control of risks.
Principle Analysis
Techniques:
Full understanding and use of
analysis- comprehensive events,
all ight measurements and
strong understanding and use of
statistical methods.
Minimal use of event data, weak
assessment of risks, lack of
monitoring of normal operation
and no statistical information used.
Ineective analysis leading to
failure to identify risks.
Principle Tools
for Analysis,
Assessment and
Process Control
Comprehensive tools set. Analysis,
assessment facilitation, quality and
process control tools
Minimal tools available. Lacking
exibility and ease of use. No de-
brief or assessment tools worthy
of note. Process control and quality
tools missing.
Poor quality data, interpretation
and assessment leading to
ineective analysis and failure to
identify risks.
Principle Safety
communication:
Proactive information and
education material, regular
publications with targeted
practical content based on recent
operational experience.
No evidence of any FDM
information being used to support
safety communication/promotion.
Failure to inform authorities or
other organisations of identied
risks.
Principle Ocial
safety investigation
requirements
Tight control and preservation of
data surrounding accidents/serious
incidents or when requested as
part of an ocial investigation.
Good procedures which are
understood and implemented
operationally.
The involved personnel are not
aware of their duty to preserve
ight data or they do not know
how to preserve ight data.
Determination of the causes of the
accident or serious incident was
impeded due to missing ight data.
Principle
Integration of FDM
with Occurrence
reporting
Close co-ordination and two
way cross fertilisation between
FDM and internal occurrence
reporting. Actions taken to
reconcile dierences and improve
understanding of individual and
group issues.
No cross checking between
FDM programme and internal
occurrence reporting systems.
Barrier between investigations or
cross feeds of insights.
Lack of understanding of
signicant incidents due failure to
correlate all data sources.
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
31
FDM Principle Description of Acceptable Description of Unacceptable Safety Hazard
Principle Data
recovery
Aiming for and achieving fully
representative data recovery and
condence in the quality of data.
Poor data recovery overall, with
no justication (except resources).
Segments of operation missed
completely. Fleets, bases, leased in
aircraft etc.
Failure to identify risks due to gaps
in programme coverage of entire
operation.
Principle Data
retention
Retaining the data for aperiod that
extracts the last safety benet.
Retention shows the recognition
of the need for retrospective
analysis and trending. Sensible de-
identication is implemented as
aroutine part of this process.
All data destroyed immediately
after running through FDM
program. Lack of understanding
of the benets of trending, big
picture, long term views of data.
Problems with de-identication of
data prior to assessment.
Inability to identify trends and
issues due to lack of data or over
cautious de-identication.
Principle Data
protection
Rigorous control of the access
rights of individuals/post holders.
Audit trail of access and actions.
Secure computer and data systems.
No control of data access or no one
is allowed access to data. Open
terminals with undened access
and no audit trail tracking.
Loss of control and condence
in the FDM process adversely
aecting overall safety culture.
Principle
Condentiality
procedure
Clear, practical document that
covers all the major aspects of
these principles. Signed up to by
all parties.
No document or one that does
not reect the practices found.
Alternatively processes scattered
around anumber of other
documents that are uncoordinated.
Lack of understanding, clarity of
purpose and buy-in to the FDM
process.
Principle
Airborne
Equipment
Proper provision of airborne
equipment that is t for purpose
and does not adversely aect other
aircraft systems. Procedures in
place to deal with faults, repairs
and MEL aspects.
Unapproved equipment. Use of
magnetic-tape FDRs.
Individual aircraft ying with an
inoperative FDM recorder for
along period (more than 10 days),
eectively escaping monitoring.
. FDM programmes supporting an ATQP
Principle A-: FDM
as afeedback loop
to the ATQP
FDM ndings or trends are
reected in the practical and/or
theoretical curricula of ight crew
members. Changes in the training
programme are monitored by the
FDM programme.
No FDM output is reected in the
training programme. The changes
to training that could be monitored
through FDM are not.
The training programme is out-of-
synch with the actual operational
risks and therefore ineective.
Principle A-:
eective FDM
programme before
starting the ATQP
Eective FDM programme (refer
to Principles 1 to 13) covering all
individual aircraft included in the
ATQP, all frequent routes own by
those aircraft.
The FDM programme in place is not
satisfactory.
Some aircraft included in the ATQP
are not monitored at all through
FDM. Some frequent routes
completely escape monitoring.
The FDM monitoring of the
ATQP eet has signicant gaps,
so that safety issues may remain
unchecked.
Principle A-:
advanced FDM
programme for
extending the ATQP
The FDM data collection rate
for the ATQP eet is at least the
baseline value. The data collection
rate for ight crew training events
conducted in the frame of the
ATQP is also higher than the
baseline value. Data from FDM is
systematically used in conjunction
with other sources to support
safety risk assessment.
Some aircraft included in the ATQP
are not monitored at all through
FDM. The data collection rate for
FDM and/or ight crew training
events is less than the baseline
value. Use of FDM outputs without
any context or no use of FDM data.
FDM data are not used together
with data from crew training
events.
Data coverage is insucient
to support an advanced FDM
programme. Integration with
training is insucient to support
early detection and end-to-end
management of safety issues.
Principle A-: data
gathering and
exchange
Complete, up-to-date and useful
results of the FDM programmeare
provided to the ATQP manager.
There is ecient two-way
communication between the FDM
team and the ATQP manager.
Information provided by the FDM
team to the ATQP is not complete
or too seldom, or already obsolete.
The FDM results are not usable
as such and no explanation was
provided.
The training programme is relying
on incomplete and/or obsolete
information, and therefore not
fully eective.
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
32
FDM Principle Description of Acceptable Description of Unacceptable Safety Hazard
. FDM programmes for alleviating FDR operational checks
B-: monitoring
the quality of FDR
parameters
The data source of mandatory ight
parameters is the same for FDR
and FDM. Acomplete inspection
of the quality of the mandatory
ight parameters is conducted at
time intervals specied in the AMC
for the FDR recording inspection
and following the related guidance
material, and is evidenced by
inspection reports.
There has been no inspection of
mandatory ight parameters, or
inspections are supercial and/or
incomplete. For several mandatory
ight parameters, the data source
is not the same as for the FDR.
FDR recording quality problems
remain undetected until an
accident or serious incident occurs.
Subsequently, circumstances and
causal factors remain unclear
because valid FDR data are missing.
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
33
Annex : Regulation and guidance
related to Flight data monitoring and
safety management
. ICAO Provisions
ICAO Annex to the Convention on International Civil Aviation, Operation of aircraft
Part I: International Commercial Air Transport– Aeroplanes (Amendment -A):
The Standards and Recommended Practices related to FDM for commercial air transport aeroplanes operators
are:
“3.3.1 Recommendation— An operator of an aeroplane of acerticated take-o mass in excess of 20000 kg should
establish and maintain aight data analysis programme as part of its safety management system.
3.3.2 An operator of an aeroplane of amaximum certicated take-o mass in excess of 27 000 kg shall establish
and maintain aight data analysis programme as part of its safety management system.
Note— An operator may contract the operation of aight data analysis programme to another party while retain-
ing overall responsibility for the maintenance of such aprogramme.
3.3.3 Aight data analysis programme shall be non-punitive and contain adequate safeguards to protect the
source(s) of the data.
Note 1.— Guidance on the establishment of ight data analysis programmes is included in the Manual on Flight
Data Analysis Programmes (FDAP) (Doc 10000).
Note 2.— Legal guidance for the protection of information from safety data collection and processing systems is con-
tained in Attachment Bto Annex 19.”
ICAO Annex to the Convention on International Civil Aviation, Operation of aircraft
Part III: International Operations– Helicopters (Amendment -A):
The Standards and Recommended Practices related to FDM for commercial helicopter operators are:
“1.3.1 Recommendation.— An operator of a helicopter of acertified take-off mass in excess of 7 000
kg or having a passenger seating configuration of more than 9 and fitted with a flight data recorder
should establish and maintain aight data analysis programme as part of its safety management system.
Note.— An operator may contract the operation of aight data analysis programme to another party while retain-
ing overall responsibility for the maintenance of such aprogramme.
1.3.2 Aight data analysis programme shall be non-punitive and contain adequate safeguards to protect the
source(s) of the data.
Note 1.— Guidance on the establishment of ight data analysis programmes is included in the Manual on Flight
Data Analysis Programmes (FDAP) (Doc 10000).
Note 2.— Legal guidance for the protection of information from safety data collection and processing systems is con-
tained in Attachment Bto Annex 19.”
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
34
Flight Data Analysis Programme Manual
ICAO Document 10 000 (Flight Data Analysis Programme Manual) provides an overview of the components of
aFDM programme, its prerequisite and how to implement it. It also provides description of the relationship be-
tween an aircraft operator’s Management System and its FDM programme.
. European regulation and guidance material
Flight data monitoring programmes for large commercial air transport aeroplanes
Paragraph ORO.AOC.130 of Commission Regulation (EU) 965/2012, Annex III (Part ORO), contains the require-
ment on commercial air transport operators that for aeroplanes with an MCTOM of over 27 000 kg, aight data
monitoring programme is established.
An acceptable means of compliance is provided by paragraph AMC1 ORO.AOC.130 of EASA ED Decision
2012/017/R
In addition, more detailed guidance material on FDM programmes has been introduced into GM1 ORO.AOC.130
of the same ED Decision. GM 2 ORO.AOC.130 refers to UK CAA CAP 739 for additional guidance.
Flight data monitoring for supporting an ATQP
Requirements for getting approval for an alternative training and qualication programme (ATQP) are laid down
in Commission Regulation (EU) 965/2012, Annex III (Part ORO), paragraph ORO.FC.A.245. An acceptable means
of compliance is provided by EASA ED Decision 2012/017/R, AMC1 ORO.FC.A.245. This acceptable means of com-
pliance includes the provision of aFDM programme or an advanced FDM programme.
Flight data monitoring for alleviating FDR operational check
Annex IV to Commission Regulation (EU) 965/2012 (Part CAT), contains arequirement on operators to perform
operational checks to maintain the serviceability of ight recorders: see paragraph CAT.GEN.MPA.195. An ac-
ceptable means of compliance is provided by EASA ED Decision 2012/018/R, AMC1 CAT.GEN.MPA.195 (b). This
acceptable means of compliance includes an alleviation of the annual FDR recording inspection, when, among
other conditions, an FDM programme is in place.
Flight data monitoring for commercial helicopter o-shore operations
Comments Response Document to Notice of Proposed Amendment 2013-10 on helicopter o-shore operations
(published on 06 June 2013) contains draft provisions on FDM programmes.
Note:
The draft rules proposed by aNotice of Proposed Amendment are subject to changes after the
public consultation or by the European legislator. The provisions presented below are not nal.
For the most recent development on this rulemaking project, please consult EASA website.
EAFDM – Good practice on the oversight of FDM programmes
Version 1, January 2015, republished April 2017
35
Annex : Safety Culture and Just Culture
According to the Safety Culture Framework developed by the ECAST SMS Working Group
10
:
“Safety Culture is the set of enduring values and attitudes regarding safety issues, shared by every member of
every level of an organization. Safety Culture refers to the extent to which every individual and every group of
the organization is aware of the risks and unknown hazards induced by its activities; is continuously behaving so
as to preserve and enhance safety; is willing and able to adapt itself when facing safety issues; is willing to com-
municate safety issues; and consistently evaluates safety related behaviour.”
Also according to this document:
“Just Culture is clearly an element of [a Safety Culture framework] (in the Justness Characteristic or component).
Throughout the literature on Safety Culture it is quite obvious that Justness is indeed an indispensable compo-
nent of Safety Culture.”
Commission Regulation (EU) No 691/2010 denes
11
just culture as:
“‘a culture in which front line operators or others are not punished for actions, omissions or decisions taken by
them that are commensurate with their experience and training, but where gross negligence, wilful violations
and destructive acts are not tolerated;”
An important part of agood just culture depends on how an organization overseessafety reports which may
contain information about potentially unsafe/risky actions, either directly or indirectlytaken by its employees.
Thesemay be the result of slips, common mistakes, technical failures or can even be related to systematic train-
ing issues. When reviewing such occurrences, consideration should be given as to whether the person’s actions
were reasonable. It could be that the actions taken were the same as what another competent person may have
reasonably taken in asimilar situation. Part of this is ensuring that the right level of expertise is available to help
understand the context and situation surrounding what occurred. Employees at all levels should be encouraged
to report any occurrences or issues that may aect safety and be open to learning from these.
A safety culture and ajust culture should be fostered. However in the rare cases, in which gross negligence, wil-
ful violations or destructive acts are apparent, such acts/behaviour should not be tolerated.Through following
of clear and proper procedures, anyone involved in cases of possible gross negligence will receive fair treatment
and proportionate remedial action to prevent areoccurrence.
10 Available on ESSI/ECAST website: http://easa.europa.eu/essi/ecast/.
11 Commission Regulation (EU) 691/2010 of 29 July 2010 laying down aperformance scheme for air navigation services and network functions and
amending Regulation (EC) 2096/2005
European Aviation Safety Agency
Postal address
Postfach 10 12 53
D-50452 Cologne,
Germany
Visiting address
Konrad-Adenauer-Ufer 3
D-50668 Cologne, Germany
Tel. +49 221 8999 000
Fax + 49 221 8999 099
Mail info@easa.europa.eu
Web www.easa.europa.eu
An Agency of the European Union
