Easy Access Rules for Air Operations

ED Decision 2025/010/R

DIFFERENT OPERATING PROCEDURES FOR NON-COMMERCIAL OPERATIONS

Aeroplanes and helicopters are referred to here as ‘aircraft’.

When developing operating procedures for non-commercial operations that are different from the ones used for its CAT operations, the AOC holder should identify the hazards and assess and mitigate the risks associated with each specific non-commercial operation, as part of the safety risk management process in compliance with ORO.GEN.200.

This process should consider at least the following elements:

(a)Flight profile (including manoeuvres to be performed, any simulated abnormal situations in flight, duties and responsibilities of the crew members);

(b)Continuing airworthiness, as applicable. This includes the case when the aircraft is returned to the AOC holder after having been used by another operator for operations in accordance with ORO.GEN.310;

(c)Levels of functional equipment and systems (MEL, CDL);

(d)Operating procedures, minima, and dispatch criteria;

(e)Operating a flight with a double purpose (e.g. a relocation flight used as a line training flight or a maintenance check flight used as a line training flight);

(f)Specific approvals held by the AOC holder;

(g)Flight and duty time limitations and rest requirements and cumulative fatigue;

(h)Selection, composition, and training of flight crew and cabin crew;

(i)Multi-pilot operation as per Part-CAT vs single-pilot operation when operating according to Part-NCC or Part-NCO;

(j)Flights performed with aircrew that includes aircrew members of another operator, who have not completed a familiarisation training and who may not be familiar with the AOC holder’s operational procedures;

(k)Categories of passengers on board, including when non-commercial operations are performed with no cabin crew.

ED Decision 2025/010/R

PLANNING FLIGHTS WITH AN INCREASED LEVEL OF RISK

(a)Significant aspects such as the ones below should be addressed in the risk assessment and risk mitigation process by any operator conducting such flights:

(1)which pilots are involved in their operation;

(2)what is the purpose of the flight; and

(3)how it is to be accomplished — what flight procedures are to be applied.

(b)The AOC holder should prepare the non-commercial operations with an increased level of risk taking into consideration the following elements, as applicable:

(1)pre-flight briefing;

(2)duties and responsibilities of the flight crew members involved, task sharing;

(3)special operating procedures;

(4)manoeuvres to be performed in flight, minimum and maximum speeds and altitudes for all portions of the flight;

(5)operational limitations;

(6)potential risks and contingency plans;

(7)adequate available airspace and coordination with the air traffic control (ATC);

(8)selection of flight crew members; and

(9)additional flight crew training at regular intervals to ensure recency (considering also a flight of a similar risk profile in the simulator, if needed).

ED Decision 2025/010/R

EXAMPLES OF DIFFERENT OPERATING PROCEDURES APPLIED TO NON-COMMERCIAL OPERATIONS

The provisions of ORO.AOC.125 enable an AOC holder to apply the most appropriate requirements when conducting non-commercial operations, based on the risk assessment and risk mitigation processes.

Below is a non-exhaustive list of elements that an AOC holder may identify and describe as being different in its non-commercial operations from those used for its CAT operation and for which the provisions of Part-ORO and Part-NCC or the provisions of Part-NCO should apply as appropriate:

(a)Qualification, training and experience of aircrew members, including aerodrome and route competence requirements.

(b)Flight crew and cabin crew composition requirements

(1)CAT operations contain more stringent requirements for aircrew members, e.g. multi-pilot vs single-pilot requirements.

(2)The AOC holder should specify the minimum number of flight crew and cabin crew and the applicable aircrew composition.

(c)Fuel requirements

(d)Performance requirements

(e)Serviceable instruments, data and equipment and MEL considerations

(f)Non-ETOPS/ETOPS

ETOPS are applicable to CAT operations only and thus a flight operated according to Part-NCC/Part-NCO may be performed without the ETOPS restrictions.

(g)Non-commercial flights with no cabin crew (see ORO.CC.100(d) and the associated AMC).

Regulation (EU) 2015/1329

(a)The operator shall establish and maintain a flight data monitoring programme, which shall be integrated in its management system, for aeroplanes with a maximum certificated take-off mass of more than 27 000 kg.

(b)The flight data monitoring programme shall be non-punitive and contain adequate safeguards to protect the source(s) of the data.

ED Decision 2025/020/R

FLIGHT DATA MONITORING (FDM) PROGRAMME

(a)The safety manager, as defined under AMC1 ORO.GEN.200(a)(1), should be responsible for the identification and assessment of issues and their transmission to the manager(s) responsible for the process(es) concerned. The latter should be responsible for taking appropriate and practicable safety action within a reasonable period of time that reflects the severity of the issue.

(b)An FDM programme should allow an operator to:

(1)identify areas of operational risk and quantify current safety margins;

(2)identify and quantify operational risks by highlighting occurrences of non-standard, unusual or unsafe circumstances;

(3)use the FDM information on the frequency of such occurrences, combined with an estimation of the level of severity, to assess the safety risks and to determine which may become unacceptable if the discovered trend continues;

(4)put in place appropriate procedures for remedial action once an unacceptable risk, either actually present or predicted by trending, has been identified; and

(5)confirm the effectiveness of any remedial action by continued monitoring.

(c)FDM analysis techniques should comprise the following:

(1)Exceedance detection: searching for deviations from aircraft flight manual limits and standard operating procedures. A set of core events should be selected to cover the main areas of interest to the operator and as much as possible, the most significant risks identified by the operator. The event definitions should be continuously reviewed to reflect the operator’s current operating procedures.

(2)All flights measurement: a system defining what is normal practice. This may be accomplished by retaining various snapshots of information from each flight.

(3)Statistics — a series of data collected to support the analysis process: this technique should include the number of flights flown per aircraft and sector details sufficient to generate rate and trend information.

(d)FDM analysis, assessment and process control tools: the effective assessment of information obtained from digital flight data should be dependent on the provision of appropriate information technology tool sets.

(e)Education and publication: sharing safety information should be a fundamental principle of aviation safety in helping to reduce accident rates. The operator should pass on the lessons learnt to all relevant personnel and, where appropriate, industry.

(f)Accident and incident data requirements specified in CAT.GEN.MPA.195 take precedence over the requirements of an FDM programme. In these cases the FDR data should be retained as part of the investigation data and may fall outside the de-identification agreements.

(g)Every crew member should be responsible for reporting events. Significant risk-bearing incidents detected by FDM should therefore normally be the subject of mandatory occurrence reporting by the crew. If this is not the case, then they should submit a retrospective report that should be included under the normal process for reporting and analysing hazards, incidents and accidents.

(h)The data recovery strategy should ensure a sufficiently representative capture of flight information to maintain an overview of operations. Data analysis should be performed sufficiently frequently to enable action to be taken on significant safety issues.

(i)The data retention strategy should aim at providing the greatest safety benefits practicable from the available data. A full dataset should be retained until the action and review processes are complete; thereafter, a reduced dataset relating to closed issues should be maintained for longer-term trend analysis. Programme managers may wish to retain samples of de-identified full-flight data for various safety purposes (detailed analysis, training, benchmarking, etc.).

(j)The data access and security policy should restrict information access to authorised persons. When data access is required for airworthiness and maintenance purposes, a procedure should be in place to prevent disclosure of crew identity.

(k)The procedure to prevent disclosure of crew identity should be written in a document, which should be signed by all parties (airline management, flight crew member representatives nominated either by the union or the flight crew themselves). This procedure should, as a minimum, define:

(1)the aim of the FDM programme;

(2)a data access and security policy that should restrict access to information to specifically authorised persons identified by their position;

(3)the method to obtain de-identified crew feedback on those occasions that require specific flight follow-up for contextual information; where such crew contact is required the authorised person(s) need not necessarily be the programme manager or safety manager, but could be a third party (broker) mutually acceptable to unions or staff and management;

(4)the data retention policy and accountability, including the measures taken to ensure the security of the data;

(5)the conditions under which advisory briefing or remedial training should take place; this should always be carried out in a constructive and non-punitive manner;

(6)the conditions under which the confidentiality may be withdrawn for reasons of gross negligence or significant continuing safety concern;

(7)the participation of flight crew member representative(s) in the assessment of the data, the action and review process and the consideration of recommendations; and

(8)the policy for publishing the findings resulting from FDM.

(l)Airborne systems and equipment used to obtain FDM data should range from a quick access recorder (QAR) in an aircraft with digital systems, to a crash-protected flight recorder in an older or less sophisticated aircraft. The analysis potential of the reduced data set available in the latter case may reduce the safety benefits obtainable. The operator should ensure that FDM use does not adversely affect the serviceability of equipment required for accident investigation.

[applicable until 31 December 2027 — ED Decision 2021/005/R]

AMC1 ORO.AOC.130 Flight data monitoring — aeroplanes

ORGANISATION OF THE FLIGHT DATA MONITORING (FDM) PROGRAMME

(a)Safety manager’s responsibilities: the safety manager, as defined under AMC1 ORO.GEN.200(a)(1), should be responsible for the identification and assessment of issues and their transmission to the manager(s) responsible for the process(es) concerned. The latter should be responsible for taking appropriate and practicable safety action.

(b)Contribution to the management system: an FDM programme should support the identification and evaluation of safety hazards and the management of their associated risks, as required by point ORO.GEN.200, by allowing the operator to:

(1)identify areas of operational risk and quantify current safety margins;

(2)identify and quantify operational risks by highlighting occurrences of non-standard, unusual or unsafe circumstances;

(3)estimate the frequency of such occurrences, assess the safety risks and determine which risks are unacceptable or may become unacceptable if the discovered trend continues;

(4)inform the definitions of remedial actions with accurate and current safety data; and

(5)confirm the effectiveness of any remedial action by continued monitoring.

(c)FDM analysis techniques: FDM analysis techniques should comprise the following:

(1)Exceedance detection (‘FDM event’): searching for deviations from aircraft flight manual limits and standard operating procedures.

(2)All flights measurement (‘FDM measurement’): a system defining what is normal practice. This may be accomplished by retaining various snapshots of information from each flight.

(3)Statistics — a series of data collected to support the analysis process: FDM-based statistics should include distributions and rate and trend information where the number of flights flown is sufficient to reliably generate such information.

(d)FDM analysis, assessment and process control tools: the assessment of information obtained from flight data should be supported by the provision of appropriate information technology capabilities. These capabilities should include specialised software (‘FDM software’) or a specialised service (‘FDM service’) to process the flight data. In addition, to facilitate linking flight data with occurrence reports and other data, such as traffic data and weather data, these capabilities should include:

(1)the automatic identification of individual flights in the data files collected for FDM; and

(2)if the necessary data is collected, the provision of the following information for each detected FDM event:

(i)the aircraft’s geographical position and altitude,

(ii)coordinated universal time (UTC) date and time,

(iii)information that identifies the flight, and

(iv)aircraft registration.

(e)Safety information and promotion: FDM programme output should be used, in compliance with the procedure specified in point (k), to support the sharing of safety information with flight crew members and all other relevant personnel. For this purpose, the operator should provide, upon request by its competent authority, documentation on the principles it follows to ensure the adequate quality of FDM events, FDM measurements and FDM-based statistics used for safety information sharing. It should also demonstrate that FDM-based safety information provided to individual flight crew members is clear and relevant.

(f)Accident and incident data requirements: requirements regarding the preservation of flight recorder recordings after accidents and serious incidents specified in CAT.GEN.MPA.195 take precedence over the requirements of an FDM programme.

(g)Incident reporting: significant risk-bearing incidents detected by FDM should be the subject of reporting by the crew. If this is not the case, then they should submit a retrospective report that should be included under the normal process for reporting and analysing hazards, incidents and accidents, in accordance with Regulation (EU) No 376/2014.

(h)Data recovery and validation: the data recovery and validation strategy should ensure a sufficiently representative capture of flight information to maintain an overview of operations and that data is recovered from all aeroplanes that are within the scope of point ORO.AOC.130. In addition, the validation of FDM events and measurements should be performed sufficiently frequently to enable action to be taken on significant safety issues. Data recovery and validation should incorporate all the points below.

(1)To ensure that a sufficiently representative subset of flights is monitored by the FDM programme, the number of flights available for processing by the FDM programme and that contain valid data should amount to:

(i)at least 60 % of the total number of flights performed in the past 12 months by aeroplanes that are within the scope of point ORO.AOC.130, if the operator operates fewer than 20 such aircraft; or

(ii)at least 80 % of the total number of flights performed in the past 12 months by aeroplanes that are within the scope of point ORO.AOC.130, if the operator operates 20 or more such aircraft.

This condition is not applicable to aeroplanes that performed fewer than 50 flights in the previous 12 months.

(2)To limit the maximum duration during which no flight data may be received from an individual aeroplane, the operator should:

(i)have means and procedures to identify a failure of the means to collect data from any individual aeroplane that is within the scope of point ORO.AOC.130 either within 22 calendar days after the failure occurs or before 10 more flights are performed after the failure occurs; and

(ii)correct any failure of the means to collect data from any individual aeroplane that is within the scope of point ORO.AOC.130 within 120 days of being made aware of the failure.

(3)To ensure that significant FDM events (FDM events that correspond to the most significant deviations from the SOPs and circumstances potentially affecting the airworthiness of the aircraft) can be identified without unnecessary delays, the flights for which flight data is collected within the FDM programme (hereafter called ‘collected flights’) should be processed in a timely manner. At least 80 % of the collected flights that were performed in the previous 12 months should have been processed by the FDM software either within 22 calendar days after completion of the collected flight or before 10 flights following the collected flight were performed by the same aircraft.

(4)For each aeroplane that is within the scope of point ORO.AOC.130 and that is first issued with an individual certificate of airworthiness (CofA) on or after 1 January 2029:

(i)the operator should ensure that, within 90 calendar days after it starts operating the aeroplane, the data collected for processing by the FDM software include all the flight parameters required to be recorded by a flight data recorder in accordance with AMC1.2 CAT.IDE.A.190; and

(ii)the operator should verify, within 90 calendar days after it starts operating the aeroplane, that the flight parameters specified in point (i) meet the performance specifications (range, sampling intervals, accuracy limits and resolution in
read-out) as defined in EUROCAE Document 112A or any later equivalent standard produced by EUROCAE — this verification may be based on the documentation provided by the aircraft manufacturer or the installer of the airborne systems used to collect the flight data.

(5)The operator should explain, upon request by its competent authority, the principles it uses for validating an FDM event, that is, how it determines whether an FDM event genuinely reflects a deviation that is considered abnormal for the flight in which the FDM event was triggered.

(6)The operator should validate significant FDM events as a matter of priority. At least 80 % of significant FDM events should be validated within 15 calendar days after their first detection by the FDM software.

(i)Data retention strategy: the data retention strategy should aim at providing the greatest safety benefits practicable from the available data. For this purpose:

(1)All raw or decoded flight data should be retained at least until valid significant FDM events have been analysed. In addition, 80 % or more of the raw or decoded flight data files of aircraft required to be part of the FDM programme should remain available for processing with the FDM software for at least 2 years; however, retaining a lower proportion of these flight data files is acceptable until 2 years after installing new FDM software or until 2 years after the start of a contract with a new FDM service provider.

(2)A dataset relating to de-identified analyses of significant FDM events should be maintained for a time that is consistent with the operator’s record-keeping for management-system-related activities (refer to point ORO.GEN.220).

(3)The data retention strategy should include measures to ensure the security of stored data.

(j)Data access and security policy: the data access and security policy should restrict information access to authorised persons. This policy should specifically address the case of a data access request for airworthiness or maintenance purposes.

(k)Procedure to prevent disclosure of crew identity: the procedure to prevent disclosure of crew identity should be written in a document, which should be signed by all parties (airline management, flight crew member representatives nominated either by the union or the flight crew themselves). This procedure should, as a minimum, define:

(1)the aim of the FDM programme;

(2)a data access and security policy that should restrict access to information to specifically authorised persons identified by their position (refer to point (j));

(3)the method to obtain de-identified crew feedback on those occasions that require specific flight follow-up for contextual information; where such crew contact is required the authorised person(s) need not necessarily be the programme manager or safety manager, but could be a third party (broker) mutually acceptable to unions or staff and management;

(4)a data retention strategy (refer to point (i)) and data accountability;

(5)the conditions under which advisory briefing or remedial training should take place; this should always be carried out in a constructive and non-punitive manner;

(6)the conditions under which the identity of a crew member may be disclosed, which should be consistent with the provisions laid down in Regulation (EU) No 376/2014 and the operator’s safety risk management procedures;

(7)the participation of flight crew member representative(s) in the assessment of the data, the action and review process and the consideration of recommendations; and

(8)the policy for sharing safety information based on FDM (refer to point (e)).

(l)Access to information on flight parameters and FDM algorithms: the operator should have unhindered access to information on the flight parameters and the algorithms used to produce FDM events and measurements. For aircraft required to be part of the FDM programme and first issued with an individual CofA on or after 1 January 2029, the operator should, within 90 calendar days after it starts operating these aircraft, be able to provide the following documentation upon request by its competent authority:

(1)documentation of the data source and the performance (at least the recording resolution and recording rate) of all the flight parameters collected and used by the FDM software to produce FDM events and measurements;

(2)documentation on the algorithms used to produce FDM events or FDM measurements, which should include the following:

(i)a description of the logic of each algorithm, which should be sufficiently detailed to verify consistency with the applicable flight manual limitations or standard operating procedures, as applicable; in the case of an FDM event algorithm, the event trigger conditions and the trigger threshold values should be specified;

(ii)for each algorithm, the list of flight parameters needed by the algorithm.

(m)Airborne systems and equipment: for all aircraft required to be part of the FDM programme and that are first issued with an individual CofA on or after 1 January 2029, airborne systems and equipment used to obtain flight data should continuously collect the data throughout the flight, including when the aircraft is moving on the ground under its own power. The use of such airborne systems and equipment, including retrieval of data from the aircraft, should not affect the availability or the serviceability of flight recorders required for accident investigation.

[applicable from 1 January 2028 — ED Decision 2025/020/R]

ED Decision 2025/020/R

SCOPE OF THE FLIGHT DATA MONITORING (FDM) PROGRAMME

(a)A set of core FDM events or FDM measurements should be selected to cover, as far as possible, the most significant risks identified by the operator. The definitions of FDM events and FDM measurements in this core set should be designed to help identify deviations from the standard operating procedures that are beyond what is considered normal practice and not only occurrences that require reporting to the competent authority or unscheduled continued airworthiness activity. The definitions of FDM events and FDM measurements in this core set should be continuously reviewed to reflect the operator’s current operating procedures and any newly identified safety risks.

(b)For all aeroplanes that are within the scope of point ORO.AOC.130 and first issued with an individual certificate of airworthiness (CofA) on or after 1 January 2016, the FDM programme should monitor, to the extent possible with the available flight data and without requiring overly complex algorithms, precursors of the following key risk areas:

(1)risk of runway excursion during take-off or landing,

(2)risk of airborne collision,

(3)risk of aircraft upset, and

(4)risk of collision with terrain.

(c)If the necessary flight parameters are collected by the airborne systems used to obtain flight data, the FDM programme should monitor:

(1)exceedances indicating that the airworthiness of the aircraft may be affected and that are related to any of the following parameters:

(i)speed and configuration;

(ii)altitude;

(iii)accelerations;

(iv)attitude angles;

(v)engine limitations (e.g. those related to thrust parameters, exhaust gas temperature, vibration levels and reverse thrust versus aircraft speed);

(vi)aircraft weight; and

(2)caution and warning alerts to the flight crew, indicating that the airworthiness of the aircraft may be affected.

(d)Upon request by its competent authority, the operator should provide documentation identifying which types of occurrences are monitored with the FDM programme. This documentation should cover at least the occurrences subject to mandatory reporting and listed in Section 1 (excluding paragraph 1.5, point (3)) and Section 5 of Annex I to Commission Implementing Regulation (EU) 2015/1018. This documentation should include a short description of the applicable FDM event(s) or FDM measurement(s) for each type of occurrence monitored by the FDM programme.

[applicable from 1 January 2028 — ED Decision 2025/020/R]

ED Decision 2025/020/R

IMPLEMENTATION OF AN FDM PROGRAMME

Flight data monitoring is defined in Annex I to this Regulation. It should be noted that the requirement to establish a FDM programme is applicable to all individual aircraft in the scope of ORO.AOC.130, not to a subset selected by the operator.

(a)FDM analysis techniques

(1)Exceedance detection

(i)FDM programmes are used for detecting exceedances, such as deviations from flight manual limits, standard operating procedures (SOPs), or good airmanship. Typically, a set of core events establishes the main areas of interest that are based on a prior assessment of the most significant risks by the operator. In addition, it is advisable to consider the following risks: risk of runway excursion or abnormal runway contact at take-off or landing, risk of loss of control in flight, risk of airborne collision, and risk of collision with terrain.

Examples: low or high lift-off rotation rate, stall warning, ground proximity warning system (GPWS) warning, flap limit speed exceedance, fast approach, high or low on glideslope, heavy landing.

(ii)Trigger logic expressions may be simple exceedances such as redline values. The majority, however, are composites that define a certain flight mode, aircraft configuration or payload-related condition. Analysis software can also assign different sets of rules dependent on airport or geography. For example, noise sensitive airports may use higher than normal glideslopes on approach paths over populated areas. In addition, it might be valuable to define several levels of exceedance severity (such as low, medium and high).

(iii)Exceedance detection provides useful information, which can complement that provided in crew reports.

Examples: reduced flap landing, emergency descent, engine failure, rejected take-off, go-around, airborne collision avoidance system (ACAS) or GPWS warning, and system malfunctions.

(iv)The operator may also modify the standard set of core events to account for unique situations they regularly experience, or the SOPs they use.

Example: to avoid nuisance exceedance reports from a non-standard instrument departure.

(v)The operator may also define new events to address specific problem areas.

Example: restrictions on the use of certain flap settings to increase component life.

(2)All-flights measurements

FDM data are retained from all flights, not just the ones producing significant events. A selection of parameters is retained that is sufficient to characterise each flight and allow a comparative analysis of a wide range of operational variability. Emerging trends and tendencies may be identified and monitored before the trigger levels associated with exceedances are reached.

Examples of parameters monitored: take-off weight, flap setting, temperature, rotation and lift-off speeds versus scheduled speeds, maximum pitch rate and attitude during rotation, and gear retraction speeds, heights and times.

Examples of comparative analyses: pitch rates from high versus low take-off weights, good versus bad weather approaches, and touchdowns on short versus long runways.

(3)Statistics

Series of data are collected to support the analysis process: these usually include the numbers of flights flown per aircraft and sector details sufficient to generate rate and trend information.

(4)Investigation of incidents flight data

Recorded flight data provide valuable information for follow-up to incidents and other technical reports. They are useful in adding to the impressions and information recalled by the flight crew. They also provide an accurate indication of system status and performance, which may help in determining cause and effect relationships.

Examples of incidents where recorded data could be useful:

—high cockpit workload conditions as corroborated by such indicators as late descent, late localizer and/or glideslope interception, late landing configuration;

—unstabilised and rushed approaches, glide path excursions, etc.;

—exceedances of prescribed operating limitations (such as flap limit speeds, engine overtemperatures); and

—wake vortex encounters, turbulence encounters or other vertical accelerations.

It should be noted that recorded flight data have limitations, e.g. not all the information displayed to the flight crew is recorded, the source of recorded data may be different from the source used by a flight instrument, the sampling rate or the recording resolution of a parameter may be insufficient to capture accurate information.

(5)Continuing airworthiness

Data of all-flight measurements and exceedance detections can be utilised to assist the continuing airworthiness function. For example, engine-monitoring programmes look at measures of engine performance to determine operating efficiency and predict impending failures.

Examples of continuing airworthiness uses: engine thrust level and airframe drag measurements, avionics and other system performance monitoring, flying control performance, and brake and landing gear usage.

(b)FDM equipment

(1)General

FDM programmes generally involve systems that capture flight data, transform the data into an appropriate format for analysis, and generate reports and visualisation to assist in assessing the data. Typically, the following equipment capabilities are needed for effective FDM programmes:

(i)an on-board device to capture and record data on a wide range of in-flight parameters;

(ii)a means to transfer the data recorded on board the aircraft to a ground-based processing station;

(iii)a ground-based computer system to analyse the data, identify deviations from expected performance, generate reports to assist in interpreting the read-outs, etc.; and

(iv)optional software for a flight animation capability to integrate all data, presenting them as a simulation of in-flight conditions, thereby facilitating visualisation of actual events.

(2)Airborne equipment

(i)The flight parameters and recording capacity required for flight data recorders (FDR) to support accident investigations may be insufficient to support an effective FDM programme. Other technical solutions are available, including the following:

(A)Quick access recorders (QARs). QARs are installed in the aircraft and record flight data onto a low-cost removable medium.

(B)Some systems automatically download the recorded information via secure wireless systems when the aircraft is in the vicinity of the gate. There are also systems that enable the recorded data to be analysed on board while the aircraft is airborne.

(ii)Fleet composition, route structure and cost considerations will determine the most cost-effective method of removing the data from the aircraft.

(3)Ground replay and analysis equipment

(i)Data are downloaded from the aircraft recording device into a ground-based processing station, where the data are held securely to protect this sensitive information.

(ii)FDM programmes generate large amounts of data requiring specialised analysis software.

(iii)The analysis software checks the downloaded flight data for abnormalities.

(iv)The analysis software may include: annotated data trace displays, engineering unit listings, visualisation for the most significant incidents, access to interpretative material, links to other safety information and statistical presentations.

(c)FDM in practice

(1)FDM process

Typically, operators follow a closed-loop process in applying an FDM programme, for example:

(i)Establish a baseline: initially, operators establish a baseline of operational parameters against which changes can be detected and measured.

Examples: rate of unstable approaches or hard landings.

(ii)Highlight unusual or unsafe circumstances: the user determines when non-standard, unusual or basically unsafe circumstances occur; by comparing them to the baseline margins of safety, the changes can be quantified.

Example: increases in unstable approaches (or other unsafe events) at particular locations.

(iii)Identify unsafe trends: based on the frequency and severity of occurrence, trends are identified. Combined with an estimation of the level of severity, the risks are assessed to determine which may become unacceptable if the trend continues.

Example: a new procedure has resulted in high rates of descent that are nearly triggering GPWS warnings.

(iv)Mitigate risks: once an unacceptable risk has been identified, appropriate risk mitigation actions are decided on and implemented.

Example: having found high rates of descent, the SOPs are changed to improve aircraft control for optimum/maximum rates of descent.

(v)Monitor effectiveness: once a remedial action has been put in place, its effectiveness is monitored, confirming that it has reduced the identified risk and that the risk has not been transferred elsewhere.

Example: confirm that other safety measures at the aerodrome with high rates of descent do not change for the worse after changes in approach procedures.

(2)Analysis and follow-up

(i)FDM data are typically compiled every month or at shorter intervals. The data are then reviewed to identify specific exceedances and emerging undesirable trends and to disseminate the information to flight crews.

(ii)If deficiencies in pilot handling technique are evident, the information is usually de-identified in order to protect the identity of the flight crew. The information on specific exceedances is passed to a person (safety manager, agreed flight crew representative, honest broker) assigned by the operator for confidential discussion with the pilot. The person assigned by the operator provides the necessary contact with the pilot in order to clarify the circumstances, obtain feedback and give advice and recommendations for appropriate action. Such appropriate action could include re-training for the pilot (carried out in a constructive and non-punitive way), revisions to manuals, changes to ATC and airport operating procedures.

(iii)Follow-up monitoring enables the effectiveness of any corrective actions to be assessed. Flight crew feedback is essential for the identification and resolution of safety problems and could be collected through interviews, for example by asking the following:

(A)Are the desired results being achieved soon enough?

(B)Have the problems really been corrected, or just relocated to another part of the system?

(C)Have new problems been introduced?

(iv)All events are usually archived in a database. The database is used to sort, validate and display the data in easy-to-understand management reports. Over time, this archived data can provide a picture of emerging trends and hazards that would otherwise go unnoticed.

(v)Lessons learnt from the FDM programme may warrant inclusion in the operator’s safety promotion programmes. Safety promotion media may include newsletters, flight safety magazines, highlighting examples in training and simulator exercises, periodic reports to industry and the competent authority. Care is required, however, to ensure that any information acquired through FDM is de-identified before using it in any training or promotional initiative.

(vi)All successes and failures are recorded, comparing planned programme objectives with expected results. This provides a basis for review of the FDM programme and the foundation for future programme development.

(d)Preconditions for an effective FDM programme

(1)Protection of FDM data

The integrity of FDM programmes rests upon protection of the FDM data. Any disclosure for purposes other than safety management can compromise the voluntary provision of safety data, thereby compromising flight safety.

(2)Essential trust

The trust established between management and flight crew is the foundation for a successful FDM programme. This trust can be facilitated by:

(i)early participation of the flight crew representatives in the design, implementation and operation of the FDM programme;

(ii)a formal agreement between management and flight crew, identifying the procedures for the use and protection of data; and

(iii)data security, optimised by:

(A)adhering to the agreement;

(B)the operator strictly limiting data access to selected individuals;

(C)maintaining tight control to ensure that identifying data is kept securely; and

(D)ensuring that operational problems are promptly addressed by management.

(3)Requisite safety culture

Indicators of an effective safety culture typically include:

(i)top management’s demonstrated commitment to promoting a proactive safety culture;

(ii)a non-punitive operator policy that covers the FDM programme;

(iii)FDM programme management by dedicated staff under the authority of the safety manager, with a high degree of specialisation and logistical support;

(iv)involvement of persons with appropriate expertise when identifying and assessing the risks (for example, pilots experienced on the aircraft type being analysed);

(v)monitoring fleet trends aggregated from numerous operations, not focusing only on specific events;

(vi)a well-structured system to protect the confidentiality of the data; and

(vii)an efficient communication system for disseminating hazard information (and subsequent risk assessments) internally and to other organisations to permit timely safety action.

(e)Implementing an FDM programme

(1)General considerations

(i)Typically, the following steps are necessary to implement an FDM programme:

(A)implementation of a formal agreement between management and flight crew;

(B)establishment and verification of operational and security procedures;

(C)installation of equipment;

(D)selection and training of dedicated and experienced staff to operate the programme; and

(E)commencement of data analysis and validation.

(ii)An operator with no FDM experience may need a year to achieve an operational FDM programme. Another year may be necessary before any safety and cost benefits appear. Improvements in the analysis software, or the use of outside specialist service providers, may shorten these time frames.

(2)Aims and objectives of an FDM programme

(i)As with any project there is a need to define the direction and objectives of the work. A phased approach is recommended so that the foundations are in place for possible subsequent expansion into other areas. Using a building block approach will allow expansion, diversification and evolution through experience.

Example: with a modular system, begin by looking at basic safety-related issues only. Add engine health monitoring, etc. in the second phase. Ensure compatibility with other systems.

(ii)A staged set of objectives starting from the first week’s replay and moving through early production reports into regular routine analysis will contribute to a sense of achievement as milestones are met.

Examples of short-term, medium-term and long-term goals:

(A)Short-term goals:

—establish data download procedures, test replay software and identify aircraft defects;

—validate and investigate exceedance data; and

—establish a user-acceptable routine report format to highlight individual exceedances and facilitate the acquisition of relevant statistics.

(B)Medium-term goals:

—produce an annual report — include key performance indicators;

—add other modules to the analysis (e.g. continuing airworthiness); and

—plan for the next fleet to be added to programme.

(C)Long-term goals:

—network FDM information across all of the operator’s safety information systems;

—ensure FDM provision for any proposed alternative training and qualification programme (ATQP); and

—use utilisation and condition monitoring to reduce spares holdings.

(iii)Initially, focusing on a few known areas of interest will help prove the system’s effectiveness. In contrast to an undisciplined ‘scatter-gun’ approach, a focused approach is more likely to gain early success.

Examples: rushed approaches, or rough runways at particular aerodromes. Analysis of such known problem areas may generate useful information for the analysis of other areas.

(3)The FDM team

(i)Experience has shown that the ‘team’ necessary to run an FDM programme could vary in size from one person for a small fleet, to a dedicated section for large fleets. The descriptions below identify various functions to be fulfilled, not all of which need a dedicated position.

(A)Team leader: it is essential that the team leader earns the trust and full support of both management and flight crew. The team leader acts independently of others in line management to make recommendations that will be seen by all to have a high level of integrity and impartiality. The individual requires good analytical, presentation and management skills.

(B)Flight operations interpreter: this person is usually a current pilot (or perhaps a recently retired senior captain or instructor), who knows the operator’s route network and aircraft. This team member’s in-depth knowledge of SOPs, aircraft handling characteristics, aerodromes and routes is used to place the FDM data in a credible context.

(C)Technical interpreter: this person interprets FDM data with respect to the technical aspects of the aircraft operation and is familiar with the power plant, structures and systems departments’ requirements for information and any other engineering monitoring programmes in use by the operator.

(D)Gate-keeper: this person provides the link between the fleet or training managers and flight crew involved in events highlighted by FDM. The position requires good people skills and a positive attitude towards safety education. The person is typically a representative of the flight crew association or an ‘honest broker’ and is the only person permitted to connect the identifying data with the event. It is essential that this person earns the trust of both management and flight crew.

(E)Engineering technical support: this person is usually an avionics specialist, involved in the supervision of mandatory serviceability requirements for FDR systems. This team member is knowledgeable about FDM and the associated systems needed to run the programme.

(F)Replay operative and administrator: this person is responsible for the day-to-day running of the system, producing reports and analysis.

(ii)All FDM team members need appropriate training or experience for their respective area of data analysis. Each team member is allocated a realistic amount of time to regularly spend on FDM tasks.

GM1 ORO.AOC.130 Flight data monitoring — aeroplanes

IMPLEMENTATION OF A FLIGHT DATA MONITORING (FDM) PROGRAMME

‘Flight data monitoring’ (FDM) is defined in Annex I to this Regulation. It should be noted that the requirement to establish a FDM programme is applicable to all individual aircraft in the scope of ORO.AOC.130, not to a subset selected by the operator.

(a)FDM analysis techniques

(1)Exceedance detection / FDM event

(i)FDM programmes are used for detecting what are known as ‘FDM events’, such as deviations from flight manual limits, standard operating procedures (SOPs), or good airmanship. It is advisable to monitor deviations from the SOPs in all phases of the flight, including when the aircraft is on the ground.

Examples of FDM events for aeroplanes: low or high lift-off rotation rate, fast approach, high or low on glideslope.

(ii)Trigger conditions of FDM event algorithms may be as simple as detecting that a ‘redline value’ was exceeded. The majority, however, are composites that define a certain flight mode, aircraft configuration or payload-related condition. In addition, it might be valuable to define several levels of FDM event severity (such as low, medium and high severity). While such severity levels can help identify significant FDM events and relevant trends, they should not be considered safety risk levels; assessing the safety risk level associated with an occurrence or a trend usually requires a more thorough assessment and consideration of all the relevant data available to the operator.

Example of composite trigger conditions for aeroplanes: conditions dependent on airport or geography — for example, the instrument-landing-system-based guidance of noise-sensitive airports may use higher-than-normal glideslopes over densely populated areas.

Examples of significant (high-severity) FDM events for aeroplanes: stall warning, terrain awareness warning system ‘PULL UP’ warning.

Example illustrating the difference between FDM event severity level and safety risk level: an FDM event algorithm detects a longer-than-normal landing-threshold-to-touchdown horizontal distance. The analysis of an occurrence detected with this algorithm may conclude that the level of safety risk associated with this occurrence was low, for instance because the landing distance available was significantly greater than the computed landing distance and the runway friction coefficient was high (dry runway) at the time of landing. For the same landing-threshold-to-touchdown horizontal distance and the same runway, the analysis could conclude that the level of safety risk was high due to a reduced landing distance available on the day (e.g. construction works on the runway) and because the runway friction coefficient was low (contaminated runway) at the time of landing.

(iii)FDM events provide useful information, which can complement that provided in crew reports.

Examples for aeroplanes: reduced flap landing, emergency descent, engine failure, rejected take-off, go-around, airborne collision avoidance system (ACAS) or GPWS warning, and system malfunctions.

(iv)The operator may also modify the standard set of core FDM events to account for unique situations they regularly experience, or the SOPs they use.

Example for aeroplanes: to avoid nuisance FDM events from a unique approach procedure.

(v)The operator may also define new FDM events to address specific problem areas.

Example for aeroplanes: an FDM event measuring the flap extension rate to monitor the reliability of the flap system on a given aircraft model.

(vi)Being able to easily adjust the variables of FDM event algorithms can be advantageous, as it allows an FDM event definition to be adapted to new operational conditions.

(vii)The choice of appropriate trigger conditions and severity level threshold values for all FDM events is very important for an effective FDM programme. In particular, it is important that the trigger conditions of an FDM event algorithm are set so that it detects not only the most severe deviations (which are subject to mandatory occurrence reporting or require unscheduled inspection or maintenance) but also deviations that are beyond normal piloting practice. This is important for the effective and timely detection of outliers and unsafe trends. It is advisable to document how trigger conditions and severity level threshold values are determined.

(2)All-flights measurements / FDM measurements

FDM data are retained from all flights, not just the ones producing FDM events. A selection of parameters is retained that is sufficient to characterise each flight and allow a comparative analysis of a wide range of operational variability. The distributions of flight parameter values, which can typically be produced with FDM measurements, may contain a wealth of information on common piloting practices and outliers. By analysing such distributions, emerging trends and tendencies may be identified and monitored before the trigger conditions associated with an FDM event are reached.

Examples of parameters monitored for aeroplanes: take-off weight, flap setting, temperature, rotation and lift-off speeds versus scheduled speeds, maximum pitch rate and attitude during rotation, and gear retraction speeds, heights and times.

Examples of comparative analyses for aeroplanes: pitch rates from high versus low take-off weights, good versus bad weather approaches, and touchdowns on short versus long runways.

(3)Statistics Series of data are collected to support the analysis process: these usually include the numbers of flights flown per aircraft and sector details sufficient to generate rate and trend information.

(4)Investigation of incidents flight data by the operator

Recorded flight data provides valuable information for follow-up to incidents and other technical reports. It is useful in adding to the impressions and information recalled by the flight crew. It also provides an accurate indication of system status and performance, which may help in determining cause and effect relationships.

Examples of incidents where recorded data could be useful:

—unstabilised and rushed approaches, glide path excursions, etc.;

—exceeding prescribed operating limitations (such as flap limit speeds, engine overtemperatures); and

—wake vortex encounters, turbulence encounters or other events causing significant vertical accelerations.

It should be noted that recorded flight data have limitations, e.g. not all the information displayed to the flight crew is recorded, the source of recorded data may be different from the source used by a flight instrument, the sampling rate or the recording resolution of a parameter may be insufficient to capture accurate information.

(5)Continuing airworthiness

Data of FDM measurements and FDM events can be utilised to assist the continuing airworthiness function. For example, engine-monitoring programmes look at measures of engine performance to determine operating efficiency and predict impending failures.

Examples of continuing airworthiness uses for aeroplanes: engine thrust level and airframe drag measurements, avionics and other system performance monitoring, flying control performance, and brake and landing gear usage.

(b)FDM equipment, FDM software and FDM service

(1)General

FDM programmes generally involve systems that capture flight data, transform the data into an appropriate format for analysis, and generate reports and visualisation to assist in assessing the data. Typically, the following are needed for effective FDM programmes:

(i)an on-board device to capture and record data on a wide range of in-flight parameters;

(ii)means to transfer the data recorded on board the aircraft to a secure repository where it can be processed and analysed; and

(iii)software or a service to process and analyse the data, identify deviations from expected performance, generate reports to assist in interpreting the read-outs, etc.

(2)Airborne equipment

(i)Several technical solutions are available, including the following:

(A)Some systems are installed in the aircraft and record flight data onto a removable medium.

(B)Some systems automatically transmit the recorded data via secure wireless systems after completion of the flight.

(C)Some systems preprocess the recorded data to be analysed while the aircraft is airborne. Whatever the flight data processing performed by such systems, a complete set of raw flight data still needs to be recovered after the flight, as this is needed for in-depth analysis by the FDM team.

(3)FDM software or service

(i)Processing and analysing flight data require specialised FDM software or a specialised FDM service.

(ii)The FDM software or service typically converts the raw flight data into flight parameters expressed in engineering units and textual interpretation (‘flight parameter decoding’) and applies FDM algorithms to the flight parameters (refer to points (a)(1) and (a)(2)).

(iii)The FDM software or service typically includes the capability to produce parameter plots and parameter tables, the capability to drill down and visualise flight parameter values for the portion of the flight during which an event was detected, access to interpretative material, links to other safety information and statistical presentations.

(iv)For the FDM software or service, the following additional capabilities are advantageous.

(A)In the case of FDM software, the capability to program FDM algorithms, and the capability to interface with advanced processing tools or to access advanced functions libraries beyond those offered as part of the FDM software.

(B)The capability to link flight data with other data sources (e.g. occurrence reports or weather data) to facilitate the analysis of events and trends. This capability should be used in accordance with data protection policies and procedures, and its output should be restricted to authorised users.

(C)The capability to export outputs (e.g. FDM event and measurement data) in a standard electronic format that is compatible with business intelligence tools.

(D)The capability to export outputs in formats compatible with geographical information systems.

(E)The capability to replay flight data in a flight animation, thereby facilitating visual reconstruction of an occurrence.

(F)The capability to design and provide individual FDM summary reports or dashboards that can be confidentially consulted by flight crew members. It is more safety-relevant that such reports focus on compliance with the SOPs and aircraft flight manual limits rather than on comparing the performance of an individual pilot with that of their peers.

(G)The capability to export the information related to flight parameter decoding into a file format that:

(a)complies with an electronic documentation standard that has a general public licence policy; and

(b)includes means to retain the history of changes to the decoding information.

An example of an applicable standard is ARINC specification 647A (Flight Recorder Electronic Documentation).

(H)In the case of FDM software, the capability to generate documentation on the flight parameters that are used to produce FDM events and measurements, and the capability to generate documentation describing the logic of the algorithms used to produce FDM events and measurements, and for which type of reportable occurrences these algorithms are relevant.

(v)In case of a change of FDM software or FDM service provider, it is advisable to keep the previous FDM software or service operative for several months to ensure business continuity and validate the outputs of the new FDM software or service.

(c)FDM in practice

(1)FDM process

Typically, operators follow a closed-loop process in applying an FDM programme, for example:

(i)Establish a baseline: initially, operators establish a baseline of operational parameters against which changes can be detected and measured. They also determine ranges of flight parameter values that correspond to normal operations, which facilitates the determination of the appropriate trigger conditions for an FDM event definition.

Examples for aeroplanes: rate of unstable approaches or hard landings.

(ii)Highlight unusual or potentially unsafe circumstances: the user determines when non-standard, unusual or potentially unsafe circumstances occur; by comparing them with the baseline margins of safety, the changes can be quantified.

Example for aeroplanes: increases in unstable approaches (or other unsafe events) at particular locations.

(iii)Identify potentially unsafe trends: based on the frequency and severity of FDM events, trends are identified. If a trend shows a significant increase in the frequency and/or severity of FDM events, a safety risk assessment may be necessary, as part of the operator safety risk management. More guidance on the identification of trends can be consulted in the European Operators Flight Data Monitoring forum (EOFDM) document Flight Data Monitoring — Analysis techniques and principles.

Example for aeroplanes: a new procedure has resulted in high rates of descent that are nearly triggering GPWS warnings.

(iv)Monitor the effectiveness of corrective actions, if the FDM programme is relevant for that purpose: once a remedial action has been put in place in the framework of the operator’s safety risk management, its effectiveness is monitored, confirming that it has reduced the identified risk and that the risk has not been transferred elsewhere. At this stage, the operator typically evaluates whether the FDM programme can contribute to this monitoring.

Example for aeroplanes: confirm that other safety measures at the aerodrome with high rates of descent do not change for the worse after changes in approach procedures.

(v)Adapt the FDM programme to monitor new risks stemming from operational changes.

Example for aeroplanes: significant changes to the area of operation or business model.

(2)Analysis and follow-up

(i)FDM data is typically processed at short intervals. The data is then reviewed to identify and validate specific FDM events and emerging undesirable trends. Validating an FDM event means determining whether it corresponds to a genuine and abnormal event. It does not include analysing the possible causes or consequences of the event or assessing its safety risks.

(ii)If deviations from the SOPs are detected, motivating an analysis of the causes and circumstances, the information about these deviations is passed (in accordance with point (k) of AMC1 ORO.AOC.130) on to the person responsible for flight crew contact. The decision to initiate flight crew contact (e.g. notification, request for additional information or confidential discussion) should be made after an initial assessment that takes contextual information into account. If a confidential discussion with the flight crew is deemed necessary, the responsible person provides the necessary contact with the pilot in order to clarify the circumstances and obtain feedback for a more thorough safety assessment.

(iii)All FDM events are usually archived in such a way that they can be sorted, validated and presented in easy-to-understand management reports. Over time, this archived data can provide a picture of emerging trends and hazards that would otherwise go unnoticed. In addition, the FDM team may wish to retain samples of de-identified full-flight data for various safety purposes (detailed analysis, training, benchmarking, etc.).

(iv)Sharing safety information is necessary to maintain a competent workforce and support an effective management system (refer to point ORO.GEN.200). Therefore, lessons learnt from the FDM programme may warrant inclusion in the operator’s safety promotion programmes. Safety promotion media may include newsletters, flight safety magazines, emails, video recordings and information on the company’s intranet, highlighting examples in training and simulator exercises. Care is required, however, to ensure that any information acquired through FDM is de-identified before using it in any training or promotional initiative. In addition, it is recommended to not provide individual flight crew members with personalised access to FDM-based information (e.g. individual FDM summary reports or the possibility of replaying one’s flight) without support from an FDM specialist on how to use these systems and correctly interpret the information provided. The safety manager is normally responsible for the transmission of FDM-based information (refer to AMC1 ORO.AOC.130), which includes defining processes to ensure that such information is validated, clear and relevant to the recipient and provided in accordance with the procedure to prevent disclosure of crew identity.

(v)All successes and failures are recorded, comparing planned programme objectives with expected results. This provides a basis for review of the FDM programme and the foundation for future programme development.

(d)Preconditions for an effective FDM programme

(1)Protection of FDM data and related crew reports

The integrity of FDM programmes rests upon protection of the FDM data. Any disclosure for purposes other than safety management can compromise the voluntary provision of safety data, thereby compromising flight safety. It is also advisable to consider Regulation (EU) 2016/679 (General Data Protection Regulation), where applicable. In addition, the inherent protection of reporters and of persons mentioned in occurrence reports under Regulation (EU) No 376/2014 applies to flight crew members, whether their reports are voluntarily provided or retrospectively requested by the operator after an FDM event. Note that, after an official safety investigation of an accident or serious incident is initiated, the data recorded on a crash-protected flight data recorder should be preserved as part of the investigation data (point CAT.GEN.MPA.195).

(2)Essential trust

The trust established between management and flight crew is the foundation for a successful FDM programme. This trust can be facilitated by:

(i)early participation of the flight crew representatives in the design, implementation and operation of the FDM programme;

(ii)a formal agreement between management and flight crew, identifying the procedures for the use and protection of data; and

(iii)data security, optimised by:

(A)adhering to the agreement;

(B)the operator strictly limiting data access to selected individuals;

(C)maintaining tight control to ensure that identifying data is kept securely; and

(D)ensuring that operational problems are promptly addressed by management.

(3)Requisite safety culture

Indicators of a positive safety culture within an FDM programme typically include:

(i)top management’s demonstrated commitment to promoting a positive safety culture;

(ii)a non-punitive operator policy that covers the FDM programme;

(iii)FDM programme management by dedicated staff under the authority of the safety manager, with a high degree of specialisation and logistical support;

(iv)involvement of persons with appropriate expertise when assessing FDM events, FDM measurements and trends (refer to point (e)(3));

(v)monitoring fleet trends aggregated from numerous operations, not focusing only on specific events;

(vi)a well-structured system to protect the confidentiality of the data; and

(vii)communicating relevant information on the general trends identified by and lessons learnt from the FDM programme in the communications on safety matters specified in AMC1 ORO.GEN.200(a)(4).

(4)Integration with the operator’s management system

Point ORO.AOC.130 requires the integration of the FDM programme with the operator’s management system. Because of this, FDM programme outputs are expected to be used together with other relevant data sources to support safety risk management (SRM). The SRM process is not an internal process within the FDM programme but part of the operator’s management system. AMC1 ORO.AOC.130 specifies that the safety manager should be responsible for identifying and assessing issues, which are the first steps of the SRM process. The European Operators Flight Data Monitoring Forum document Breaking the Silos details industry good practices regarding integration of the FDM programme in the management system.

(5)Complete access to flight parameter decoding information

(i)The flight parameter decoding information is the information sufficient for extracting flight parameter values from the recorded data files and decoding them into values expressed in engineering units or textual interpretation. This information, which is usually provided by the installer of the airborne systems used to collect the flight data, is essential for programming the FDM software to decode the flight parameters.

(ii)Therefore, it is recommended that complete access to the flight parameter decoding information is obtained at the time of aircraft delivery and that unhindered access is maintained. To facilitate the management of this information, it is recommended that it is consigned in documentation that complies with an electronic documentation standard and has a general public licence policy. In addition, it is advisable to have a versioning system that allows quick identification of the applicable documentation for any individual aircraft and any time period. Such documentation could be fully or partially generated by the FDM software if the software has this capability.

(iii)When the airborne equipment used for FDM purposes records a copy of the flight data recorder data stream, the flight data recorder decoding documentation that must be retained in accordance with point CAT.GEN.MPA.195 could be used.

(6)Objectives to ensure a good overview of operations

Internal objectives regarding the proportion of collected flights, the time from performing the flight to processing its data with the FDM software or the time to detect that no flight data is being collected any more from an individual aeroplane are important to ensure a good overview of operations. It is advisable to set targets that are ambitious enough for this purpose.

Examples of internal targets:

(i)collect data from at least 90 % of the total number of flights performed in the past 12 months by aeroplanes that are within the scope of point ORO.AOC.130;

(ii)identify within 10 calendar days a failure of the means to collect data from any individual aeroplane that is within the scope of point ORO.AOC.130;

(iii)process the data of at least 90 % of the collected flights that were performed in the past 12 months within 10 calendar days of the flights’ completion.

(e)Implementing an FDM programme

(1)General considerations

(i)Typically, the following steps are necessary to implement an FDM programme:

(A)implementation of a formal agreement between management and flight crew;

(B)establishment and verification of operational and security procedures;

(C)installation of equipment;

(D)selection and training of dedicated and experienced staff to operate the programme; and

(E)commencement of data analysis and validation.

(ii)An operator with no FDM experience may need a year to achieve an operational FDM programme. Another year may be necessary before any safety and cost benefits appear. Improvements in the analysis software, or the use of outside specialist service providers, may shorten these time frames.

(2)Aims and objectives of an FDM programme

(i)As with any project there is a need to define the direction and objectives of the work. A phased approach is recommended so that the foundations are in place for possible subsequent expansion into other areas. Using a building block approach will allow expansion, diversification and evolution through experience.

Example: with a modular system, begin by looking at basic safety-related issues only.

(ii)A staged set of objectives starting from the first week’s replay and moving through early production reports into regular routine analysis will contribute to a sense of achievement as milestones are met.

Examples of short-term, medium-term and long-term goals:

(A)Short-term goals:

—establish an FDM team (refer to point (e)(3) below);

—establish data download procedures and test FDM software;

—verify for all aircraft in the FDM programme that the flight parameters used for FDM events and measurements are valid and correctly decoded — GM1 CAT.GEN.MPA.195(b) contains guidance on evaluating the validity of flight parameters;

—verify that the flight parameter decoding information (see point (d)) is complete and correct;

—design and/or adapt FDM algorithms and test them, and validate and investigate FDM events — for an FDM event algorithm, this includes verifying that the event trigger conditions and the severity level threshold values take into account any applicable aircraft flight manual limit, the SOPs and the distribution of values collected from all operations; and

—establish a user-acceptable routine report format to highlight individual FDM events and facilitate the acquisition of relevant statistics.

(B)Medium-term goals:

—ensure that the FDM programme meets the minimum data recovery and validation objectives and the data retention objectives;

—produce reports and dashboards that include key performance indicators in accordance with an established schedule and at a frequency that is sufficient for the proactive handling of safety risks;

—add other modules to the analysis (e.g. continuing airworthiness); and

—plan for the next fleet to be added to the FDM programme.

(C)Long-term goals:

—network FDM information across all of the operator’s safety information systems; and

—ensure FDM provision for any proposed alternative training and qualification programme (ATQP).

(iii)Initially, focusing on a few known areas of interest will help prove the system’s effectiveness. In contrast to an undisciplined ‘scatter-gun’ approach, a focused approach is more likely to gain early success.

Examples for aeroplanes: rushed approaches, or rough runways at particular aerodromes. Analysis of such known problem areas may generate useful information for the analysis of other areas.

(3)The FDM team

(i)Experience has shown that the ‘team’ necessary to run an FDM programme could vary in size from one person for a small fleet, to a dedicated section for large fleets. The descriptions below identify various functions to be fulfilled, not all of which need a dedicated position. As the safety manager should be responsible for the FDM programme, and FDM outputs should, as much as possible, be analysed in relation to other safety data sources, the FDM team leader is expected to be part of the safety manager’s team.

(A)Team leader: it is essential that the team leader earns the trust and full support of both management and flight crew. The individual requires good analytical, presentation and management skills.

(B)Flight operations interpreter: this person is usually a qualified pilot (or perhaps a recently retired senior captain or instructor), who knows the operator’s route network and aircraft. This team member’s in-depth knowledge of SOPs, aircraft handling characteristics, aerodromes and routes is used to place the FDM data in a credible context.

(C)Technical interpreter: this person interprets FDM data with respect to the technical aspects of the aircraft operation and is familiar with the information required by the departments in charge of power plant, structures and systems and with any other engineering monitoring programmes in use by the operator.

(D)Gatekeeper: this person provides the link between the fleet or training managers and flight crew involved in events highlighted by FDM. The position requires good people skills and a positive attitude towards safety education. The person is typically a representative of the flight crew association or an ‘honest broker’ and is the only person permitted to connect the identifying data with the event. It is essential that this person earns the trust of both management and flight crew.

(E)Engineering technical support: this person is usually an avionics specialist. This team member is knowledgeable about FDM and the associated systems needed to run the programme.

(F)FDM analyst: this person is responsible for the design and validation of FDM algorithms and the analysis of FDM outputs. This usually requires at least basic knowledge of statistics; basic programming skills; detailed knowledge of FDM data flows from the data collection on board the aircraft to the production of FDM-based indicators and dashboards; and in-depth knowledge of the FDM software or service. If the processing of data or the validation of FDM events is subcontracted to a service provider, the FDM analyst should have the necessary skills to effectively control and direct the work performed by that service provider.

(G)FDM administrator: this person is responsible for the day-to-day recovery and processing of the flight data by the FDM software.

(ii)All FDM team members need appropriate training or experience for their respective area of data analysis. Each team member is allocated a realistic amount of time to regularly spend on FDM tasks.

(f)Other uses of flight data

It is recommended to establish a written procedure to prevent the disclosure of crew identity whenever access to flight data or flight data-based information is requested to meet operational needs, such as fuel use optimisation, aircraft performance and preventive maintenance. As a minimum, it is advisable that such a procedure contains:

(1)the aim of the programme in which flight data or flight data-based information is to be used;

(2)clear data access and security principles regarding access to flight data and flight-data-based information by staff members and service providers;

(3)data and information retention principles; and

(4)the method to obtain de-identified flight crew feedback on those occasions that require specific flight follow-up for contextual information.

In case a service provider is granted frequent access to flight data, a non-disclosure agreement is also advisable.

(g)The FDM programme and large data exchange programmes

Some States and organisations have set up so-called large data exchange programmes, in which very large amounts of data (including FDM data) provided by many operators and by other industry stakeholders are gathered, centrally processed and analysed. Participation in a large data exchange programme may offer an operator various benefits, such as the ability to compare its safety performance with that of comparable operators or access to other types of data (weather, traffic, etc.) or to advanced data integration capabilities. In addition, if an operator with a small fleet produces small amounts of flight data that do not allow reliable trend identification, joining a large data exchange programme may help to overcome this limitation. However, taking part in a large data exchange programme does not in itself satisfy point ORO.AOC.130, and every operator remains responsible for implementing its FDM programme. In addition, the FDM programme needs to be well integrated into the operator’s management system for it to benefit from a large data exchange programme.

[applicable from 1 January 2028 — ED Decision 2025/020/R]