LAMPIRAN PERATURAN DIREKTUR JENDERAL PERHUBUNGAN UDARA

NOMOR : KP 277 Tahun 2017

TANGGAL : 5 Oktober 2017

Staff Instruction
SI 19 – 03
Flight Data Analysis Program

Amendment : Original
Date : October 2017
REPUBLIC OF INDONESIA – MINISTRY OF TRANSPORTATION
DIRECTORATE GENERAL OF CIVIL AVIATION
JAKARTA – INDONESIA
 SI 19 – 03
October 2017

AMENDMENT RECORD LIST

Amendment No. Issue Date Reference

DG Decree No. KP 277 Year 2017,

0 5 October 2017
Date October 5, 2017

i
 SI 19 – 03
October 2017

FOREWORD

1. PURPOSE : This Staff Instruction prescribes responsibilities, policies,

and procedures to be used by the Directorate General of
Civil Aviation for conducting monitoring of the
implementation of flight data analysis program by air
operator. This Staff Instruction may be made available to
the public so that they may better understand the authority
and responsibilities of DGCA.
2. REFERENCES : This Staff Instruction should be used in accordance with
the applicable regulations.

3. CANCELLATION : -

4. AMENDMENT : The revision of this Staff Instruction hand-book is

delegated to Director of Airworthiness and Aircraft
Operations, Directorate General of Civil Aviation.

DIRECTOR GENERAL OF CIVIL AVIATION

Ttd.

Dr. Ir. AGUS SANTOSO, M.Sc.

ii
 SI 19 – 03
October 2017

TABLE OF CONTENTS

AMENDMENT RECORD LIST .................................................................................................. i

FOREWORD ............................................................................................................................... ii

TABLE OF CONTENTS ............................................................................................................ iii

ACRONYMS AND ABBREVIATIONS ..................................................................................... 4

CHAPTER 1 INTRODUCTION ................................................................................................. 1

1. BACKGROUND............................................................................................................ 1
2. OBJECTIVES AND SCOPE ....................................................................................... 1
3. FLIGHT DATA ANALYSIS PROGRAMME .............................................................. 1

CHAPTER 2 FLIGHT DATA ANALYSIS PROGRAMME DESCRIPTION ......................... 5

1. FDAP OVERVIEW ....................................................................................................... 5
2. FDA EQUIPMENT ....................................................................................................... 5
3. PROCESSING FDA DATA......................................................................................... 7
4. ANALYSIS AND FOLLOW-UP .................................................................................. 8

CHAPTER 3 PREREQUISITES FOR AN EFFECTIVE FDAP .......................................... 10

1. PROTECTION OF FDA DATA................................................................................. 10
2. INVOLVEMENT OF FLIGHT CREWS.................................................................... 11
3. SAFETY CULTURE ................................................................................................... 11

CHAPTER 4 ESTABLISHING AND IMPLEMENTING AN FDAP ..................................... 13

1. IMPLEMENTATION PLAN ....................................................................................... 13
2. AIMS AND OBJECTIVES ......................................................................................... 13
3. FDAP TEAM ............................................................................................................... 14
4. CONTINUOUS IMPROVEMENT ............................................................................ 15

CHAPTER 5 FDAP SURVEILLANCE ................................................................................... 17

1. BACKGROUND AND OBJECTIVES ...................................................................... 17
2. FORMS/CHECKLIST ................................................................................................ 19

iii
 SI 19 – 03
October 2017

ACRONYMS AND ABBREVIATIONS

ACAS Airborne collision avoidance system

ADRS Aircraft data recording system
ASR Air safety report
ATC Air traffic control
Doc Document
FDA Flight data analysis
FDAP Flight data analysis programme
FDAPM Flight Data Analysis Programme Manual
FDR Flight data recorder
FOQA Flight operations quality assurance
GPWS Ground proximity warning system
LOSA Line operations safety audit
QAR Quick access recorder
SDCPS Safety data collection and processing system
SOP Standard operating procedures
SMM Safety Management Manual
SMS Safety management system(s)

4
 SI 19 – 03
October 2017

CHAPTER 1 INTRODUCTION

1. BACKGROUND
Initially, the principal use of flight recorders was to assist accident/incident
investigators, especially in those accidents with no surviving crew members. It was
recognized that analysis of the recorded data was also useful for better understanding
of safe operations. By routinely accessing the recorded flight parameters, much could
be learned about the safety of flight operations and the performance of airframes and
engines. Valuable data on what goes right in day-to-day operations were available,
putting accident and incident data into perspective. As well, analysis of this de-
identified data could assist in the predictive identification of safety hazards before an
incident or accident occurred.
To capitalize on these benefits, a number of operators set up systems to routinely
analyze recorded flight data. The aviation industry is increasingly analyzing recorded
data from normal operations in support of organizations’ safety management systems
(SMS). Flight data analysis (FDA) has provided management with another tool for
proactively identifying safety hazards, and controlling and mitigating the associated
risks.
Outlining the requirements for establishing and maintaining a flight data analysis
programme (FDAP) refer to CASR Part 19. This material has been incorporated into
this manual in order to highlight the importance of establishing an FDA programme
(FDAP).

2. OBJECTIVES AND SCOPE

This manual is addressed to DGCA providing oversight to air operators as well as air
operators performing commercial air transport operations with airplanes and
helicopters.
The objective of this manual is to provide:
(a) a description of the relationship between SMS and FDAP;
(b) an overview of FDAP elements; and
(c) guidance for the establishment and implementation of an FDAP.

3. FLIGHT DATA ANALYSIS PROGRAMME

FDA, sometimes referred to as flight data monitoring or flight operational quality
assurance (FOQA), provides a systematic tool for the proactive identification of
hazards. FDA is a complement to hazard and incident reporting and to a line
operations safety audit (LOSA).
CASR Part 1 defines “flight data analysis” as a process of analysing recorded flight
data in order to improve the safety of flight operations.
An FDAP may be described as a non-punitive programme for routine collection and
analysis of flight data to develop objective and predictive information for advancing
safety, e.g. through improvements in flight crew performance, training effectiveness,

1
 SI 19 – 03
October 2017

operational procedures, maintenance and engineering, and air traffic control (ATC)
procedures.
FDA involves:
(a) capturing and analysing flight data to determine if the flight deviated from a safe
operating envelope;
(b) identifying trends; and
(c) promoting action to correct potential problems.
Periodically, flight data are transferred from the aircraft and analysed by the ground
analysis system at a centralized location.
Deviations of more than certain predetermined values, called “exceedances”, are
flagged and evaluated. The FDA team will propose and evaluate corrective actions,
as well as produce exceedances aggregation over time to determine and monitor
trends. FDA also allows for early identification of aircraft system degradation for
maintenance action.

Objectives of a flight data analysis programme

FDAPs are increasingly being used for the monitoring and analysis of flight
operations and engineering performance. They are a mandatory type of safety data
collection and processing system (SDCPS) of the SMS for operators of airplanes of
a maximum certificated take-off mass in excess of 27 000 kg, and an advisable
component for those that are below that mass threshold. Successful FDAPs
encourage adherence to standard operating procedures (SOPs), and determine non-
standard behavior, thereby improving safety performance. They can detect adverse
trends in any part of the flight regime and thus facilitate the investigation of events,
including those which have had serious consequences.
Flight data analysis can be used to identify non-standard or deficient procedures,
weaknesses in the air traffic control (ATC) system and anomalies in aircraft
performance. FDA allows the monitoring of various aspects of the flight profile, such
as the adherence to the prescribed take-off, climb, cruise, descent, approach and
landing SOPs. Specific aspects of flight operations can be examined either
retrospectively to identify problem areas, or proactively prior to introducing operational
change, and subsequently to confirm the effectiveness of the change.
During incident analysis, flight data of the related flight can be compared with the fleet
profile data, thereby facilitating analysis of the systemic aspects of an incident. It
may be that the parameters of the incident-flight vary only slightly from many other
flights, possibly indicating a requirement for change in operating technique or
training. For example, it would be possible to determine whether a tail-scrape on
landing was an isolated event, or symptomatic of a wider mishandling problem, such
as over-flaring on touchdown or improper thrust management.
Engine monitoring programmes may utilize FDAP data for reliable trend analysis,
as manually coded engine data are limited in terms of accuracy, timeliness and
reliability. It is also possible to monitor other aspects of the airframe and systems.
In summary, FDAPs offer a wide spectrum of applications for safety management.
Furthermore, it also offers the benefit of improving operational efficiency and
economy that compensate the needed investment. The objective is to:
2
 SI 19 – 03
October 2017

(a) determine operating norms;

(b) identify potential and actual hazards in operating procedures, fleets,
aerodromes, ATC procedures, etc.;
(c) identify trends;
(d) monitor the effectiveness of corrective actions taken;
(e) provide data to conduct cost-benefit analyses;
(f) optimize training procedures; and
(g) provide actual rather than presumed performance measurement for risk
management purposes.
It is important that FDAPs are non-punitive and contain adequate safeguards to
protect the source(s) of the data.

A flight data analysis programme integrated within a safety management system

FDA aims at continuous improvement of the overall safety performance of an
operator and it should be integrated in the safety assurance component of the
operator’s SMS. Ideally, where multiple systems are utilized to identify hazards and
manage risk, they should be integrated to maximize their combined effectiveness,
to ensure resources are being distributed appropriately across the systems and,
where possible, to reduce duplicated processes for greater system efficiency. So,
an operator wishing to implement an FDAP and which already has mature SMS
processes in place should be able to readily adopt and understand the fundamental
processes of an FDAP.
For example, as part of an operator's SMS safety assurance processes, an FDAP will
have identified indicators or parameters chosen for measuring and monitoring the
operator's safety performance, including “operational events”. These events may be
low consequence (deviation, non-compliance events) or high consequence safety
performance indicators (accident and serious incident rates). Such data are routinely
fed into or part of the SDCPS.
The operator's SMS assurance processes would also have procedures for corrective
or follow-up action to be taken when targets are not achieved and/or alert levels
are breached that are set for each of the performance indicators/parameters.
Alert and target levels serve as markers to define what are the
abnormal/unacceptable occurrence rate as well as the desired target (improvement)
rate for the indicator. The alert level for a particular safety indicator is the
demarcation line between the acceptable trending region and the unacceptable
region. Target level setting is the desired improvement level within a defined future
milestone or monitoring period. With such defined alert and target settings, it
becomes apparent that a qualitative/quantitative performance outcome can be
derived at the end of any given monitoring period. This may be done by counting the
number of alert breaches and/or the number of targets achieved for an individual
indicator and/or a package of safety indicators. Further guidance on setting alert and
target levels can be found in the Staff Instruction 19-05, Safety Management System.
Under such an assurance programme, the management would also be responsible
for setting procedures to review new and existing aviation safety-related facilities

3
 SI 19 – 03
October 2017

and equipment, including operations and processes for hazards/risks before they
are established or when changes to operations are introduced.
The FDA specific data output could be easily integrated into existing databases
for measuring safety performance, managing change and continuous improvement.
Such cross-communication between an FDAP and SMS would increase the
robustness of the processes and help achieve greater effectiveness in safety and
quality of the system/programme.
Where an FDAP is in place but not integrated in the SMS, the operator will need to
develop the processes to assure effective means of safety performance
measurement and corrective action plans in order to maintain continuous
improvement of the operations.
An FDAP held remote from the SMS of an operator would cause a substandard
performance of the SMS for its continuous improvement. Moreover, information
from other SMS data sources gives context to the flight data which will, in return,
provide quantitative information to support analysis that otherwise would be based
on subjective reports. Air safety reporting, avionic and systems maintenance, engine
monitoring, ATC and scheduling are just a few of the areas that could benefit.
The degree of integration between an operator’s SMS and its FDAP will depend on
many factors, including the relative maturity of the two systems as well as operational,
organizational and regulatory considerations.

4
 SI 19 – 03
October 2017

CHAPTER 2 FLIGHT DATA ANALYSIS PROGRAMME DESCRIPTION

1. FDAP OVERVIEW
The quality and capability of an operator’s FDAP will be dependent on the selection,
availability of flight parameters, and the quick access recorder’s (QAR’s) availability.
The selected flight parameters should be relevant and appropriate to reflect the
safety, quality or risk level of the process thereby providing a performance track. It is
important to note that the programme description herewith provides baseline
components. Therefore, depending on availability of resources, technology,
complexity and size of operation, the programme will need to be modified to suit the
needs of the operator.

2. FDA EQUIPMENT
FDAPs generally involve systems that capture flight data, transform the data into an
appropriate format for analysis, for generating reports and for visualization to assist
in assessing the data. The level of sophistication of the equipment can vary widely.
Typically, however, the following equipment capabilities are required for effective
FDAPs:
(a) an on-board device to capture and record data on a wide range of flight
parameters. These flight parameters should include, but not be limited to, the
flight parameters recorded by the flight data recorder (FDR) or aircraft data
recording systems (ADRS). The flight parameter performance (range, sampling
rate, accuracy, recording resolution) should be as good as or better than the
performance specified for FDR parameters;
(b) a means to transfer the data recorded on board the aircraft to a ground-based
processing station. In the past, this largely involved the physical movement of the
memory unit from the QAR. To reduce the physical effort required, more modern
transfer methods utilize wireless technologies;
(c) a ground-based computer system (using specialized software) to analyse the data
(from single flights and/or in an aggregated format), identify deviations from
expected performance, generate reports to assist in interpreting the read-outs,
etc.; and
(d) optional software for a flight animation capability to integrate all data, presenting
it as a simulation of in-flight conditions, thereby facilitating visualization of actual
events for analysis and crew debriefing.

Airborne equipment
Modern glass-cockpit and fly-by-wire aircraft are equipped with the necessary
digital data-buses from which information can be captured by a recording device for
subsequent analysis. Older, non-digital, aircraft are capable of capturing a limited
set of data, but may be retrofitted to record additional parameters. Nevertheless,
a limited parameter set will allow for a useful, basic FDAP.
The flight parameters recorded by the FDR or ADRS may determine a minimum set
for an FDAP. In some cases, the flight parameters and FDR/ADRS recording
5
 SI 19 – 03
October 2017

duration required by law to support accident and incident investigations may be

insufficient to support a comprehensive FDAP. Thus, many operators are opting for
additional recording capacity, capable of being easily downloaded for analysis.
QARs are optional non-crash protected recorders installed on the aircraft and record
flight data in a low- cost removable medium. They are more accessible and record
the same parameters for a longer duration than the FDR. New technology QARs and
new flight data acquisition systems offer the possibility to capture and record
thousands of flight parameters. They also allow for increasing the sampling rate or
the recording resolution of specific flight parameters to values appropriate for
advanced flight data analysis. The expanded data frame greatly increases the
resolution and accuracy of the output from ground analysis programmes. However,
the data frame definition is one of the more difficult parts of setting up an FDAP. For
example, in a mixed fleet, it is very expensive to obtain the necessary capability to
read different data sets.
An increasing number of aircraft are being fitted with light-weight flight recorders as
standard equipment; these units will provide a source of flight data for operators
of smaller aircraft. This will enable such operators to implement an FDAP
commensurate with the size of their operations even if there are no provisions
requiring them to institute FDAPs. The light-weight recorders make use of low-cost
removable memory cards which may simplify the process to download and analyse
the flight data.
To eliminate the task of moving the data from the aircraft to the ground station by
physically removing the recording medium of the QAR, newer systems
automatically download the recorded information via secure wireless systems when
the aircraft is in the vicinity of the gate. In other systems, the recorded data is
analysed on board while the aircraft is airborne. The relevant encrypted data are
then transmitted to a ground station using satellite communications. Fleet
composition, route structure and cost considerations will determine the most cost-
effective method of removing the data from the aircraft.

Ground-based computer system for flight data analysis

Flight data are downloaded from the aircraft recording device into a ground-
based computer system including analysis software, where the data are held
securely to protect this sensitive information. Such computer systems are
commercially available; however, the computer platform will require appropriate front-
end interfaces to cope with the variety of recording inputs available today.
FDAPs generate large amounts of data requiring specialized analysis software.
This analysis software facilitates the routine analysis of flight data in order to identify
situations that may require corrective action.
The analysis software checks the downloaded flight data for abnormalities. The
exceedance detection typically includes a large number of trigger logic expressions
derived from a variety of sources such as flight performance curves, SOPs, engine
manufacturers’ performance data, airfield layout and approach criteria. Trigger logic
expressions may be simple exceedances such as redline values. The majority,
however, are composites which define a certain flight mode, aircraft configuration or
payload-related condition. Analysis software can also assign different sets of rules
dependent on aerodrome or geography. For example, noise sensitive aerodromes
6
 SI 19 – 03
October 2017

may use higher than normal glide slopes on approach paths over populated areas.
The set of trigger logic expressions is normally user-defined.
Exceedances and routine measurements can be displayed on a ground computer
screen in a variety of formats. Recorded flight data are usually shown in the form of
color-coded traces and associated engineering listings, cockpit simulations or
animations of the external view of the aircraft.

3. PROCESSING FDA DATA

Exceedance detection
Exceedance detection, such as deviations from flight manual limits or SOPs, is one
way of extracting information from flight data. A set of core events/parameters
establishes the main areas of interest to an operator.
Examples: High lift-off rotation rate, stall warning, ground proximity warning system
(GPWS) warning, flap limit speed exceedance, fast approach, high/low on glide slope
and heavy landing.
Exceedance data provides factual information which complement crew and
engineering reports.
Examples: Reduced flap landing, hard landings, emergency descent, engine
failure, rejected take-off, go-around, airborne collision avoidance system (ACAS) or
GPWS warning and system malfunctions.
Operators may also modify the standard set of core events to account for unique
situations they regularly experience or for the SOPs they use.

Routine measurements
Data can be retained from all flights, not just those producing significant events. A
selection of parameters is retained that is sufficient to characterize each flight and
allow a comparative analysis of a wide range of operational variability. Emerging
trends and tendencies are monitored before the trigger levels associated with
exceedances are reached.
Examples of flight parameters monitored: Take-off weight; flap setting;
temperature; rotation and lift-off speeds versus scheduled speeds; maximum pitch
rate and attitude during rotation; and gear retraction speeds, heights and times.
Examples of comparative analyses: pitch rates from high versus low take-off
weights; unstable approaches; and touchdowns on short versus long runways.

Incident investigation
FDAPs provide valuable information for incident investigations and for follow-up of
other technical reports. Quantifiable recorded data have been useful in adding to the
impressions and information recalled by the flight crew. FDAP data also provide an
accurate indication of system status and performance, which may help in determining
cause and effect relationships.
Examples of incidents where recorded flight data could be useful: High cockpit
workload conditions as corroborated by such indicators as:
7
 SI 19 – 03
October 2017

(a) late descent;

(b) late localizer and/or glide slope interception;
(c) large heading change below a specific height;
(d) late landing configuration;
(e) unstabilized and rushed approaches, glide path excursions, etc.;
(f) exceedances of prescribed operating limitations (such as flap limit speeds, engine
over-temperatures); and
(g) Wake vortex encounters, low-level wind shear, turbulence encounters or other
vertical accelerations.

Continuing airworthiness
Both routine measurements and exceedances can be utilized to assist the continuing
airworthiness function. For example, engine-monitoring programmes look at measures
of engine performance to determine operating efficiency, predict impending failures
and assist in maintenance scheduling.
Examples of continuing airworthiness uses: Engine thrust level and airframe drag
measurements; avionics and other system performance monitoring; flight control
performance; monitoring "on-condition" systems and engine deterioration; and brake
and landing gear usage.

Integrated safety analysis

All the data gathered in an FDAP should be integrated in a central safety database.
By linking an FDAP database to other safety databases (such as incident reporting
systems and technical fault reporting systems), a more complete understanding of
events becomes possible through cross-referencing the various sources of
information. Care should be taken, however, to safeguard the confidentiality of FDA
data when linking the data to identified data.
Example of integration: A heavy landing results in a flight crew report, an FDA
exceedance and an engineering report. The flight crew report provides the context,
the FDA exceedance provides the quantitative description and the engineering report
provides the result.

4. ANALYSIS AND FOLLOW-UP

Overviews and summaries of FDA data are compiled on a regular basis, usually
weekly or bi-weekly, whilst individual significant events would be expected to be
more timely followed up. All data should be reviewed to identify specific
exceedances and emerging undesirable trends and to disseminate the information to
flight crews.
If deficiencies in the flight technique are recognized, the information is de-identified in
order to protect the identity of the flight crew. The information on specific
exceedances is passed to a flight crew contact person. This person provides the
necessary contact with the flight crew (see 4.3 “The FDAP team”) in order to clarify
the circumstances, obtain feedback and give advice and recommendations for
8
 SI 19 – 03
October 2017

appropriate action, such as flight crew re-training (carried out in a positive and non-
punitive way), revisions to operating and flight manuals or changes to ATC and
aerodrome operating procedures.
All events are archived in a database. The database is used to sort, validate and
display the data in easy- to-understand management reports. Over time, this
archived data can provide a picture of emerging trends and hazards which would
otherwise go unnoticed.
Lessons learned from an FDAP may warrant inclusion in the company’s safety
promotion activities. Care is required, however, to ensure that any information
acquired through FDA is de-identified before using it in any training or promotional
initiative unless permission is given by all the crew members involved. Care should
also be taken that, in order to avoid an exceedance, flight crews do not attempt to
“fly the FDA profile” rather than follow SOPs. Such behavior would have a negative
impact on safety.
A proper value should be programmed for trigger and exceedance and designed to
include an acceptable buffer that will disregard minor deviation, spurious events, as
well as introduce an adequate operational margin to fly the aeroplane through SOPs,
instead of leading the flight crew to focus on FDA parameters in order to avoid
deviations.
As in any closed-loop process, follow-up monitoring is required to assess the
effectiveness of any corrective actions taken. Flight crew feedback is essential for
the identification and resolution of safety problems and could include answering the
following example questions:
(a) Is the implementation and effectiveness of corrective actions adequate?
(b) Are the risks mitigated, or unintentionally transferred to another part of the
operations?
(c) Have new problems been introduced into the operation as a result of implementing
corrective actions?
All successes and failures should be recorded, comparing planned programme
objectives with expected results. This provides a basis for review of an FDAP and the
foundation for future programme development.

9
 SI 19 – 03
October 2017

CHAPTER 3 PREREQUISITES FOR AN EFFECTIVE FDAP

1. PROTECTION OF FDA DATA

Overall approach
The operator’s management, flight crews and the DGCA have legitimate concerns
regarding the protection of FDA data, which include:
(a) use of data for disciplinary purposes;
(b) use of data for enforcement actions against individuals or against the company,
except in cases of criminal intent or willful misconduct;
(c) disclosure to the media and the general public under the provisions of State laws
regarding access to information; and
(d) disclosure during civil litigation.
However, the integrity of an FDAP rests upon protection of the FDA data. Any
disclosure for purposes other than safety management can compromise the
required cooperation of the affected flight crew in clarifying and documenting an
event. Thus, preventing the misuse of FDA data is a common interest of the State, the
operator and the flight crews.
Data protection can be optimized by:
(a) adhering to the agreement between management and the flight crews, where
available;
(b) strictly limiting data access to selected individuals;
(c) maintaining tight control to ensure that data identifying a specific flight are kept
secure;
(d) ensuring that operational problems are promptly addressed by management; and
(e) to the extent possible, non-reversible de-identification of the flight data files after a
time appropriate for their analysis.

Policy on retention of data

Because of the large volumes of data involved, it is important that a strategy for data
access, both online and offline, is carefully developed to meet the needs of FDAP
users.
The most recent flight data and exceedances are normally kept readily available to
allow fast access during the initial analysis and interpretation stages. When this
process is completed, it is less likely that additional data from the flights will be
required so the flight data can be archived. Exceedances are usually kept online for
a much longer period to allow trending and comparison with previous events.

De-identification policy and procedures

A policy on FDA data de-identification is an absolutely critical area that should be
carefully written down and agreed to before it is needed in extreme circumstances.
10
 SI 19 – 03
October 2017

Management assurance on the nondisclosure of individuals must be very clear and

binding. The one exception is when the operator/flight crew believes that there is a
continuing unacceptable safety risk if specific action regarding the flight crew is not
taken. In this case, an identification and follow-up action procedure, previously
agreed to before the particular event, can be brought into play. Experience has
shown that this is very rarely required. Most often a flight crew responds to advice
from the FDA flight crew contact person to submit an air safety report (ASR) and they
may then be covered by protection assured under that programme.
There should be an initial stage during which the data can be identified to allow
confidential follow-up by the crew representative or trusted individual agreed to by the
operator and the flight crews. Strict rules of access should be enforced during this
period. In the case of a mandatory occurrence or accident, any data retained by the
programme may not be de-identified or removed from the system prior to the
investigation or for confirmation that it is not required. This will allow the safety
investigators access to all relevant information.

Set authorized access levels

The FDA ground-based computer system must have the ability to restrict access to
sensitive data and also control the ability to edit data. For example, the FDA flight crew
contact person could have full access, while operations management would only have
access to de-identified data and the ability to add comments and edit a few
appropriate fields.

2. INVOLVEMENT OF FLIGHT CREWS

As with successful incident reporting systems, the trust established between
management and its flight crews is the foundation for a successful FDAP. For most
operators this will be accomplished through an association, while for others civil
aviation authority may be the custodian of flight crew involvement under the limitation
of the due “duty of care”. Here it is incumbent upon management to provide
assurance of the FDAP intent, conditions of use and protection given to its
employees. This trust can be facilitated by:
(a) early participation of the flight crew representatives and/or authority
representatives in the design, implementation and operation of an FDAP; and
(b) a formal agreement between management and the flight crews, and/or authority
identifying the procedures for the use and protection of data.

3. SAFETY CULTURE
Consistent and competent programme management characterizes successful FDAPs.
Indications of an effective safety culture of an operator include:
(a) top management’s demonstrated commitment to promoting a proactive safety
culture;
(b) the cooperation and accountability of all organizational levels and relevant
personnel representatives, meaning that anyone believing to have identified a
potential risk should feel able to report and expect follow-up action to be
considered. From the line pilot to the fleet manager all have responsibility to act;
11
 SI 19 – 03
October 2017

(c) a written non-punitive company policy that covers FDA and makes clear that the
main objective of an FDAP should be to improve safety, and not to allocate blame
or liability;
(d) an identified safety manager whose role and functions are defined following the
recommendations of the SI 8900-15.3, Safety Management System;
(e) FDAP management by a dedicated staff under the authority of the safety manager,
with a high degree of specialization and logistical support;
(f) Involvement of persons with appropriate expertise when identifying and assessing
risks. For example, flight crews experienced on the aircraft type being analyzed are
required for the accurate diagnosis of operational hazards emerging from FDA
analyses;
(g) A focus on monitoring fleet trends aggregated from numerous operations, rather
than on specific events. The identification of systemic issues adds more value for
safety management than isolated events;
(h) a well-structured de-identification system to protect the confidentiality of the data;
and
(i) an efficient communication system, to permit timely safety action, for disseminating
hazard information and subsequent risk assessments internally and to other
organizations.

12
 SI 19 – 03
October 2017

CHAPTER 4 ESTABLISHING AND IMPLEMENTING AN FDAP

1. IMPLEMENTATION PLAN
Typically, the following steps are required to implement an FDAP:
(a) management approval of the programme;
(b) implementation of a formal agreement between management and flight crews;
(c) identification of an FDAP implementation committee, including the future FDA
team members; this committee should be involved in all of the following steps;
(d) development of a business plan, including processes, software and hardware
and assignment of adequate resources;
(e) establishment and verification of operational and security procedures;
(f) development of an FDAP procedures manual;
(g) assessment of possible interfaces between an FDAP and other safety data
sources (i.e. SDCPS) and of integration of an FDAP into the SMS;
(h) selection of equipment (airborne, ground-based computer system, interface with
other data sources and the SMS);
(i) selection and training of the FDA team members, according to their respective
roles;
(j) testing of data transfer; testing of the ground-based computer system
(including data acquisition, definition of trigger logic expressions, data analysis
and visualization, data de-identification, final storage of data);
(k) testing of data security, including security procedures;
(l) identification of areas of interest that should be first looked at in the data;
(m) checking of the proper decoding and of the quality of flight parameters used by an
FDAP; and
(n) start of data analysis and validation, focused on key areas in operation.
Historically, bearing in mind the time required to obtain flight crew/management
agreements and develop relevant procedures, an operator with no FDA experience
would not likely achieve an operational FDAP in less than twelve months. Another
year may be required before any safety and cost benefits appear. Improvements in
the analysis software, or the use of outside specialist service providers, should
shorten these time frames to ensure FDA coverage during the safety-critical period of
introduction to service.

2. AIMS AND OBJECTIVES

A phased approach is recommended so that the foundations are in place for possible
subsequent expansion into other areas. Using a building block approach will allow
expansion, diversification and evolution through experience.

13
 SI 19 – 03
October 2017

Example: With a modular system, begin by looking at basic safety-related issues

only. Add engine health monitoring, etc. in the second phase. Ensure compatibility
with other systems.

A staged set of objectives starting from the first week’s replay and moving through
early production reports into regular routine analysis will contribute to a sense of
achievement as milestones are met.
Examples:
Short-term goals:
(a) establish data download procedures, test analysis software and identify aircraft
defects;
(b) validate and investigate exceedance data; and
(c) establish a user-acceptable routine report format to highlight individual
exceedances and facilitate the acquisition of relevant statistics.
Medium-term goals:
(a) produce annual report — include key performance indicators;
(b) add other modules to analysis (e.g. continuing airworthiness); and
(c) plan for the next fleet to be added to the programme.
Long-term goals:
(a) network FDA information across all company safety information systems and
integrate an FDAP into the SMS;
(b) ensure FDA provision for any proposed advanced training programme; and
(c) use utilization and condition monitoring to reduce spares holdings.
Initially focusing on a few known areas of interest will help prove the system’s
effectiveness.
Examples: Rushed approaches, or rough runways at particular aerodromes;
unusual fuel usage on particular flight segments, etc. Analysis of such known
problem areas may generate useful operational confidence leading to the analysis
of other areas.

3. FDAP TEAM
Experience has shown that the “team” required running an FDAP can vary in size
from one person for a small fleet, to a dedicated section for large fleets. The
descriptions below identify various functions to be fulfilled, not all of which need a
dedicated position.
(a) Team leader. It is essential that the team leader earns the trust and full support of
both management and flight crews. He/she acts independently of others in line
management to make recommendations that will be seen by all to have a high
level of integrity and impartiality. The individual requires good analytical,
presentation and management skills. He/she should be the safety manager or
placed under the authority of the safety manager.

14
 SI 19 – 03
October 2017

(b) Flight operations interpreter. This person is usually an experienced pilot in the
type and operation who knows the operator’s route network and aircraft. This
team member’s in-depth knowledge of SOPs, aircraft handling characteristics,
airports and routes will be used to place the FDA data in a credible context.
(c) Technical interpreter. This person interprets FDA data with respect to the
technical aspects of the aircraft operation and is familiar with the power plant,
structures and systems departments’ requirements for information and any other
engineering monitoring programmes in use by the operator.
(d) Flight crew contact person. This is a person usually assigned by the operator
for this responsibility (safety manager, agreed flight crew representative, honest
broker), or a mutually acceptable substitute, for confidential discussion with flight
crews involved in events highlighted by FDA. The position requires good people
skills and a positive attitude towards safety education. The flight crew contact
person should be the only person permitted to connect the identifying data with
the event. The flight crew contact person requires the trust of both flight crew
members and managers for his/her integrity and good judgement.
(e) Engineering technical support. This person is usually an avionics specialist,
involved in the supervision of FDR serviceability. Indeed, an FDAP can be used
to monitor the quality of flight parameters sent both to the FDR and to the FDA
recorder, and thus ensure the continued serviceability of the FDR. This team
member should be knowledgeable about FDA and the associated systems
needed to run the programme.
(f) Air safety coordinator. This person cross-references FDA information with other
safety data sources (such as the company’s mandatory or confidential incident
reporting programme and LOSA) and with the operator’s SMS, creating a credible
integrated context for all information. This function can reduce duplication of
follow-up investigations.
(g) Replay operative and administrator. This person is responsible for the day-to-
day running of the system, producing reports and analyses. Methodical, with
some knowledge of the general operating environment, this person keeps the
programme moving. Operators may utilize the services of a specialist
contractor to operate an FDAP.
All FDAP team members need appropriate training or experience for their respective
area of data analysis and should be subject to a confidentiality agreement.
Each team member should be allocated a realistic amount of time to regularly spend
on FDA tasks. With insufficient human resources, the entire programme will
underperform or even fail.

4. CONTINUOUS IMPROVEMENT
New safety issues identified and published by other organizations, such as safety
investigation reports, safety bulletins by the aircraft manufacturer or safety issues
identified by aviation authorities, should be assessed for inclusion in a
corresponding monitoring activity of an FDAP.
The FDA processes and procedures will need to be amended when an FDAP
matures and each time there are changes in the operations, the internal organization
of the aircraft operator or the interface with other data sources and processes.
15
 SI 19 – 03
October 2017

In order to assess the general effectiveness of an FDAP, a periodic review or an

audit may be beneficial. Such a review could determine:
(a) if anticipated safety benefits are being realized;
(b) if the FDA procedures reflect the actual operation of an FDAP, and if they have
been followed;
(c) whether the information provided to FDAP users is accurate, timely, and useable;
and
(d) if the tools employed to collect and present data are still adequate and if other
technology would be more effective.

16
 SI 19 – 03
October 2017

CHAPTER 5 FDAP SURVEILLANCE

1. BACKGROUND AND OBJECTIVES

FDAP is the systematic, pro-active use of digital flight data from routine operations to
improve aviation safety within an intrinsically non-punitive and just safety culture.
DGCA inspectors shall check the Flight Data Analysis Program of the operator on a
yearly basis. The objectives of the inspections are as follows:
(a) Evaluation of the FDAP documentation for completeness and workability
(b) Assess if the FDAP is non-punitive and adheres to just culture best practices
(c) Evaluate if FDAP personnel is sufficiently trained and is able to carry out the tasks
(d) Evaluate if the FDAP capture rate ensures that a representable percentage of the
flying program is analyzed
(e) Evaluate the FDAP trend reports and ascertain that the operator keeps to the
targets it set itself
(f) Evaluate the value of the company FDAP targets and ensure that continues
improvement to the level of safety is ensured
A. Process illustration. The operator’s FDAP documentation should contain a
FDAP policy which sets out the overall intentions of the program. A statement to the
effect that FDAP shall be non-punitive is a key element of this policy. The FDAP policy
can also be substituted by an overall (company) safety policy. Various procedures
should be described in the documentation for each phase of the program according
the check list. If the process is contracted out, there should be a service level
agreement together with the contract. This service level agreement should stipulate
minimum requirements such as a maximum transcript time for events, maximum time
for adjusting parameters and limitation settings, etc.
B. FDAP system. It is important to ascertain which system is being used to
capture the FDAP data. The system determines the amount of sectors that are
recorded in relation to the total number of sectors flown (number of flights
recorded/total amount of flights x 100= capture rate in %) This percentage is called
the “capture rate”. If a wireless connection is used for transferring the data, a
reasonable capture rate will be between 90 and 95%. If a PCMCIA card is used a
capture rate of around 80 and 85% can be expected. If optical disks are used a
capture rate of 65 and 75% can be expected. The important issue is that the capture
rate should ensure a reasonable representation of the entire flying program. If the
capture rate is low, it does not give a good representation of the flying program and is
therefore unacceptable. Even if the capture rate is acceptable the inspector needs to
ensure that all geographical operating areas are included in the data for it to be
representable for the total flying program of that fleet. Data loss is often incurred by
aircraft that are operated in remote areas.
Airborne systems and equipment used to obtain data, range from already installed full
Quick access recorders, in modern aircraft with digital systems, to a basic crash
protected recorder in older or less sophisticated aircraft. The analysis potential of the
reduced data set available in the older aircraft may reduce the safety lessons drawn
from the data. The operator shall ensure that the FDAP use does not negatively
17
 SI 19 – 03
October 2017

influence the serviceability of equipment required for accident investigation. Tape

based DFDR’s should not be used for regular downloads. It is best practice to include
the QAR in the MEL as a D item. QAR’s should not be unserviceable for a long time
especially if this impacts severely on the capture rate.
The management of false events or spurious data and an indication of how much of
the raw data is valid, will give insight in the maturity of the FDAP system and how well
the process is managed and maintained. Access to all the recorded parameters and
to the trigger events is necessary to adopt the system to the company’s procedures
and ensures further validity of the data. Ask if extra parameters were added and which
trigger levels have been adjusted for further understanding of the maturity level of the
system. Ideally all level three events (most serious events) need to be debriefed to the
crew involved. This should never be done before a flight. If not one hundred percent of
the crew in level three events is debriefed the reason why should be evaluated and
could result in a finding. The target should always be 100%. The use of lower level
events ensures that emerging negative trends are addressed and that hazards are
addressed before they end up as incidents.
C. Process for results. This section deals with the processes that are in place for
dealing with the outcome of the FDAP. The gate keeper is the person with access to
the names of the crew. He should assure that the names are not disclosed. This
ensures the system stays non-punitive. Only in cases of grave misconduct names can
be disclosed. A process for when names can be disclosed must be present. Best
practice indicates de-identified data should be kept for 5 years. Identified data should
be kept for less time since the only purpose it serves is debriefing the crew.
Trend reports should be prepared regularly. Once a month would be a good time
frame. The FOD should be briefed regularly about the trends and single events so
they can manage their department accordingly. Graphs should be normalized to
ensure growth or seasonal influences in the flying program are not a factor in the
trend. A check should be carried out to ensure the target for producing trend reports
was adhered to. The FOD should use FDAP data as a starting point for managing the
quality of flying of the crew. Negative trends should be addressed by management
action. Trend reports with graphs that do not go into detail (events per airport,
operating area, time of the day etc.) may indicate a lack of interest or knowledge of
the FOD. This should be addressed by the FDAP Team. The last two questions in the
TREND section of the check list are also there to establish the management
capabilities of the FOD.
FDAP trend data should also be feedback to the training department and to the crew.
D. Reference to other data. Processes should be in place to line up FDAP
events with tech log entries to ensure corrective actions by the Maintenance section.
The percentage of FDAP events versus tech log entries also gives a good indication
of the safety culture and the level of discipline of the crews.
This is the same for the percentage of FDAP events versus the number of air safety
reports that are filled. An unsatisfactory percentage should be the subject of
management action by the FOD. Targets for these percentages should be set every
year to ensure continuous improvement.
In case of an accident or serious incident processes should be in place to swiftly
secure the data and protect the data.

18
 SI 19 – 03
October 2017

2. FORMS/CHECKLIST
The forms/checklist to conduct FDAP surveillance are provided in DAAO Form No.
120-95.

19