"Breaking The Silos": Fully Integrating Flight Data Monitoring Into The Safety Management System

EUROPEAN OPERATORS FLIGHT DATA MONITORING FORUM
WORKING GROUP C
SAFETY PROMOTION
Good Practice document
“BREAKING THE SILOS”

Fully integrating Flight Data Monitoring
into the Safety Management System
June 2019
Initial issue
“Breaking the Silos” | Fully integrating Flight Data Monitoring into the Safety Management System | Initial issue
Contents
Note....................................................................................................................................................4
Introduction.......................................................................................................................................5
1. Background............................................................................................................................................. 5
2. Definitions............................................................................................................................................... 6
I. P
racticalities of integrating FDM in the Safety Management System..........................................7
1. Enriching FDM with other data sources................................................................................................ 7
a. The limitations of flight data taken alone........................................................................................7
b. W hat the operating context can bring to the understanding of FDM data...................................7
c. What air safety reports can add to FDM...........................................................................................9
d. Automatically combining flight data with other data.....................................................................9
2. Benefits of FDM integrated in the SMS................................................................................................ 10
a. How can FDM be used as part of the SMS?....................................................................................10
b. Practical benefits of FDM in SMS....................................................................................................10
c. Organizational FDM Integration.....................................................................................................11
d. Competences of the FDM and SMS teams......................................................................................11
3. Examples of combining flight data with other data........................................................................... 12
a. Analysing long-flare-distance events..............................................................................................12
b. Individual FDM summary reports...................................................................................................15
c. Enhancing self-awareness and encouraging positive behaviour..................................................20
4. Black and white vs. grey – combining objective and subjective information................................... 22
a. Introduction......................................................................................................................................22
b. S ome organizational challenges of combining flight data with air safety reports......................23
5. The state of play in 2018...................................................................................................................... 24
a. Online survey on combining flight data and other data sources..................................................24
b. Conclusion........................................................................................................................................27
II. C
onfidentiality vs. Safety – where to draw the line....................................................................28
1. C
onfidentiality requirements for FDM programmes and applicable EU legislation......................... 28
a. The air operation requirements......................................................................................................28
b. What policy should be in place?.....................................................................................................29
c. Who at the operator is responsible for the protection of data?...................................................29
d. What does the regulation on occurrence reporting mean for FDM programmes?....................30
e. What does the regulation on personal data protection mean for an FDM programme?...........30
f. What happens when an official safety investigation is launched?................................................33
2. The current practice.............................................................................................................................. 35
a. Online survey on combining flight data and other data sources..................................................35
b. Conclusion........................................................................................................................................37
2
3. The potential conflict between confidentiality and the broader use of FDM for safety................... 38
a. A non-punitive FDM programme in a just culture environment...................................................38
b. Finding the optimal level of protection for flight data..................................................................38
c. Further developments......................................................................................................................39
d. Emerging issues.............................................................................................................................. 40
e. Just Culture.......................................................................................................................................41
4. Circle of confidence – The boundaries of confidentiality.................................................................. 42
a. The circle of confidence – who is that?...........................................................................................42
b. Break a silo, not the confidentiality................................................................................................43
5. The safety culture and the need for confidentiality – a dynamic relationship.................................. 44
III. Going beyond the conventional use of FDM.............................................................................45
1. S erving internal and external customers............................................................................................ 45
a. Internal customers...........................................................................................................................45
b. External customers..........................................................................................................................46
c. Supporting operations – day-to-day applications of flight data...................................................47
2. Enhancements to training and operational policy using FDM........................................................... 48
a. Environmental................................................................................................................................. 48
b. T ake-off and landing location (airfield or helideck) and noise abatement procedures.............. 48
c. Aircraft............................................................................................................................................. 48
3
Note
This document was produced by the working group C of the European Operators Flight Data Monitoring forum
(EOFDM WG-C – Integration of an FDM programme into operator processes).
According to its terms of reference, the EOFDM is a voluntary and independent safety initiative. Therefore this
document should be considered as industry good practice which EASA promotes actively. This document should
not be considered as an alternative to any applicable regulatory requirement, and it should not be considered as
official guidance from EASA.
If you would like to give your comments or a feedback on this document, please write to:
fdm@easa.europa.eu.
Information on the EOFDM forum and other good practice documents produced by EOFDM can be consulted on
the EASA website (https://www.easa.europa.eu/).
4
Introduction
1. Background
Flight data monitoring (FDM) was born in the 1970s to support safety assessment tasks. Several large European
airlines identified at that time the potential benefit of FDM and pioneered this domain. With the progress in in-
formation technologies of the 1980s and 1990s allowing to record and process even greater amounts of digital
data, FDM steadily gained momentum and recognition, resulting in the International Civil Aviation Organization
(ICAO) introducing in Annex 6, a standard applicable to aeroplanes with a MCTOM in excess of 27 000 kg. The
Joint Aviation Authorities (JAA) introduced a similar requirement in JAR-OPS 1, making FDM a necessary com-
ponent of an operator’s accident prevention and flight safety programme1. In parallel to that, other types of
operators than large airlines (business jet operators, helicopter operators) decided to set up on a voluntary basis
an FDM programme, and to adapt the concept of FDM to their particular organizations.
In the first decade after year 2000, the notions of quality system and of accident prevention and flight safe-
ty programmes defined by JAR-OPS 1 were superseded by the concept of safety management system (SMS). It
eventually resulted in the creation of a dedicated ICAO Annex (Annex 19) in 2013. As a consequence of this con-
ceptual change, the FDM programme was declared a part of the SMS and as such had to be integrated into SMS
processes2.
However, at the time this document was written, an FDM programme was still perceived by some operators as
a standalone process, separated from other safety data collection and analysis schemes. There were still little
practical guidance available on integrating an FDM programme with the operator’s SMS, and in particular on
linking FDM with other data sources. This translated for some operators into maintaining non-integrated struc-
tures in their organizations (e.g. FDM team and SMS team being kept apart) or internal restrictive policies (such
as forbidding any use of flight data for other purposes than the FDM programme).
In parallel, an EU regulation entered into force in 2018 to provide for an EU-wide framework for the protection
of personal data3. While this EU regulation was driven by concerns with other industries than aviation, it impact-
ed all processes whereby data related to an individual are collected, including the FDM programme. This did not
only raise again questions about correct implementation of an FDM programme, it also created an opportunity
for operators to embrace a common approach for the collection and processing of safety data.
This document is meant to provide some practical advice for overcoming the issues related to the integration of
an FDM programme with other safety data collection processes and into the SMS.
Note: This document sometimes refers to another EOFDM document titled ‘Preparing
a memorandum of understanding for an FDM programme’. This is because the two documents
are considered complementary.
1 Refer to JAR-OPS 1 Section 1, 1.035 and 1.037

2 Refer to ICAO Annex 6 Part I, chapter 3 section 3.3.
3 Regulation (EU) 2016/679 of 27 April 2016 (General data protection regulation)
5
2. Definitions
According to Annex I to Regulation (EU) 965/2012 (Definitions applicable to the rules for air operation), “flight
data monitoring (FDM)” means the proactive and non-punitive use of digital flight data from routine operations
to improve aviation safety’.
According to Regulation (EU) No 376/2014, just culture means a culture in which front-line operators or other
persons are not punished for actions, omissions or decisions taken by them that are commensurate with their
experience and training, but in which gross negligence, wilful violations and destructive acts are not tolerated.
In all this document:
‘flight data’ designates parametric data recorded on-board the aircraft by a system dedicated for this purpose
(for instance, this system can be a flight data recorder or a quick access recorder).
Note: Flight data is the data necessary for running an FDM programme, however, it can also be
used for other purposes.
‘FDM data’ designates flight data collected and analysed in the framework of the FDM programme. This
includes raw flight data as well as processed flight data, such as FDM event triggers, FDM-based safety per-
formance indicators and FDM statistics.
‘FDM event/Exceedance’ designates circumstances detected by an algorithm looking at flight data.
‘Safety culture’ designates the set of enduring values and attitudes regarding safety issues, shared by eve-
ry member of every level of an organization. Safety culture refers to the extent to which every individual and
every group of the organization is aware of the risks and unknown hazards induced by its activities; is contin-
uously behaving so as to preserve and enhance safety; is willing and able to adapt itself when facing safety
issues; is willing to communicate safety issues; and consistently evaluates safety related behaviour.
6
I. Practicalities of integrating
FDM in the Safety
Management System
1. Enriching FDM with other data sources
a. The limitations of flight data taken alone

Flight data in isolation provides at best information as to “What happened” and does not provide the “Why it
happened”. When additional data (such as contextual data) related to an incident, is combined with FDM, then
it becomes easier to understand why an incident occurred. In addition, for some kinds of incidents flight data is
not even sufficient to understand what happened (e.g. in the case of an airprox).
See also examples in section I.3.
b. W
hat the operating context can bring to the understanding
of FDM data
Several other types of factual (non-subjective) information available to the operator can be combined with FDM
data in order to allow a more accurate analysis of occurrences and their findings (‘contextual data’). For instance,
weather, traffic data, and aircraft documentation are some of the types of data which can help FDM gain a more
accurate assessment of the occurrences.
Contextual data can be used in the framework of FDM for a double purpose:
´´ Better analyses of individual FDM event triggers; and
´´ Context-enriched FDM statistics, which address practical questions regarding the safety trends and bet-
ter support decision-making.
Some contextual data would need to be obtained close to the time of the FDM event trigger or the FDM meas-
urement (e.g. local weather conditions, landing runway condition, etc.).
7
Table I.1 presents various contextual data which can be associated with FDM data.
´´ Table I.1: examples of contextual data that can be combined with FDM data.
What information does this data
Type of contextual data Possible data source(s)
bring for FDM?
Aircraft flight manual, aircraft operating
Aircraft publications Knowledge of the applicable SOPs
manual
This enables the FDM data of a given

Operational flight data: aircraft tail number,
flight to be associated with operational Records from the operational control over
flight number, departure point, arrival
information, e.g. aircraft load and trim the flights (flight dispatching)
point, etc.
data, nature of flight delay if any
Weather: en-route weather, night/day Local weather stations (SIGMET, AIRMET,

Identify adverse weather phenomenon
and visibility conditions, local sunrise and TAF, METAR) or national weather offices
(turbulence, storms, icing, windshear)
sunset time (satellite maps)
Constraints imposed by the departure/

Available airfield infrastructure, Navigation
arrival airfield and departure/arrival AIP
aids and departure/arrival procedures
procedures on the conduct of the flight
Runway friction condition, closed runway

Airfield and runway condition and taxiways at the time of landing/ NOTAM
take-off
Computed performance data: computed

weight and balance and other computed
Identify any mismatch between the
values, such as V1, V2, available runway.
expected performance and the actual EFB, FMS
Also including performance data, and
performance of the aircraft
profiles of departure and arrival for
helicopters
Flight plan, delay in departing, and airspace Contextual information to better

Operator
restrictions reconstruct the history of the flight
Other traffic around (gives an indication of

ATC surveillance data, ADS-B data from
Traffic data how busy ATC is and of the actual risk of
private suppliers
airprox)
Training and experience of flight crew Example: to check whether the flight crew
Training records
members member was trained on a particular aspect
Fatigue: flight activity of the flight crew

Level of fatigue of flight crew members
members in the last 72 hours, fatigue risk FRMS, rostering system
(human factor)
index or alertness level
Aircraft technical logs, such as maintenance

intervention, or defect and reliability
Whether a particular aircraft has been
Aircraft maintenance history reports, is Vehicle Health Monitoring data
susceptible to repeated system failures
(or Health and Usage Monitoring System
data in the case of an helicopter)
Constraints imposed by the surrounding

terrain. Analysing approaches to airfield
Geographical information system, terrain
Terrain model where there are frequent TAWS alerts.
databases.
Identify local weather phenomena caused
by terrain (e.g. mountain wave).
Note: This table is not meant to be exhaustive. More data sources may become available in the future.
8
c. What air safety reports can add to FDM

The narrative from a report associated with an event can provide information that is not recorded by flight data.
Examples include actual weather conditions at the time of an event and ATC clearances. A report also provides
information about flight crew perception of the flight, their intentions and a rationale for their actions.
In addition, if a report has been submitted and there is no corresponding FDM event trigger, then this may
identify an issue with the event detection logic. In addition, air safety reports (ASRs) can be used to refine the
detection logic of an FDM event.
For situations involving inadequate use of airborne systems, FDM and ASR data can be correlated to understand
whether a repetitive issue is being reported by flight crews. The benefits of combining ASR with FDM statistics
for this purpose could be:
´´ Define an FDM event in order to assess the actual extent of the issue;
´´ Monitor the effectiveness of risk mitigations with FDM (not just counting ASRs);
´´ Identify those categories of FDM events which are underreported and understand why (are they not
perceived as significant by the flight crews, or have flight crew members got used to experiencing the de-
viations tracked by the FDM events?);
´´ Define an event risk score, to be used for deciding on follow-up actions.
Note: When facing a recurrent issue during the operation (such as a technical failure or an
issue with the SOP), the natural human tendency is to not report it any more after a couple of
occurrences. This is because one gets used to the issue or reporting is perceived as a waste
of time when this issue is perceived as known. In that case, FDM may facilitate a quantitative
assessment of the issue and of any related trend.
d. Automatically combining flight data with other data

A “common identification data point” is necessary to combine the flight data with other data source. Examples
include:
a. Flight number or tail number and departure date and time;
b. Departure point & actual departure date and time; or
c. Arrival point & actual arrival date and time.
Once a unique flight has been identified, it will then be possible to combine flight data related to this flight with
other safety data (see Figure I.1). In order to facilitate the merging of all these data, the creation of a data ware-
house is advisable. This usually requires the setup of a dedicated IT project.
´´ Figure I.1: example of sources of safety data that can contribute to the risk picture.
Operational
FDM
Data
Air Safety Risk Continuing

Reports Picture Airworthiness
9
2. B
enefits of FDM integrated in the SMS
a. How can FDM be used as part of the SMS?
Objectives
The objective should be to support core processes of the SMS, in particular the identification and the assessment
of risk. The FDM programme may play a particular role among SMS data sources, because it has the potential to
capture all flight operations, it records every measurement or deviation which were programmed and it supports
accurate reconstruction of incidents. Refer also to EOFDM document ‘Preparing a memorandum of understand-
ing for an FDM programme’.
Risk monitoring
FDM should always be part of any operational risk monitoring. FDM processes should be as transparent as
possible and FDM should provide up-to-date information to all management levels and to the flight crews.
FDM indicators should be updated frequently and they should be accessible so that they are fully integrated in
the SMS.
Note: this implies that a system is in place allowing the collection and analysis of flight data on
a frequent basis.
b. Practical benefits of FDM in SMS

FDM provide numerous benefits in SMS which include the following:
´´ Elevated safety awareness: The process elevates the safety awareness in all departments including non-
operational departments (e.g. human resource department or finance department). Flight data provides
more clarity on occurrences.
´´ Raising the standardization bar: FDM can be used to achieve better standardization of the operations. In-
deed, FDM can provide feedback to the flight crew members, which will add incentive for the flight crew
members to improve their performance and to uphold the company’s SOPs.
´´ Clear situation and operational awareness: ascertain a clear situational and precise operational aware-
ness for the upper management and most stakeholders. Example: Getting more accurate data on issues
specific to an airfield, or fleet.
´´ Elevate transparency: The FDM elevates transparency and accuracy in the area of reporting.
´´ Safety assurance process: e.g. unstabilised approach and high rate of descent. It is a transparent way of
measuring operational compliance.
´´ Audits of the SMS: FDM is a data source for reactive reporting (Occurrence / Hazard reporting) and proac-
tive reporting (Safety awareness). FDM is part of the demonstration of the reporting process for internal
and external auditors. FDM helps in checking whether risks have been effectively mitigated by correc-
tive actions.
´´ Using aggregated data to monitor SPIs linked to an operators’ risk register;
´´ Management of changes, e.g. monitoring the change to a SOP, following up the operation and deviations
from SOPs when new fleets and/or new pilots are starting in the operator.
10
c. Organizational FDM Integration

When addressing the organizational integration of FDM, the operator must revert back to the “Why” question,
followed by the “How” and finally “What”, in order to have a holistic and transparent view of the possible ways
to integrate the FDM programme:
´´ Why collecting flight data: Is it only for compliance with the rules or a customer agreement, or is it for
enhancing operational safety (e.g. better monitoring a risk portfolio), or for improving operational effi-
ciency (e.g. fuel, use of brakes, etc.)…?
´´ How can the FDM programme be designed and integrated with the SMS so that the objectives in the pre-
vious question are met?
´´ What principles should be defined in the internal policy ruling the SMS and the FDM to ensure the effi-
cient exchange of data?
A clear understanding of cultural aspects at the operator together with a correct safety culture analysis, are es-
sential to define an optimal integration of FDM into an organization. The level of safety and organizational
awareness is driven by management and resource allocation. See also section III.5.
In practice, there are several organization solutions, depending on factors such as whether FDM is performed by
an in-house unit or a third party, whether the company has one or several AOCs, etc.
d. Competences of the FDM and SMS teams

The skills of the FDM and SMS teams are key for successfully ‘breaking data silos’ between FDM and other data
sources.
The competences recommended for the FDM team are provided in guidance material to the EU FDM
requirement4.
The FDM and the SMS teams should include, in addition to the competences described in the guidance materi-
al, a good competence in IT. Indeed, to this date the solutions on the market for combining FDM with other data
sources have limited capabilities. Bridging the various sources of safety data in a smart way requires a good un-
derstanding of these data and how they will be used, as well as IT competence. Meaning in turn that someone
with relevant IT competence is needed in the teams or the FDM service provider either to develop ad-hoc solu-
tions or to translate the FDM/SMS needs for external developers.
All competences do not need to be in-house, however in that case there should be some assurance that they are
present at the service provider(s). Likewise, one individual might cover several competences.
As important as selecting the right individuals for the FDM team is favouring the growth of competence. FDM
competence growth is a rather slow process and a long-term investment. This implies proper allocation of time
and human resource to go beyond just day-to-day jobs and superficial analyses, encouraging professional devel-
opment for all team members and creating the incentives to stay in the FDM team.
If too little is invested into the competence of the FDM and SMS teams, it is unlikely that they will be capable of
developing a robust FDM system integrated with other data sources and with the SMS.
Note: In order to demonstrate the need for human resource for the FDM programme, an internal
ticketing service might be helpful. Such a ticketing service should capture the time spent for
each request, including the time for debriefing with individual flight crew members. It should
also track the time spent on R&D projects.
4 Refer to the acceptable means of compliance and guidance material for Annex III to Commission Regulation (EU) 965/2012 (Part-ORO), GM1 ORO.
AOC.130.
11
3. Examples of combining flight data with

other data
a. Analysing long-flare-distance events
A Long Landing Distance event is triggered in a specific FDM software based only on the distance measured from
the runway threshold to the touchdown point.
The FDM event is triggered yellow when this distance exceeds 750 m, then amber beyond 900 m and finally red
beyond 1050 m (see Figure I.2).
´´ Figure I.2: thresholds applicable to the Long Landing Distance event.
Let’s compare two events, a red one and an amber one.

The red FDM event is triggered with a distance from threshold to touch down greater than 1050 m and the amber
FDM event with this distance between 900 and 1050 m (see Figure I.3 for examples of actual FDM event triggers).
´´ Figure I.3: examples of FDM event triggers for the Long Landing Distance event.
Usually most of the operators will focus on the red one and will probably consider the amber one as being less
priority.
When looking at the first one we realize that this event occurred in Dubai Airport on a 4,315 m runway giving a re-
maining distance available after touch down of 3255 m.
Checking the weather conditions we observe the runway was dry, the wind favorable with a 10 kt ahead compo-
nent and the calibrated airspeed was stable at Vapp. The aircraft status was without effect on the braking efficiency.
When looking at the amber one we observe that this event occurred at New Delhi on a runway with a landing dis-
tance available (LDA) of 2970 m (see Figure I.4). So the remaining distance after touchdown is 2970-1033=1937
m which is a lot considering the normal landing distance on a dry runway.
But looking a bit deeper we observe a tail wind at 11kt, the gross weight at landing is closed to the maximum land-
ing weight and the aircraft is 4 kt above the approach speed. Checking the performance we observe the factored
landing distance, computed with the auto brake to low, is above the LDA. Fortunately, the non-factored landing dis-
tance remains within the LDA but with a stop margin of only 215 m. But because the actual flare was longer than
assumed in the computation, this margin does not exist anymore and that’s the reason why the flight crew had to
revert to manual braking.
Looking at the weather conditions of the day some rain showers have been reported changing the landing perfor-
mance considerably. Here if we consider more the 3 mm of water on the runway, which is not unrealistic in New
Delhi in that period of time, even the auto brake medium setting would not allow at stopping the aircraft on the re-
maining runway following the long flare.
Only the aggregation of data from different sources, (FDM, weather, performance, maintenance), gives reliable in-
dication of the exposure to the risk.
But to go further, it would be necessary to have the feedback of the flight crew (air safety report).
12
´´ Figure I.4: landing performance data for a landing at New Delhi, assuming tailwind is
11 kt, dry runway and breaking mode set on Low.
13
´´ Figure I.5: landing performance data for a landing at New Delhi, assuming tailwind is
11 kt, wet runway and breaking is manual.
14
b. Individual FDM summary reports

Airline ‘A’ has identified high energy approach / unstable approach prevention as part of its 3 year Corporate
Safety Strategy. The purpose of the strategy is to reduce high energy approaches and unstable approaches to an
acceptable level. The airline is providing all captains with monthly FDM summary report which is specifically tar-
geted on approach and configuration exceedances. AFM exceedances are provided as an addendum to the report
along with a summary of the event flights and dates.
Information is collected from multiple data sources and merged to produce an individual report. This report is,
in this example, sent to the mobile devices of flight crew members on a fixed date every month and it provides
a performance report against 21 Key Performance Indicators (KPI’s). Only the concerned flight crew member and
FDM programme trustees have access to the data of an individual performance report.
Data Source
Operational data – Flight number, destination, departure, times, tail number,

Flight crew data – Flight crew members codes, experience levels of flight crew members (months with Airline A).
Flight data – Exceedance data, registration & time
Definitions of FDM events – Triggers, events, event classification, event name
Data flow and merge
The airline IT department uses a system of ETL (extract, transfer and load) to merge and combine the data sourc-
es (see Figure I.6). The data is then exported to a dedicated data mart where the structured data is collated and
prepared for reporting. There are two logical tables or data sets (1st flights, 2nd exceedance) with a link between
the two tables. The date merge generates the report which is then automatically exported to the user.
´´ Figure I.6: data flow.
Operational Information
(Flight Details, inc Crew Data)
My FDM
Airline FDM DataBase Reports
(Events linked to Flights)
Raw Flight Data Processed FDM

(Information ‘Evented’)
Dashboards
Pilot Dashboard Page 1 – Approach Data

There are 21 approach KPI’s that are split between Speed, Rate of Descent, Altitude and Configuration (see Fig-
ure I.7). The information is presented as a value in respect of all approaches conducted in the one month period.
The pilot has comparable data for ‘This Month’, ‘Last Month’, and ‘Year to Date’, the number of approaches car-
ried out by the pilot and an increase / decrease trend indication relative to the previous month.
15
Pilot Dashboard Page 2 - AFM Exceedance data

There are 9 AFM limitations presented in respect of speed, altitude, G loading and weight exceedance (see Fig-
ure I.8). The information is presented as a value in respect of all approaches conducted in the one month period.
The pilot has comparable data for ‘This Month’, ‘Last Month’, and ‘Year to Date’.
An approach performance and overall performance ”rating” is presented as an aggregate of all events that have
occurred on all flights in the previous month and also year to date. The percentage is calculated by sectors flown
minus number of events, divided number of sectors. Hence, when considering the rating corresponding to this
month, if one event is triggered, and the pilot flew 50 sectors in the month, it would be 98%. ‘Year to date’ is
simply the same calculation, but for the previous rolling 12 months.
The benefit with having these rating statistics is that it effectively factors the events taking into consideration
sectors flown.
Note: There is no information on the pilot dashboards that can be used to identify an individual
flight crew member or a specific flight.
Trustee Dashboards
The super users (trustees) can drill down using filters into features such as:
´´ Base/ Captain/ Arrival Airport/ Month/ Severity Class
´´ Detailed as well as high level view of the data
´´ Geographical mapping of the data for ease of reference
´´ Month-on-Month comparisons
Conclusion
Such an initiative together with other awareness or training activities can be very effective in highlighting are-
as of increased operational risk.
16
´´ Figure I.7: example of presentation of key performance indicators related to the approach
(pilot dashboard).
17
´´ Figure I.8: example of presentation of AFM exceedance data (pilot dashboard).
18
c. Enhancing self-awareness and encouraging positive behaviour

In traditional FDM programmes the flight crews, despite being the ones creating the data, have been little in-
volved in the process that takes place after the data has been received, analysed and used for safety actions. In
the most basic systems, the flight crew only knows this data through debriefings of incidents and accidents. An-
other typical use of flight data could be through statistics, usually containing data on exceedances, presented to
a group of pilots. This kind of statistics could be helpful in identifying negative trends and possible safety risks
within the operation.
Debriefs and statistical data based on exceedances are a small part of all data available in a FDM system, e.g.
even if a pilot has never exceeded a flap extension speed limit, the system would have data from all his flights
and the possibility to say his max, min, and average speed for selecting flaps.
Further development of the FDM system within the organization could result in an increased self-awareness of
own performance, thus enhancing further safety.
Excerpt from the ICAO Safety Management Manual, Doc 9859:

‘A healthy safety culture actively seeks improvements, vigilantly remains aware of hazards and utilizes systems
and tools for continuous monitoring, analysis and investigation.’
Pilot feedback could range from an individual feedback on per event/ limit exceeded to more advanced reports.
As stated earlier, it could be beneficial to not only look at limits and exceedances, but also other underlying data
that could indicate something about pilots’ technique.
Presenting data of a pilot’s performance should be accompanied with some guidance on what the intended
range for that data is, this could be referenced from e.g. training manuals or operations manuals. For certain data
sets it could be beneficial to include the average performance of pilot’s peers.
Example 1
´´ Table I.2: example of individual feedback (rotation rate).

AVERAGE ROTATION RATE DURING TAKEOFF
PILOT A ALL PILOTS ON FLEET TRAINING MANUAL GUIDANCE
1,8 DEG/S 2,2 DEG/S 2-3 DEG/S
Table I.2 will indicate to the pilot receiving this data that he is rotating at a slower rate than the recommendations
set in the training manual. At the same time, he can see that he is not aligned with the rest of the pilot group.
Had this data been presented in a pilot group or fleet wide statistics the average would have been within the set
limits of the training manual and pilot A (from the example) would most likely not be aware of his technique be-
ing out of the guidance limits.
Note:
In order to get a meaningful comparison, the context should also be provided. For example:
1. The pilot and the pilot group are operating the same aircraft model,
2. The type of mission is the same,
3. The pilot and the pilot group are operating the same kind of airfields, and
4. The size of the sample must be large enough to make meaningful statistics.
19
Example 2
´´ Table I.3: example of individual feedback (average air speed at the time flap 1 is selected).
AVERAGE AIRSPEED AT FLAP 1 SELECTION
PILOT A ALL PILOTS ON FLEET SOP
MAX 240, AIM FOR MNVR SPD FOR CURRENT

230 KT 220 KT
FLAP.
Pilot A is on average 10 knots below the 240 knots limit that would typically be set as the trigger limit for an
FDM event however, he selects the flaps at an airspeed which is in average 10 knots higher than his peers (see
table I.3).
Example 3
If pilot A has received the information from example 1 he will hopefully be trying to adjust his technique to be in
line with the guidance limits. For the pilot to easily identify improvements over time he/she should be present-
ed with a possibility to view the development over time for the selected parameter (see Table I.4 and Figure I.9).
´´ Table I.4: example of individual feedback (evolution of average rotation rate during take-
off over time)
AVERAGE ROTATION RATE DURING TAKEOFF, PILOT A (DEG/S)
JAN FEB MAR APR
1,8 1,9 2,1 2,2
´´ Figure I.9: example of individual feedback (evolution of average rotation rate during
take-off over time).
3.5
3.0
Rotation rate
2.5
2.0
1.5
1.0
Jan Feb Mar Apr May
Training Manual Guidance Pilot A
Note 1: Providing flight crew members with their performance data should be done very
carefully in order not to cause any unnecessary changes in flying technique/behaviour. In other
words, the intention of providing performance data is not for pilots to fly the aircraft in order
to have ”good stats” but rather a means of helping them monitor their own performance and
20
raise self-awareness of any unwanted trends. The most important objective behind such reports
remains compliance with the SOPs and the operations manual.
Note 2: Any kind of flight-data-based visualisation (plots, animations, etc.) generated to provide
feedback to the flight crews should not be made available without pre-validation and technical
support to interpret the visualisation, and assistance from an honest broker / gatekeeper with
operational experience. Indeed, systematically providing data without support and context is
likely to be counter-productive.
4. Black and white vs. grey – combining

objective and subjective information
a. Introduction
Digital data from airborne systems5 are generated and recorded based on a clearly defined target, threshold or
criteria. Hence, if the defined condition is satisfied the information is generated and recorded. The condition for
their existence is clearly defined and therefore considered as “objective data”.
By definition, objective data is very consistent and it will often tell us that something happened. However, it will
not provide a complete picture of the context and therefore other data sources are necessary in order to provide
a more accurate picture of what happened.
From a safety perspective, one source of complementary data can be a safety report submitted by a flight crew
member. And while there are set requirements for what needs to be reported, the occurrence needs to be detect-
ed (or identified) by the flight crew member, interpreted as an occurrence which satisfies the reporting criteria
and, finally, needs to be reported after-the-fact with details of the flight crew member’s recollection of what hap-
pened. These various conditions need to be met for a safety report to be generated and submitted for analysis.
Therefore, in comparison with objective data, such data sources which are subject to a large extent on human
interpretation and individual perception of risk, can be considered as “subjective data”.
Note: As explained in GM1 ORO.AOC.130, ‘It should be noted that recorded flight data have
limitations, e.g. not all the information displayed to the flight crew is recorded, the source of
recorded data may be different from the source used by a flight instrument, the sampling rate
or the recording resolution of a parameter may be insufficient to capture accurate information.’
Hence, objective data can be difficult to interpret or even lead to wrong conclusions, especially
when one does not know well the source and the limitations of this data.
5 The Flight Data Recorder and Quick Access Recorder are just a few examples of data sources on the aircraft. Terrain Awareness and Warning System
(TAWS), Airborne Collision Avoidance System (ACAS), Central Maintenance Computer (CMC) and Electronic Engine Controller (EEC) are other sources of
digital data, available for internal systems processing and for download for analysis purposes.
21
b. S ome organizational challenges of combining flight data with air

safety reports
There are several challenges faced when objective data is combined with subjective data. Firstly, there is the tech-
nological challenge. Existing safety data management systems have come a long way to allow ease-of-use and
practical management of safety data. However, without a system automatically linking the FDM software with
air safety reports, it is necessary to access and interact with different sources of data separately in order to in-
vestigate an event.
Therefore, the task of combining data between several sources becomes a manual process, arduous and time
consuming, which makes it impractical for an organization to systematically engage in complementing air safe-
ty reports with FDM data.
Another challenge is the flight crew perception. For any given event there may be several details which may go
unnoticed by the flight crew members, yet picked-up though FDM. Indeed, the flight crew members may have
a different recollection, may omit certain details or even, ultimately, fail to submit the report. Without FDM,
this could lead to an event to go unnoticed. In addition, flight data can be used to add technical details to the
event, get an enhanced reconstruction of the event or alert the flight crew for the need for a retrospective air
safety report.
However, this may cause a sense of being watched and lectured even though the main purpose is to comple-
ment the information contained in the safety report, in the interest of creating a more accurate picture of what
happened and therefore to identify and address hazards more precisely. Hence, such a practice needs to be
considered very carefully and executed with great care in order not to cause any adverse perception or conse-
quences among flight crew member. As expressed earlier, the organization and flight crew members must evolve
together in terms of safety culture to reach the stage where they are prepared and confident about using data
from FDM for maximum safety benefit to the operation. In practical terms, the organization can, again, establish
a risk classification criteria for when flight data is used to help analyse events reported through air safety reports.
Note: In order to encourage reporting by staff members (flight crew members, but also
technicians and ground staff), the reporting tools should be user-friendly and easily available.
Also a review of all channels of reporting, which may compete with one another, may be helpful.
22
5. The state of play in 2018
a. Online survey on combining flight data and other data sources

A survey of operators was performed during spring 2018. The survey aimed at answering the following
questions:
´´ Benefits perceived by the operators?
´´ Capabilities and limitations of current FDM/SMS tools?
´´ How is flight data protected when it is combined with other data?
´´ Any implementation issue?
The survey was aimed at aircraft operators and was made available online. It included 22 questions (some of
which single-choice and others multiple-choice) and free text fields to collect more specific input.
Overall, 26 responses were received from a total of 22 operators. The survey responses were treated in confi-
dence and only figures and de-identified summary of comments are shared.
The set of the survey is presented in Figures I.10, I.11 and I.12.
23
´´ Figure I.10: distribution of the place of business of operators between EASA Member
States and other States.
18%
Based in an EASA MS
Not based in EASA MS
82%
´´ Figure I.11: distribution of participating operators according to the category of

operated aircraft.
4%
9%
Operating aeroplane with MCTOMs>27 000 kg only

14%
Operating aeroplanes (including MCTOM<27 000kg)
Operating helicopters only
Operating aeroplanes and helicopters
73%
24
´´ Figure I.12: distribution of participating operators according to the size of the fleet.
9%
30 aircraft or more
23%
Between 10 and 29 aircraft
Less than 10
68%
The survey replies showed that about 80% of participating operators were using FDM software capable of
exporting data (see Figure I.13), and that for about 60%, the FDM software is even capable of automatically ex-
porting data: typically the flight parameters corresponding to an FDM event trigger can be exported.
However, most of the time the data can just be exported in CSV (Excel compatible) format or in raw bit stream
format, and sometimes KMZ/KML (Google Earth compatible).
´´ Figure I.13: distribution of participating operators according to the capability of their FDM
software with regards to exporting FDM data.
15%
19%
Can the exporting of FDM data be automated?

4%
No
Yes
I don't know
(Not replied)
62%
In addition, less than 20% of participants had tools for automatically combining data from their FDM programme
with other data sources, while the majority combine these data with other data on a case-by-case basis (in the
case of an incident investigation or an ad-hoc study).
25
´´ Figure I.14: distribution of survey replies with regards to the combination of FDM data
with other data.
When is FDM data combined with other data?
12
10
0
For incident For ad-hoc Automatically on incoming Other
investigations studies FDM data files
The main technical limitations of combining FDM with other data sources appear to be the complexity and the
number of manual actions, the data reliability and the data quality (see Figure I.15). Non-technical limitations
are discussed in section III.2.
´´ Figure I.15: distribution of survey replies with regards to the main limitation of FDM tools.
Main limitations of the tool(s)

9
0
Complexity or number Data Data quality Cost Other I don't know
of actions required reliability
b. Conclusion
Most of existing FDM analysis systems allow data to be exported in several different formats in order to be com-
bined with other data sources, but this often requires a significant amount of effort or resources. And in many
cases, this is the main obstacle to combining data from FDM with other sources in a more systematic basis.
This means that some of the FDM analysis systems could be further improved and better linked to air safety
reports, or automatically import relevant contextual data for a given FDM event trigger. Too often, a signifi-
cant amount of time is spent by aircraft operators on developing a solution to connect different systems with
each other.
26
II. Confidentiality vs. Safety –

where to draw the line
1. Confidentiality requirements for

FDM programmes and applicable EU
legislation
Note: this section contains explanations and good practice about the relationships between FDM
requirements and other rules. Like the rest of this document, it only presents the view of EOFDM
members and it should not be confused with EASA official guidance.
a. The air operation requirements

The setup of a FDM programme is required by EU air operation rules for large aeroplanes operated under an
AOC (commercial air transport) and for helicopters operated for commercial air transport offshore helicopters6.
Paragraph ORO.AOC.130 of Annex III (Part ORO) to Commission Regulation (EU) 965/2012 contains the EU rule
applicable to aeroplanes:
‘ORO.AOC.130 Flight data monitoring — aeroplanes
a. The operator shall establish and maintain a flight data monitoring system, which shall be integrated in its
management system, for aeroplanes with a maximum certificated take-off mass of more than 27 000 kg.
b. The flight data monitoring system shall be non-punitive and contain adequate safeguards to protect the
source(s) of the data.’
Paragraph SPA.HOFO.145 of Annex V to Commission Regulation (EU) 965/2012 contains the EU rule applicable
to helicopters:
‘SPA.HOFO.145 Flight data monitoring (FDM) system
a. When conducting CAT operations with a helicopter equipped with a flight data recorder, the operator shall
establish and maintain a FDM system, as part of its integrated management system, by 1 January 2019.
b. The FDM system shall be non-punitive and contain adequate safeguards to protect the source(s) of
the data.’
Hence, ‘adequate safeguards to protect the source(s) of data’ are required by EU air operation rules. Therefore,
the following is recommended to be checked by the oversight authority in EAFDM document ‘Good practice on
the oversight of FDM programmes’:
a. Statement on the general condition of use and protection of the flight data used in the framework of an
FDM programme.
b. The flight crew members have access to the safety policy statement and the corresponding documents.
6 See https://www.easa.europa.eu/document-library/general-publications/easy-access-rules-air-operations.
27
b. What policy should be in place?

The EU air operation rules are complemented by acceptable means of compliance (AMC) issued by EASA. AMC
are non-binding standards which illustrate means to establish compliance with a rule7.
‘AMC1 ORO.AOC.130 Flight data monitoring – aeroplanes
(...)
(j) The data access and security policy should restrict information access to authorised persons. When data access is
required for airworthiness and maintenance purposes, a procedure should be in place to prevent disclosure of crew
identity.’
Note 1: AMC1 SPA.HOFO.145 refers to AMC1 ORO.AOC.130 for all aspects, except the example
list of FDM events in Appendix 1 to AMC1 ORO.AOC.130. Hence the provisions related to
confidentiality and data protection in AMC1 ORO.AOC.130 are also applicable to helicopters
required to comply with SPA.HOFO.145.
Note 2: Refer to EOFDM document ’Preparing a memorandum of understanding for an FDM

programme for guidance on the data access and security policy’, chapter 2, for the data access
and security policy.
c. Who at the operator is responsible for the protection of data?

ORO.AOC.130 and SPA.HOFO.145 state that the FDM programme ‘shall be integrated in its management system’
and so it refers to ORO.GEN.200 Management system.
In addition, AMC1 ORO.GEN.200(a)(1) recommends the following:
‘The management system of an operator should encompass safety by including a safety manager and a safety re-
view board in the organizational structure.
a. Safety manager
1. The safety manager should act as the focal point and be responsible for the development, administra-
tion and maintenance of an effective safety management system.’
Further to that, AMC1 ORO.AOC.130 recommends:
‘(a) The safety manager, as defined under AMC1-ORO.GEN.200(a)(1), should be responsible for the identification and
assessment of issues and their transmission to the manager(s) responsible for the process(es) concerned.’
The safety manager is designated by AMC1 ORO.AOC.130 as the responsible manager for the ‘transmission’ of
issues, which means that he/she should be responsible for deciding what information needs to be transmitted
and to which service. This also implies that the safety manager should be consulted in the establishment of the
‘safeguards to protect the source(s) of the data’8 required by ORO.AOC.130 and SPA.HOFO.145, so that he/she
can easily arbitrate the transmission of issues detected by the FDM programme. However, it does not mean that
the safety manager him/herself must ensure the protection of FDM data or is responsible for FDM data security.
7 The AMC issued by EASA are not of a legislative nature. They cannot create additional obligations on the regulated persons, who may decide to show
compliance with the applicable requirements using other means. However, as the legislator wanted such material to provide for legal certainty and
to contribute to uniform implementation, it provided the AMC adopted by EASA with a presumption of compliance with the rules, so that it commits
competent authorities to recognise regulated persons complying with EASA AMC as complying with the corresponding rules.
8 The data protection officer should also be consulted: see the part E of this section.
28
d. W
hat does the regulation on occurrence reporting mean for FDM
programmes?
Regulation (EU) 376/2014 on the reporting, analysis and follow-up of occurrences in civil aviation applies to (see
Article 3(1)):
´´ ‘occurrences’ i.e. any safety-related event which endangers or which, if not corrected or addressed, could
endanger an aircraft, its occupants or any other person and includes in particular an accident or serious
incident,
´´ and to other relevant safety-related information in that context.
The European Commission also published Guidance Material for Regulation (EU) No 376/2014 and Commission
Implementing regulation (EU) 2015/10189.
This official guidance material states:
‘It is understood that Regulation 376/2014 does not apply to automatic sources of safety information such as the
Flight Data Monitoring programmes in air operators or radar track analysis calculations in Air Navigation Service
Providers.’ This means that an FDM event trigger is not considered as an occurrence under Regulation (EU) 376/2014.
However, an FDM event trigger could reveal an occurrence. In that case, this official guidance states:
‘In some cases an individual may be made aware of an occurrence through the automatic reporting systems of his/
her organisation (e.g. Flight Data Monitoring programme, post processing of radar tracks etc) and not during the
actual operation. In those cases, the 72 hours period [for reporting an occurrence] starts when the potential report-
er is made aware of this occurrence.’
e. W
hat does the regulation on personal data protection mean
for an FDM programme?
Definitions
Regulation (EU) 2016/679 on the protection of natural persons with regards to the processing of personal data
and on the free movement of such data, defines the following (Article 4):
´´ ‘personal data’ means any information relating to an identified or identifiable natural person (‘data sub-
ject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by
reference to an identifier such as a name, an identification number, location data, an online identifier or
to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or so-
cial identity of that natural person.
´´ ‘processing’ means any operation or set of operations which is performed on personal data or on sets
of personal data, whether or not by automated means, such as collection, recording, organisation,
structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dis-
semination or otherwise making available, alignment or combination, restriction, erasure or destruction;
´´ ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or
jointly with others, determines the purposes and means of the processing of personal data; (…)
According to these definitions, raw flight data may be considered ‘personal data’ (as they can be associated to
flight crew members), and Regulation 2016/679 should be considered when collecting raw flight data. However,
if all information allowing direct or indirect identification of a flight crew member is removed from flight data,
then it does not need to be considered personal data.
9 See https://ec.europa.eu/transport/sites/transport/files/modes/air/safety/doc/guidancematerial376.pdf.
29
In addition, the recital of Regulation 2016/0679 contains the following explanations:

‘The principles of data protection should apply to any information concerning an identified or identifiable natural
person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by
the use of additional information should be considered to be information on an identifiable natural person. To de-
termine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be
used, such as singling out, either by the controller or by another person to identify the natural person directly or in-
directly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should
be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into
consideration the available technology at the time of the processing and technological developments. The princi-
ples of data protection should therefore not apply to anonymous information, namely information which does not
relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that
the data subject is not or no longer identifiable. This regulation does not therefore concern the processing of such
anonymous information, including for statistical or research purposes.’
Data protection officer
The tasks of the data protection officer are defined in Article 39. They mainly consist in informing and advising,
monitoring compliance raising awareness and training the staff. However, the responsibility of protecting the
data remains with the data controller (i.e. for FDM, the operator).
Data processing
Regulation (EU) 2016/679 establishes the following:

Article 5 – Principles relating to the processing of personal data
‘1. Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness
and transparency’);
b. collected for specified, explicit and legitimate purposes (…); further processing for archiving purposes in the
public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Ar-
ticle 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);
c. adequate, relevant and limited to what is necessary in relation to the purposes for which they are pro-
cessed (‘data minimisation’);
d. accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that per-
sonal data that are inaccurate, having regard to the purposes for which they are processed, are erased or
rectified without delay (‘accuracy’);
e. kept in a form which permits identification of data subjects for no longer than is necessary for the purpos-
es for which the personal data are processed; personal data may be stored for longer periods insofar as the
personal data will be processed solely for archiving purposes in the public interest, scientific or historical re-
search purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the
appropriate technical and organisational measures required by this Regulation in order to safeguard the
rights and freedoms of the data subject (‘storage limitation’);
f. processed in a manner that ensures appropriate security of the personal data, including protection against
unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropri-
ate technical or organisational measures (‘integrity and confidentiality’).’
While ORO.AOC.130, SPA.HOFO.145 and their AMC cover points (a), (b) and (c) of Article 5, attention should be
paid to points (d), (e) (f). These aspects should also be addressed in the policies addressing the FDM programme.
30
Note 1: The ‘fairness’ principle mentioned in point (a) of Article 5 is addressed in points (60) and
(61) of the recital of Regulation (EU) 2016/679. In short, fairness means handling personal data in
ways that people would reasonably expect and not use it in ways that have unjustified adverse
effects on them. The fairness principle is taken into account in AMC1 ORO.AOC.130. Indeed,
Point (b) of AMC1 ORO.AOC.130 describes what the FDM programme should allow the operator
to do (identify areas of operational risk, quantify risks, put in place procedures for remedial
action, confirm the effectiveness of remedial actions), and point (k) specify that the procedure to
prevent disclosure of crew identity should be written in a document which should be signed by
all parties (including flight crew member representatives). However, when flight data is used for
other purposes than an FDM programme (e.g. for operating efficiency) or combined with other
protected, the issue of fairness should be addressed.
Note 2: EOFDM document ‘Preparing a memorandum of understanding for an FDM programme’,

provides advice regarding data retention.
Article 6 – lawfulness of processing

‘1. Processing shall be lawful only if and to the extent that at least one of the following applies:
a. the data subject has given consent to the processing of his or her personal data for one or more specific
purposes;
b. …;
c. processing is necessary for compliance with a legal obligation to which the controller is subject;
d. …;
e. …;
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third
party, except where such interests are overridden by the interests or fundamental rights and freedoms of
the data subject which require protection of personal data, in particular where the data subject is a child.’
Hence the use of flight data for an FDM programme can be considered lawful under Art 6.1 (c): the processing is
necessary for compliance with EU air operation rules.
However, when an FDM programme is implemented at the initiative of the operator (not required by the EU air
operation rules) or if the flight data are used for purposes other than operational safety (e.g. for airworthiness
or maintenance purposes, fuel efficiency, etc.) then the operator should identify the conditions for ensuring that
these other uses are lawful.
Example: The readout of specific parameters can be requested by the maintenance manual as
a necessary step in the troubleshooting procedure to restore the airworthiness of an aircraft.
Note 1: If de-identified information stemming from flight data is provided to airworthiness or

maintenance purposes, then the general data protection regulation does not apply to that data.
In addition, improving operational safety, continuing airworthiness or limiting the environmental
impact of operations might be considered as ‘legitimate interests’ of the operator.
Note 2: Regulation 679/2016 defines consent as follows (refer to Article 4):

‘Consent’ of the data subject means any freely given, specific, informed and unambiguous
indication of the data subject’s wishes by which he or she, by a statement or by a clear
affirmative action, signifies agreement to the processing of personal data relating to him or her;
In the case of a relationship employer/employee between the data controller and the data
subject (like between the operator and flight crew members), the consent of the employee might
be considered as not ‘freely given’.
31
Note 3: When flight data is combined with other data, the technical protection of the combined
data should follow the highest standard among technical protection standards applicable among
the data sources for this combined data. In practice it is advised that the combined data is
securely stored and that it is encrypted.
Rights of the data subject
Regulation 2016/679 defines the rights of the data subject in Chapter III of Regulation (EU) 2016/679. The op-
erator should be aware of these provisions and check that they are taken into account in the internal policies
regulating the FDM programme.
In particular:
Article 13 - Information to be provided where personal data are collected from the data subject
Article 15 - right of access by data subject
‘1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal
data concerning him are being processed.’
Article 15 provides a list of information the data subject has the right to obtain. However, Article 15.4 states: ‘The
right to obtain a copy [of personal data] shall not adversely affect the rights and freedoms of others’.
In the case where the aircraft is piloted by two flight crew members, the flight data are not related to one single
flight crew member, but to both.
Article 16 - Right to rectification
‘The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccu-
rate personal data concerning him or her.’
Where FDM data is considered personal (because associated to identified FDM members), a flight crew member
might require correction of errors in that data. Hence, validation of FDM event triggers is important to avoid that
undesired (i.e. non-relevant) FDM event triggers are used for following up the performance of individual flight
crew members or initiate flight crew contact. An event detection can be undesired for several reasons, which
are explained in EOFDM document titled ‘Key performance indicators for a flight data monitoring programme’.
Article 17 - Right to erasure
‘1.The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or
her without undue delay and the controller shall have the obligation to erase personal data without undue delay
where one of the following grounds applies:
(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise
processed;
(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or
point (a) of Article 9(2), and where there is no other legal ground for the processing;
(…)’
Note: Regulation 2016/679 also defines the general obligations of the data controller and
processor in Chapter IV of Regulation (EU) 2016/679.
f. What happens when an official safety investigation is launched?
General principles
According to ICAO Annex 13 on Accident and Incident Investigations, the authority’s investigator-in-charge is
entitled to access all data and evidence that are relevant for the investigation. In Europe, these principles were
32
transposed to Regulation (EU) 996/2010. This Regulation applies, among others, to the official investigations of
accidents and serious incidents which have occurred in Europe, or where an EASA Member State is involved as
State of the Operator (see Article 3).
Article 11:
‘2. N
otwithstanding any confidentiality obligations under the legal acts of the Union or national law, the inves-
tigator-in- charge shall in particular be entitled to:
…
(c) have immediate access to and control over the flight recorders, their contents and any other relevant
recordings;
…
(g) h
ave free access to any relevant information or records held by the owner, (…), the operator or the manufac-
turer of the aircraft,...’
Article 13:
‘3. Any person involved shall take all necessary steps to preserve documents, material and recordings in relation
to the event…’
Article 15:
‘1. The staff of the safety investigation authority in charge, or any other person called upon to participate in or
contribute to the safety investigation shall be bound by applicable rules of professional secrecy’
Therefore, it is advised that the flight data files pertaining to an accident or a serious incident are integrally pre-
served and made available on request by the official safety investigation authority.
Care should also be taken of the confidentiality of the official safety investigation.
Case where FDR data is used for the FDM programme
In the particular case where the flight data recorder (FDR) is used for the FDM programme, AMC1 ORO.AOC.130
indicates that:
‘(f) Accident and incident data requirements specified in CAT.GEN.MPA.195 take precedence over the require-
ments of an FDM programme. In these cases the FDR data should be retained as part of the investigation data
and may fall outside the de-identification agreements. ‘
CAT.GEN.MPA.195 (Handling of flight recorder recordings: preservation, production, protection and use) indi-
cates that:
‘(a) Following an accident, a serious incident or an occurrence identified by the investigating authority, the opera-
tor of an aircraft shall preserve the original recorded data for a period of 60 days or until otherwise directed by the
investigating authority.’
33
2. The current practice
a. Online survey on combining flight data and other data sources

This section presents the results of a survey performed in 201810, on the data access policies in place at opera-
tors and the current practice regarding merging FDM data with other data. The results of this survey regarding
the tools and technical capabilities are presented in Chapter I.
Over half of all participants replied that they did not have a common data access policy covering both FDM and
air safety reports (ASR). The remainder either had such a policy (about a third) in place or did not know (10%).
´´ Figure II.1: distribution of participating operators depending on whether they have

a common data access policy.
11%
Does your company have a common data access policy

covering both FDM and ASRs?
No
35%
Yes
I don't know
54%
Almost 90% of all participants replied that flight data would also be used to analyse events reported through an
ASR, which is not subject to mandatory occurrence reporting (see Figure II.2). All participants indicated that in
case of an incident subject to mandatory occurrence reporting, flight data from the incident flight is used to an-
alyse the occurrence report.
This seems to show that while there are well-functioning channels between the FDM programme and the inter-
nal occurrence reporting system at most operators, data often stay subject to different data access policies. Also,
ASRs are usually managed internally by an aircraft operator while the FDM programme may be subcontracted.
Having multiple data access policies and/or data processing solutions does not hinder an effective analysis of
ASRs and flight data, but it makes the gathering of these data and their combination challenging.
10 This survey was performed shortly before the entry into force of Regulation (EU) 2016/679 (General data protection regulation)
34
´´ Figure II.2: distribution of participating operators depending on the use of FDM data to
analyse ASR.
4% 8%
In case of an ASR not subject to mandatory

occurrence reporting, is FDM data from the
ASR flight often used to analyse the ASR?
No
Yes
I don't know
88%
Insufficient time or lack of human resources was the main reason identified by participants for not combining
FDM with other data sources. Technical impossibility for doing this also ranked quite high among the respond-
ents (see Figure II.3).
An agreement with flight crew members or internal SMS policy or restricted access to the internal safety data
warehouse, are some of the measures in place to protect files containing flight data combined with other data.
Note: the survey question related to this aspect is not specifying whether FDM is exported and
combined with other data or it is the other way around.
Most operators have either a system based on a gate-keeper (restricting access to identified FDM data for any-
one else) or a system entrusting the safety manager team (see Figure II.4). It is indeed essential that the safety
manager (or designated members of his/her team) have complete access to the information necessary for per-
forming a thorough assessment.
On the other hand, when it comes to staff other than from the FDM team or the safety management team, it is
advisable to provide access to flight data only on a case-by-case and need-to-know basis.
´´ Figure II.3: distribution of replies with regards to the main limitations to combining FDM
data with other data.
What are, in your company, the main limitations to combining FDM with other data?
14
12
10
0
Lack of time Not technically Possibilities not Lack of internal Other Not a priority Forbidden by
or human resource possible yet assessed coordination company policy
35
Note: One participant mentioned the difficulty to reconcile the General Data Protection
Regulation with the OPS requirements regarding FDM. Another participant mentioned the
challenge to visualize the FDM data in a meaningful way. The distrust of flight crew unions was
also mentioned as a source of major hindrance by one participant.
´´ Figure II.4: distribution of replies with regards to the access to identified data.
Which internal stakeholders (other than the staff processing the FDM data and the gate-keeper)
have an unrestricted access to the identified FDM data?
14
12
10
0
Safety No one else Maintenance Accountable Flight crew Other
manager team manager members
b. Conclusion
It is interesting to note that some operators combine flight data with other data in the interest of safety, whether
for incident investigations or ad-hoc studies. Likewise, many operators use FDM data to analyse events voluntar-
ily reported through a safety report and not limit their investigations to the occurrences subject to mandatory
reporting.
Finally, it is important to recognise that the industry is coming to terms with the added benefit of FDM for risk
management and safety performance monitoring of an operation. Evidence of this is that 14% of the survey par-
ticipants extend their FDM programme to aircraft in their operation which fall below the 27 tonnes requirement
threshold. As FDM becomes an integral part of the safety management system, operators will increasingly seek
systems which make it easier to combine sources of safety data, seamlessly, all on the same platform.
36
3. T he potential conflict between

confidentiality and the broader use of
FDM for safety
a. A non-punitive FDM programme in a just culture environment

FDM was introduced with the sole objective of enhancing safety.
Because a direct monitoring of individual crew members is possible with an FDM program, there is a need to
reconcile the non-punitive character of FDM on one hand and the identification of unacceptable behaviour on
the other hand.
According to EU requirements applicable to FDM, the safety manager should be responsible for the identification
and assessment of safety issues (see also section II.1).
In addition, EOFDM document ‘Preparing a memorandum of understanding for an FDM programme’ recom-
mends among others:
´´ That FDM is embedded in a just culture environment that basically promotes a non-punitive, open and
transparent reporting culture while at the same time recognising that unacceptable behaviour such as
gross negligence is not be tolerated. With the introduction of Regulation (EU) 376/2014, a definition of
what “gross negligence” in aviation should be, found its way into European legislation for the first time.
´´ To define a clear framework for contacting the flight crew after FDM findings where follow-up is required.
One possible solution is based on a gate keeper who can contact the crew to collect information after
a significant FDM event trigger.
´´ To balance the need for confidentiality versus accountability once potentially unacceptable behaviour was
detected.
b. Finding the optimal level of protection for flight data

Protecting flight data while making it available for wider use to enhance operational safety can be difficult.
´´ An FDM programme with a stronger tendency towards confidentiality can cause flight crew members to
be more honest and forthcoming with information during the analysis of the events by the FDM team (say
with a peer pilot). However, the subsequent use and benefit of that information within the organization’s
risk management process are hindered due to confidentiality restrictions. Indeed, information provided
without the support of accurate data such as provided by FDM may have less force and be less convinc-
ing for decision makers.
´´ An FDM programme that is more open may not obtain as much honest and open information from the
crew compared to a more restrictive model. However, it may be more effective from a risk management
perspective and achieve greater safety gains.
Note 1: The principles for removing confidentiality should be defined in procedures and be clear
to everybody. In addition, such procedure should clearly identify who is responsible for what
action (interview, debrief, training, etc.).
Note 2: It is recommended to consider the “who-needs-to-know-what” principle in the sharing of

safety data inside the operator. The principle is to share with each internal stakeholder what they
need to know for their duty and not more.
37
c. Further developments
With the larger amount of data recorded on new aircraft models, insight into aircraft performance beyond mere
flight envelope and SOP monitoring is easily possible. The following list describes several areas of interest:
Performance monitoring
This is one of the most prominent fields of interest for an operator as it may very quickly yield results in many ar-
eas ranging from safety to economic and environmental benefits.
Note: Some of the areas may span over safety and other areas. For example, single-engine taxi
could be analysed for safety purposes or other performance purposes.
Safety performance monitoring

It consists in providing to flight crew members a means where they can see their performance against several
safety performance indicators. For example, a safety performance indicator provides the number of triggers for
a particular FDM event over the last 30 calendar days. An example is provided in II.4.
Operational performance monitoring
In an ever competitive economic environment where costs such as fuel, staffing and maintenance attribute to
a significant proportion to the overall operating costs of an airline, flight data can be used to assess the effec-
tiveness of company procedures with regards to operating efficiency.
For example:
´´ percentage of flights completing single engine taxi;
´´ adherence to procedures, such as engine cool-down and warm-up times, thrust limits etc. being observed;
´´ route analysis: compare different routes i.e. oceanic routing versus domestic, shorter routing with restric-
tions (i.e. level caps) versus longer unrestricted routes. Bringing together comparison data for fuel burn,
A/C and engine hours / maintenance requirements, staffing (i.e. pilot costs) could allow an airline to effi-
ciently create its flight plans.
Flight animations and training
Developments in this area fall into a number of closely related categories:

´´ The appearance of sophisticated data analysis and processing software as well as user-friendly hardware
facilitates replay of own flights at user level. Most importantly the approach and landing phase. Some op-
erators are already making this available to their crews.
´´ A logical continuation of flight animations is the possibility to create an individual performance report.
Operators define certain criteria (such as (vertical) speed limits or stabilization on final) and provide an
overview of how an individual pilot performed compared to the rest of his/her group (see section I.3).
´´ Another development would be to make good use of the acquired individual performance data and devel-
op training of individual deficits during recurrent sim lessons. This is already in some operators’ training
processes. Pilots could be encouraged to bring their personal results to the next planned simulator event
and the instructor would take care of the individual deficits as far as possible.
38
d. Emerging issues
Performance monitoring
The use of individual performance reports may easily lead to the unwanted situation that crews rather “fly the
recorder” than the aircraft. In other words, they worry more about limits than about good airmanship. As a re-
sult, unwanted situations could occur because a crew’s primary focus was not on proper decision making as is
recognised in ICAO doc 10 000:
‘2.4.5 A proper value should be programmed for trigger and exceedance and designed to include an acceptable
buffer that will disregard minor deviation, spurious events, as well as introduce an adequate operational margin
to fly the aeroplane through SOPs, instead of leading the flight crew to focus on FDA parameters in order to avoid
deviations.’
The EOFDM document ’Key performance indicators for a flight data monitoring programme’ also refers to these
risks:
‘An event detection can be undesired for several reasons, such as:
´´ Corrupt data or faulty data due to an on-board sensor(s) failure (see note 1);
´´ A shortcoming in the measurement algorithm, detection logic or other FDM software configuration;
´´ It’s the result of a necessary, intentional and expected action from the crew – meaning it’s detection is cor-
rect, but the event is not applicable in the context of the flight (see note 2). ’
The effect of improperly set individual performance reports is potentiated when performance (of the individual)
could be used as a basis for management decisions or even for disciplinary actions, especially when no seniority
systems are in place or contract details are negotiated individually. It is imperative that individual performance
reports are fine-tuned in order to include margins so that they do not put unnecessary emphasis on a ‘perfect’
flight profile.
Note: Individual performance reports tell little about how an individual pilot will “perform” in an
exceptional situation. Hence, being focussed on individual performance reports (or other kinds
of SPIs) might create a false feeling of being safe while it just shows a high level of compliance
with SOPs.
The balance between safety, efficiency and environmental factors is a delicate one. For example, linking fuel
monitoring to disciplinary supervision is unacceptable. Crews need to be absolutely free in their decision re-
garding the fuel quantity carried for each flight. These decisions must be based on the circumstances of the
respective flight. Any pressure because of economic considerations will eventually compromise safety. Even the
mere comparison of “fuel performance” between crews may result in a competition to take less and less fuel
with negative safety consequences.
Flight animations and training
Flight animations are prone to significant limitations:

´´ Data integrity should be checked before the replay to ensure their correctness (data validation). Missing
data or a spike in data could lead to significant deviations between the visualisation and the actually flown
flight path and/or instrument indications
´´ Some of the parameters shown in an animation are not actually measured and recorded but calculated or
derived from one or more other parameters. For example, altitude values shown may or may not be cor-
rected for QNH regardless of what value is displayed in the altimeter setting window. Also, Flight Mode
Annunciations are usually derived from a complex algorithm using multiple parameters. The resulted val-
ue may not be correct.
39
Obviously, the above-mentioned limitations must be considered. All data needs to be carefully screened before it
can be used in a visualisation. Also, crew members themselves should be made aware of the limits of such a vis-
ualisation and using it for unsupported “self-briefing” is unadvisable.
Combining FDM with other data sources
Once de-identified personal data are available, the potential for misuse increases when a link can be made with
related data. Even if that link is the result of an unintended side effect. For example, combining an FDM exceed-
ance with meteorological data could lead to a flight date and subsequent crew identification when a significant
meteorological event was involved. This could potentially also be done outside the regulated environment of
a flight safety department.
The subsequent potential effect of “naming and shaming” of individual crew members and/or companies would
have a disastrous effect on just culture and should be avoided at all cost. Therefore there is a need for defining
a “circle of confidence” (refer to section II.4).
e. Just Culture
A broader use of FDM as described above will bring clear safety benefits when a functioning just culture is
in place.
In order to achieve this, unambiguous protocols, should be in place. Any crew member should be convinced that
increasing personal excellence and company safety is the only driver behind such programs. Trustful agreements
will result in a win-win situation for both parties: The company provides programs to improve or strengthen in-
dividual abilities which pay off by having better performing pilots. On the other hand, everybody needs to accept
human factors, shortcomings and show willingness to address them.
For a functioning just culture, much more is required than a simple statement of intent and a definition. Just cul-
ture principles must pervade the organization every day in all activities.
EOFDM document ‘Preparing a memorandum of understanding for an FDM programme’ provides recommenda-
tions with regards to just culture and to participation of flight crew representatives.
40
4. Circle of confidence –
The boundaries of confidentiality
a. The circle of confidence – who is that?

The circle of confidence means the people who have access to identified data.
The simple fact of compiling data does not mean that this data is useful. The analysis of the compiled data, done
by the right person and the use of the resulting information by the right team will make it meaningful. This nor-
mally requires the involvement of persons with the necessary expertise to understand safety issues.
Essential trust is defined as the trust established between management and flight crew and is considered the
foundation of a successful FDM program. This can be facilitated by the operator strictly limiting data access to
selected individuals according to point (d)(2)(iii)(B) of GM1.ORO.AOC.130.
‘(2) Essential trust
The trust established between management and flight crew is the foundation for a successful FDM programme. This
trust can be facilitated by:
(i) …;
(ii) …; and
(iii) data security, optimised by:
(A) adhering to the agreement;
(B) the operator strictly limiting data access to selected individuals;
(C) maintaining tight control to ensure that identifying data is kept securely; and
(D) ensuring that operational problems are promptly addressed by management.’
During the investigation of an incident, the safety analyst will use data obtained from air safety reports (ASRs)
or any other reports in conjunction with the operational information related to the flight. This process, when we
talk about incidents and not about accidents, is carried out by the company safety staff. In this context, the less
restricted their access to flight data the more accurate the investigation outcomes will be.
In some cases, when a pilot fills in an ASR, the possibility of omitting important information exists. Therefore,
the FDM information may be used to add the necessary information to the ASR: see point (a) (4) of GM1 ORO.
AOC.130:
‘(4) Investigation of incidents flight data
Recorded flight data provide valuable information for follow-up to incidents and other technical reports. They are
useful in adding to the impressions and information recalled by the flight crew. They also provide an accurate indi-
cation of system status and performance, which may help in determining cause and effect relationships.
(…)’
However, someone should be able to decide which FDM event triggers are relevant to include in the analysis of
the ASR (only FDM event triggers corresponding to the reported occurrence, other detections in the same flight
not directly related to the occurrence, similar FDM event triggers from previous flights with the same aircraft…?).
This choice is only possible when the access of the safety analyst to FDM data is not restricted. Conversely, for
the safety analyst to be able to perform an informed analysis of FDM event triggers, his/her access to the related
ASRs should be facilitated. One can usually not preclude the information sufficient for a given safety analysis. This
shows that the safety analysts (including the safety manager) may need to access identified data for their job.
41
b. Break a silo, not the confidentiality

To ensure the confidentiality of the flight data, and in order to guarantee control over the communication
and identification, the staff inside the circle of confidence should commit to confidentiality terms of the FDM
programme.
However, the data may be shared de-identified, with other departments within the organization such as training
department to correct operational drifts, engineering, etc.
Unless justified and addressed by established processes, the access to flight data by departments other than the
safety department, should be limited to unidentified data and statistics.
The level of confidentiality depends on the level of information shared, so, in some manner, different circles may
coexist with different levels of information and different levels of confidentiality.
Considering that just culture is the basis of the SMS, any persons with the authority to impose sanctions against
the pilot (e.g. training, flight operations, etc.), or to influence career progress, should remain outside the circle
of confidence, and not have any access to identifiable flight data. Disclosure for purposes other than promot-
ing or improving safety of flight operations can compromise the engagement of all persons involved, including
flight crews.
Clearly defined processes have to be designed and agreed prior to the point of implementation of any FDM pro-
gram with regards to identified & de-identified data, and monitored for compliance once implemented. These
processes will be specific to an operator depending on such things as existing structures/departments, size of
the organization and roles and responsibilities within, and maturity of the safety culture in the organization.
Example 1:
An adverse safety trend is highlighted across the pilot body of airline X within FDM that could
be addressed via recurrent training, then de-identified data can be passed to the Training
department highlighting this trend, thus allowing the adverse safety trend to be addressed at the
3 year recurrent sim training program.
Example 2:
If after analysis of an FDM event trigger or a series of FDM event triggers that involve a single
flight crew member, it is concluded that ad-hoc/remedial training is required, then detailed
information would need to be passed to the Training department in order to allow specific
training to be delivered. The process for doing this would need to be detailed and adhered to11.
In this case a ‘trustee’ from within the Training department is given the detailed information,
who can then develop an individual training plan. The training plan does not need the actual
event detail. Once the plan is complete, it can then be passed (without original flight data) to any
‘non-trustee’ (i.e. a TRI/TRE) who can perform the training.
Example 3:
At airline Y, a complementary training process has been established which allows remedial
training requests to be instigated by the Safety department or the Flight Operations department
and implemented by the Training department. The complementary training delivered to the crew
member may either be in accordance to the standard procedures documented in the Operating
Manual or developed in the form of a tailored training package. If the request for complementary
training was made by the Safety department on the basis of confidential data sources (for
example FDM or confidential safety report), then the result of the training will be kept as
a separate record by the Safety department. In all other cases, the results of the remedial training
will be stored in the crew member’s training file.
11 According to the principle of transparency established by Regulation (EU) 2016/679, the processes for passing the necessary information from the
FDM programme to the Training department should be transparent for the flight crew members (refer to section II.1)
42
These are just examples of a defined process, which could involve various departments across an organization.
The larger an organization, the more processes and lines of communication have to be defined. The larger the
organization the more trustees, simply due to roles and responsibilities being divided in such an organization –
no one person in a large organization could be responsible and manage the processes end-to-end.
5. T he safety culture and the need for

confidentiality – a dynamic relationship
Every organization will have a different setup for FDM. Set within the regulations, there will be differences de-
pending on the size and structure of the organization, the human resource invested in the FDM programme,
the degree of participation from unions and, most importantly, the level of maturity of the organization’s safe-
ty culture. And within that, specifically, the implementation and perception of just culture. For example, within
an organization with a non-mature safety culture, the FDM programme, at inception, will have to be much more
protective of the data in order to ensure confidentiality. This FDM model comes about as a consequence of the
organizational environment and the expectations of crew with respect to data protection. In a sense, one could
consider that this FDM model, although far from ideal, may in fact be adequate for the needs of that organiza-
tion, at that point in time, with respect to the prevalent level of safety culture. In contrast, at an organization
where there is a more advanced level of maturity in terms of safety culture, FDM would have a more integrated
role in the Management System of the operator. Whilst confidentiality would still be maintained to a degree, the
data may be used more liberally to better support safety critical decision within the organization. Likewise, this
FDM model is designed to respond to the safety needs of such an organization. It is important to recognise that
none of these FDM models are wrong. The cultural context of the organization determines what type of an FDM
model is created. And more importantly, as the organization evolves over time and, with it, there is a more ma-
ture level of safety culture, so too should the FDM programme keep pace of this progress in order to ensure that
it adequately meets the safety needs of the organization.
Note: Indications of a mature safety culture are provided in ICAO Doc 10 000, Manual on Flight
Data Analysis Programmes (FDAP). In order to get an assessment of the company’s safety culture,
an analysis performed by an independent consultant might be useful. In that case, the analysis
should not just rely on an opinion survey but include an active investigation of how safety
information is protected and how safety lessons are disseminated internally. Another approach
may consist in comparing the internal implementation with industry best practice. In any case,
soft skills such as human factors, psychology, etc. are advisable for a relevant analysis.
Whatever the level of maturity of the operator’s safety culture, external threats such as those caused by a judicial
investigation or the press, or lawsuits for breaching Regulation (EU) 2016/679 (General data protection regula-
tion) still exist. Therefore, operators should also consider these risks when defining their data protection and
retention strategies. In order to address such threats, it is advised to set up clear and complete procedures to
guide the assessment of significant security and compliance issues and to document each individual assessment.
These procedures should take into account the personal data protection regulation applicable to the operator
(in the case of EU-based operators, it is Regulation (EU) 2016/679: see section II.1)
Example 1: Following an accident where several passengers were severely injured, the justice
administration seized all flight data and ASR records retained at the operator. They tasked
independent experts to analyse this data.
Example 2: FDM trends are leaked to investigative journalists, which use them to picture the
operator as being unsafe and complacent with safety risk.
Example 3: A pilot files a complaint against an airline for using data without consent (where
only legitimate interest prevails) and the airline is fined at the maximum penalty of 4% of annual
turnover as stated by Regulation (EU) 2016/679.
43
III. G
oing beyond the
conventional use of FDM
1. Serving internal and external

customers
In order to fulfil its purpose as an integral component of the Safety Management System, FDM needs to support
several internal and external “customers” in the discharge of their safety duties.
Operators are very diverse (large or small, operating helicopters or aeroplanes), and implementing and integrat-
ing FDM in each organization is unique.
FDM needs to be utilized in a company holistic vision, and to be supported by optimal and efficient data flows,
in order to extract, communicate, service and deliver essential information to all departments. Many operators
have realized this to stay competitive.
All departments inside an operator could potentially benefit from more data-driven knowledge because it would
elevate the respective departments’ awareness in either safety matters or optimal efficiency, or even both.
To achieve this, the needs of these internal customers need to be thoroughly understood and, likewise, they may
need to be informed about the worth of flight data and the importance of safeguards to protect the flight data.
Note: There can be limitations to this approach. For example one limitation is the number of
recorded flight parameters: on older aircraft, there are too few flight parameters available for
implementing some of the ideas exposed here. Other limitations may be the size of the fleet, the
diversity of missions which makes comparisons and meaningful statistics difficult.
a. Internal customers
Beyond the traditional contact with crew to debrief them of occurrences or exceedances, FDM can provide in-
formation which can help crew proactively improve their performance and prevent occurrences or exceedances
in the first place. A good example of this is providing monthly reports to crew members with their own perfor-
mance regarding stable approaches or touchdown distances: see section I.3.
There is also potential for closer collaboration with flight operations at management level. Sharing aggregated
data in the form of safety metrics / statistics can help flight operations management monitor the operation and
act where necessary to halt the development of any adverse trends or behaviours. Working with Fleet Manage-
ment, specific fleet metrics can help the Chief Pilot monitor normal operations or target a particular concern. In
addition to sharing aggregate data, FDM can also support flight operations ad-hoc requests and projects.
FDM and flight operations can also collaborate and combine their technical expertise to create flight animations
which can aid crews to gain better familiarity of category B and C aerodromes or to understand aircraft/system
behaviours. Specifically, such flight animations are useful to raise crew awareness of the correct track whilst
executing visual or VPT approaches12 in order to adhere to stable approach requirements. These flight anima-
tions can help mitigate unstable approaches at hotspots identified through FDM. An example of where this can
12 Visual approach with prescribed track
44
be useful is Nice runway 22, in order to help crew to initiate the turn at the correct point or Le Bourget runway
25 to avoid infringement of Charles de Gaulle airspace. The flight animations can also help enhance familiarity
with the local terrain and obstacle features near airports, such as Bolzano, Pantellaria, Annecy, Cannes, Lugano
and Buochs. Unexpected aircraft/system behaviours can also be the subject of flight animations, to raise crew
awareness and complement other sources of mitigating action, such as operational procedures, training etc. In
most cases, add-on modules are required to allow the FDM team to take full advantage of the data and create
flight animations, using the actual flight displays or accurate terrain features. Some software programmes allow
to simulate weather phenomenon (clouds, fog, snow, etc.) and also different light conditions (dusk, night, etc.).
Advanced means of replaying the data can also have a significant benefit from a training perspective. A future
application of FDM may be in the form of monitoring compliance of training with the syllabus and consistency of
training scenarios played in the simulator with circumstances encountered during actual operations, by integrat-
ing into the FDM programme, data recorded by the simulator. Such an activity could provide a more objective
view of what was trained, how it was trained, the crew member’s response to the training and, thus, serve as
a reference to baseline reference to monitoring of day-to-day operations. The so-called SOQA (simulator opera-
tional quality assurance) is still at its infancy but it offers interesting prospects.
FDM can also help monitor serviceability of parameters required to be recorded by the FDR13, and help trouble-
shoot technical events. Indeed, through FDM, flight data is available over long periods of time, which can help
engineering teams to carry-out reliability assessments and better support the investigation of technical events.
b. External customers
There are a few external customers which will benefit from access to some of the flight data collected for the
FDM programme. The first example are the OEMs, which can use routinely collected flight data to support trou-
bleshooting and investigation of technical issues, or seek improvements in terms of reliability at component or
system level. Indeed, some OEM’s will have their own means (airborne systems) which will collect flight data in-
dependently from the operator’s FDM programme, to carry-out health monitoring/management. In other cases,
they may rely on the operator for the data.
Civil aviation regulatory authorities and airline associations may also seek FDM programme output of operators
in order to conduct predictive analyses of the aviation system, and some have set up large data exchange pro-
grammes for that purpose. Examples of such data exchange programmes are EASA’s Data4Safety programme,
FAA’s ASIAS programme and IATA’s pioneering STEADES programme. STEADES participants also benefit from
contributing their data because they are able to access the database and use the de-identified data for their own
analysis and benchmarking.
Operators may choose to share data from their FDM programmes among each other, for benchmarking pur-
poses, although this needs to be done very carefully in order to obtain meaningful results. There needs to be
sufficient similarity in place to allow any meaningful comparison between two operators. There is greater poten-
tial for achieving this, for example, between operators within the same group company, where normally there
is both scope for data sharing and also commonality in terms of SOPs and operation of the same aircraft types.
In addition, the intrinsic design of the FDM software may result in different results for the same FDM event defi-
nition. This can make comparisons of FDM events between operators using different FDM software challenging.
Example:
In the case of recurrent failure of an aircraft system, flight data can be used to support
a discussion with the (supplemental) type certificate holder.
13 Refer to AMC1 CAT.GEN.MPA.195(b): under certain conditions a FDM programme can be used to get a relief from mandatory inspection of FDR
recording.
45
c. Supporting operations – day-to-day applications of flight data

The following activities may be supported by the use of flight data, but should not be considered as an exhaus-
tive list.
Part-M
´´ Aircraft maintenance (e.g. for engine condition monitoring)
´´ Serviceability of the FDR (to fulfil the requirement to inspect the FDR recording)
Part-145
´´ Preventive monitoring concerning rises in Temp, Pressure etc.
´´ Support maintenance troubleshooting
Operations Manual Part D (training)

´´ Evidence based training (OPC & PC)
´´ Line training
´´ Introduction to FDM (to improve transparency and get the buy-in of flight crew members)
Training organizations
´´ Evidence based training (lesson plans)
´´ Replay of scenarios based on findings made in flight data for pre & post simulator session briefings
Flight Operations and Ground Operations

Flight Operations:
´´ Annual, quarterly & monthly performance indicators in reference to FM, OM-B etc.
´´ Key performance indicators, such as:
›› Fueling procedure versus flight plan
›› Taxi in respect to times, speed etc.
›› On time performance
›› Starting procedure: ground power unit versus aircraft battery
›› Use of brakes versus thrust reverse
Ground operations:
´´ Key performance indicators related to the fueling procedure and the aircraft weight: Monitor the fuel
actually burnt (fuel conservation), the actual time taken by the refuelling procedure, and the margin to
structural weight limits
´´ Key performance indicators related to the shutdown cooling procedure
Other applications
´´ Annual audit, e.g. by customers
´´ Fuel conservation program
´´ Block-to-block (B2B) run times
46
2. E nhancements to training and

operational policy using FDM
A robust line operation requires the implementation of a relevant and effective training programme. Flight data
provides an additional source of information separate from training records or the human interface.
In order to maximise the benefits of using the findings of FDM in training it is important to have an unobstruct-
ed line of communication from the FDM programme into the training department. Each commercial operator
will have a 3 year recurrent simulator training (RST) programme. Formal procedures should exist in operations
manual part D (training) to ensure communication between FDM and Training department management for the
identification of trends, the effectiveness of new procedures and the development of appropriate content for the
RST programme. This communication can be achieved through routine review meetings where operational feed-
back is assessed to establish the effectiveness of training programmes and compliance with standard operating
procedures. See also section II.4, subsection B.
a. Environmental
Safety performance in abnormal weather events (e.g. high winds, severe clear air turbulence) or local challenging
conditions (e.g. platform environment in the case of offshore operations) should be examined to ensure ongo-
ing effectiveness of procedures and limitations. De-identified FDM event triggers indicating at abnormal weather
events should be publicised as fast as possible to make all flight crew members aware.
b. T ake-off and landing location (airfield or helideck) and noise

abatement procedures
Repeatedly triggered FDM events associated with a particular location or compliance with noise abatement
procedures should be publicised to flight crews by way of crew safety bulletin, safety documentation or specif-
ic airfield briefs. Where an FDM event trigger can be traced to a specific procedure or location, details of the
operation should be reviewed to ensure that standard operating procedures remain fit for purpose or require
modification in order to reduce exposure to the particular FDM event; i.e. steep approach, offset approach, cir-
cling approach. Any associated change of procedure must be included in pilot theoretical or RST programmes as
deemed appropriate by nominated persons for flight operations and training.
c. Aircraft
Undesirable trends associated with a particular aircraft tail number, or fleet, should be communicated to the En-
gineering post holder. Where it is established that crew management of a specific failure or malfunction is prone
to mishandling or misinterpretation as evidenced by FDM, the procedure should be reviewed and mitigation con-
sidered to reduce exposure to repetition of such incidents.
47
European Aviation Safety Agency
Postal address
Postfach 10 12 53
D-50452 Cologne,
Germany
Visiting address
Konrad-Adenauer-Ufer 3
D-50668 Cologne, Germany
Tel. +49 221 8999 000

Fax + 49 221 8999 099
Mail info@easa.europa.eu
An Agency of the European Union
Web www.easa.europa.eu

"Breaking The Silos": Fully Integrating Flight Data Monitoring Into The Safety Management System

Uploaded by

Copyright:

Available Formats

"Breaking The Silos": Fully Integrating Flight Data Monitoring Into The Safety Management System

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

"Breaking The Silos": Fully Integrating Flight Data Monitoring Into The Safety Management System

Uploaded by

Copyright:

Available Formats

EUROPEAN OPERATORS FLIGHT DATA MONITORING FORUM

“BREAKING THE SILOS”

1 Refer to JAR-OPS 1 Section 1, 1.035 and 1.037

1. Enriching FDM with other data sources

a. The limitations of flight data taken alone

This enables the FDM data of a given

Weather: en-route weather, night/day Local weather stations (SIGMET, AIRMET,

Constraints imposed by the departure/

Runway friction condition, closed runway

Computed performance data: computed

Flight plan, delay in departing, and airspace Contextual information to better

Other traffic around (gives an indication of

Fatigue: flight activity of the flight crew

Aircraft technical logs, such as maintenance

Constraints imposed by the surrounding

c. What air safety reports can add to FDM

d. Automatically combining flight data with other data

Air Safety Risk Continuing

a. How can FDM be used as part of the SMS?

b. Practical benefits of FDM in SMS

c. Organizational FDM Integration

d. Competences of the FDM and SMS teams

3. Examples of combining flight data with

´´ Figure I.2: thresholds applicable to the Long Landing Distance event.

Let’s compare two events, a red one and an amber one.

b. Individual FDM summary reports

Operational data – Flight number, destination, departure, times, tail number,

Data flow and merge

´´ Figure I.6: data flow.

Raw Flight Data Processed FDM

Pilot Dashboard Page 1 – Approach Data

Pilot Dashboard Page 2 - AFM Exceedance data

´´ Figure I.8: example of presentation of AFM exceedance data (pilot dashboard).

c. Enhancing self-awareness and encouraging positive behaviour

Excerpt from the ICAO Safety Management Manual, Doc 9859:

´´ Table I.2: example of individual feedback (rotation rate).

1,8 DEG/S 2,2 DEG/S 2-3 DEG/S

MAX 240, AIM FOR MNVR SPD FOR CURRENT

1,8 1,9 2,1 2,2

Training Manual Guidance Pilot A

4. Black and white vs. grey – combining

b. S ome organizational challenges of combining flight data with air

5. The state of play in 2018

a. Online survey on combining flight data and other data sources

Not based in EASA MS

´´ Figure I.11: distribution of participating operators according to the category of

Operating aeroplane with MCTOMs>27 000 kg only

Operating helicopters only

Operating aeroplanes and helicopters

Between 10 and 29 aircraft

Can the exporting of FDM data be automated?

Main limitations of the tool(s)

II. Confidentiality vs. Safety –

1. Confidentiality requirements for

a. The air operation requirements

b. What policy should be in place?

Note 2: Refer to EOFDM document ’Preparing a memorandum of understanding for an FDM

c. Who at the operator is responsible for the protection of data?

In addition, the recital of Regulation 2016/0679 contains the following explanations:

4. Black and white vs. grey – combining

b. S ome organizational challenges of combining flight data with air

II. Confidentiality vs. Safety –

1. Confidentiality requirements for

3. T he potential conflict between

5. T he safety culture and the need for

1. Serving internal and external

2. E nhancements to training and

b. T ake-off and landing location (airfield or helideck) and noise