Go Back  PPRuNe Forums > Flight Deck Forums > Tech Log
Reload this Page >

FDM processes & procedures

Wikiposts
Search
Tech Log The very best in practical technical discussion on the web

FDM processes & procedures

Thread Tools
 
Search this Thread
 
Old 11th May 2015, 14:21
  #1 (permalink)  
PJ2
Thread Starter
 
Join Date: Mar 2003
Location: BC
Age: 76
Posts: 2,484
Received 0 Likes on 0 Posts
FDM processes & procedures

Good day; I need some help with a question which has arisen concerning the processes & procedures of running a mature FDM Program, ('mature' = implemented, validated, providing daily information & timely reports to end users, supported by management & pilots alike, system confidentiality, agreements in place, accepted crew contact processes, possibly used in AQP, etc).

The question for those running, and experienced with FOQA/FDM/FDA Programs (in either Europe, N.A., Asia-Pacific), concerns the pilot FDM gatekeeper & crew contacts:

...is there a requirement in your ops manuals, or as a matter of course, is there a requirement for the FDM gatekeeper to contact the crew for each and every FDM event in the data, regardless of severity?

Thanks.
PJ2 is offline  
Old 11th May 2015, 20:24
  #2 (permalink)  
 
Join Date: May 2000
Location: Seattle
Posts: 3,196
Likes: 0
Received 0 Likes on 0 Posts
AFAIK, there is no place for a company to use identified FOQA data under an approved FAA FOQA program: From the FAA FOQA policy statement 981202:
The FAA encourages voluntary airline collection of deidentified digital flight data recorder data to monitor line operations on a routine basis, along with the establishment of procedures for taking corrective action that analysis of such data indicates is necessary in the interest of safety.
Further guidance from HBAT 00-11 of 26 July 2000:
Data that could be employed to determine flight crewmember identity are removed from the electronic record as part of the initial event extraction process. However, air carrier FOQA programs typically do provide for a gatekeeper, who is provided with a secure means of determining identity information for a limited period of time, in order to enable follow-up inquiry with a particular flightcrew concerning a particular FOQA event, when needed for further insight into the circumstances surrounding an event. The gatekeeper is typically, though not necessarily, a member of the air carrier's bargaining unit. The concurrence of the designated air carrier pilot's bargaining unit representative is typically required in order for follow-up with an individual pilot to be initiated. Follow-up inquiries of individual crewmembers concerning FOQA events will in all cases be accomplished by a designated member of the air carrier's bargaining unit.
So, ONLY a Crewmember who is the designated member of the collective bargaining unit representing the pilots may contact a Crewmember regarding an incident flagged by FOQA.

AC 120-02 of 12 Apr 2004 further clarifies the restriction on off-premises data and identifies the role of the Gatekeeper:
This FOQA information is protected from disclosure under 49 U.S.C. 40123 and part 193. It may be released only with the written permission of the Federal Aviation Administration Associate Administrator for Regulation and Certification.
. . .

Gatekeeper. The FMT member who is primarily responsible for the security of identified data. The gatekeeper is the individual(s) who can link FOQA data to an individual flight or crewmember. The gatekeeper is normally a member of the pilot association.
. . .

Data that could be employed to determine flight crewmember identity are removed from view in the electronic record as part of the initial processing of the airborne data. However, air carrier FOQA programs typically provide for a gatekeeper, who is provided with a secure means of determining identifying information for a limited period of time, in order to enable follow-up inquiry with the specific flightcrew associated with a particular FOQA event. Such contact is usually limited to situations when further insight into the circumstances surrounding an event is needed. The gatekeeper is typically a line captain designated by the air carrier’s pilot association (if applicable). The concurrence of the gatekeeper is required in order to initiate a follow-up with an individual pilot. Follow-up inquiries with individual crewmembers concerning FOQA events will normally be accomplished by a line captain designated as a gatekeeper by the air carrier’s pilot association (if applicable).
HOWEVER,
No aircraft operator is required to have a FOQA program. No operator that conducts a FOQA program is required to obtain FAA approval of that program. However, an aircraft operator that seeks the protection available in part 13, section 13.401 from the use by the FAA of FOQA information for enforcement purposes must obtain FAA approval of its program.
so it is important that any pilot group ensure that any FOQA program the company proposes will be an "approved" program.
Intruder is offline  
Old 11th May 2015, 21:48
  #3 (permalink)  
PJ2
Thread Starter
 
Join Date: Mar 2003
Location: BC
Age: 76
Posts: 2,484
Received 0 Likes on 0 Posts
Intruder;

My sincere thanks for your time in researching and responding - very helpful. Check the AC document is 120-82, thanks for the reminder.

In the statements quoted, a number of things are clarified regarding the FAA's approval for FOQA and how the gatekeeper process functions, in particular the statement:

"Such contact is usually limited to situations when further insight into the circumstances surrounding an event is needed.", (AC 120-82)

which states very clearly that the gatekeeper process is not required for every FOQA event but only when further understanding is necessary. That's the way we've been running it for some time, of course.

To put the question succinctly, someone apparently without any understanding of how FOQA works, had mentioned that every event requires a crew contact, period.

From our p.o.v. as long-experienced operators of FDM, such an endeavour would appear to be nigh impossible and wholly unnecessary but there it was, a requirement, and I am seeking others' input and views on this as I was wondering where such a thing was coming from.

We have a successful FOQA/FDM Program running, though not in the U.S., and the gatekeeper process, including strict confidentialities thereof, is accepted by the pilots and management alike; the process is working well, as is the reporting process and so on. The Program has been of exceptional value in that it has, through properly-conceived FDM processes, made positive, material differences to the operation.

For further clarification, I am wondering if the same specification quoted above applies in Europe - that crew-contact by the pilot association gatekeeper is usually limited to situations in which further understanding and insight may be required to maintain and improve flight safety and that there exists no requirement to contact the crew for every FOQA/FDM Event?

I know this must sound odd coming from someone who's both flown transports for thirty-five years and concurrently done FDM in one form or another for almost thirty years, but the question is a serious one.

My thanks once again.

Last edited by PJ2; 11th May 2015 at 22:30.
PJ2 is offline  
Old 11th May 2015, 23:02
  #4 (permalink)  
 
Join Date: Jan 2006
Location: Between a rock and a hard place
Posts: 1,267
Likes: 0
Received 0 Likes on 0 Posts
Just a driver here, European airline, with limited insight into the FDM. We are not told what the FDM triggers are but the word on the line is that it picks up the smallest things, such as:

Flap extension above certain speed (well below placard speed)
No flap extension within certain distance to touchdown
Operation of certain switches normally not used in daily operation


But no, never heard anything from the FDM facilitator for transgressions of above mentioned criteria.
172_driver is offline  
Old 12th May 2015, 03:55
  #5 (permalink)  
 
Join Date: Oct 2008
Location: UK
Posts: 361
Likes: 0
Received 0 Likes on 0 Posts
From what I understand, every operator can select the point at which an FDM monitored parameter triggers an alert. This will inevitably mean that in different airlines, the very same event will trigger an alert in one FDM system, but not in another.

A typical system generates so much data, that it simply isn't possible to use it as the "spy in the cab" that some pilots seem convinced that it is. I've spent a bit of time with the Safety Managers in the airlines where I've worked so far, and the trigger points for the kind of FDM event where the Safety Manager registers any interest at all are well beyond normal SOP parameters, except where there is a hard limit, such as placard speeds.

The systems give quite a bit of wiggle room for the average pilot on a normal duty to do his thing without raising any eyebrows in the office. Very often, an event which a pilot feels must have triggered an FDM event, goes completely undetected, and only on receipt of a pilot report does the data get reviewed, and very often with no real concern from a safety standpoint.
Otto Throttle is offline  
Old 12th May 2015, 15:32
  #6 (permalink)  
PJ2
Thread Starter
 
Join Date: Mar 2003
Location: BC
Age: 76
Posts: 2,484
Received 0 Likes on 0 Posts
172_driver, thanks for your comments. A good FDM Program will pick up many details of the operation to provide a highly-detailed picture. Does your FDM Program have a pilot gatekeeper who can identify crews and contact them for further information on a flight?

Otto Throttle, thanks also for your insights. That's how FDM Programs are supposed to run - the "wiggle room" recognizes that no two operations go the same way and almost all are within safe boundaries and SOPs, even as they may vary in handling by different crews. It takes an experienced eye to know when something truly out of the ordinary has occurred, and that's what makes the value of the crew contact so high.

Given this and your understanding of flight data monitoring, what would do you believe the pilots would think of a process that required a crew contact for every FDM Event and not just the significant ones?
PJ2 is offline  
Old 12th May 2015, 16:41
  #7 (permalink)  
 
Join Date: Oct 2008
Location: UK
Posts: 361
Likes: 0
Received 0 Likes on 0 Posts
To me, the value of a good FDM system is in having appropriate parameters set to trigger an event alert. If the parameters are set too low, then the risk is that relatively minor events with little flight safety significance are brought to the fore. If all such "trigger" events lead to contact being made with the crew, then this will only serve to reinforce the "spy in the cab" view and will probably end with the loss of pilot support. This undermines the value of the system. Pilots should be encouraged and supported to make their own reports of safety related events, and these can be cross checked against the FDM data to help analyse the event and it's causes.

My current operator has two different levels of trigger event, major and critical. As far as I am aware, only critical events lead to contact being made with the crew, usually as a follow up to the pilot safety report. Critical events should be sufficiently serious that it ought to be obvious to the crew at the time that an event occurred, and an open reporting culture should encourage voluntary provision of the pilot report. Major events I believe are only followed up where the data does not make complete sense, but again, voluntary reports submitted by the crew can be cross checked before any contact should be made.

Both parties need to play the game properly. There needs to be an avoidance of management nitpicking over relatively insignificant events, and a sufficient level of professionalism and open reporting from the pilots, without fear of persecution for honest errors. It requires a great deal of trust, which I can appreciate is in very short supply at times.
Otto Throttle is offline  
Old 12th May 2015, 17:22
  #8 (permalink)  
PJ2
Thread Starter
 
Join Date: Mar 2003
Location: BC
Age: 76
Posts: 2,484
Received 0 Likes on 0 Posts
Otto Throttle, again thanks. That is exactly what I was seeking - a line pilot's view of a specific requirement to contact crews for every event...it is not only a logistical problem but would actually do damage to our FDM Program as you have outlined and, ironically, increase risk/reduce flight safety, the very opposite of what is believed "contacting crews for every event" would achieve!
PJ2 is offline  
Old 13th May 2015, 05:12
  #9 (permalink)  
 
Join Date: Jan 2006
Location: Between a rock and a hard place
Posts: 1,267
Likes: 0
Received 0 Likes on 0 Posts
172_driver, thanks for your comments. A good FDM Program will pick up many details of the operation to provide a highly-detailed picture. Does your FDM Program have a pilot gatekeeper who can identify crews and contact them for further information on a flight?
Yes, a very sensible person too.

Given this and your understanding of flight data monitoring, what would do you believe the pilots would think of a process that required a crew contact for every FDM Event and not just the significant ones?
Not so sure about that idea. If the 'alleged' FDM triggers in this outfit are true it would be a full time job. More importantly though, the feeling of constant monitoring could undermine one's confidence in operating safely within the aircraft limitations. I've flown with pilots refusing to operate say the flaps above the FDM trigger speed, even though it's well within the placard speed. While you try to be nice to your aircraft there are times when the flaps or gear need to be used for a bit of extra drag. You fly the plane as you think management would like to see you fly, rather than what you believe is right for the moment. The last I'd like is another pilot (i.e. the gatekeeper or other) second guessing, putting their opinion in as to how I should fly. There is a difference if it was a safety critical situation of course.
172_driver is offline  
Old 13th May 2015, 11:49
  #10 (permalink)  
 
Join Date: Dec 2002
Location: UK
Posts: 2,451
Likes: 0
Received 9 Likes on 5 Posts
PJ2, I sense from your question, and from several replies, that the focus of the discussion is on transgressions, identifying the deviant occurrences, and thence drifting towards blame albeit under the cover of seeking to understand an event.
This is typical of chasing the symptoms approach to safety vice looking for the underlying disease. Identifying a few spotty faces based on the degree of redness (crossing the limit) is not an indicator of operational health; after all who sets the limit, why, what does a transgression actually mean, …
FDM has the ability to provide an overall health check, but this requires looking at the wider picture, looking at the widest spectrum of data possible, what is normal, patterns, and thinking about safety.
Europe has made inroads to this type of FDM, see:-European Operators FDM forum, where a partnership between operator and regulator has a common objective. Look under publications and conferences for example materials, e.g.
FDM and Safety Promotion
Deep and Long Landings and of the Runway Excursion Risk.
Landing Performance – SMS
safetypee is offline  
Old 13th May 2015, 22:57
  #11 (permalink)  
Moderator
 
Join Date: Apr 2001
Location: various places .....
Posts: 7,187
Received 97 Likes on 65 Posts
safetypee - unable to hyperlink to the last three citations. Any chance you could email me some detail, please ?
john_tullamarine is offline  
Old 14th May 2015, 13:43
  #12 (permalink)  
 
Join Date: Dec 2002
Location: UK
Posts: 2,451
Likes: 0
Received 9 Likes on 5 Posts
John, PM please with an e-mail address. However, first try direct linking, which may also help others with download difficulties:-

From European Operators FDM forum, select > Annual EOFDM Conference menu and view a conference year as required; this will list the presentations which can viewed / downloaded;
Thus FDM and Safety Promotion – 2013, or Characterisation of deep long landings – 2012, 2014 is active.

Re the original question; although not associated with any one operator, I did not see any requirement published during visits to many operators worldwide.
This may be a dated view, but perhaps self-evident as the early days of FDM programs followed (were part of) confidential reporting systems where anonymity was paramount.
Written reports can be completely confidential, thus there was a need for a gatekeeper if further investigation was warranted; perhaps well implmented FDM is less dependent on confidentiality.

With FDM it is unlikely that any event can be completely de-identified unless integrated within the analysis system.
Any need for a gatekeeper in FMD might be driven by the safety culture and use of FDM. If FDM only considers exceedances then further understanding – safety value, is limited unless the crew provide narrative. This an old view of safety, the human as a hazard, blame and train, only looking at what goes wrong.
Exceedances might only occur in 1 in 1,000 flights, whereas data from all flights can provide a much better picture of safety health. Why point the finger at one ‘spotty’ crew for a 2kt exceedance, when 500 others have operational ‘high temperatures’, flying 2kts below the limit; how do the latter crews manage, what is the actual safety margin, risk, etc. Many of the presentations in the links above consider the latter view with little discussion of or need for a gatekeeper.

A presentation relevant to the question is “Applying Just Culture Principles in an OFDM Program” (2013) https://easa.europa.eu/essi/ecast/wp...st_Culture.pdf
Note the emphasis on trust, communication, and feedback.
safetypee is offline  
Old 14th May 2015, 19:39
  #13 (permalink)  
PJ2
Thread Starter
 
Join Date: Mar 2003
Location: BC
Age: 76
Posts: 2,484
Received 0 Likes on 0 Posts
172_driver, re "full-time-job", yes exactly, and to what end? What you have said is true...FDM certainly isn't about flying another pilot's airplane.

safetypee, thank you, very helpful links and your views - coincidentally I am in the process of joining EOFDM and have already downloaded a few of their publications which provide excellent guidance and perspective on FDM. The links you supplied, (and which you traditionally supply in your valuable contributions), help create the needed perspective with which to deal with this odd, singular "finding"; indeed, not only would it be a full-time job for several gatekeepers but it would destroy all trust and acceptance which we have worked so hard to achieve and maintain.

Regarding the 2nd link in your post, I have this and other presentations & papers by Pere Fabregas, (source is the NLR), and we used the same approach as Fabregas to employ our flight data to assess our own landing performance risks on shorter runways; the analysis worked extremely well and the information was conveyed to our pilots as "trend information". Also, in the process we found that the touchdown point being generated by the FDM software was incorrect by one to four seconds and the "long landings" were not nearly as numerous once the touchdown point was more accurately determined, (using the air-ground parameter is, oddly, the poorest way of determining the t/d point, Ref. A Study of Normal Operational Landing Performance on Subsonic, Civil, Narrow-Body Jet Aircraft During Instrument Landing System Approaches). The response to these reports has been very positive and effective in terms of reduced numbers of landing distance events, because the pilots know that we operate in a just culture supported right from the top.

P.S. John, the links worked for me but might it be a "country" thing? Were you able to get the documents online?

Last edited by PJ2; 14th May 2015 at 20:19.
PJ2 is offline  
Old 14th May 2015, 22:55
  #14 (permalink)  
Moderator
 
Join Date: Apr 2001
Location: various places .....
Posts: 7,187
Received 97 Likes on 65 Posts
All OK, now .. thanks, both. best regards, John
john_tullamarine is offline  
Old 18th May 2015, 18:24
  #15 (permalink)  
 
Join Date: Dec 2002
Location: UK
Posts: 2,451
Likes: 0
Received 9 Likes on 5 Posts
PJ, thanks. I had seen the NLR study.
I was instrumental in a similar task many years ago, but with lesser recording and analysis capability.

One aspect which might be relevant in the NLR study and with your point of touchdown is the assumption that the ILS beam is a straight line at low altitude.
Because the ILS GS is a reflected beam it will show a parabolic path along the runway, tending to be above the 3 deg ideal at lower altitudes. In operations this is not significant particularly as autoland systems tend to fade out the GS and incorporate attitude stability until flare.

These new (real data) risk assessment methods are attractive because as the risks are identified their significance can be related to specific operations, thence proactive safety action considered and the findings communicated to all crews – participation.
In particular, I like the possibility of using the data store and analysis as a means of real time risk assessment for all aircraft via the growing communication capabilities; turning the hindsight of previous (acceptable) landings in the data base into foresight for some of the significant parameters in a pending landing, e.g. reconsider flap setting, increase brake setting. This machine based decision aiding might also strengthen the human decision processes, which is still essential for ill-determined parameters – accuracy of reported runway condition, wind, etc.
Overall these activities could provide the crew with awareness of the available safety margin for each approach and the need to adjust, or be aware of the need for accuracy in touchdown, speed, etc.

An interesting point is the correlation of touchdown positon with a limiting runway (seen in other data) – why do pilots touchdown earlier, yet on longer runways they do not; cue the psychologists.
SESMA

Last edited by safetypee; 18th May 2015 at 18:38.
safetypee is offline  
Old 19th May 2015, 07:17
  #16 (permalink)  
 
Join Date: Mar 2002
Location: Seat 1A
Posts: 8,559
Received 76 Likes on 44 Posts
An interesting point is the correlation of touchdown positon with a limiting runway (seen in other data) – why do pilots touchdown earlier, yet on longer runways they do not; cue the psychologists.
Psychologists?? It's pretty obvious to any even inexperienced driver: on a short runway you touch down earlier/harder so you don't run off the end! Long runways, you won't run off the end so no need to be quite as anal about the touchdown.
Capn Bloggs is offline  
Old 19th May 2015, 11:58
  #17 (permalink)  
 
Join Date: Dec 2002
Location: UK
Posts: 2,451
Likes: 0
Received 9 Likes on 5 Posts
Bloggs, to minimise the glare of the blindingly obvious, consider ‘longer’ as being of the same runway length, but the conditions at the time of landing make it limiting.
The conditions which determine ‘limiting’ are either those where the crew have direct control – flap, brakes, speed; and others requiring judgement based on reported conditions – and flying accuracy.
A proactive uplink based on previous landings could simplify some of the choices, add confidence to a decision, and improve knowledge of the safety margin.

‘There is no truth’ (bio); only probability, risk assessment, and choice, all of which have to be managed.
If we believe that we are able to consistently judge when to aim for, and achieve an accurate landing, then perhaps we should reassess the probability of our behaviour (and it’s not error free).

FDM can provide an insight of our management process; a gatekeeper / interview for each transgression might help us review what happened, but less so the reasons why.
The alternative of looking at all landings (no gatekeeper required) could provide a probability plot of individual or operator performance and the likely-hood of achieving a particular standard, a standard required for a particular situation – a limiting runway. How certain can we be that a runway is limiting or not ... ... there is no truth?
Many would say that this is airmanship, experience; but it would be an advantage to have a measure of past performance, to use real data and not have to rely on memories based on individual belief.
safetypee is offline  
Old 20th May 2015, 17:02
  #18 (permalink)  
PJ2
Thread Starter
 
Join Date: Mar 2003
Location: BC
Age: 76
Posts: 2,484
Received 0 Likes on 0 Posts
Capn Bloggs;

In fact, that is the psychology and it is difficult to argue when one's daily experience is "12,000ft" in front of one's B737, etc.! Nevertheless, as you'd know, it is habit as well as performance that is the goal. We use the FDM data to emphasize this, but the differences between 5000ft runways and those twice that length are certainly in the data.

safetypee;

I considered that you'd have seen the NLR work; nice to know (but no surprise) that you've contributed to such work as well. The NLR (Van Es, & the Fabregas presentations, etc.), has helped us in our FDM Program work as have the presentations to which you have kindly provided links, above.

The original question regarding "calling crews for every event" is, through the feedback on this thread, largely settled, but the discussion on FDM is well worth continuing for those so engaged.

Regarding the assumptions behind an ILS Glide Slope, I hadn't considered, but understand, that any interference-with/attenuation-of the GS signal could "bend" (alter the "null point") and lead to differences in the air distance from the threshold, (or, as is assumed most of the time, an RA reading of 50ft), to the touchdown point.

We were dealing with chronically long air distances from 50ft RA to t/d and finally asked the question, "Is the touchdown point as determined by the FDM software, accurate?".

Using an FAA paper entitled, "A Study of Normal Operational Landing Performance on Subsonic, Civil, Narrow-Body Jet Aircraft During Instrument Landing System Approaches" we began to examine this question. It turned out that the FDM Program used only the Air-ground parameter. The FAA study indicated that rather than using air-ground which is often late, a combination of vertical 'g', spoiler deployment (or wheel speed if one has the parameter), radio altimeter and so on, can more closely determine the t/d point and more accurately determine the actual air distance and flare time from 50ft to t/d.

A number of steps were taken to enhance the accuracy of this event, with the result that landing performance data was reliable (within the contributing parameter sample rates available). It was then possible, using airport/runway database information, to place risk more expeditiously, (deceleration required for runway remaining, risk of overrun if deceleration was =< 0.2g, speed-at-1000ft-to-go, etc). The end result is better communication to the pilot group through regular monthly reporting which begin to enable the real-time assessment process, (foresight) described including available safety margins. This has recently been put to work in a challenging airfield and the process and the results (from communication to actual performance) are encouraging. In fact, we deal with the "psychology" of the matter directly, emphasizing that long runways do not necessarily provide equally-generous margins, depending upon conditions.

I am of the view that providing actual FDM data to individual pilots is to be encouraged at every turn, providing the usual confidentialities are formally in place and expected. At present they are free to call the gatekeeper to discuss a flight and often do, I am told. This is "learning for free", in my view and goes well beyond traditional restrictions (perhaps moreso in North America) which consider the data sacred territory when in fact, employed appropriately it is another tool in the kit.
PJ2 is offline  

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service

Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.