8900.1 CHG 368

Volume 10  Air Transportation Oversight System

Chapter 1  General

Section 2  Introduction to ATOS Business Process and Tools

10-20    PURPOSE. The Air Transportation Oversight System (ATOS) improves the certification and surveillance processes for air carriers. It assesses the safety of air carrier operating systems using system safety principles, safety attributes, risk management (RM), and structured system engineering practices.

10-21    OVERSIGHT SYSTEM MODEL. ATOS exists in relation to the aviation system that an air carrier uses to produce its goods and services. The air carrier is the process owner of its aviation system, which is a production system in that it serves customers via products and services. The Federal Aviation Administration (FAA) is the process owner of the oversight system, which is a protection system. The design of protection systems is to protect customers from receiving inferior goods and services, and from potential harm of production activities. This includes potential harm from airplane accidents, occupational hazards, loss of equipment and other property, and damage to the environment. Safety Management Systems (SMS) and Quality Management Systems (QMS) are also protection systems. The FAA and air carriers are the process owners of such complementary systems. The relationship between production and protection systems is a matter of exchanging information and exerting influence. Protection systems influence production systems by imposing controls. Figure 10-1, Oversight System Model—Level I, shows this relationship at a high level.

Figure 10-1.  Oversight System Model—Level I

Figure 10-1. Oversight System Model—Level I

A.    Major Functions of ATOS. Three major functions further define the oversight system: Design Assessment (DA), Performance Assessment (PA), and RM. The following Level II diagram shows these functions in a high-level model.

Figure 10-2.  Oversight System Model—Level II

Figure 10-2. Oversight System Model—Level II

B.    Design Assessment (DA). DA is the ATOS function that ensures an air carrier’s operating systems comply with regulations and safety standards, including the requirement to provide service at the highest level of safety in the public interest. DA is the most important function of ATOS because safety is the outcome of a properly designed system. Poor system design compromises safety RM. ATOS certification processes ensure that an air carrier’s operating systems comply with the intent of the regulations. ATOS uses standardized, systematic certification processes to determine an air carrier’s qualification for an operating certificate. The FAA uses similar processes to approve or accept a new or changed air carrier program. The tools used in the certification processes also re-verify that an air carrier is meeting regulatory requirements during periodic program reviews or when environmental changes occur. Although not all DCT questions are based on regulations, the data collected (or answers) provides a means for principal inspectors (PI) to determine regulatory compliance.

Indicates new/changed information. Indicates new/changed information. Indicates new/changed information.

C.    Performance Assessment (PA). FAA aviation safety inspectors (ASI) conduct PAs to confirm that an air carrier’s operating systems produce intended results, including mitigation or control of hazards and associated risks. ATOS uses time-based PAs to detect latent, systemic failures that may occur due to subtle environmental changes. PA schedules are also adjustable based on known risks or safety priorities. Surveillance provides information for PAs and RM. In this context, surveillance is synonymous with auditing. ATOS audits use the same tools as certification processes. Not all Data Collection Tool (DCT) questions are based on regulations. The data collected (answers) provides a means for PIs to determine regulatory compliance. These answers will also confirm that the air carrier’s system produced the desired results.

D.    Risk Management (RM). RM identifies and controls hazards and manages FAA resources according to risk-based priorities. The FAA accomplishes RM through systematic risk assessments of an air carrier’s performance and environment. The potential consequences of hazards define them. The likelihood and severity of a consequence determines risk. When multiple risks exist, ATOS assesses the combined effects of likelihood and severity to determine priority. Subsequent RM action plans contain strategies to transfer, eliminate, accept, or mitigate the risk. This process validates the intended results of an action plan to ensure that a hazard is effectively eliminated or controlled. ATOS uses a modified version of Nicholas J. Bahr’s system safety process model for hazard identification and RM (see
Figure 10-4, System Safety Process Model). ATOS is concerned with the hazards and associated risks that are subject to regulatory controls such as enforcement actions, certificate amendments, and rulemaking. The ATOS Risk Management Process (RMP) tracks hazards that are the air carrier’s responsibility until the air carrier successfully resolves them.

10-22    BUSINESS PROCESS MODULES. A Level III model of the oversight system further defines ATOS processes at a procedural level.

A.    Definition of Business Process Modules. There are eight business process modules in the design and performance functions. The application of each process may be somewhat different depending on whether conducting a DA or PA, but the overall purpose of each module is as follows:

1)    Module 1—System Configuration. The system configuration process assesses an air carrier’s or applicant’s request for a new or changed scope of operation to develop an oversight profile that contains all applicable elements.
2)    Module 2—Planning. Planning develops a risk-based data collection plan for DAs and PAs.
3)    Module 3—Resource Management. Resource management provides the resources, training, and funding to execute the data collection plan.
4)    Module 4—Data Collection. The data collection process collects the data requested in the data collection plan.
5)    Module 5—Data Reporting. The data reporting process transfers the collected data into the ATOS database.
6)    Module 6—Data Review. The data review process evaluates data in the ATOS database for compliance with the requirements in the data quality guidelines (DQG).
7)    Module 7—Analysis and Assessment. Analysis and assessment makes a data-based decision about whether to approve, accept, or reject the design or performance of an air carrier’s or applicant’s programs.
8)    Module 8—Action Determination and Implementation. Action determination and implementation decides on and executes the appropriate course of action based on the decisions made during analysis and assessment.

B.    Flow Chart. The Level III model consists of cross-functional flowcharts for each of the business process modules. Cross-functional flowcharts show responsibility for process steps using horizontal bands and vertical bands (swim lanes). Standard flowchart symbols used to depict ATOS processes include:

Figure 10-3.  Standard ATOS Business Process Flowchart Symbols

Figure 10-3.  Standard ATOS Business Process Flowchart Symbols

10-23    APPLICATION OF SYSTEM SAFETY CONCEPTS. The overall purpose of a system safety-based approach like ATOS is to identify, eliminate, or control hazards, and mitigate the associated risk. Below is the Flight Standards Service (AFS) System Safety Process Model, a modified version of the Nicholas J. Bahr system safety process model. Comparing the ATOS model to the system safety process model demonstrates how ATOS is a system safety-based approach to air carrier oversight.

Figure 10-4.  System Safety Process Model

Figure 10-4. System Safety Process Model

Figure 10-5.  Comparison of the ATOS Business Process and the System Safety Process

System Safety Process Step

ATOS Business Process

Define Objectives and Describe System.

Define the acceptable levels of safety.

How does the system work and how do its components interact?

Module 1, System Configuration.

Regulations and policy define the acceptable level of safety. System description begins with the Air Carrier Oversight Profile (ACOP).

Hazard Identification.

Where are the hazards in the system?

What can go wrong?

Modules 2–6.

Identify areas where conditions in the system or operating environment may be creating hazards. Plan, report, and review data collection in those areas.

Risk Analysis and Assessment.

Determine the potential consequences that could result if hazards are not addressed or corrected.

Module 7, Analysis and Assessment.

Principal inspectors (PI) analyze data to identify hazards and determine the level of risk associated with a hazard. Hazards are assessed in terms of their severity and likelihood that an adverse outcome would result.


What can be done to control the effects of the hazard and/or mitigate the associated levels of risk?

Module 8, Action Determination and Implementation.

Take action to control the effects of the hazard and/or mitigate unacceptable levels of risk.

Validation of Controls.

Did the action work?

Module 8, Action Determination and Implementation.

Determine if the action eliminated the hazard or lowered the level of risk to acceptable levels. If not, take additional action.

Indicates new/changed information.

10-24    AIR CARRIER SYSTEMS, SUBSYSTEMS, AND ELEMENTS. ATOS uses a structured process to analyze how systems, subsystems, and elements interact. Seven air carrier systems form the basis for the ATOS system‑based approach. Each of these systems has a defined set of subsystems and elements. Elements are interrelated activities or actions completed to support air carrier subsystems and systems. Figure 10-6, ATOS System/Subsystem/Element Chart—Airworthiness Elements, and Figure 10-7, ATOS System/Subsystem/Element Chart—Operations and Cabin Safety Elements, at the end of this section identify each of the systems, subsystems, and elements (along with associated ASI specialties) used in planning and executing ATOS data collection. Below are the seven air carrier systems:

A.    Aircraft Configuration Control. An air carrier maintains the physical condition of the aircraft and its components using this system.

B.    Manuals System. This system controls the information and instructions to define and govern the air carrier activities.

C.    Flight Operations. This system pertains to aircraft movement.

D.    Personnel Training and Qualifications. Air carriers use processes to ensure that their personnel have the proper training and qualifications.

E.    Route Structures. An air carrier uses this system to maintain facilities on approved routes.

F.    Airman and Crewmember Flight, Rest, and Duty Time. This system prescribes time limitations for air carrier employees.

G.    Technical Administration. Air carriers use this system to address other aspects of certification and operation, such as key management personnel.

Indicates new/changed information.

10-25    ATOS TOOLS. ATOS standardizes the certification and surveillance processes. The ATOS automation supports ATOS policy and procedures, and contains tools that ASIs use to perform and document work. ASIs should refer to the Automation User Guide (AUG) for instruction on how to use the following tools:

A.    Air Carrier Configuration Checklist. The Air Carrier Configuration Checklist helps Certification Project Teams (CPT) and Certificate Management Teams (CMT) to document the air carrier’s or applicant’s scope of operation including factors such as type of operations, aircraft, equipment, and operations specifications (OpSpecs). CPTs and CMTs use this information for automated filtering of the oversight profile.

B.    Air Carrier Oversight Profile (ACOP). This profile is a tailored list of elements, DCT questions, and Job Task Items (JTI) that are based on the specific regulatory requirements that apply to the air carrier or applicant.

C.    Air Carrier Assessment Tool (ACAT). This tool uses risk indicators to look for conditions that may be creating hazards in the air carrier’s systems. The results of the ACAT help to prioritize oversight activities.

D.    Comprehensive Assessment Plan (CAP). This tool helps the PI plan DAs and PAs.

NOTE:  For information to flow correctly among modules in ATOS, it is critical for a PI to synchronize the ACOP, ACAT, and CAP. If you are the PI, synchronize the ACOP, ACAT, and CAP to final in the proper sequence. You must synchronize the ACOP, ACAT, and CAP each time the DCTs change.

1)    As the PI, when do I have to synchronize the ACOP, ACAT, and CAP?
a)    Review the DCT change report on the left side of your home page. This report will help you identify what changed in the DCTs.
b)    See table below for additional details.



DCT questions are deleted, revised, or new questions are added.

Synchronize the ACOP, ACAT, and CAP.

An element is deleted or a new element is added to the air carrier system/subsystem.

Synchronize the ACOP, ACAT, and CAP.

The criticality of an element has changed, which affects the baseline interval for PAs.

Synchronize the ACOP, ACAT, and CAP.

2)    As the PI, how do I incorporate the changes into the plan (synchronization)?
a)    Create a new draft ACOP, review it, and save it as final.
b)    Create a new draft ACAT, review it, and save it as final.
c)    Create a new draft CAP, review it, and save it as final.

Figure 10-5A.  Synchronize ACOP, ACAT, and CAP

Figure 10-5A. Synchronize ACOP, ACAT, and CAP

E.    Oversight Prioritization Tool (OPT). Use of the OPT is optional. Only one OPT is required for each air carrier when the PI chooses to use the OPT. It is advisable that the PI utilize the OPT or their normal risk-based prioritization methodology. When the PI utilizes the OPT for planning surveillance, it can assist in:

1)    Prioritization of air carrier maintenance providers to determine specific data collection requirements,
2)    Identifying areas of concern or criticality, and
3)    Providing data that allows the PI to target resources toward maintenance providers with the highest risk.
Indicates new/changed information.

F.    Corrective Action Tracking Tool (CATT). ASIs must use the CATT to ensure that air carriers meet schedules for completing corrective actions that result from DAs and PAs or other oversight functions. ASIs may use the CATT to track other CMT issues. The CATT does not replace documentation requirements specified in other guidance.

Indicates new/changed information.

G.    DCTs. Prior to conducting a Safety Attribute Inspection (SAI) or Element Performance Inspection (EPI), ASIs must first review the ATOS Broadcast Message(s) (BCM) as applicable to the DCT. This ensures the ASI considers the most current question information during the assessment. BCMs appear as a pop-up on the ATOS home page until acknowledged. BCMs may also be found on the Flight Standards Information Management System (FSIMS) website via a link under the Publications tab. The previous quarter BCMs remain available via a link under the ATOS “New and Documentation” page.

1)    Safety Attribute Inspection (SAI). ASIs use the SAI questions to collect data for DA. Air carrier applicants use SAI DCTs during initial certification to document the results of their self-audit.
Indicates new/changed information. Indicates new/changed information.
2)    Element Performance Inspection (EPI). ASIs use the EPI questions to collect data for PA.
3)    Constructed Dynamic Observation Report (ConDOR). PIs use ConDORs for focused inspections, special emphasis oversight, and to collect data about immediate concerns.
Indicates new/changed information.
4)    Dynamic Observation Report (DOR). This tool allows ASIs to record safety observations outside the planned oversight process. These observations may involve any Title 14 of the Federal Regulations (14 CFR)
part 121 air carrier at any location, at any time.
Indicates new/changed information.
5)    ATOS Random Inspections. These tools allow ATOS 1.2-trained part 121 air carrier ASIs to record unplanned cockpit en route inspections, cabin en route inspections, ramp inspections, or spot inspections. With management authorization, ASIs may perform these inspections on any part 121 air carrier at any location at any time. Neither CAPs nor the National Flight Standards Work Program Guidelines include random inspections.

NOTE:  ASIs that have access to ATOS automation can access random inspections on their home page. ASIs that do not have access to ATOS must request it from Flight Standards National Field Office (AFS-900) by contacting the Flight Standards National Field Office Continual Improvement Program Office Automation Team at AFS-900-Automation-Team@faa.gov.

6)    Assessment Determination and Implementation Tool. The PI or certification program manager (CPM) uses this tool to document the bottom-line DA or PA and the appropriate course of action for implementation.
Indicates new/changed information.
7)    Off-Hour Surveillance Decision Aid. The CAP must be capable of detecting deficiencies in air carrier performance no matter when ASIs conduct the activity. Based on the information gathered during surveillance, the CMT will be prepared to evaluate the air carrier’s ability to manage activities conducted during off-hour periods and address any identified risks.
a)    Know what types and levels of activity the air carrier conducts during off hours.
b)    Understand how the air carrier is managing and supervising off-hour activities, especially the interface with air carrier maintenance providers and other contracted activities.
c)    Determine if the air carrier’s processes and controls are sufficient to detect and correct any risks inherent with off-hour activities.
d)    Determine if the off-hour activities present a greater risk than activities done during normal FAA duty hours.
Indicates new/changed information.

10-26    ATOS PROCESS FEEDBACK AND CONTINUOUS IMPROVEMENT. ATOS uses a feedback loop to aid in its effectiveness. ASIs should submit their concerns or recommendations using the Problem Reporting and Feedback feature in ATOS automation.

Figure 10-6.  ATOS System/Subsystem/Element Chart—Airworthiness Elements

1.0 Aircraft Configuration Control

2.0 Manuals

1.1 Aircraft

2.1 Manual Management

1.1.3 (M)(R)

Special Flight Permits

2.1.1 (M)

Manual Management

1.2 Records and Reporting Systems



1.2.1 (M)

Airworthiness Release/Maintenance Log Recording Requirements



1.2.4 (L)

Mechanical Interruption Summary (MIS)/ Service Difficulty Report (SDR)

4.0 Personnel Training and Qualifications

1.3 Maintenance Organization

4.1 Maintenance Personnel Qualifications

1.3.1 (M)(R)

Maintenance Program

4.1.1 (M)

RII Personnel

1.3.2 (M)(R)

Maintenance/Inspection Schedule

4.1.2 (L)

Maintenance Certificate Requirements

1.3.3 (M)

Maintenance Facility/Main Maintenance Base

4.2 Training Program

1.3.4 (H)

Required Inspection Items (RII)

4.2.1 (M)

Maintenance/RII Training Program

1.3.5 (H)(R)

Minimum Equipment List (MEL)/ Configuration Deviation List (CDL)/ Deferred Maintenance



1.3.6 (H)

Airworthiness Directives (AD) and Maintenance Record Requirements



1.3.7 (H)(R)

Maintenance Providers

5.0 Route Structures

1.3.8 (M)

Control of Calibrated Tools and Test Equipment

5.1 Approved Routes and Areas

1.3.9 (H)

Major Repairs and Alterations

5.1.1 (H)

Line Stations

1.3.10 (M)(R)

Aircraft Parts/Material Control

5.1.8 (H)(R)

Extended Operations (ETOPS)

1.3.11 (H)

Continuing Analysis and Surveillance System (CASS)

5.1.9 (M)(R)

Reduced Vertical Separation Minimum (RVSM) Authorization

1.3.15 (H)(R)

Reliability Program



1.3.16 (M)




1.3.17 (M)(R)

Weight and Balance (W&B) Program

7.0 Technical Administration

1.3.18 (M)(R)

Deicing Program

7.1 Key Personnel

1.3.19 (M)

Lower Landing Minimums

7.1.1 (L)(R)

Part 119 Required Personnel

1.3.23 (M)(R)

Short-Term Escalations

7.1.6 (H)(R)

Maintenance Control

1.3.24 (L)(R)

Coordinating Agencies for Supplier’s Evaluation (C.A.S.E.)



1.3.25 (H)

Cargo Handling Equipment, Systems and Appliances



(R): Used for initial certification of a Title 14 of the Code of Federal Regulations (14 CFR) part 121 air carrier. These elements pertain to manuals or programs that require approval or are related operations specifications (OpSpecs) that should be assigned to certificate-holding district office (CHDO) aviation safety inspectors (ASI).

(H): High Criticality Elements.

(M): Medium Criticality Elements.

(L): Low Criticality Elements.

Indicates new/changed information.

Figure 10-7.  ATOS System/Subsystem/Element Chart—Operations and Cabin Safety Elements

1.0 Aircraft Configuration Control

4.0 Personnel Training and Qualifications

1.1 Aircraft

4.2 Training Program

1.1.2 (L)

Appropriate Operational Equipment

4.2.3 (M)(R)

Training of Flightcrew Members



4.2.4 (M)(R)

Training of Flight Attendants (F/A)

2.0 Manuals

4.2.5 (M)(R)

Training and Qualification of Dispatchers/Flight Followers

2.1 Manual Management

4.2.6 (M)(R)

Training of Station Personnel

2.1.1 (M)

Manual Management

4.2.7 (M)(R)

Training of Check Airman and Instructors



4.2.8 (M)(R)

Simulators/Training Devices



4.2.9 (M)(R)

Outsource Crewmember Training



4.2.12 (L)(R)

Hazardous Materials (hazmat) Training Program



4.3 Crewmember and Dispatch Qualifications

3.0 Flight Operations

4.3.1 (M)

Pilot Operating Limitations/Recent Experience

3.1 Air Carrier Programs and Procedures

4.3.2 (M)

Appropriate Airmen/Crewmember Checks and Qualifications

3.1.1 (M)

Passenger Handling

4.3.3 (M)(R)

Advanced Qualification Program (AQP)

3.1.2 (M)

Crewmember Duties/Cabin Procedures

5.0 Route Structures

3.1.3 (H)(R)

Airman Duties/Flight Deck Procedures

5.1 Approved Routes and Areas

3.1.4 (M)(R)

Operational Control

5.1.5 (H)

Line Station Operations/Ground Personnel Duties

3.1.5 (M)(R)

Carry-on Baggage Program

5.1.6 (L)(R)

Use of Approved Areas, Routes, and Airports

3.1.6 (M)(R)

Exit Seating Program

5.1.7 (L)(R)

Special Navigation Areas of Operation

3.1.7 (M)(R)

Deicing Program

5.1.8 (H)(R)

Extended Operations (ETOPS)

3.1.8 (M)(R)

Carriage of Cargo

5.1.9 (L)(R)

Reduced Vertical Separation Minimum (RVSM) Authorization

3.1.9 (M)(R)

Airplane Performance Operating Limitations

6.0 Airman and Crewmember Flight, Rest, and Duty Time

3.1.10 (L)(R)

Category (CAT) II & III Operations

6.1 Airman and Crewmember Limitations

3.1.11 (L)(R)

Computer Based Recordkeeping

6.1.2 (M)

Flightcrew Member Flight/Duty/Rest Time

3.1.12 (M)(R)


6.1.3 (M)

F/A Duty/Rest Time



6.1.4 (M)

Dispatcher Duty/Rest Time



7.0 Technical Administration

3.2 Operational Release

7.1 Key Personnel

3.2.1 (H)(R)

Dispatch/Flight Release

7.1.3 (L)(R)

Part 119 Required Personnel

3.2.2 (H)(R)

Flight/Load Manifest/Weight and Balance (W&B) Control

7.2 Other Programs

3.2.3 (H)(R)

Minimum Equipment List (MEL)/ Configuration Deviation List (CDL)/ Nonessential Equipment and Furnishings (NEF) Procedures

7.2.1 (M)(R)

Safety Program (Ground and Flight)

(R): Used for initial certification of a Title 14 of the Code of Federal Regulations (14 CFR) part 121 air carrier. These elements pertain to manuals or programs that require approval or are related operations specifications (OpSpecs) that should be assigned to certificate-holding district office (CHDO) aviation safety inspectors (ASI).

(H): High Criticality Elements.

(M): Medium Criticality Elements.

(L): Low Criticality Elements.

Indicates new/changed information.

RESERVED.    Paragraphs 10-27 through 10-41.