6/29/18

 

8900.1 CHG 495

VOLUME 11  FLIGHT STANDARDS PROGRAMS

CHAPTER 2  VOLUNTARY SAFETY PROGRAMS

Section 2  Safety Assurance System: Flight Operational Quality Assurance (FOQA)

Indicates new/changed information.

Source Basis:

    Section 13.401, Flight Operational Quality Assurance Program: Prohibition Against Use of Data for Enforcement Purposes.

    Section 193.1, What Does This Part Cover?

    Section 193.3, Definitions.

    Section 193.5, How May I Submit Safety or Security Information and Have it Protected From Disclosure?

    Section 193.7, What Does it Mean for the FAA to Designate Information as Protected?

    Section 193.9, Will the FAA Ever Disclose Information That is Designated as Protected Under This Part?

    Section 193.11, What is the Notice Procedure?

    Title 49 U.S.C. § 40123, Protection of Voluntarily Submitted Information.

11-63    PURPOSE AND OBJECTIVES. Flight operational quality assurance (FOQA) is a voluntary safety program designed to improve aviation safety through the proactive use of flight-recorded data. Operators will use these data to identify and correct deficiencies in all areas of flight operations. Properly used, FOQA data can reduce or eliminate safety risks, as well as minimize deviations from regulations. Through access to de‑identified aggregate FOQA data, the Federal Aviation Administration (FAA) can identify and analyze national trends and target resources to reduce operational risks in the National Airspace System (NAS), air traffic control (ATC), flight operations, and airport operations. This chapter will define the elements of an FOQA program, the FOQA program approval process, and the role of the principal operations inspectors (POI) and air carrier inspectors in monitoring continuing FOQA operations. This section is related to Safety Assurance System (SAS) Element 1.1.2 (OP) Safety Program (Ground and Flight).

NOTE:  The Air Transportation Division is responsible for management of the FOQA program at a national level. The Air Transportation Division may delegate authority for FOQA program approval, revision, withdrawal, and monitoring to a branch within the division.

11-64    BACKGROUND. The FAA and the air transportation industry have sought additional means for addressing safety problems and identifying potential safety hazards. Based on the experiences of foreign air carriers, the results of several FAA-sponsored studies, and input received from government/industry safety forums, the FAA concluded that wide implementation of FOQA programs could have significant potential to reduce air carrier accident rates below current levels. The value of FOQA programs is the early identification of adverse safety trends, which, if uncorrected, could lead to accidents. A key element in FOQA is the application of corrective action and followup to ensure that unsafe conditions are effectively remediated.

A.    FOQA Overview. FOQA is a program for the routine collection and analysis of digital flight data (FDAT) generated during aircraft operations. FOQA programs provide more information about, and greater insight into, the total flight operations environment. FOQA data is unique because it can provide objective information that is not available through other methods. An FOQA program can identify operational situations in which there is increased risk, allowing the operator to take early corrective action before that risk results in an incident or accident. FOQA must interface and be coordinated with the operator’s other safety programs, such as the Aviation Safety Action Program (ASAP), Advanced Qualification Program (AQP), pilot reporting systems, and Voluntary Disclosure Reporting Program (VDRP). The FOQA program is another tool in the operator’s overall operational risk assessment and prevention program. Being proactive in identifying and addressing risk will enhance safety.

B.    FOQA Program Approval. The term “FOQA program” means an FAA-approved program for the routine collection and analysis of digital FDAT gathered during aircraft operations, including data currently collected pursuant to existing regulatory provisions (when such data are included in an approved FOQA program). To gain FAA approval, the operator will write a plan that includes a description of how data are collected and analyzed, procedures for taking corrective action that analysis of the data indicates is necessary in the interest of safety, procedures for providing the FAA access to de-identified aggregate FOQA information, and procedures for informing the FAA as to any corrective action performed. The FAA will monitor trends in FOQA data and the operator’s effectiveness in correcting adverse safety trends.

C.    FOQA Data Collection and Analysis. In an FOQA program, data are collected using either a special acquisition device such as a Quick Access Recorder (QAR), directly from the flight data recorder (FDR), or by other means. Using one of several available transmission methods, data are periodically retrieved and sent to the operator’s FOQA office for analysis. This office usually resides within the flight safety organization at the operator, but may reside elsewhere. The data are then verified and analyzed, using specialized processing and analysis software designed to convert the FDAT into usable information. The operator can use the information and insights provided by FOQA to improve safety by enhancing training effectiveness, operational procedures, maintenance and engineering procedures, and ATC procedures.

11-65    KEY TERMS. The following are key terms that an inspector is likely to encounter in reviewing an operator’s FOQA program documentation:

A.    Aggregate Data. The summary statistical indices that are associated with FOQA event categories, based on an analysis of FOQA data from multiple aircraft operations.

B.    Aggregation. The process that groups and mathematically combines individual data elements based on some criterion (e.g., time, position, event level, and aircraft type). Each aggregation is based on factors of interest to the analyst at a particular point in time.

C.    Data Management Unit (DMU). A unit that performs the same data conversion functions as a flight data acquisition unit (FDAU), with the added capability of processing data onboard the aircraft. Additionally, this unit has a powerful data processor designed to perform in flight airframe/engine and flight performance monitoring and analysis. Some DMUs have ground data link and ground collision avoidance systems incorporated into the unit.

D.    Data Validation. A process during which FDAT are reviewed to verify that they are valid, accurate, and free of errors (such as might result from damaged sensors or faulty recording).

E.    De-Identified Data. Data from which any identifying elements that could be used to associate them with a particular flight, date, or flightcrew have been removed.

NOTE:  Operator data which is provided to the FAA may be further de-identified by removal of identifying elements that could be used to identify the operator.

F.    Event. An occurrence or condition in which predetermined values of aircraft parameters are measured. If parameter values are exceeded, the Ground Data Replay and Analysis System (GDRAS) will flag the event for further analysis and record it in a database for trending.

G.    Event Levels. The parameter limits that, if exceeded, classify the degree of deviation from an operator-determined standard into two or more event severity categories. When assigning levels to an event, consideration is given to compliance with Federal regulations, aircraft limitations, and company policies and procedures.

H.    Event Set. A collection of events designed to measure all aspects of normal flight operations for a particular aircraft type by a particular operator. The event set for a particular fleet may be limited by the available parameters on the aircraft.

I.    Event Validation. The process in which an event is determined to be a valid sample of operation outside the established norm. Even though aircraft parameter limits may have been exceeded, a valid event may not have occurred (e.g., significant localizer deviation may have occurred when an aircraft makes an ATC‑directed sidestep approach to a parallel runway).

J.    Flight Data Acquisition Unit (FDAU). A device that acquires aircraft data via a digital databus and analog inputs and formats the data for output to the FDR according to regulatory requirements. Additionally, many FDAUs have capability that enables them to perform additional processing and distribution of data to Aircraft Condition Monitoring Systems (ACMS), Aircraft Communications Addressing and Reporting Systems (ACARS), Engine Condition Monitoring (ECM) systems, or to a QAR for recording/storage of raw FDAT. There are many varieties of FDAUs (known by a number of different acronyms), but all perform the same core functions.

K.    Flight Operational Quality Assurance (FOQA). A program for the routine collection and analysis of FDAT to provide more information about, and greater insight into, the total flight operations environment. An FOQA program combines these data with other sources and operational experience to develop objective information to enhance safety, training effectiveness, operational procedures, maintenance and engineering procedures, and ATC procedures.

L.    FOQA Monitoring Team (FMT). A group of technical experts, which may include pilots, instructors, check airmen, safety personnel, and maintenance personnel, responsible for reviewing and analyzing flight and event data and identifying, recommending, and monitoring corrective actions.

M.    FOQA Steering Committee. An oversight committee formed at the beginning of FOQA program planning to provide policy guidance and vision for the FOQA effort. Membership may include a senior management person and representatives from key stakeholder departments, such as flight operations, maintenance, training, and safety. A representative from the pilot association is also typically included on this committee.

N.    Gatekeeper. The FMT member who is primarily responsible for the security of identified data. The gatekeeper, who is normally appointed by the pilot association, has limited ability to link FOQA data to an individual flightcrew member. If further information is needed to understand the reasons why an event occurred, the gatekeeper is the only individual who may contact a crewmember to elicit further information.

O.    Ground Data Replay and Analysis System (GDRAS). A sophisticated software application that transforms flight-recorded data into a usable form, analyzes the data, detects events, and generates reports for review.

P.    Implementation and Operations Plan (I&O Plan). A detailed plan specifying all aspects of an operator’s FOQA program, including how the operator will collect and analyze data, procedures for taking corrective action based on findings from the data, means for providing the FAA with access to de-identified aggregate FOQA information/data, and procedures for informing the FAA of corrective actions undertaken.

Q.    Logical Frame Layout (LFL). A data map that describes the format in which parameter data are transcribed to a recording device. This document details where each bit of data is stored and is used by the GDRAS to correctly process raw FDAT.

R.    Operator. A U.S.-certified air carrier or other U.S.-registered aircraft operator with appropriate aircraft and equipment to meet FOQA requirements.

S.    Parameters. Measurable variables that supply information about the status of an aircraft system or subsystem, position, or operating environment. Parameters are collected by a data acquisition unit installed on the aircraft and then sent to a recording device. Parameter data may be continuous (e.g., airspeed) or binary (e.g., switch position on/off). The accuracy over time of parameter data is subject to both the sampling rate and the level of precision (e.g., number decimal places) at which they are recorded.

T.    Quick Access Recorder (QAR). An onboard recording unit that stores flight-recorded data. These units are designed to provide quick and easy access to a removable medium on which flight information is recorded. QARs may also store data in solid-state memory accessible through a download reader. It is possible in some modern systems for the functions of the QAR to be integrated into a single solid-state recording system that also provides the FDR functions that are required by regulation.

U.    Routine Operational Measurement (ROM). A “snapshot” look at a selected parameter value at predefined points in time or space during every flight being analyzed by the GDRAS. ROMs provide standard statistics (e.g., minimum, maximum, or average) for the specified parameter for a particular period of time or condition. Since ROMs are collected on every flight, they provide valuable trending insight into normal operations. ROMs are also useful in establishing a baseline for normal aircraft operation across a fleet.

V.    Stakeholder. Constituencies that are potential users of FOQA data and that have a stake in the program’s success.

11-66    APPLICABILITY. FOQA programs are intended for use by any operator desiring to improve the safety of its operation, but this program description and guidance is targeted to those air carriers operating under Title 14 of the Code of Federal Regulations (14 CFR) part 121 and part 135. FOQA is a program entered into voluntarily by the operator.

11-67    FOQA CONCEPTS.

A.    FOQA Is a Proactive Safety Program. Rather than using the vast amount of flight-recorded data only for accident investigation purposes, FOQA focuses on using these data to reduce the risk of, and perhaps prevent, aircraft accidents. FOQA programs seek to discover previously unknown risks and focus the efforts of safety personnel on reducing or eliminating these risks.

B.    FOQA Is Focused on Aggregate Trends Rather Than Individual Flights. Through experience, operators with FOQA programs have learned that the primary value of the program comes from trend information based on aggregate FOQA data. Using these data, the operator, sometimes in partnership with the FAA, can identify and correct systemic problems. While FOQA will also provide an airline with information on individual pilot performance on a given flight, it is FAA FOQA policy not to require that the airline convey FOQA data specific to individual pilot performance to the FAA.

C.    FOQA Analysis Is a Continuous Process. Data are gathered from the aircraft and used to identify trends. Corrective actions are devised to counter adverse trends. Data are again gathered to determine the efficacy of any corrective actions undertaken. If needed, new corrective actions are devised and implemented. Data are used to evaluate the effectiveness of these new actions. This process continues until the actions are deemed successful, and then data are used to monitor long-term success and ensure there is no recurrence.

D.    FOQA Is a Nonpunitive Program. Before entering into an FOQA program, operators ordinarily enter into agreements with their pilots that no data or information developed as a result of FOQA will be used in any pejorative manner by the operator against a pilot. The FAA assures both operators and employees that no enforcement action will be undertaken as a result of FOQA data, except for deliberate or criminal acts, when the operator’s FOQA program has been approved by the FAA under 14 CFR part 13, § 13.401. To further strengthen this concept, access to FOQA data is tightly controlled and identifying information is permanently stripped from stored records. The success of a voluntary FOQA program depends on cooperation with pilots who can provide further insights beyond what the data can reveal.

E.    The Sum of FOQA Is Greater Than Its Parts. The FOQA data collected by an individual operator is valuable and useful in improving safety at that operator. Without the knowledge of what other operators are experiencing, however, an operator may not have a complete picture. The FAA, because it does not generate these data, may not have sufficient information about issues confronting the NAS. The aggregation and sharing of FOQA data provides even greater opportunities for improvements in safety than any single operator’s program by itself may provide.

11-68    ELEMENTS OF AN FOQA PROGRAM. All FOQA programs are comprised of four basic elements:

    Equipment to collect and record FDAT;

    A means to deliver the data to a place where analysis will occur;

    Software that will process the data, analyze the data, and generate reports of findings from the data; and

    A structure that will devise and track corrective actions based on the data.

A.    Airborne Data Recording Systems. These systems acquire and capture the necessary in-flight information. They include specific aircraft data input sources and parameters, and the equipment to record and store the collected data. Data are gathered via onboard sensors that measure significant aspects of aircraft operation. Most sensor information is carried to its eventual destination via several databuses. Data are collected by interfacing with these buses. Other airborne equipment can be used to process and analyze the collected data, display the data to pilots during flight or on the ground, and transmit data to a GDRAS.

B.    Data Transmittal Systems. Data must get from the aircraft to a location where it can be processed and analyzed. There are numerous ways of accomplishing this, depending on the capabilities of equipment used, both on board the aircraft and on the ground. QARs and some FDAUs have removable media that are taken off the aircraft and hand-delivered or sent by mail to the FOQA office. There are handheld download devices that can be used to download data from an FDAU, QAR, or FDR. The data is stored in the unit and downloaded via modem or the operator’s Wide Area Network (WAN). Operators may also use wireless data links (WDL), in which data are downloaded wirelessly to a network connection, which transmits the data to the FOQA office.

C.    Data Analysis Systems. The GDRAS is the heart of the program. This software takes the raw binary data and, using an LFL defined for each fleet make, model, and series (M/M/S) and variant, translates it into engineering units (EU) (e.g., feet, knots, or degrees). It is also the primary tool for analysis of FOQA data. Depending on the capabilities of a particular GDRAS, it may allow examination of an entire distribution of the values of a recorded parameter. It may also allow the operator to look for events that fall outside operator‑determined standards based on operator-defined event sets and event levels. It stores those events in a database that is used for generating and tracking trend information. The GDRAS may also be capable of generating ROMs that provide valuable trending insight on what is “normal” in an operation. It generates reports in a variety of formats for use by the operator’s analysis team. The GDRAS may also have other statistical analysis tools incorporated in it. To complement the GDRAS, an operator may also choose to use flight animation software or other third-party analysis products as both analysis and communication tools.

D.    FOQA Organizational Structure. The operator must put in place an FOQA structure that is capable of taking corrective actions where the data shows they are warranted. This structure must have the support of senior management and the FOQA stakeholders who will provide the human and financial resources needed to effect corrective actions. It needs to be able to coordinate actions across departmental lines, track assigned corrective actions, and hold departments accountable for implementation of agreed-upon actions. FOQA data can be generated, collected, transmitted, and analyzed, but if corrective actions are not implemented to reverse adverse trends, the FOQA program is not successful.

11-69    FOQA PROGRAM RESOURCES. The planning and implementation of an effective FOQA program will result in a significant commitment of both human and financial resources. During the development of an FOQA program, it is important that the operator understand and be willing to commit the necessary personnel, time, and money needed to ensure that data collected in the program is used effectively. Before embarking on an FOQA program, it is useful for an operator to consult with other operators with established FOQA programs to better gauge the resources required for the effort.

11-70    DEVELOPMENT OF AN FOQA PROGRAM. The development of an FOQA program occurs in three stages as illustrated in the following diagram (Figure 11-13, Planning and Preparation, Implementation and Operations, and Continuing Operations).

Figure 11-13.  Planning and Preparation, Implementation and Operations, and Continuing Operations

Figure 11-13. Planning and Preparation, Implementation and Operations, and Continuing Operations

A.    Phase I. The planning stage sets the policy and direction for the FOQA effort. As these are developed, the necessary resources are committed to implement the program. The policies, procedures, resources, and operational processes for collecting, managing, and using FOQA data are then laid out in the I&O Plan as the program blueprint, and submitted to the FAA to obtain approval for the program. Essential activities during the planning stage include:

    Establishment of a steering committee,

    Defining goals and objectives,

    Identifying and soliciting input from stakeholders,

    Selecting technology and personnel,

    Defining safeguards and events,

    Negotiating pilot agreements, and

    Creating the I&O Plan.

B.    Phase II. The second stage is plan implementation. It will begin once the I&O Plan has been approved and will probably start with a limited number of aircraft. It will involve the installation of the equipment, training of personnel, and collection and processing of data from the aircraft. Work during this stage is focused on the validation of the program, including its logistics and security mechanisms. Essential activities during the implementation stage include:

    Implementing and auditing security mechanisms,

    Installation of equipment,

    Training of personnel,

    Involving stakeholders,

    Collecting and processing airborne data,

    Analysis and validation of data,

    Development and documentation of FOQA system procedures, and

    Defining start-up criteria.

C.    Phase III. The final stage is continuing operations. Once the operator has validated its processes and the accuracy of its data collection and analysis, it will officially launch the program. Data collected can then be used in trend identification, determination of corrective actions, and monitoring the effectiveness of those actions. Expansion of the program will occur as outlined in the FOQA I&O Plan, or as documented in subsequent FOQA I&O Plan revisions. Essential activities during the planning stage include:

    Taking corrective actions,

    Conducting periodic program reviews (PR),

    Tracking costs and benefits,

    Evaluation of emerging technologies,

    Expansion of data usage, and

    Communicating FOQA program benefits.

11-71    FOQA I&O Plan. An operator is not required to obtain FAA approval in order to operate an FOQA program. However, an operator who seeks the protections in § 13.401 from the use of FOQA data for enforcement action must obtain FAA approval of its FOQA I&O Plan. Similarly, only operators who have an FAA-approved FOQA I&O Plan are eligible under 14 CFR part 193 and FAA Order 8000.81, Designation of Flight Operational Quality Assurance (FOQA) Information as Protected From Public Disclosure Under 14 CFR Part 193, for protection from public disclosure of FOQA information obtained by the agency. The FOQA I&O Plan is the document that describes an operator’s FOQA program for FAA approval purposes. The FAA determines whether an operator’s FOQA program is approved and notifies the operator by letter of any concerns and/or formal approval in accordance with procedures outlined in this chapter.

A.    Elements of an I&O Plan. The I&O Plan specifies the organization, technology, policies, procedures, and operational processes used by an operator for its FOQA program. The FAA approval process for an I&O Plan is designed to determine that the operator has identified adequate procedures, organizational resources, and material resources to collect, analyze, and, as required by § 13.401, to act upon information derived from FOQA data when warranted in the interests of safety. The I&O Plan should describe the following elements:

    Program goals and objectives;

    Fleet(s) to be equipped for FOQA;

    Airborne hardware, analysis software, and other equipment to be used in the program;

    Organizational structure for the FOQA program;

    FOQA program personnel and associated roles and responsibilities;

    Procedures for data acquisition and handling;

    Procedures for data analysis and reporting;

    Procedures to implement corrective action(s) when adverse safety trends are discovered;

    Procedures for informing the FAA as to any corrective action that analysis of the data indicates is necessary in the interest of safety;

    Policies on data retention, data security, and crew contact;

    Policies on providing the FAA with de-identified aggregate data and information on corrective actions undertaken;

    Policies and procedures for maintaining and revising the I&O Plan;

    A glossary of terms used in the I&O Plan; and

    Appendices, which should include a copy of the letter of agreement on FOQA with the pilots’ collective bargaining unit (if applicable); a list of events, parameters, and threshold values to be used in the program for each FOQA-equipped aircraft fleet; and a list of the documents referenced or cited.

B.    Identifying and Revising I&O Plans. An operator should identify its planned FOQA airborne and ground-based equipment in its initial I&O Plan. Subsequent revisions to the I&O Plan should identify any changes to the planned or implemented equipment. The purpose of this information is to ascertain proposed system capabilities, rather than to approve an operator’s selection of a particular brand or vendor. Decisions with respect to the selection of software and equipment vendors are left entirely to the operator. However, the FAA may assess, for the initial plan and any subsequent revisions, whether the proposed products’ functionality appears to be adequate to accomplish the program’s goals.

C.    The FAA and the Operator. The FAA prefers to interact closely with applicants during the development of the I&O Plan, rather than wait for the formal submittal of the finished plan before establishing substantive dialogue. A discussion and review of rough drafts of document sections early in the development process will facilitate approval. The submittal of the final documents then becomes a formality, with minimal changes required.

D.    Developing an I&O Plan. To assist an operator’s development of an I&O Plan, Advisory Circular (AC) 120-82, Flight Operational Quality Assurance, contains a sample I&O Plan template and a copy of the checklist of items to be included in the plan. Although specific areas should be addressed in the plan, the I&O Plan template is flexible enough to allow the operator to tailor the plan to its individual needs.

E.    Using the I&O Plan Checklist. The operator must use the I&O Plan checklist (see Figure 11-14, I&O Plan Checklist) to ensure that the information is included in the I&O Plan. The completed checklist will accompany the proposed I&O Plan when submitted to the FAA. The FAA will use the checklist to verify that the operator has provided the information needed for the initial approval of an FOQA program.

F.    Answering Each Checklist Question. The operator should complete the “Response” column for each question. Appropriate responses are “Yes,” “No,” or “NA” (not applicable). For all “No” or “NA” responses, the operator’s completed checklist should include a brief statement describing why that item was marked “No” or “NA.”

G.    Completing the Reference Column. The operator should complete the “Reference” column to identify the location of a particular checklist item in the proposed I&O Plan (e.g., “I&O Plan, Section 2.1; Event Definitions, Appendix A,” etc.).

11-72    PROGRAM APPROVAL, REVISION, AND WITHDRAWAL OF APPROVAL.

A.    Initial FOQA Program Approval. To obtain approval for its FOQA program, the operator must develop and submit an FOQA I&O Plan to the FAA as described in this section. The plan must be accompanied by a completed I&O Plan checklist (Figure 11-14), documenting where the checklist items have been addressed in the plan, and a cover letter addressed to the POI requesting approval of the plan. The operator should also simultaneously forward an electronic copy of the plan, cover letter, and completed checklist to the Air Transportation Division. Operators, other than certificated air carriers or air operators, should send an electronic copy of the cover letter and plan directly to the Air Transportation Division. Electronic copies to the Air Transportation Division should be mailed to 9-AFS-HQ-FOQA@faa.gov.

1)    The Air Transportation Division is responsible for management of the FOQA program at a national level. When an operator submits an I&O Plan, the Air Transportation Division is responsible for initiating coordination with the POI and providing the POI with assistance in assessing the technical adequacy of the plan. The POI and the Air Transportation Division must use the I&O Plan checklist in Figure 11-14 as an aid in determining the adequacy of the plan.
2)    Operators should make any decisions dealing with the selection of software and equipment vendors. Although the operator is required to identify the airborne and ground-based FOQA equipment in its initial FOQA I&O Plan, and should include changes to this equipment in I&O Plan revisions, the purpose of this requirement is to ascertain whether or not the functionality described for these products appears to be adequate to accomplish the program goals described in the operator’s plan, rather than to approve the operator’s selection of a particular brand or vendor.
3)    Evaluation of the I&O Plan should center on whether or not the structure set up for the FOQA program will realistically address the collection and analysis of data, as well as procedures for taking corrective actions. Because of differences in air carriers, the POI is in the best position to assess whether the proposed FOQA program organization and amount of resources dedicated to it are adequate.
4)    If the operator has elected to include aircraft maintenance monitoring as part of its FOQA program, the POI is responsible for coordinating with the principal maintenance inspector (PMI) in reviewing those portions of the initially proposed I&O Plan, and subsequent revisions thereto, that pertain to aircraft maintenance.
5)    The POI and the Air Transportation Division should mutually review comments from their respective offices on the proposed plan, and establish a consensus concerning whether they should approve the plan. The Air Transportation Division will communicate inadequacies in proposed plans in a letter for the joint signature of the POI and the Air Transportation Division. The POI will deliver the letter to the operator. Similarly, when the POI and the Air Transportation Division concur to approve the plan, the Air Transportation Division will initiate a letter of approval for the joint signature of the POI and the Air Transportation Division. Once signed by the POI, the POI is responsible for the delivery of the approval letter to the operator.
6)    Once the FAA approves an I&O Plan, the operator’s FOQA program may continue for an indefinite period, unless the operator elects to terminate the FOQA program or the FAA withdraws its approval.

B.    FOQA Program Revisions. Changes will occur in an operator’s program as it assimilates new technologies, modifies event definitions, and changes structures to meet its program’s growing needs. Changes are likely to be frequent during the early stages of an operator’s FOQA program. When changes occur to previously approved I&O Plan content, the I&O Plan should be revised to document those changes.

1)    Operators should revise previously approved FOQA I&O Plans in accordance with standard revision control methodology (i.e., revision control page with remove and replace instructions by page, list of effective pages, and both revision number and revision date on every page of the document). The operator should submit revisions to the POI and an electronic copy to the Air Transportation Division.
2)    Revisions to approved I&O Plans do not require FAA letters of approval. Because such changes can be potentially frequent and voluminous, revisions to approved plans must be considered to be accepted by the FAA, unless the FAA notifies the carrier in writing within 45 days of submission that it has not accepted the revision, except as follows: notwithstanding this 45-day period, if at any time the FAA discovers that the content of an FOQA I&O Plan is not consistent with § 13.401, or is otherwise unacceptable to the FAA, the FAA may notify the operator that revisions are required in order to maintain approval. Either the POI or the Air Transportation Division should initiate mutual coordination if it appears to either office that it should not accept a revision, in which case the Air Transportation Division will prepare a letter of nonacceptance for joint signature of the POI and the Air Transportation Division, which the POI will transmit to the operator. In addition, unless the POI determines that it is inappropriate for a given operator, he or she should permit the operator to consolidate and submit revisions on a quarterly basis throughout the calendar year, rather than submitting each revision as it occurs. This procedure will reduce workload for both the operator and the FAA.

C.    Withdrawal of Approval. FOQA is a voluntary program, and the operator may therefore elect at any time to terminate its program. The FAA may withdraw approval of the operator’s FOQA I&O Plan, if the FAA determines that the operator has failed to comply with the requirements of § 13.401. The regulations extend certain enforcement protections for FOQA based on the expectation that the operator will act upon FOQA information indicative of an adverse safety trend or a continuing violation. If the FAA determines that the operator is making no effort to develop and implement a plan of corrective action for such items, and the operator is not responsive to FAA efforts to elicit compliance with this requirement, withdrawal of program approval is appropriate. Either the POI or the Air Transportation Division may initiate withdrawal of approval action, subject to coordination between each office. The Air Transportation Division will then initiate a withdrawal of approval letter for joint signature of the POI and the Air Transportation Division, which the POI will transmit to the operator.

11-73    MONITORING OF APPROVED PROGRAMS AND DATA/INFORMATION SHARING. Once the FOQA I&O Plan is approved, the FAA should monitor the overall progress of program implementation. The POI and/or Aircrew Program Manager (APM) should participate in the periodic meetings of the operator’s FOQA review team. The focus of these meetings should be on the identification and correction of potential threats to safety uncovered by aggregate FOQA trend information. Due to the de-identification and aggregation processes used, the association of individual flightcrew members with events or specific flights is not possible, nor is it consistent with FAA FOQA policy to request specific crewmember identity or individual flight information from the operator’s FOQA data.

A.    FAA Participation. The main purpose of FOQA programs is to identify adverse safety trends and to proactively initiate corrective action before such trends can lead to accidents. The operator has the primary responsibility for this activity. However, the FAA must verify that the operator is in fact fulfilling this responsibility. While the purpose of FAA participation in operator FOQA review meetings is primarily to observe, it is appropriate for the inspector attending the meetings to offer suggestions or comments that could be helpful in correcting adverse safety trends.

B.    Access to FOQA Data. Under an FAA-approved FOQA program, the POI (and/or APMs) and the PMI (and/or Partial Program Managers (PPM)) should be permitted free and open access to the operator’s de‑identified aggregate FOQA data, including fleet-specific trend analysis information. The operator must invite the POI (and/or APMs) and the PMI (and/or PPMs) to review trend information with the operator on at least a quarterly basis. This operator may satisfy this requirement at regular operator FOQA meetings, where the operator will present such trend information.

C.    Public Disclosure Protection. Order 8000.81 designates information received by the agency from an approved voluntary FOQA program as protected from public disclosure, in accordance with the provisions of part 193.

D.    Protected Information. Under Title 49 of the United States Code (49 U.S.C.) § 40123, certain voluntarily provided safety and security information is protected from disclosure in order to encourage people to provide the information to the FAA. The FAA must first find that 49 U.S.C. § 40123 protects the information. The FAA’s rules for implementing 49 U.S.C. § 40123 are in 14 CFR part 193. If the Administrator issues an order designating information as protected under 49 U.S.C. § 40123, that information will not be disclosed under the Freedom of Information Act (FOIA) (Title 5 of the United States Code (5 U.S.C.) § 552) or other laws, except as provided in 49 U.S.C. § 40123, part 193, and the order that designates the information as protected. This FAA order for FOQA (Order 8000.81) is issued under part 193, § 193.11, which sets out the notice procedure for designating information as protected.

E.    Protection from Use for Enforcement Protection. Section 13.401 protects any FOQA data or information shared with the FAA from use by the FAA for enforcement purposes.

F.    Data Protection Warning. Any FOQA data or information shared with the FAA will be protected from public disclosure in accordance with part 193 and Order 8000.81. Any de-identified FOQA data or aggregate FOQA data that leaves the operator’s property will be clearly labeled as follows:

“WARNING: This FOQA information is protected from disclosure under 49 U.S.C. § 40123 and 14 CFR part 193. This information may be released only with the written permission of the Federal Aviation Administration Associate Administrator for Regulation and Certification.”

G.    Identifying Information. The operator ordinarily will remove any information that could be employed to derive operator identity from any aggregate FOQA data submissions that the operator provides to the FAA in compliance with § 13.401, unless the operator elects to include that information. In the event that the operator chooses to allow FOQA data or aggregate FOQA data that includes airline identity information to be removed from its property, all such data will be labeled as the confidential and propriety property of the operator, in addition to the preceding warning.

H.    Providing FOQA Data to the FAA. Section 13.401(d) provides that the operators will provide aggregate FOQA data to the FAA in a form and manner acceptable to the Administrator. Operators accomplish this requirement by providing aggregate FOQA data to the FAA’s Aviation Safety Information Analysis and Sharing (ASIAS) program, in addition to the certified operator’s information-sharing activities that take place with the certificate-holding district office (CHDO). All information included in any industry-sharing activity or any Request for Information (RFI) will be reviewed and approved by the operator before release. Any information released by the FAA will comply with the provisions of Order 8000.81 and part 193.

I.    Future Requirements for § 13.401(d) Compliance. In the future, the FAA may provide further guidance regarding requirements for compliance with § 13.401(d). The operator will review those requirements to determine whether to continue its voluntary participation in an approved FOQA program. If the decision is made to continue with the program, the I&O Plan will be revised accordingly.

J.    Unauthorized Disclosure. All FAA personnel must understand the sensitivity of information and data that the operator may share with the FAA. Any unauthorized disclosure of information or data entrusted to the FAA, even if inadvertent, could cause negative consequences for future cooperation with the FAA in voluntary safety programs.

11-74    ENFORCEMENT POLICY. Except for criminal or deliberate acts, data gathered under an FAA‑approved FOQA program will not be used in any enforcement action against that operator or its employees. This protection is in accordance with § 13.401 and no attempt should be made by any inspector to identify individual flightcrew members associated with any FOQA event.

Indicates new/changed information.

11-75    TRACKING FOQA OVERSIGHT ACTIVITIES. For oversight conducted in accordance with SAS, the inspector must enter the code “FOQA” in the “National Use” field in the SAS database.

Figure 11-14.  I&O Plan Checklist

Certificate holders should use the following checklist to prepare their I&O Plan and verify they are including all required materials. The FAA will review this checklist to determine that the I&O Plan has specified the items required in an FOQA program. This checklist identifies the minimum requirements of an I&O Plan. An operator’s I&O Plan may contain additional information in excess of these minimum requirements. When the operator submits an I&O Plan for FAA approval, a completed copy of this checklist should accompany it.

The “Response” column must be completed for each question. Appropriate responses are “Yes,” “No,” or “NA” (not applicable). All “No” and “NA” responses should include, in the “Comment” column, a brief explanation of each such response.

The “Reference” column is to be completed for each question to which the operator provides a “Yes” response. The information provided in the “Reference” column must identify the specific location of the subject item in the I&O Plan (e.g., section 2.1).

 

Response

Reference

Comment

General

1. Has the certificate holder requested approval of the I&O Plan in a cover letter addressed to the POI, accompanying submittal of the plan?

☐ Yes

☐ No

☐ NA

 

 

2. Has a copy of the cover letter and plan been forwarded to the Air Transportation Division?

☐ Yes

☐ No

☐ NA

 

 

3. Does the I&O Plan identify the personnel, system equipment, and resources it has committed to support the FOQA program?

☐ Yes

☐ No

☐ NA

 

 

4. Does the I&O Plan acknowledge the requirement to document revisions in accordance with standard revision control methodology?

☐ Yes

☐ No

☐ NA

 

 

5. Does the I&O Plan acknowledge that, following initial FAA approval, it must document subsequent modifications to the FOQA program in revisions submitted to the POI and the Air Transportation Division?

☐ Yes

☐ No

☐ NA

 

 

I&O Plan

1. Does the plan clearly specify the goals and objectives of the FOQA program?

☐ Yes

☐ No

☐ NA

 

 

2. Does the plan clearly identify the major stakeholders within the operator?

☐ Yes

☐ No

☐ NA

 

 

3. Does the plan include a copy of an agreement with the pilot association (if applicable) for FOQA data usage as an appendix?

☐ Yes

☐ No

☐ NA

 

 

4. Does the plan describe operator data safeguard and protection mechanisms?

☐ Yes

☐ No

☐ NA

 

 

5. Does the plan identify the operator fleets (e.g., make, model, series) that are targeted for participation in the FOQA program?

☐ Yes

☐ No

☐ NA

 

 

6. Does the plan describe the capabilities of the planned airborne equipment for FOQA?

☐ Yes

☐ No

☐ NA

 

 

7. Does the plan identify provisions for airborne equipment maintenance and support?

☐ Yes

☐ No

☐ NA

 

 

8. Does the plan specify a fleet installation plan?

☐ Yes

☐ No

☐ NA

 

 

9. Does the plan describe the capabilities of the proposed Ground Data Replay and Analysis System (GDRAS)?

☐ Yes

☐ No

☐ NA

 

 

10. Does the plan identify provisions for maintenance of the GDRAS hardware and software?

☐ Yes

☐ No

☐ NA

 

 

11. Does the plan describe other key technology components of the operator’s FOQA program?

☐ Yes

☐ No

☐ NA

 

 

12. Does the plan designate a single point of contact (POC) to oversee the FOQA program?

☐ Yes

☐ No

☐ NA

 

 

13. Does the plan define the operator’s organizational structure for oversight and operation of the FOQA program?

☐ Yes

☐ No

☐ NA

 

 

14. Does the plan describe the roles and responsibilities of key operator personnel and teams?

☐ Yes

☐ No

☐ NA

 

 

15. Does the plan specify the schedule and timeline for implementing the FOQA program?

☐ Yes

☐ No

☐ NA

 

 

16. Does the plan specify FOQA program start-up criteria?

☐ Yes

☐ No

☐ NA

 

 

17. Does the plan describe how it will train key FOQA team members?

☐ Yes

☐ No

☐ NA

 

 

18. Does the plan describe how the operator will educate its pilots about the FOQA program?

☐ Yes

☐ No

☐ NA

 

 

19. Does the plan describe a method for educating senior management and stakeholders?

☐ Yes

☐ No

☐ NA

 

 

20. Does the I&O Plan specify procedures for implementing and auditing security mechanisms?

☐ Yes

☐ No

☐ NA

 

 

21. Does the plan specify a data storage and retention policy?

☐ Yes

☐ No

☐ NA

 

 

22. Does the plan specify flight data (FDAT) collection and retrieval procedures?

☐ Yes

☐ No

☐ NA

 

 

23. Does the plan describe the procedures for defining fleet-specific events and associated parameters?

☐ Yes

☐ No

☐ NA

 

 

24. Does the plan provide the fleet-specific event definitions, including trigger limits for each event’s severity classification, as Appendix 2 to the plan?

☐ Yes

☐ No

☐ NA

 

 

25. Does the plan describe the procedures for validating, refining, and tracking event definitions?

☐ Yes

☐ No

☐ NA

 

 

26. Does the plan acknowledge that updates to FOQA event definitions must be included in I&O Plan revisions submitted to the FAA?

☐ Yes

☐ No

☐ NA

 

 

27. Does the plan specify procedures for data review and evaluation?

☐ Yes

☐ No

☐ NA

 

 

28. Does the plan provide for notifying appropriate operator departments of adverse trends revealed by FOQA data flightcrew training?

☐ Yes

☐ No

☐ NA

 

 

29. Does the plan specify procedures for taking, tracking, and following up on corrective actions?

☐ Yes

☐ No

☐ NA

 

 

30. Does the plan describe guidelines for crewmember contact and followup?

☐ Yes

☐ No

☐ NA

 

 

31. Does the plan include a description of how it will document FOQA system procedures?

☐ Yes

☐ No

☐ NA

 

 

32. Does the plan describe the process for joint FAA/operator periodic reviews of the FOQA program and associated aggregate data?

☐ Yes

☐ No

☐ NA

 

 

Indicates new/changed information.

RESERVED. Paragraphs 11-76 through 11-91.