Helicopter Flight Data Monitoring (HFDM) - Recommended Practice for Oil and Gas Passenger Transport Operations - HeliOffshore
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
Version 1.0 HO-HFDM-RP-v1.0 Helicopter Flight Data Monitoring (HFDM) Recommended Practice for Oil and Gas Passenger Transport Operations Enter
HFDM Recommended Practice Version 1.0 Contents 2
Safety Through Collaboration
Collaboration empowers safety and is at the very heart of HeliOffshore. This HFDM Recommended
Practice is a great example of how our industry – from designers and maintainers, to pilots and
passengers – works together and learns from each other to ensure no lives are lost in offshore flight.
I would like to thank the HeliOffshore HFDM Working Group, industry stakeholders and every
HeliOffshore member who came together to deliver this guidance. Thank you for your commitment
and contribution. Together, we will implement and sustain ever-higher levels of performance
so those we are responsible for travel home safely every day.
Tim Rolfe
CEO, HeliOffshore
Publishing Details Acknowledgments Disclaimer
Version: 1.0 HeliOffshore gratefully acknowledges the contribution of the Global While every effort has been made to ensure the information
HFDM group, whose document was the starting point for this contained in this recommended practice is accurate,
Publication date: September 2020 recommended practice. HeliOffshore makes no warranty, express or implied, and takes
no responsibility as to the accuracy, capability, efficiency,
Authors: We would also like to thank all the industry groups who offered merchantability, or functioning of this information. The user of
feedback to help improve this document, including EASA, UK CAA, such information does so at their own risk and has reviewed and
Cat Reed (WG co-lead) Cougar FAA, Flight Safety Foundation and Cranfield University. independently verified the information for their own purposes.
Robert Bouillion (WG co-lead) PHI
Extracts from this recommend practice may be published
José Luis Cendejas Aeroservicios Especializados without specific permission from HeliOffshore, provided that
Amanda Roberts Bristow HeliOffshore is duly acknowledged as the source and that the
Jared Simon CHC material is reproduced accurately, in context and solely for the
Chastity Marks Era purpose of safety.
Liz Ardila GE Digital
Quintin Frost Heliconia The guidance given in this recommended practice document
Matt Greaves HeliOffshore represents a collective position adopted by the HFDM Working
Lucas Nerone Líder Aviação Group. Participation in the group or being named as an author
Sean Western NHSL does not imply that an individual or their organization support
Maxime Perrot NHV any particular point.
Renata Freitas Omni
Brett Ingram Pathfinder This document is not intended to replace any contractual
Ryan Landry PHI negotiations, agreements or requirements between helicopter
Ryan Smith PHI operators and their customers.
Sam Richmond PHI International
Andy Heather Tonic Analytics
Capt Dato’ Sim Kian Peng Weststar
HFDM Recommended Practice Version 1.0 Contents 3
1 Introduction 4 5 HFDM Hardware and Software 17 8 Acting on Results 30
1.1 What is the aim of this document? 5 5.1 Choice of System 18 8.1 Communication of Results 31
1.2 Who is this document aimed at? 5 5.2 Aircraft Types 18 8.2 Crew Contacts 31
5.3 On-board Systems 19 8.3 Review and Playback 32
2 Background 6 5.4 Data Transfer 19 8.4 Serious / Repeat Events 32
2.1 Brief history of HFDM in Offshore Operations 7 5.5 Ground Hardware and Software 19 8.5 Data Storage, Retention and Back-up 32
2.2 Objectives and Benefits of an HFDM 5.6 System Serviceability 20
Programme 7 9 Programme Audits 33
2.3 HFDM as Part of an SMS 7 6 Organizational Structure 21 9.1 Internal Audits and Review 34
2.4 HFDM and Just Culture 8 6.1 HFDM Programme Manager 22 9.2 External Audits 34
2.5 Overview of HFDM System Process 9 6.2 Gatekeeper 22
6.3 Data Analyst(s) 22 10 Other Topics 35
3 Regulation 10 6.4 Pilot Liaison 23 10.1 Use of HFDM Data in EBT / ATQP 36
3.1 Requirement to Record Flight Parameters 11 6.5 HFDM Review Group 23 10.2 Statistics 36
3.2 Requirement for an HFDM Programme 12 6.6 Personnel Training 23 10.3 Data-sharing Forums 36
3.3 Other Guidance 12 6.7 Size of Organization 24
3.4 IOGP Guidance 13 11 Summary 37
7 Data Analysis 25
4 Legal Agreements 7.1 Collect and Process Flight Data 26 12 Definitions / Glossary 39
and Data Protection 14 7.2 Event Analysis 26
4.1 Staff Agreements 15 7.3 Event Severity 27 13 Appendices 42
4.2 Deidentification of Data 16 7.4 Threshold Setting 27 13.1 Appendix 1 – Requirements to Fit an FDR 43
4.3 Protection of Data and the General Data 7.5 Analysis of All Flights 28 13.2 Appendix 2 – HFDM Vendors and Training 44
Protection Regulation 16 7.6 Defining Custom Events 28 13.3 Appendix 3 – Parameters in AMC1.1
7.7 Trend Analysis and Storing Results 28 to CAT.IDE.H.190 45
13.4 Appendix 4 – Generic Event List 47
13.5 Appendix 5 – HeliOffshore Safety
Event Approach 54
14 References 57
HFDM Recommended Practice Version 1.0 Introduction Contents 4
Section 1 Introduction
HFDM Recommended Practice Version 1.0 Introduction Contents 5
Section 1
Introduction
1.1 What is the aim of this The document is not specifically aimed 1.2 Who is this document aimed at?
document? at those who are considering setting up The practices described in this document are
an HFDM programme; there are various aimed at helicopters performing Commercial
This is a compilation of recognized best
considerations and enrolment procedures Air Transport (CAT) of passengers in
practices collected from aircraft operators,
that an operator would want to undertake support of Oil and Gas. In general, for this
industry groups, regulatory agencies,
that are not described here. Other application, the guidance will relate most
educational organizations and individual
documents provide specific guidance on closely to larger helicopters supplied with
experts in this field. It is not intended to
establishing an (H)FDM programme including an HFDM capability. However, the principles
replace official or regulatory guidance
AC-120 from the FAA1, CAP 739 from the described in this document can be applied to
material, but to provide useful information
UK CAA2, the HFDM toolkit from the IHST/ any helicopter capable of capturing data.
to those looking to implement or improve
IHSF3 and the ICAO Manual on Flight
their Helicopter Flight Data Monitoring
Data Analysis Programmes4. Instead, this
(HFDM) programmes.
document aims to describe the features of a
mature, functioning HFDM programme and
as such can provide an ‘aim point’ for those
establishing a new programme.
HFDM Recommended Practice Version 1.0 Background Contents 6
Section 2 Background
HFDM Recommended Practice Version 1.0 Background Contents 7
Section 2
Background
The International Helicopter Safety Helicopter Operational Monitoring Project offer many similar benefits to operators, with the implementation of their SMS; the
Foundation (IHSF)3 defines Helicopter Flight report in 19977 and the Super Puma including: ICAO Safety Management Manual11 is a good
Data Monitoring (HFDM) as “a systematic Operational Usage Analysis report in 19908. starting point.
method of accessing, analyzing, and acting • proactive risk monitoring (see Section 2.3)
upon information obtained from flight Since then, the use of HFDM has grown including organizational or procedural The ICAO SMS framework11 is made up of
data to identify and address operational considerably and today, most helicopter drift, systemic issues and operating four components:
risks before they can lead to incidents operators supporting the major oil and gas environment;
and accidents.” This concept has also producers have active HFDM programmes. • enhancing training effectiveness; • Safety policy and objectives;
variously been described as: Helicopter The InternationaI Association of Oil and • compliance monitoring; • Safety risk management;
Flight Operational Quality Assurance Gas Producers (IOGP) Offshore Helicopter • monitoring the effectiveness of risk • Safety assurance; and
(HFOQA); Helicopter Operations Monitoring Recommended Practices9 states an mitigations that have been introduced; • Safety promotion.
Programme (HOMP); Line Activity expectation that “a Helicopter Flight Data • improved investigation of events; and
Monitoring Programme (LAMP); Flight Data Monitoring (HFDM) programme is in place”. • enhanced crew feedback. HFDM has a significant role to play in the
Analysis Programme (FDAP) and more. The Similarly, the Flight Safety Foundation operator’s SMS. Hazard identification is the
term HFDM will be used in this document to Standard for Offshore Helicopter Operations Running an effective HFDM system may first step in the safety risk management
represent all of these different descriptions. (SOHO)10 requires HFDM for contracts also offer financial benefits such as reduced (SRM) process and ICAO11 lists HFDM as a
While much of an HFDM programme will exceeding 6 months. insurance premiums, enhanced operational “Source for Hazard Identification” alongside
be similar to the equivalent system in efficiencies, a reduction in incidents and other sources such as: line operations safety
fixed-wing, at present there are sufficient In the past, HFDM has been most commonly maintenance improvements stemming from audits (LOSA); voluntary and mandatory
differences to warrant the different name. employed by large operators on heavy better data availability. reporting systems; audits; feedback from
aircraft. However, progress in technology training; and service provider safety
2.1 Brief history of HFDM in Offshore and a recognition of the value of HFDM 2.3 HFDM as Part of an SMS investigations. Compared with the other
Operations has led to the wider introduction of The ICAO Safety Management Manual11 sources, HFDM has the benefit of automated
programmes, even for small fleets and light notes that “Safety Management seeks to collection of objective data that can be
In late 1998, following the successful
aircraft within smaller operators. proactively mitigate safety risks before they quickly analysed.
completion of an initial feasibility study,
the UK CAA instigated trials of an FDM result in aviation accidents and incidents.”.
programme for North Sea helicopters, 2.2 Objectives and Benefits of an An active safety management system (SMS) ICAO11 lists HFDM as a “Proactive” hazard
HFDM Programme has been a requirement for most aircraft identification methodology. Rather than
known as the Helicopter Operations
operators for a number of years. A full focussing on past outcomes or events and
Monitoring Programme (HOMP)5,6. The The benefits of FDM within fixed wing
discussion of safety management is beyond the investigation of safety occurrences
HOMP trial represented one of the first operations are well-documented. HFDM,
the scope of this document and significant (“Reactive”) the focus of an HFDM system
applications of FDM to helicopters, although despite having different complexities, can
resources are available to help operators should be on lower consequence events to
the groundwork was arguably laid by the
HFDM Recommended Practice Version 1.0 Background Contents 8
assess whether a hazard could lead to an 2.4 HFDM and Just Culture The latest version of ICAO Annex 616 contains a change in language from requiring a Flight
accident or incident11. The ICAO Safety Management Manual11 Data Analysis Programme to be “non-punitive”, to the definition given in Appendix 3 of ICAO
identifies the need for a positive safety Annex 1917:
That is not to say that HFDM cannot support culture, saying “Safety culture is arguably
reactive hazard identification, but the the single most important influence on the “States shall ensure that safety data or safety information is not used for:
primary role of an HFDM programme should management of safety”.
not be to spot individual exceedances or a) disciplinary, civil, administrative and criminal proceedings against employees, operational
deviations. Instead, it should focus on the In the 1990s, the concept of a ‘no-blame personnel or organizations;
larger datasets and trends, with ‘compliance culture’ was widespread (as distinct b) disclosure to the public; or
monitoring’ being a much smaller part. from the largely punitive cultures that it c) any purposes other than maintaining or improving safety; unless a principle of exception
Furthermore, in the case of a significant sought to replace). It recognised that most applies.”
safety event being identified through HFDM, ‘unsafe acts’ were ‘honest errors’ whose
a crew will often be encouraged to submit perpetrators were not blameworthy, and With respect to safety culture around HFDM, guidance material to the FDM requirement in
an air safety report (ASR) into the SMS, where no benefit would be gained from the EU rules for air operations18 states that:
where an HFDM programme can support an punishment. However, this concept failed
investigation. to address wilful dangerous behaviour or “Indicators of an effective safety culture typically include:
distinguish between culpable and non-
HFDM can also contribute to other parts of culpable unsafe acts14. (i) top management’s demonstrated commitment to promoting a proactive safety culture;
the SMS framework by supporting safety (ii) a non-punitive operator policy that covers the FDM programme;
performance monitoring (SPM), creating In part to address this shortfall, Reason15 (iii) FDM programme management by dedicated staff under the authority of the safety
safety performance indicators (SPIs), defined the concept of a ‘Just Culture’ as manager, with a high degree of specialisation and logistical support;
informing a training-needs analysis (TNA) (iv) involvement of persons with appropriate expertise when identifying and assessing the
and feeding safety promotion material. “an atmosphere of trust in which people are risks (for example, pilots experienced on the aircraft type being analysed);
encouraged, even rewarded, for providing (v) monitoring fleet trends aggregated from numerous operations, not focusing only on
IOGP Report 6909 specifies that “the aircraft essential safety-related information – but in specific events;
operator uses HFDM analysis, wxithin its SMS which they are also clear about where the (vi) a well-structured system to protect the confidentiality of the data; and
to assist with the identification of specific line must be drawn between acceptable and (vii) an efficient communication system for disseminating hazard information (and subsequent
risks in the conduct of flight procedures.” unacceptable behaviour.” risk assessments) internally and to other organisations to permit timely safety action.”
The European Operators FDM (EOFDM) This concept maintains the no-blame This is a subset of the guidance on Safety Culture contained within the ICAO Manual on Flight
Forum offers guidance on integrating FDM concept but does not tolerate gross Data Analysis Programmes4.
into the SMS12 and the BARS Offshore negligence, wilful violations and destructive
Helicopter Operations Standard13 notes that acts, while recognising that only a very small Some cite as an advantage of HFDM, its ability to detect events in organizations without
proportion of human actions that are unsafe a good reporting culture. However, without the appropriate safety culture in place, any
“For long-term contracts the aircraft operator are deliberate. HFDM programme cannot hope to be effective. Similarly, any abuse of that culture, and
must have a Flight Data Monitoring (FDM) the trust that accompanies it, by the HFDM programme will have an enormous impact on
program as part of its SMS to systematically Any HFDM programme should be entirely the programme and the organization as a whole. It is crucial that any HFDM programme
analyze and make pro-active use of digital consistent with the Just Culture established commands and maintains the trust of the workforce.
flight data from routine operations to reduce in the organization through the SMS.
risk and provide operational feedback.”
HFDM Recommended Practice Version 1.0 Background Contents 9
2.5 Overview of HFDM System
Helicopter flight(s)
Process
The figure opposite outlines the key stages of
the HFDM process. For clarity this flowchart Transmit data (card,
shows only the HFDM components rather network, wireless...)
than the full interaction with the operator’s
SMS, see2,12 for example.
Import raw data into
HFDM system and decode
Data in
engineering units
Anonymise data
Extract measurements
No events
Analyse for events No action needed
Events detected
Invalid Address source of
Validate events
invalidity
Valid
Low Assess High
operational
risk
Medium
Event logged
for trending Gatekeeper identifies flight crew
Communicate Crew contact
to crew and debrief
Event rate trending HFDM Review Group
Key Performance Indicators Measurement distributions
Key Safety Indicators Training recommendations
Periodic publications Continuous improvement
HFDM Recommended Practice Version 1.0 Regulation Contents 10
Section 3 RegulationHFDM Recommended Practice Version 1.0 Regulation Contents 11
Section 3
Regulation
3.1 Requirement to Record Flight 4.7.1.1.1 – All helicopters of a maximum 3.1.3 Summary
Parameters certificated take-off mass of over 3175 Appendix 13.1 contains the specific guidance issued by EASA, FAA and Transport Canada
kg for which the individual certificate of regarding fitment of FDRs. Table 1 below summarises the guidance for some typical aircraft
While the requirement for a helicopter
airworthiness is first issued on or after 1 in operation in Oil and Gas passenger transport, disregarding the date of the individual
to carry a Flight Data Recorder (FDR) is
January 2016 shall be equipped with an certificate of airworthiness, based on Maximum Certified Take-Off Mass (MCTOM) and
independent of any HFDM programme, the
FDR which shall record at least the first 48 Maximum Operational Passenger Seating Configuration (MOPSC).
requirement to carry an FDR implies that the
parameters listed in Table A4-1 of Appendix 4.
flight parameters are concentrated before
being recorded, which makes it possible to Typical MCTOM (kg) Typical MOPSC ICAO EASA FAA TC
4.7.1.1.2 – All helicopters of a maximum
collect them for HFDM purposes. Therefore, Bell 407 2,268 6 - o - -
certificated take-off mass of over 7000 kg, or
it is relevant to be aware of the regulation AW 169 4,800 10 o • • •
having a passenger seating configuration of
around the requirement to carry a recorder.
more than nineteen, for which the individual Airbus H155 4,850 14 o • • •
In addition, the presence or absence of an
certificate of airworthiness is first issued on Bell 212 5,080 14 o • • •
FDR is sometimes referred to in regulation
or after 1 January 1989 shall be equipped
relating to HFDM (e.g. SPA.HOFO19, Annex Sikorsky S-76 (D) 5,386 9 o • - -
with an FDR which shall record at least the
616). Bell 412 (EP) 5,398 14 o • • •
first 30 parameters listed in Table A4-1 of
Appendix 4. AW 139 6,400 15 o • • •
3.1.1 Flight Recorder Standards
Airbus H175 7,500 18 • • • •
The most commonly referenced standards 4.7.1.1.3 – Recommendation – All helicopters
for Flight Data Recorders are ED-112A20 AW 189 8,300 19 • • • •
of a maximum certificated take-off mass
(or TSO C124c21) for crash-protected of over 3175 kg, up to and including 7000 Airbus H225 11,000 25 • • • •
airborne recorder systems, and ED-15522 for kg, for which the individual certificate of Sikorsky S-92 12,020 19 • • • •
lightweight flight recording systems. Both airworthiness is first issued on or after 1
documents contain a table of parameters to January 1989, should be equipped with an Table 1 – Requirement to fit a Flight Data Recorder
be recorded (see also Section 5.2). FDR which should record at least the first 15 (• = required, o = recommended, - = not required)
parameters listed in Table A4-1 of Appendix 4.
3.1.2 ICAO Annex 6 …
ICAO Annex 6, Part III16 provides Standards 4.7.1.3 – Duration – All FDRs shall retain the
and Recommended Practices for Helicopters information recorded during at least the last
and Section III, Chapter 4.7 describes the 10 hours of their operation.”
requirement to fit an FDR:
The Annex also lists parameters to be
“4.7.1.1 – Applicability recorded – see Section 5.2.HFDM Recommended Practice Version 1.0 Regulation Contents 12
3.1.4 Lightweight Recorders and Rotorcraft 3.2.2 EU Rules for Air Operations The document focuses predominantly on The Basic Aviation Risk Standard (BARS) for
CAT.IDE.H.19123 mandates the fitment EU Rules for Air Operations SPA.HOFO19 fixed-wing but much of the content is also Offshore Helicopter Operations10 and the
of a lightweight flight recorder for CAT contains requirements applicable to relevant to an HFOQA / HFDM programme. BARS OHO Implementation Guide13 published
helicopters with a MCTOM of 2,250kg Helicopter Offshore Operations and, by the Flight Safety Foundation includes
or more and an individual Certificate of specifically, SPA.HOFO.145 Flight Data 3.2.4 CASA Flight Data Monitoring as part of an effective
Airworthiness on or after 5 September Monitoring (FDM) system states that: SMS and also as part of a minimum mission
The Australian Civil Aviation Safety Authority
2022. In addition, EASA revised a Safety fit.
(CASA) Part 11926 119.195 requires that an
Information Bulletin (SIB)24 which encourages “(a) When conducting CAT operations with Australian air transport operator must have
the fitment of flight data recorders to light a helicopter equipped with a flight data The European Operators Flight Data
a flight data analysis programme if they are
rotorcraft. recorder, the operator shall establish Monitoring (EOFDM) Forum28 has produced
operating a rotorcraft
and maintain a FDM system, as part of a number of FDM industry good practice
3.2 Requirement for an HFDM its integrated management system, by 1 publications, including:
“(i) with a maximum take off weight of more
Programme January 2019. than 7,000 kg; or
• Preparing a Memorandum of
Not all States have requirements for, or offer (ii) with a maximum operational passenger
(b) The FDM system shall be non-punitive Understanding for an FDM Programme29
guidance on, running an HFDM programme. seat configuration of more than 9
and contain adequate safeguards to • Key Performance Indicators for a Flight
Some of the better-known guidance and seats and that is required, under these
protect the source(s) of the data.” Data Monitoring Programme30
regulation is described below. Regulations, to be fitted with a flight
• Breaking the Silos: Integrating Flight Data
data recorder.”
AMC1, GM1 and GM2 to SPA.HOFO.145 Monitoring into the Safety Management
3.2.1 ICAO System12.
provide additional means of compliance and The regulation also gives further details
ICAO Annex 6 - Part III16 states in Section II guidance on the form the programme should about the form the programme should take.
that: take. GM2 includes a list of example HFDM The group has also published other guidance
CASA Civil Aviation Advisory Publication
events that is taken from the Global HFDM such as:
CAAP SMS-4(0) gives supporting Guidance
“1.3.1 Recommendation.– The operator guidance25. on the Establishment of a Flight Data Analysis
of a helicopter of a certified take-off • Review of Accident Precursors31
Program (FDAP) – Safety Management
mass in excess of 7000 kg or having 3.2.3 FAA • Guidance for the Implementation of FDM
Systems (SMS)27. The guidance predominantly
a passenger seating configuration of Precursors32
FAA Advisory Circular 120-821 gives concerns fixed-wing operations.
more than 9 and fitted with a flight data
“guidance on one means, but not necessarily
recorder should establish and maintain a which, although aimed at fixed-wing
flight data analysis programme as part
the only means, of developing, implementing, 3.3 Other Guidance operations, offers useful concepts for HFDM.
and operating a voluntary Flight Operational CAP 739 – Flight Data Monitoring2 from
of its safety management system.” They also publish presentations delivered at
Quality Assurance (FOQA) program that the UK CAA is a comprehensive reference previous FDM conferences33.
is acceptable to the Federal Aviation for FDM, including some details specific to
The Annex also refers the reader to the ICAO
Administration (FAA).” HFDM. It was last updated in 2013.
Manual on Flight Data Analysis Programmes4 The ICAO Manual on Flight Data Analysis
for information on establishing a programme Programmes4 offers useful guidance on all
The document notes that FOQA is a The Industry Best Practice25 from the Global
and ICAO Annex 1917 for guidance on the aspects of an FDM programme.
voluntary safety programme and that HFDM group offers useful guidance that is
protection of data.
approval of that programme by the specific to helicopter operations. It was last
FAA is only required if protection from updated in 2012.
enforcement is sought, under 14 CFR part 13,
section 13.401.HFDM Recommended Practice Version 1.0 Regulation Contents 13 3.4 IOGP Guidance The International Association of Oil & Gas Producers (IOGP) represents the global upstream oil and gas industry. IOGP Report 6909 describes Offshore Helicopter Recommended Practices to assist in the management of offshore commercial helicopter transport operations. The guidance in Report 690 that relates to HFDM (mostly contained in Section 8 of 690-2: Aircraft Operations) is included throughout this report in highlighted boxes, as shown below. IOGP Report 6909 specifies that: “A Helicopter Flight Data Monitoring (HFDM) programme is established and documented, and is aligned with the HeliOffshore HFDM Recommended Practices (HO-HFDM-RP-v1.0).”
HFDM Recommended Practice Version 1.0 Legal Agreements and Data Protection Contents 14
Section 4 Legal Agreements and Data ProtectionHFDM Recommended Practice Version 1.0 Legal Agreements and Data Protection Contents 15
Section 4
Legal Agreements and Data Protection
The success of any HFDM programme lies in compliance to ORO.AOC.13034, it is specified out in a constructive and non-punitive Foundation (IHSF) provide an example Pilot
the level of trust and support it commands in subpart (k): manner; Agreement as part of their HFDM toolkit3
within the organization. Absolutely central (6) the conditions under which the • Appendix D of CAP 7392 gives a Sample
to the issue of trust is the confidentiality, “The procedure to prevent disclosure confidentiality may be withdrawn for FDM Procedural and Confidentiality
anonymity and data protection within the of crew identity should be written in a reasons of gross negligence or significant Agreement but this is relatively limited in
programme. document, which should be signed by continuing safety concern; scope.
all parties (airline management, flight (7) the participation of flight crew member • Working Group C of the European
4.1 Staff Agreements crew member representatives nominated representative(s) in the assessment of the Operators Flight Data Monitoring
An HFDM programme must contain a policy either by the union or the flight crew data, the action and review process and Forum has produced a document
defining how the flight data that is acquired themselves). This procedure should, as a the consideration of recommendations; entitled Preparing a Memorandum of
will be treated, often referred to as a minimum, define: and Understanding for an FDM Programme29
‘confidentiality agreement’, ‘Memorandum (8) the policy for publishing the findings to assist in preparing a document. It deals
of Understanding’ or similar. This document (1) the aim of the FDM programme; resulting from FDM.” with the 8 areas listed above, in turn.
is part of an operator’s Safety Management (2) a data access and security policy that
System (SMS), whose specific manuals and should restrict access to information to It is beyond the scope of this document If an external HFDM provider is used (see
documents it should be linked to, but it can specifically authorised persons identified to discuss in detail the content of the Section 5.1.2) they should be a party to
also be regarded as a standalone document by their position; confidentiality agreement as it must be the confidentiality agreement with specific
in support of the HFDM programme. (3) the method to obtain de-identified crew tailored to each individual operator’s needs. provisions about their responsibilities.
feedback on those occasions that require For example, one significant difference
The confidentiality agreement must specific flight follow-up for contextual between operators is whether the pilots If the operator is taking part in a data-
clearly define the responsibilities of the information; where such crew contact operate in a unionised or non-unionised sharing forum (see Section 10.3), it would be
operator and its employees with respect is required the authorised person(s) environment, possibly leading to different helpful to include that in the confidentiality
to the processing, analysis, handling and need not necessarily be the programme procedures around the handling of HFDM agreement.
retention of flight data. It should also layout manager or safety manager, but could data. This may require operators to produce
the conditions and process for making be a third party (broker) mutually different confidentiality agreements for Very occasionally, some feel that the level
contact with a crew. This agreement should acceptable to unions or staff and different regions of operations or different of data protection given to HFDM data
be signed by the highest levels of senior management; Air Operator’s Certificates (AOCs). is excessive or onerous despite the fact
management on behalf of the operator and (4) the data retention policy and that a data protection policy need not be
also by any individual coming into contact accountability, including the measures However, examples of typical agreements complicated or expensive. In those cases,
with data from individual flights. taken to ensure the security of the data; and guidance around the necessary it may be useful to draw the analogy for a
(5) the conditions under which advisory considerations are available: desk-based worker:
As part of the acceptable means of briefing or remedial training should
take place; this should always be carried • The International Helicopter SafetyHFDM Recommended Practice Version 1.0 Legal Agreements and Data Protection Contents 16
Imagine there were a device on your desk The ability to link a flight with an individual ICAO Annex 616 states that “as of 7 November
continually recording your actions and should be restricted to the Gatekeeper (see 2019, a flight data analysis programme shall
decisions throughout the working day, Section 6.2). The confidentiality agreement contain adequate safeguards to protect the
with the data permanently stored and must define under what circumstances source(s) of the data in accordance with
available to be reviewed by the organization. anonymous flight data can be ‘reidentified’, Appendix 3 to Annex 19.” This Appendix in
What protections would you want on the the process for doing that and the permitted Annex 1917 offers useful guidance on the
organization’s ability to identify you and uses of the identified data. conditions for protecting and releasing
review your individual actions? data. SPA.HOFO19 also makes reference to
Operators should be careful to consider at “adequate safeguards”.
4.2 Deidentification of Data what point flight data should be deidentified
One of the core protection mechanisms and ensure that the relevant confidentiality If the operator plans to release any data
for HFDM data is to store and access it in agreement is signed and observed by all in support of external programmes such
deidentified form, meaning that the flight relevant staff. For example, a maintenance as operational research, evidence-based
data cannot be linked to individual flight engineer with responsibility for uploading training (EBT), safety investigations or
crew by the person viewing the flight data. HFDM data and with access to the HFDM data-sharing forums (see Sections 8.1, 10.1
This can be achieved in a number of ways system may be able to relate flight data to an and 10.3) it should conform with the HFDM
such as removing aircraft registrations, individual. programme manual, ideally with a dedicated
specific dates or other such data. As well section detailing the data allowed to be
as protecting the individual flight crews, 4.3 Protection of Data and the released.
deidentification also limits the potential General Data Protection Regulation
influence of bias (either conscious or In Europe, the General Data Protection
With respect to storage of flight data and
subconscious) on the judgement of analysts Regulation (GDPR) was put into effect on
analysis results, the ICAO Manual on Flight
(whether positive or negative) about an May 25, 2018. Full details of the regulation
Data Analysis Programmes4 recommends
event. are available35 but in summary, the GDPR
an ‘online’ and ‘offline’ strategy where the
imposes obligations onto organizations
“most recent flight data and exceedances
It is vital that the senior management of anywhere about how they process, handle
are normally kept readily available to allow
the operator shows its full support for the and protect personal data related to people
fast access during the initial analysis and
HFDM programme and gives complete in the EU.
interpretation stages. When this process
assurance that the anonymity of flight data is completed it is less likely that additional
will be respected, with any exceptional Some operators do not consider deidentified
data from the flights will be required so the
circumstances being handled as described HFDM data to constitute personal data
flight data can be archived. Exceedances are
in the HFDM programme manual. The ICAO (since it requires additional crewing data to
usually kept on line for a much longer period
Manual on Flight Data Analysis Programmes4 ‘decode’ it or because it is not considered to
to allow trending and comparison with
notes that a policy on “data de-identification be personal data) but this will need to be an
previous events.” However, this guidance is
is an absolutely critical area that should be individual assessment by each organization’s
motivated in part by data volume and so may
carefully written down and agreed to before legal function.
become less relevant as data capacity and
it is needed in extreme circumstances.” computing speeds increase.
See also Section 8.5 on retention of flight
data.HFDM Recommended Practice Version 1.0 HFDM Hardware and Software Contents 17
Section 5 HFDM Hardware and SoftwareHFDM Recommended Practice Version 1.0 HFDM Hardware and Software Contents 18
Section 5
HFDM Hardware and Software
5.1 Choice of System and/or those with more experience in HFDM. limitations of the HFDM event. 5.2 Aircraft Types
An operator’s choice of HFDM system will The fundamental difference between aircraft
depend greatly on their individual situation One downside of this solution is that support Another option is to partner with a software types is most easily described in terms of
including: size of organization; number of from software providers can be limited, provider but perform all of the analysis in- analogue and digital instruments:
aircraft; aircraft types; and geographical particularly when establishing and defining house.
locations. Appendix 13.2 contains a list of event sets, so it can be difficult for operators • in general, aircraft using digital
some of the more well-known vendors of to have confidence in their programme. 5.1.3 External Provider instruments often employ data busses
HFDM solutions. While the software supplier may offer a When using an external provider to deliver from which parameters can be selected for
‘library’ of events to select from, it falls to the majority of the HFDM programme, the recording to a Digital Flight Data Recorder
One of the fundamental choices when the customers to modify them to suit their bulk of the work will be carried out by the (DFDR), Health and Usage Monitoring
selecting a system is whether to run the operation. external provider. This would often include System (HUMS) unit or a Quick Access
system in-house, use an external provider the software maintenance, validating and Recorder (QAR), making extraction of data
or use a hybrid system combining both Smaller operators may not have the analysing events and feeding back results. for use in an HFDM programme much
approaches. There are positives and organizational structure to support an in- Typically, any crew contacts would be easier. Many larger, more modern aircraft
negatives to each approach, some of which house programme. handled by the operator, with support from will be in this category (see Section 3.1).
are described below. the external provider. • aircraft with analogue instruments often
5.1.2 Hybrid Provision have little or no provision for extracting
5.1.1 In-house System There is a wide range of solutions which fall Although the programme may be delivered digital signals for recording. Although
In this type of system, the operator is in between the two options of full in-house and by an external provider, it remains the the aircraft may still have an FDR fitted,
charge of all aspects of the system from data full external provision, which some operators responsibility of the operator. ICAO Annex it might be designed specifically for the
acquisition to results feedback and including choose to adopt. 616 notes that “The operator may contract aircraft in question.
other activities such as: event setting, data the operation of a flight data analysis
management and software installation. For example, one approach might be to have programme to another party while retaining All system installations must be approved in
an external provider collecting, processing overall responsibility for the maintenance of accordance with the applicable regulatory
One of the strengths of this approach is and analysing data for events which are such a programme.” This means that analysis authorities’ certification requirements.
the ability for the operator to customise then fed to internal employees to analyse by the provider will be against events sets They must be fit for purpose and cause no
and manage the programme to suit their in detail, decide on a course of action and, for which the operator has responsibility. detriment to the aircraft and the safety of its
needs, including defining HFDM events if appropriate, discuss with a crew. This systems. Additionally, the HFDM installation
that are relevant for the type and context would probably require the HFDM events However, the precise form of the provision is must have no effect on the data storage
of operation and aligned with the safety to be adapted to the specific operator less important than ensuring that the HFDM within the FDR, if fitted.
priorities as identified by the SMS. This and its safety risk priorities, and for the programme is effective
approach will often suit larger operators HFDM staff at the operator to have a clear
understanding of the trigger logic and theHFDM Recommended Practice Version 1.0 HFDM Hardware and Software Contents 19
The range of data parameters recorded will duration will be more than 25 hours of Regardless of the means of transfer, the
IOGP Report 6909 specifies that:
directly affect the scope and complexity of continuous flight data with daily download, system should have the facility for operator
the monitoring that can be carried out and to ensure data is not lost. There should be a personnel to download the data at the
“The data download rate as a Key
the number and range of events that can be convenient method of transferring data from operating base and this should be carried
Performance Indicator (KPI) is tracked and
monitored. Regardless of the type of system the aircraft to the operator’s, or external out at least on a daily basis. Special attention
the target is 95%.”
installed, the installation should provide provider’s, computer systems. should be given to data security and
parameters which are appropriate for the anonymity at this point since the flight data
events being monitored and the analysis The system performing the recording should is still identifiable with respect to the flight The EOFDM Forum also suggested30 that
being performed. minimise any buffers before recording to the crew, albeit often encoded by the data frame “time between actual occurrence and first
medium in order to guard against data loss in (see Section 5.5). detection by the FDM software” be used as a
AMC1.1 to CAT.IDE.H.19036 provides a list the case of sudden/inadvertent power loss. KPI; this gives an indication of how effective
of parameters that should be recorded on As part of the investigation into the accident Each operating base should have the facility the HFDM programme is in capturing events
the FDR of a helicopter having a MCTOM to G-REDL in 2009, the UK AAIB found that to transfer data from the aircraft into the in a timely manner.
of more than 3,175 kg and first issued with the Card Quick Access Recorder used for operator’s or external provider’s system to
an individual CofA on or after 1st January HFDM (referred to as HOMP in the report) make it available for analysis. If a temporary There are now a number of systems capable
2016 and before 1st January 2023 and this is “contained a memory buffer which stored remote base is being operated from, the of supplying some flight data parameters
reproduced in Appendix 13.3. flight data for up to two minutes before being operator should make arrangements that in near real-time including: via the ADS-B
written to the removable card. If power to the allow data to be transmitted into the system protocol; using OEM solutions such as
Annex 6 – Part III16 provides a similar list, memory is lost, then its contents will be lost, from that base for analysis. Sikorsky’s Real-Time HUMS; and through
with further details such as minimum including up to two minutes of flight data.” third-party solutions such as Spidertracks.
sample rate, range and resolution. EUROCAE This prompted Safety Recommendation IOGP Report 6909 specifies that: However, it is important to verify that any
document ED-112A20 provides a similar list 2011-047 “that the Civil Aviation Authority solution to be used to implement HFDM is
as does FAA §135.152 Flight data recorders37. update CAP 739, and include in any future “HFDM data is downloaded from all fit for that purpose, not just for, say, flight-
However, even with modern aircraft, these Helicopter Flight Data Monitoring advisory aircraft daily as a minimum and a process following. HFDM requires a very specific and
lists are not always fully satisfied. material, guidance to minimise the use of for the review of the data is in place.” reliable data set whereas in flight following:
memory buffers in recording hardware, to data drop out of a few seconds may be
5.3 On-board Systems reduce the possibility of data loss.”38. entirely acceptable; required data resolution
The rate of successful data download from and sampling rates may be low; and data
The aircraft must have on-board facility for the fleet should be measured and reported
5.4 Data Transfer may not be routinely recorded.
storing flight data such as: as a key performance indicator (KPI), either
Once the flight data has been acquired as a percentage of flights, sectors, take-offs
• a memory card in a Quick Access Recorder within the helicopter, it is necessary to 5.5 Ground Hardware and Software
or similar, or as a percentage of flight hours.
(QAR); transfer the data from the aircraft into the This requires a means of calculating flights Depending on the aircraft system being used
• a storage card in a HUMS system or data operator’s systems. Various means exist for or flight hours that is independent of HFDM (e.g. DFDR, HUMS, QAR etc.) the data may be
acquisition unit; or achieving this including: data. A data recovery rate of 95 percent is a stored in a format that requires a decoder in
• embedded memory in a DFDR. reasonable target for a mature programme. order to read it. The document for decoding
• swapping flash memory devices such as PC is often referred to as the LFL (Logical Frame
The recording medium on the aircraft should cards, memory cards etc.; Layout) or DFL (Data Frame Layout) which
allow the flight data produced by that system • wireless transfer via Wi-Fi or cellular data describes how the data is recorded and
to be stored for the complete period before network; and how to convert it to engineering units, and
scheduled download. Ideally the recording • direct cable connections. can be unique to a specific airframe. (AsHFDM Recommended Practice Version 1.0 HFDM Hardware and Software Contents 20
an aside, for FDRs it is a requirement that The data analysis system and software used 5.6 System Serviceability
operators are able to provide the LFL/DFL should have the following capabilities: The operator’s flight operations,
on demand for each aircraft in their fleet to maintenance and dispatch functions will
allow accident investigators to read the FDR • the ability to display information in a ensure that the aircraft is ready for use in
in the case of an accident). Most providers logical and user-friendly way; accordance with the operator’s Minimum
will incorporate the LFL/DFL into their HFDM • the ability to programme a range of alert Departure Standards (MDS) or aircraft’s
software when an aircraft is ‘set up’ in detection thresholds to generate events Minimum Equipment List (MEL).
the system. when parameters exceed preset values,
covering aircraft flight manual limitations, It is important to note that the CVFDR (or
There are different ground hardware operator flight profile requirements and CVR and FDR if separate units) is a separate
configurations available / required by SOPs; hardware item required in the MEL which
different HFDM systems: • the ability to enable detailed analysis of provides redundancy if needed to investigate
the flight data; and an issue.
• Some HFDM systems use specific • the ability to extract values from all
computer hardware for the ground station flights (often termed ‘measurements’, With respect to system serviceability, the
- this guarantees software / hardware ‘parameters’, ‘state values’ or similar – HFDM programme should focus on whether
compatibility but can restrict flexibility, measurements will be used from this the data was recorded, downloaded and
limit access and increase costs. point) to provide long-term trend analysis processed successfully. Any issues with
• Some HFDM systems use generic hardware of data. the aircraft equipment should be relayed
with local software installations - this through the appropriate operator function.
gives operators greater flexibility and This can be achieved either within the HFDM Operators should take measures to assure
may facilitate wider access but it may software package or through the use of the availability and functionality of the
also give rise to software / hardware additional tools. One example might be using HFDM analysis system using approaches such
incompatibilities. software tools such as such as R and Python. as service agreements with the equipment
• Some HFDM providers use web-based and software OEMs or the provision of
services to give access to their systems back-up equipment.
- these systems are often independent
of operating system or browser type
and can enable access for a wider group IOGP Report 6909 specifies that:
and in any location. However, there is an
obvious requirement for an active internet “A serviceability policy for both airborne
connection to gain access to the system. and ground station equipment has been
established. System unserviceability is not
to exceed 25 flight hours between data
downloads.”HFDM Recommended Practice Version 1.0 Organizational Structure Contents 21
Section 6 Organizational StructureHFDM Recommended Practice Version 1.0 Organizational Structure Contents 22
Section 6
Organizational Structure
The organizational structure supporting the 6.1 HFDM Programme Manager operations or access to an experienced pilot Even in small organizations, it might be
HFDM programme may look different from The function of this role is to manage and is crucial. advantageous to separate this function from
one company to the next, often varying with oversee the programme including: analysis roles in order to preserve flight crew
the operator’s size, number of aircraft and In smaller operators where the Programme confidence in the anonymity of the system.
level of outsourcing. • the collection, processing and analysis of Manager is part of the core management
flight data; team, that individual may be restricted from 6.3 Data Analyst(s)
No matter how the programme is managed, • monitoring the download rates and linking access to the identified data, but retain The role of the data analyst is to use the
the functions described in the roles below to maintenance if necessary; overall management responsibilities for the software to achieve tasks such as:
will need to be performed. However, the size • the feedback of results; and system and for the use of deidentified data.
of the organization will affect the number of • the completion of follow-up activities. In a very small operation, the Programme • coding and validating events in software;
individuals that cover these functions with Manager may actually be the owner or • implementing event thresholds;
some roles being filled by the same person in It is the responsibility of the Programme Managing Director/CEO of the operator. In • identifying exceedances;
small organizations. Manager to ensure that results are provided such cases, confidentiality is very difficult, if • validating the credibility of events; and
in a timely way and in context, thereby not impossible, to achieve. However, HFDM • producing output from the programme for
IOGP Report 6909 specifies that: allowing the company management to make systems in this type of situation can still feedback, including statistics for internal
informed decisions about the safety and be very effective and retain the support of use and wider distribution.
“Personnel are appointed to fill specific effectiveness of the operation. the staff, particularly where there is a Just
positions within the HFDM programme Culture, or ‘Just and Fair’ Culture, in the The data analyst(s) should be skilled in using
(such as analyst, gatekeeper or pilot If the size of the organization allows, it organization. the chosen software to meet the operator’s
liaison) and training is provided for may be helpful for this role to be filled needs which will vary depending on the level
all personnel appropriate to their by someone from outside the Senior 6.2 Gatekeeper of outsourcing, if any.
responsibilities.” Management Team to reinforce the This role functions as the link between
independence of the role. anonymised flights and events and the In order to enable effective validation of
Any organizational structure must provide specific flight crew involved. As such, this events (see Section 7.2), and to also allow
sufficient cover to be able to accommodate In a fully-outsourced solution, it is this role role is trusted with confidential data and customisation of the process to an individual
staff working patterns, leave, illness, absence that would provide the link between the is the only role able to connect the de- operator’s requirements, it is recommended
and turnover. service provider and the operator to ensure identified data to the specific flight crew that this capability is normally performed in-
the system is effective. to whom it relates. For this reason, the house. However, provided some level of in-
Employees in these positions may be confidentiality agreement signed by staff in house analysis capability exists, the primary
full-time or part-time as appropriate, or Some operators choose to fill this role with this role must be comprehensive. or initial data analysis could be performed by
the majority of the programme could be an experienced pilot; while this is not an a third party.
managed by a third party (see Section 5.1). essential requirement, a strong knowledge ofHFDM Recommended Practice Version 1.0 Organizational Structure Contents 23
6.4 Pilot Liaison would normally be interviewed and details 6.6 Personnel Training be given by someone in the organization
It is the responsibility of the pilot may be passed to company management HFDM training can take many forms ranging who has taken the specific vendor’s training.
liaison (sometimes referred to as pilot for action as necessary. In this way, the from general Flight Data Monitoring training
representative) to contact a crew (in HFDM Programme remains ‘Just’ / ‘Just and (often having an emphasis on fixed-wing Appendix 13.2 includes details of some of the
consultation with the Gatekeeper when that Fair’ as opposed to ‘non-punitive’.) operations) to the use of specific software. software-specific training courses available.
role is filled by a different person) when
an exceedance has been identified and to The HFDM Review Group should include Training should ideally be provided for all Operators should be aware that some
explain and review that event, using playback those members of the company who have HFDM posts, appropriate to their level of training on software only contains
and analysis software where appropriate. responsibility for operational standards use. The data analyst needs to have ‘relevant information on how to make the software
The pilot liaison will also relay any comments and flight safety. In larger organizations this expert’ levels of skill in working the systems, behave in a particular way and does not give
from the crew to the HFDM programme. could include: as should the HFDM Programme Manager. guidance on the fundamental principles,
The pilot liaison position will require goals or implementation of an HFDM
In a unionized environment, a union • Chief Pilot; knowledge of the review/playback systems programme.
representative may be required or requested • Head of Flight Standards; and must be able to interpret data provided
by the crew to attend any crew meeting. • Flight Operations Manager; by the analyst. In normal operations, line 6.6.3 Information for Flight Crews and
• Flight Safety Officer; and pilots or line maintenance staff are likely to Maintainers
Although it is not essential, this role will • Training Captains need only sufficient knowledge to download It is beneficial for flight crews to understand
often be filled by an experienced and trusted data. the purpose and operation of the HFDM
pilot and it may be beneficial if it is a TRE/TRI or equivalent roles in a smaller organization. programme in order to build confidence
so they are able to provide training advice. Depending on the organization, this group 6.6.1 General Training in the programme. Similarly, it may be
In some organizations the Gatekeeper also may interact with, feed into or even be part beneficial for maintainers to understand the
of the safety action group (SAG), the safety Generic courses should include a broad
holds this post. syllabus including subjects such as: reasons for collecting data and to see that
review group (SRG), a Standards and Review HFDM can assist maintenance programmes
group or others. • regulatory frameworks;
6.5 HFDM Review Group • the role of FDM in a Safety Management as well as flight operations.
The role of the HFDM Review Group System;
IOGP Report 6909 specifies that: • FDM technology; The HFDM Programme Manager should
includes:
“An HFDM review group meets at regular • event-setting and validation; welcome queries from crews and any
intervals to: • use of measurements; request to view their data or understand
• periodic review of deidentified HFDM data
• Validate the reports, including a • interpretation of data; more about the system should be treated
findings;
periodical review of de-identified HFDM • the role of animation and visualisation in positively. It may be appropriate to hold
• determining and periodically reviewing the
data findings. presenting data; and internal sessions to raise staff awareness of
alert detection thresholds (see Section 7.4);
• Investigate significant events identified • legal requirements. the aims and protections within the HFDM
• making recommendations for changes to
by the HFDM Programme. programme.
procedures and training to the accountable
• Review KPIs and trends Appendix 13.2 includes details of some of the
manager;
• Make recommendations for suggested general courses available globally.
• investigation of significant events
changes to operational procedures or
discovered by the HFDM Programme; and
the training syllabus and tracks their 6.6.2 Specific Software Training
• making the decision to remove the
implementation.
protection of confidentiality in cases Ideally, any specific software training should
• Periodically determine the effectiveness
of gross misconduct or continued non- be provided directly by the vendor or their
of thresholds.”
compliance with SOPs. (In such cases, crews associate. Alternatively, if necessary, it canYou can also read
