More Than 250 Business Aircraft Operators Embrace A Version Of FOQA
Sep 22, 2017
Fred George | Business & Commercial Aviation
This article appears in the October 2017 issue of Business & Commercial Aviation with the title “FOQA Comes of Age.”
Flight Operational Quality Assurance (FOQA) programs earned widespread acceptance among airlines even before the turn of this century, but most business aviation operators were cool to the concept as late as a decade ago.
Air carriers embraced FOQA because it uses absolute metrics rather than imperfect memory to identify and quantify errors and threats. Historical human-based systems, such as Aviation Safety Action Programs (ASAPs) used at many airlines or NASA’s Aviation Safety Reporting System (ASRS) depend upon the willingness and ability of pilots, mechanics, flight attendants, dispatchers and air traffic controllers to document anomalies. In some cases, would-be reporters may not notice anything amiss at all because of on-the-job distractions. FOQA, in contrast, automatically collects operational parameters in real time and makes the data available for objective evaluation. It doesn’t have an ego. It never gets distracted, never frets. It’s always on duty.
A key technology to FOQA and “corporate,” or C-FOQA, is a multiple-channel quick access recorder (QAR) aboard the aircraft to monitor and precisely record dozens, or even hundreds, of parameters pertaining to the flight. The data then is downloaded for analysis.
C-FOQA makes it possible for business aircraft operators to detect, verify and quantify operational minor deviations before they develop into FAR violations, incidents or accidents. It also enables them to spot aircraft engine and systems malfunctions and correct them before they ground aircraft. The FOQA system actually provides insights into the entire spectrum of flight operations, including aircraft, crews, maintenance, weather factors, specific arrival and departure procedures, runway hazards and SOPs that need revision.
In essence, FOQA is the canary in the coal mine, as the late John Wiley wrote in “C-FOQA: Has Its Time Arrived?” (BCA, June 2007). It warns operators of potentially hazardous or lethal conditions before they truly menace. Most importantly, it breaks the historical aviation “tombstone” model of “Fly. Crash. Investigate. Then fix.”
Research by the Flight Safety Foundation revealed that for every fatal accident, there were 10 major non-fatal accidents, 30 serious incidents, 200 minor incidents, 600 abnormal events and 5,000 flights. FOQA doesn’t wait for incidents or accidents, let alone fatalities, to reveal problems. It identifies the potential risk factors in thousands of operations before they can lead to loss of life.
Corporate operators, nonetheless, had concerns about C-FOQA’s threat to privacy in spite of all the advantages demonstrated by the airlines’ use of the technology. C-FOQA was seen by many as a potential snitch to provide evidence for enforcement and punishment, wrote Wiley. He noted, though, that the airlines pushed for, and succeeded in obtaining, confidentiality guarantees. This protected flight crews from the prying eyes of the media, overzealous regulators and trial attorneys. Such privacy protections shield pilots from snoops. But as with other safety reporting systems, airline FOQA’s confidentiality guarantee only covers minor, inadvertent deviations and not intentional violations or gross negligence.
C-FOQA also has robust privacy protections. GE Aviation’s C-FOQA Centerline division (formerly Austin Digital) worked with Altria’s and Pfizer’s flight departments to start proof-of-concept programs that incorporated all the essential FOQA controls used by the airlines, including critical privacy protections.
Because of the potential legal ramifications of subpoenaing FOQA data, Vulcan Aviation’s legal team was “all atwitter” when the flight department first considered participating, says Frank Raymond, the organization’s aviation safety manager. But Raymond was confident in Austin Digital (now GE Aviation) physically securing and absolutely protecting the data. In his “view of the world,’ he was more concerned about his own department being subpoenaed in a legal dispute.
“We wanted to be in a better position to respond by saying we’re voluntarily analyzing our own data rather than waiting to say ‘Yes we’re looking, but we’ve buried our heads in sand.’ We didn’t want to go on flying and hope we got lucky.”
Flight departments are increasingly buying into C-FOQA. During the past decade, GE Aviation has grown the program to include more than 250 operators and more than two dozen types of aircraft ranging from vintage Hawker 800s to BBJs. The fleet of C-FOQA Centerline-monitored aircraft has amassed more than 800,000 flight hours, says Shelby Balogh, GE Aviation’s senior director and analytics scientist.
“We’re able to use the data that’s already being generated by the aircraft to promote the fundamental objective of improving safety,” he said.
How It Works
There are four parts to C-FOQA. As noted, it starts with installing a QAR, which is essentially a second flight data recorder designed for easy data retrieval. Some new aircraft models come from the production line with standard provisions for QARs, but virtually all QAR installations require aftermarket STCs or Service Bulletins from the airframe manufacturer.
For newer generation aircraft with fully integrated avionics systems from Garmin, Honeywell and Rockwell Collins, among others, the boxes may cost as little as $12,000 to $15,000, plus installation.
Installing QARs in older aircraft can pose major challenges, especially if they weren’t originally designed to accommodate forensic flight data recorders. However, it may be possible to install a limited function QAR that monitors FMS, air data and engine parameters, and perhaps also aircraft attitude, trim, flap and gear positions, along with weight on wheels. Eclipse 500 aircraft, for example, came standard from the Albuquerque factory with limited function QARs.
The cost of retrofitting a QAR to older aircraft goes up sharply with the number of parameters monitored by the QAR and the fewer the number of candidate aircraft in the existing fleet. In some cases, the cost of retrofitting a QAR system may exceed $100,000. Excessive cost often deters such retrofitting.
Timely and secure data retrieval and transmission is the second step of the process. Some aircraft use 4G wireless devices, enabling C-FOQA data to be sent after every flight. Others use hard media, such as flash drives, that allow data to be downloaded and transmitted to a secure website.
In the case of GE Aviation, the flight data is received and then fused with weather, airport, navigation and terrain data, as the start of the third step in the process. The holistic approach enables specific anomalies flagged during flights to be put into context during processing. Balogh notes the process enables operators to “drill down to specific hot spots” to put gust conditions, long landings and hard touchdowns into appropriate perspective. The process can identify “latent conditions” that are accident precursors.
GE Aviation sends periodic reports to subscribers as the fourth step of the process. Perusing a sequence of reports helps operators spot both one-time anomalies and trends. Balogh notes that C-FOQA can help operators establish safety performance indicators (SPI) that can alert them to fatigue, chronic weather or maintenance issues. C-FOQA can help prevent inadvertent airframe and engine limit exceedances. It also can spot trends within an organization, such as the degree of compliance with SOPs and checklists.
Balogh points out that C-FOQA also can spot “practical drift” over time. For example, fresh out of sim training, a flight crew might fly stabilized approaches with a 97% success rate, but six months later that might drop to 90%.
Practical drift also can be the result of hiring new crews, going to new destinations, introducing new types of aircraft into a company’s fleet and encountering challenging weather conditions. All these factors can erode error traps built into procedures, regulations and systems, potentially leading to a mishap, incident or accident.
Access to new safety data contained in C-FOQA reports can reduce deviations, particularly if crews’ actions are guided in non-punitive ways. This can help a flight department achieve higher standards of excellence and wider safety margins.
Operators’ Perspectives
Vulcan’s Raymond has 16 years of experience working with ASAP and FOQA programs at a major air carrier and at Vulcan. He’s participated on GE Aviation’s C-FOQA Centerline product steering committee for three years, becoming a strong advocate for data-driven safety insights that don’t depend solely on human inputs.
He discusses the May 2014 fatal crash of a Gulfstream GIV departing Bedford, Massachusetts’ Hanscom Field in which three crewmembers and four passengers perished. During takeoff, the pilots attempted to rotate the aircraft, but engagement of the flight control gust lock prevented the yoke from moving sufficiently to move the elevator to the proper position.
The NTSB noted that the pilots did not discuss checklists, nor did they perform a flight control freedom of movement check prior to takeoff. (See “Gulfstream IV Accident at BED,” Cause & Circumstance, June 2015.) When they could not rotate the aircraft, they attempted to abort the takeoff at 160 KIAS with approximately 2,300 ft. of runway remaining. The aircraft careened off the end of the runway, through the approach lighting system, localizer antenna array and perimeter fence, plunged into a creek bed and burst into flames that immolated all on board.
Based upon data from the crashed Gulfstream’s QAR, investigators determined the crew failed to perform a complete control check on 98% of the previous 175 missions. Raymond notes that procedural noncompliance had led to a normalcy of deviancy, a de facto SOP for the two pilots who had flown together for 12 years. (See “Lessons From the Bedford Gulfstream Accident, Part 2,” May 2016).
Among the NTSB’s several recommendations stemming from the investigation was one suggesting the NBAA work with corporate operators in FOQA groups to analyze existing data and determine how widespread the failure to conduct preflight control checks might be.
With the cooperation of these and other sources, an NBAA-led working group analyzed 143,756 flights between Jan. 1, 2013, and Dec. 31, 2015, conducted by 379 business aircraft. What the team discovered was that the pilots involved in those flights performed only partial flight-control checks before 15.62% of the takeoffs, and performed no checks on 2.03%, which meant 2,923 flights proceeded in the same cursory manner as did the Gulfstream that crashed at Bedford.
Upon releasing its report in September 2016, NBAA President and CEO Ed Bolen described the findings of the Bedford accident and subsequent FOQA industry data as “perplexing” and added that “complacency and lack of procedural discipline have no place in our profession.” Further, the NBAA urged other operators to establish a flight data-monitoring program and said it planned to create a council of data collection/sharing experts to identify and disseminate safety issues based upon that body of information.
When the study’s results were published, member companies and their crews took heed. Noncompliance with the required checks dropped to 4% for the group in 12 months.
Using C-FOQA at Vulcan, Raymond counseled his crews and noncompliance dropped to less than 1%. He says almost all issues he’s encountered can be settled during informal chats with crews.
“Initially, there were plenty of challenges to acceptance. Six years ago, we had lots of naysayers due to fear of punishment,” he said. But Vulcan divided follow-up to FOQA analysis three ways: (1) no action; (2) minor correction and review; and (3) elevation to the director of operations. Yet, in six years, only one deviation has had to be escalated to the head of the flight department. Now, pilots volunteer to Raymond saying, “I think I may have tripped an exception” because they trust the process and the feedback programs Vulcan has in place.
Gulfstream 1V accident at BED
GE’s own corporate flight department also uses C-FOQA data for maintenance diagnostics and troubleshooting. Director of Maintenance Joe Spielman uses GE Aviation’s Prognostic Health Management+ system as part of GE’s OnPoint hourly engine maintenance plan. With snapshots of parameters taken during takeoff, climb and cruise, Spielman is able to spot and remedy small problems before they can ground aircraft for major repairs.
He added that maintenance monitoring can spot systems problems because events that are flagged can be discussed with flight crews. In one situation, he recalls, sensors on a specific airplane weren’t indicating full travel of flight control surfaces during routine pre-takeoff flight control freedom of movement checks. After getting inputs from the flight crews, his maintenance team determined that the sensors were flawed. So, they were removed and replaced, thereby remedying the problem.
Cost and Value
Operators report that subscribing to C-FOQA costs, on average, between $425 and $500 per aircraft per month. Actual rates vary as a function of the subscriber’s aircraft types, fleet size, number of parameters monitored and hours flown, among other factors.
While not inexpensive, C-FOQA is a potent safety management tool because it’s precise, comprehensive, consistent and objective. Metrics trump memory. Yet, during a recent webinar moderated by BCA, seven out of 10 respondents said they don’t use it.
That response harkened to a famous misquote by Mark Twain that could be applied to every high-profile aviation accident: “There’s nothing like a hanging in the morning to get your attention all day long.” But why wait for a crash before taking action to prevent further loss? The C-FOQA canary can flag risks before they can endanger people or damage equipment.
Sep 22, 2017
Fred George | Business & Commercial Aviation
This article appears in the October 2017 issue of Business & Commercial Aviation with the title “FOQA Comes of Age.”
Flight Operational Quality Assurance (FOQA) programs earned widespread acceptance among airlines even before the turn of this century, but most business aviation operators were cool to the concept as late as a decade ago.
Air carriers embraced FOQA because it uses absolute metrics rather than imperfect memory to identify and quantify errors and threats. Historical human-based systems, such as Aviation Safety Action Programs (ASAPs) used at many airlines or NASA’s Aviation Safety Reporting System (ASRS) depend upon the willingness and ability of pilots, mechanics, flight attendants, dispatchers and air traffic controllers to document anomalies. In some cases, would-be reporters may not notice anything amiss at all because of on-the-job distractions. FOQA, in contrast, automatically collects operational parameters in real time and makes the data available for objective evaluation. It doesn’t have an ego. It never gets distracted, never frets. It’s always on duty.
A key technology to FOQA and “corporate,” or C-FOQA, is a multiple-channel quick access recorder (QAR) aboard the aircraft to monitor and precisely record dozens, or even hundreds, of parameters pertaining to the flight. The data then is downloaded for analysis.
C-FOQA makes it possible for business aircraft operators to detect, verify and quantify operational minor deviations before they develop into FAR violations, incidents or accidents. It also enables them to spot aircraft engine and systems malfunctions and correct them before they ground aircraft. The FOQA system actually provides insights into the entire spectrum of flight operations, including aircraft, crews, maintenance, weather factors, specific arrival and departure procedures, runway hazards and SOPs that need revision.
In essence, FOQA is the canary in the coal mine, as the late John Wiley wrote in “C-FOQA: Has Its Time Arrived?” (BCA, June 2007). It warns operators of potentially hazardous or lethal conditions before they truly menace. Most importantly, it breaks the historical aviation “tombstone” model of “Fly. Crash. Investigate. Then fix.”
Research by the Flight Safety Foundation revealed that for every fatal accident, there were 10 major non-fatal accidents, 30 serious incidents, 200 minor incidents, 600 abnormal events and 5,000 flights. FOQA doesn’t wait for incidents or accidents, let alone fatalities, to reveal problems. It identifies the potential risk factors in thousands of operations before they can lead to loss of life.
Corporate operators, nonetheless, had concerns about C-FOQA’s threat to privacy in spite of all the advantages demonstrated by the airlines’ use of the technology. C-FOQA was seen by many as a potential snitch to provide evidence for enforcement and punishment, wrote Wiley. He noted, though, that the airlines pushed for, and succeeded in obtaining, confidentiality guarantees. This protected flight crews from the prying eyes of the media, overzealous regulators and trial attorneys. Such privacy protections shield pilots from snoops. But as with other safety reporting systems, airline FOQA’s confidentiality guarantee only covers minor, inadvertent deviations and not intentional violations or gross negligence.
C-FOQA also has robust privacy protections. GE Aviation’s C-FOQA Centerline division (formerly Austin Digital) worked with Altria’s and Pfizer’s flight departments to start proof-of-concept programs that incorporated all the essential FOQA controls used by the airlines, including critical privacy protections.
Because of the potential legal ramifications of subpoenaing FOQA data, Vulcan Aviation’s legal team was “all atwitter” when the flight department first considered participating, says Frank Raymond, the organization’s aviation safety manager. But Raymond was confident in Austin Digital (now GE Aviation) physically securing and absolutely protecting the data. In his “view of the world,’ he was more concerned about his own department being subpoenaed in a legal dispute.
“We wanted to be in a better position to respond by saying we’re voluntarily analyzing our own data rather than waiting to say ‘Yes we’re looking, but we’ve buried our heads in sand.’ We didn’t want to go on flying and hope we got lucky.”
Flight departments are increasingly buying into C-FOQA. During the past decade, GE Aviation has grown the program to include more than 250 operators and more than two dozen types of aircraft ranging from vintage Hawker 800s to BBJs. The fleet of C-FOQA Centerline-monitored aircraft has amassed more than 800,000 flight hours, says Shelby Balogh, GE Aviation’s senior director and analytics scientist.
“We’re able to use the data that’s already being generated by the aircraft to promote the fundamental objective of improving safety,” he said.
How It Works
There are four parts to C-FOQA. As noted, it starts with installing a QAR, which is essentially a second flight data recorder designed for easy data retrieval. Some new aircraft models come from the production line with standard provisions for QARs, but virtually all QAR installations require aftermarket STCs or Service Bulletins from the airframe manufacturer.
For newer generation aircraft with fully integrated avionics systems from Garmin, Honeywell and Rockwell Collins, among others, the boxes may cost as little as $12,000 to $15,000, plus installation.
Installing QARs in older aircraft can pose major challenges, especially if they weren’t originally designed to accommodate forensic flight data recorders. However, it may be possible to install a limited function QAR that monitors FMS, air data and engine parameters, and perhaps also aircraft attitude, trim, flap and gear positions, along with weight on wheels. Eclipse 500 aircraft, for example, came standard from the Albuquerque factory with limited function QARs.
The cost of retrofitting a QAR to older aircraft goes up sharply with the number of parameters monitored by the QAR and the fewer the number of candidate aircraft in the existing fleet. In some cases, the cost of retrofitting a QAR system may exceed $100,000. Excessive cost often deters such retrofitting.
Timely and secure data retrieval and transmission is the second step of the process. Some aircraft use 4G wireless devices, enabling C-FOQA data to be sent after every flight. Others use hard media, such as flash drives, that allow data to be downloaded and transmitted to a secure website.
In the case of GE Aviation, the flight data is received and then fused with weather, airport, navigation and terrain data, as the start of the third step in the process. The holistic approach enables specific anomalies flagged during flights to be put into context during processing. Balogh notes the process enables operators to “drill down to specific hot spots” to put gust conditions, long landings and hard touchdowns into appropriate perspective. The process can identify “latent conditions” that are accident precursors.
GE Aviation sends periodic reports to subscribers as the fourth step of the process. Perusing a sequence of reports helps operators spot both one-time anomalies and trends. Balogh notes that C-FOQA can help operators establish safety performance indicators (SPI) that can alert them to fatigue, chronic weather or maintenance issues. C-FOQA can help prevent inadvertent airframe and engine limit exceedances. It also can spot trends within an organization, such as the degree of compliance with SOPs and checklists.
Balogh points out that C-FOQA also can spot “practical drift” over time. For example, fresh out of sim training, a flight crew might fly stabilized approaches with a 97% success rate, but six months later that might drop to 90%.
Practical drift also can be the result of hiring new crews, going to new destinations, introducing new types of aircraft into a company’s fleet and encountering challenging weather conditions. All these factors can erode error traps built into procedures, regulations and systems, potentially leading to a mishap, incident or accident.
Access to new safety data contained in C-FOQA reports can reduce deviations, particularly if crews’ actions are guided in non-punitive ways. This can help a flight department achieve higher standards of excellence and wider safety margins.
Operators’ Perspectives
Vulcan’s Raymond has 16 years of experience working with ASAP and FOQA programs at a major air carrier and at Vulcan. He’s participated on GE Aviation’s C-FOQA Centerline product steering committee for three years, becoming a strong advocate for data-driven safety insights that don’t depend solely on human inputs.
He discusses the May 2014 fatal crash of a Gulfstream GIV departing Bedford, Massachusetts’ Hanscom Field in which three crewmembers and four passengers perished. During takeoff, the pilots attempted to rotate the aircraft, but engagement of the flight control gust lock prevented the yoke from moving sufficiently to move the elevator to the proper position.
The NTSB noted that the pilots did not discuss checklists, nor did they perform a flight control freedom of movement check prior to takeoff. (See “Gulfstream IV Accident at BED,” Cause & Circumstance, June 2015.) When they could not rotate the aircraft, they attempted to abort the takeoff at 160 KIAS with approximately 2,300 ft. of runway remaining. The aircraft careened off the end of the runway, through the approach lighting system, localizer antenna array and perimeter fence, plunged into a creek bed and burst into flames that immolated all on board.
Based upon data from the crashed Gulfstream’s QAR, investigators determined the crew failed to perform a complete control check on 98% of the previous 175 missions. Raymond notes that procedural noncompliance had led to a normalcy of deviancy, a de facto SOP for the two pilots who had flown together for 12 years. (See “Lessons From the Bedford Gulfstream Accident, Part 2,” May 2016).
Among the NTSB’s several recommendations stemming from the investigation was one suggesting the NBAA work with corporate operators in FOQA groups to analyze existing data and determine how widespread the failure to conduct preflight control checks might be.
With the cooperation of these and other sources, an NBAA-led working group analyzed 143,756 flights between Jan. 1, 2013, and Dec. 31, 2015, conducted by 379 business aircraft. What the team discovered was that the pilots involved in those flights performed only partial flight-control checks before 15.62% of the takeoffs, and performed no checks on 2.03%, which meant 2,923 flights proceeded in the same cursory manner as did the Gulfstream that crashed at Bedford.
Upon releasing its report in September 2016, NBAA President and CEO Ed Bolen described the findings of the Bedford accident and subsequent FOQA industry data as “perplexing” and added that “complacency and lack of procedural discipline have no place in our profession.” Further, the NBAA urged other operators to establish a flight data-monitoring program and said it planned to create a council of data collection/sharing experts to identify and disseminate safety issues based upon that body of information.
When the study’s results were published, member companies and their crews took heed. Noncompliance with the required checks dropped to 4% for the group in 12 months.
Using C-FOQA at Vulcan, Raymond counseled his crews and noncompliance dropped to less than 1%. He says almost all issues he’s encountered can be settled during informal chats with crews.
“Initially, there were plenty of challenges to acceptance. Six years ago, we had lots of naysayers due to fear of punishment,” he said. But Vulcan divided follow-up to FOQA analysis three ways: (1) no action; (2) minor correction and review; and (3) elevation to the director of operations. Yet, in six years, only one deviation has had to be escalated to the head of the flight department. Now, pilots volunteer to Raymond saying, “I think I may have tripped an exception” because they trust the process and the feedback programs Vulcan has in place.
Gulfstream 1V accident at BED
GE’s own corporate flight department also uses C-FOQA data for maintenance diagnostics and troubleshooting. Director of Maintenance Joe Spielman uses GE Aviation’s Prognostic Health Management+ system as part of GE’s OnPoint hourly engine maintenance plan. With snapshots of parameters taken during takeoff, climb and cruise, Spielman is able to spot and remedy small problems before they can ground aircraft for major repairs.
He added that maintenance monitoring can spot systems problems because events that are flagged can be discussed with flight crews. In one situation, he recalls, sensors on a specific airplane weren’t indicating full travel of flight control surfaces during routine pre-takeoff flight control freedom of movement checks. After getting inputs from the flight crews, his maintenance team determined that the sensors were flawed. So, they were removed and replaced, thereby remedying the problem.
Cost and Value
Operators report that subscribing to C-FOQA costs, on average, between $425 and $500 per aircraft per month. Actual rates vary as a function of the subscriber’s aircraft types, fleet size, number of parameters monitored and hours flown, among other factors.
While not inexpensive, C-FOQA is a potent safety management tool because it’s precise, comprehensive, consistent and objective. Metrics trump memory. Yet, during a recent webinar moderated by BCA, seven out of 10 respondents said they don’t use it.
That response harkened to a famous misquote by Mark Twain that could be applied to every high-profile aviation accident: “There’s nothing like a hanging in the morning to get your attention all day long.” But why wait for a crash before taking action to prevent further loss? The C-FOQA canary can flag risks before they can endanger people or damage equipment.