(5) Identify User Needs. The Steering committee should conduct a user needs assessment to develop a better understanding of stakeholder needs and to establish user requirements for the operations, training, engineering, maintenance, or other relevant departments. This study elicits and analyzes users’ needs to assist in selecting the proper technology for the program. A clear and comprehensive understanding of the users’ needs is essential to the program’s success. FOQA’s primary benefits are directly related to the usefulness of the data analyses to the stakeholder. Further, the FOQA data analyses need to be distributed intelligently. Determine what pieces of information are valuable to the stakeholder and consider how FOQA data can enhance current processes. An effective user needs assessment may identify user groups reluctant to participate in the FOQA program and help bring them into the program.
(6) Select Technology. Determining the technology and vendors to use is a critical decision. FOQA programs are comprised of at least three interdependent specialized systems.
These three systems are airborne data collection, ground data replay and analysis, and data management and analysis. The first generation of programs used by U.S. air carriers was designed around commercial off-the-shelf (COTS) systems similar to those used in European and Pacific Rim FOQA programs. An increase in the number of air carriers implementing FOQA programs has led to an increasing number of vendors and products supporting FOQA programs.
The approach taken by these vendors varies widely and the technological solutions offered should be carefully evaluated to assess their suitability to the air carrier’s needs. Special consideration should be given to technical issues, such as whether a particular product is compatible with the avionics and bus configurations already on the aircraft. Vendor training, warranty, and support policies are also important considerations in product selection.
(7) Select Personnel. Selecting personnel to staff the FOQA program depends on the program’s scope, the size and organization of the air carrier, and the technology that will be implemented to record and analyze information. A typical program includes a FOQA manager, one or more FOQA analysts, and a FMT composed of experienced pilots. FMT members should be technically proficient on the aircraft types used in the FOQA program and have excellent communication and problem-solving skills.
NOTE: In order to obtain perspectives from various interested departments, an air carrier may “share” employees a cross normal departmental lines. For example, two part-time people (one from the safety department and one from the engineering department) may provi de a more synergistic approach than a single full-time analyst devoted only to FOQA.
(8) Define Safeguards. FOQA requires vigilant security and privacy protection for confidentiality of the data and to protect data against unauthorized disclosure, alteration, misuse, or destruction. The issue of data protection and security is sensitive and focuses on the confidentiality of a particular air carrier, flight, date, or flightcrew and a recorded event. The security policy should balance users’ needs to access the data against the need to keep the data confidential. From the outset, air carrier policies and procedures for all security and protective aspects of the FOQA program should be carefully designed, documented, implemented, and Par 7 Page 13
periodically reviewed. The person responsible for implementing the security policy, such as the gatekeeper, should be identified.
(9) Define Events/ROMs. The events/ROMs that can be defined are dependent upon the available parameters that are recorded on a given aircraft type. Event/ROM definition and modification starts in this phase and continues for the duration of the FOQA program. Typically, the first phase of a FOQA program focuses on a single aircraft type. Information on defining events/ROMs and associated parameters is contained in appendix A.
(10) Negotiate Pilot Agreement (if necessary). Establishing an air carrier FOQA program may necessitate the negotiation of an agreement between the air carrier and its pilots’ collective bargaining agent. This agreement defines the specifics of the FOQA program and its objectives and administration. This agreement is crucial for obtaining buy-in from the pilot community and for ensuring that line pilots play an integral part in the process.
(11) Generate FOQA I&O Plan. The FOQA I&O Plan is the most important output of Phase I. The I&O Plan describes key aspects of the FOQA program. Preparing this document is one of the last steps of Phase I. Work done on the FOQA Plan can serve as a basis for the I&O Plan. The I&O Plan must be submitted to the FAA for review and approval in order to obtain protection from FAA civil enforcement actions. See section 13.401(c) for specific guidance for the development of the I&O Plan, including a template and checklist, is provided in appendices A and B.
b. Phase II—Implementation and Operations.
(1) Work-Intensive. Phase II is the most work-intensive phase of a FOQA program.
During Phase II, the FMT performs the tasks outlined in the I&O Plan. The airborne and GDRAS equipment selected in Phase I are installed. Phase II initially focuses on a single fleet and a limited number of equipped aircraft (usually 15 to 25). A major milestone in this phase is the first time that the air carrier records FOQA data, processes the data, and performs an analysis. During this phase, activities transition from designing the FOQA program to implementing and administering the program. The FOQA steering committee will begin to function in more of an advisory capacity as the FMT begins to assume its leadership role.
NOTE: Experience has show n that it takes approximately three to six months from when data are first recorded until official program startup can commence. The transition to Phase III occurs w hen the air carrier is convinced that FOQA data are accurate, reliable, and secure.
(2) Implement and Audit Security Mechanisms. The security policies and procedures defined in Phase I should be implemented and thoroughly tested to see that they are effective.
The actual mechanisms for protecting the data will be based on the capabilities of the hardware and software used in the program. The gatekeeper should be trained on how to implement and manage these mechanisms to protect data and control access. All GDRAS users should receive instruction about the protective provisions and how to handle problems. Periodic audits of the Page 14 Par 7
security mechanisms should be conducted, and the results should be used to fine-tune the policies and procedures.
(3) Install Equipment. A schedule should be established for installation of all equipment, including airborne and GDRAS. If installation of airborne equipment requires obtaining a Supplemental Type Certificate (STC), additional time and resources must be budgeted for this process. Coordination with maintenance and vendors will be required to track progress and resolve problems.
(4) Train Personnel. Personnel who install airborne systems may require training before or during equipment installations. For the GDRAS, the different levels of users may benefit from separate training classes tailored to their needs. The individual responsible for the GDRAS, typically the FOQA analyst, should receive training on system installation, configuration, and administration. Training for end-users should be tailored to their analysis needs and be provided as close to the initial exposure to the system as possible. End-users should be educated on product usage and the data. The training should occur after the system is fully operational and when the air carrier’s actual data are available so that users learn to effectively utilize the system with their data. Additional documentation may need to be developed to supplement materials provided by the vendors and to cover carrier and fleet-specific topics.
(5) Involve Stakeholders. To realize value from the FOQA investment, information derived from FOQA data must reach the appropriate user groups. Stakeholders will value the FOQA program only if they can obtain useful information that was not available before or obtain information faster than they can by using their current methods. The stakeholders will need to know what information is available to them. Education sessions should be held to promote user awareness of the information available, the program’s capabilities, and the information’s potential uses. Initial education should explain the FOQA program, including concepts, technology, benefits, and implementation schedule. Just because FOQA data are available does not guarantee widespread usage. Follow-up educational sessions may be required and should focus on instructing stakeholders on how to access and use the information available from FOQA data. Using a variety of methods and media (newsletters, e-mail, corporate Intranet, formal presentations, one-on-one meetings, team meetings, and videos) may attract a wider audience to the program than using only a single vehicle.
(6) Collect and Process Airborne Data. Procedures for retrieving the media on which FOQA data are recorded, such as optical disks or Personal Computer Memory Card International Association (PCMCIA) cards, or for downloading data from solid-state recorders using handheld readers, are needed. These procedures need to be developed and tested for accuracy, completeness, and resource requirements. The procedures should address the retrieval of recorded media, storage and distribution of unrecorded (blank) media, and installation of unrecorded media. Typically, media containing the flight data are removed from the recording device during a scheduled maintenance check. Retrieved media are sent to a central location for transmission or processing. New media are then inserted into the devices for the next round of flights. Schedules for retrieving the media are determined by the capacity of the media, the amount of data recorded, and the schedule of maintenance checks. The media retrieval schedule may range from 3 to 20 days. The same kind of schedule would apply if hand-held download Par 7 Page 15
devices were being used. Wireless data link systems, which transmit information directly to a ground system, eliminate the scheduling and staffing logistics associated with media or data retrieval. Using wireless data links may also reduce the potential for data loss when recording media reach capacity.
(7) Analyze and Validate Data. Stakeholder confidence in the FOQA program is directly proportional to the data’s accuracy, reliability, and completeness.
(a) Data reliability is determined by validating the integrity of the airborne and ground systems’ hardware and software. “Reasonableness” and consistency checks need to be performed on the recorded data. These checks can be accomplished by a variety of means, including:
• Validation by the vendor
• Comparison of Digital Flight Data Recorder (DFDR) data readings with FOQA readings
• Sensor validation
• Comparison of FOQA data with onboard, in-flight observations
(b) Data integrity and validity standards should be established to see that the data and associated analysis and reporting are performed in a consistent, standardized manner.
NOTE: Data validation activities tend to take much longer than anticipated.
1 Event sets will probably need to be fine-tuned after data from the first flights are analyzed to determine that what is being recorded is exactly what is needed and that appropriate data are being recorded at the proper resolution. Faulty sensors, modified LFLs, or missing software updates for acquisition units or analysis programs can cause errors. Fine-tuning event sets is a time-consuming and reiterative process. Failure to properly fine-tune the event sets can yield information of no use to stakeholders or worse, unreliable and invalid data.
Appendix A contains a suggested list of events to use (with modifications, as needed) and analyze in a basic FOQA program.
2 Any modifications to event sets or their associated parameters should be carefully tracked and documented to preserve the integrity of the process. Be aware that changes to event definitions may diminish the usefulness of trend or aggregate data if those data were captured under a combination of old and new event definitions.
(8) Store Data. FOQA programs yield vast quantities of raw data. The average amount of FOQA data collected from a single, digital aircraft is approximately 7.2 megabytes (MB) per day, resulting in 2.6 gigabytes (GB) per year. The air carrier that fails to plan ahead for data storage from all the aircraft covered will soon be awash in data. Although air carriers may choose to retain only a small portion of these data, establishing and maintaining a data storage program is critical for success.
Page 16 Par 7
(9) Develop and Document FOQA Program Procedures. As the program transitions through shakedown to production status, the FMT should develop and document procedures for operating and managing the program.
(a) Manual and/or automated procedures should be developed and documented for data security and data management (including backup and recovery, data archiving and restoration, monitoring and fine-tuning databases, defining and fine-tuning event sets, and data de-identification). Written procedures describe how to:
• Define, update, and delete user accounts
• Manage libraries of reports and graphics created by users
• Control security and access permissions for users and groups
(b) Documentation of all procedures is important for promoting consistent administration of the program. The importance of good documentation becomes evident when there are personnel changes on the FMT.
(10) Satisfy Startup Criteria. The criteria that indicate when a FOQA program is official and can transition from shakedown status into a mode of formal continuing operation should be established. The official start date defines when FOQA data will be used for formal analysis and trending. The FOQA manager and members of the FMT should periodically review the startup criteria to identify and correct problem areas, as well as certify criteria completion.
Satisfaction of the startup criteria heralds the start of Phase III.
c. Phase III—Continuing Operations.
(1) Startup Criteria. Phase III begins once the startup criteria have been satisfied.
Airborne and ground-based data systems must have been tested and confirmed, data accuracy and integrity must have been checked, and methods of analysis must be validated. At this phase, the FOQA program has stability, reliably providing high-quality, readily usable data to the FOQA program’s stakeholders.
(2) Iteration and Review. Phase III shifts the focus from implementing the technology to optimizing available data and the processes required to obtain the desired information.
Periodic reviews of all aspects of the FOQA program will determine whether the program is working as well as it could or whether revisions are required. These reviews will also identify when the program needs to be updated and modernized. Air carriers typically go through several iterations of experimentation and learning before mature FOQA processes are achieved.
Following the full cycle of analysis, design, implementation, operation, and evaluation for each iteration of upgrade or change is important. At the end of each iteration, the lessons the team has learned should be captured and documented so that subsequent efforts benefit from the team’s experience.
(3) FOQA Program Changes. Changes are likely to occur in an air carrier’s FOQA program as air carriers assimilate new technologies, modify event definitions, and change structures to meet the stakeholders’ growing needs. When changes to an air carrier’s FOQA Par 7 Page 17
program result in disparities between the program as implemented and the program as documented in the approved I&O Plan, the I&O Plan should be modified accordingly and changes must be submitted for acceptance by the FAA in order for section 13.401(c) to continue to apply to the FOQA program.
(4) FOQA Program Expansion. A FOQA program is neither static nor finite. It is meant to undergo controlled expansion and evolution as stakeholder demand for information grows and new technologies become available. The program should be able to accommodate new uses for FOQA data. These may require new equipment to capture and analyze the data.
Additional stakeholders may wish to make use of available FOQA information. Once successes are achieved, the process of expanding usage of FOQA information will likely accelerate. The real payback begins when FOQA capabilities are widely recognized and used throughout the air carrier. Phase III has no distinct end-point. It is deliberately “open-ended” to allow for enhancements to airborne, ground, and processing system technology; to allow program expansion to other fleets; and to allow broadened data usage. The program’s long-term plans will span several years, but incremental evolution should occur in carefully planned and welldocumented 6- to 12-month cycles.
(5) Communicate FOQA Program Benefits. A comprehensive program to continuously promote FOQA should be established, along with mechanisms for implementation.
The FOQA promotion effort should focus on gaining widespread support for the program. A variety of communication methods should be considered. For example, a newsletter can be used to inform users of significant program accomplishments, additional capabilities, and program evolution. Bulletin boards in pilot crew rooms are useful in disseminating FOQA information.
Video presentations on FOQA findings might be useful in pilot annual recurrent training classes.
Speaking at departmental and staff meetings and publishing testimonials about FOQA successes are also useful methods to spread the word about the program’s progress.
(6) Conduct Program-Wide Periodic Reviews. Periodic reviews and assessments should be conducted to determine that the program stays relevant to stakeholders’ new and existing interests and to identify areas for potential improvements. These assessments should determine if anticipated benefits are being realized and whether the information provided to endusers is accurate, timely, and usable. Ongoing user feedback mechanisms can be a valuable tool for capturing comments on the efficacy, usefulness, perceived shortcomings, and desired improvements of the current program. Likewise, efforts should be made to maintain current awareness of new technological alternatives and product enhancements. An audit of the quality of the aggregate data should also be performed along with an assessment of the accuracy of the reference and descriptive information. The tools employed to create aggregate and trend data should be periodically reviewed to determine if new technology would be more effective.
(7) Track Costs and Benefits. Justifying the investment in a FOQA program is an ongoing task. Capturing the initial acquisition and recurring costs is straightforward, as long as all categories of recurring costs are identified. Tracking the less tangible benefits is much more difficult. Benefits of a FOQA program, savings achieved and costs avoided, are spread across many departments. The safety department is an obvious beneficiary. However, placing a dollar value on an unknown number of aircraft accidents or incidents that were prevented because of Page 18 Par 7
FOQA is almost impossible. The training department benefits from more effective training that is focused on documented problem areas, rather than using a standard syllabus that may not address areas where pilots are having problems. The maintenance department benefits from FOQA because of improved monitoring and documentation of maintenance problems, as well as having more data available for timely troubleshooting. This may result in fewer unscheduled component changes, better preventive maintenance procedures, and reduced requirements for spare part inventories.
(8) Evaluate Emerging Technologies. As the air carrier’s FOQA program expands to cover greater numbers of aircraft and fleets, the ability of current systems to accommodate growth and change should be carefully considered. Emerging technologies have the potential to increase the efficiency and effectiveness of all facets of a FOQA program. For example, newer data capture devices may be able to record more parameters more frequently, the handling of recorded data may require less human intervention, analysis programs may become more automated, and new visualization capabilities may enhance the ability to understand flights and events. Technological advances can also provide solutions for many of the day-to-day data handling problems that FOQA generates. During the next few years, the market for FOQA equipment may grow rapidly and vendors may offer new products and technology. Keeping apprised of new technologies can help to optimize the overall investment in a FOQA program.
(9) Expand Data Usage. Expansion of data analysis is controlled by the limitations of the data generated by the GDRAS and the degree to which the data are stored in proprietary formats. COTS products can be used for statistical analysis and data mining, particularly when GDRAS supports industry standards for data access and exchange. The integration of FOQA data with other internal safety-related programs (such as the Aviation Safety Action Program (ASAP)) should be considered to further enhance the safety value of the information.
(10) FOQA Meetings. Conduct periodic FOQA meetings (preferably every 30 days) to provide company stakeholders with updated trends, information, and evaluation of previously implemented corrective actions.
8. INFORMATION-SHARING WITH THE FAA AND INDUSTRY. Section 13.401 requires operators of approved FOQA programs to provide the FAA with aggregate FOQA data in a form and manner acceptable to the Administrator. There are various ways and levels on which to accomplish this sharing, which are described below. The operator’s director of safety or designated representative should be responsible for approving the release of de-identified aggregate FOQA data to any third party after obtaining the prior input and approval of all appropriate parties within the carrier, including the pilot association (if applicable).
a. Regular Briefings with the FAA Certificate Management Office (CMO). The first level of sharing is between the carrier and its local CMO/Flight Standards district office (FSDO).
To accomplish this, a regular meeting should be established with local FAA personnel, as identified in the operator’s FAA-approved I&O plan, to review FOQA program status and data trend analysis. Scheduling of these meetings should at least be quarterly, but can be held more often depending on the scope of the operator’s FOQA program. Normally, this meeting is held on the operator’s property and does not include the physical exchange of data, but a review of Par 7 Page 19
trend analysis and corrective action plans. Aggregate data has been further clarified by the FOQA Aviation Rulemaking Committee (ARC) as the de-identified summary, statistical FOQA information that is normally acquired within a carrier’s FAA-approved FOQA program. The degree of data de-identification will be determined by the respective air carrier, as described in its approved FOQA I&O Plan. For these briefings, the carrier may provide the aggregate data in oral, written, graphical, or digital format.
b. Intra-Carrier Information-Sharing. The sharing of FOQA information from an operator’s program with other operators can provide benefits to an operator’s overall safety program. This sharing can be accomplished through industry associations or directly between operators depending on the scope of the issue. Issues such as ATC or issues specific to a particular aircraft type are examples of subjects that can be shared between operators.
Maintaining confidentiality of the information between operators is important in providing a cooperative environment.
c. Industry Sharing with the FAA. Issues may be identified from FOQA data that can’t be solved through modifications or enhancements to an operator’s existing operational procedures or approved training programs or through aircraft modifications under the control of the carrier.
Also, issues may not be evident when individual carrier information is viewed independently.
Therefore, industry sharing with the FAA may be helpful in identifying and resolving broad, industry issues. The FAA, working with carriers, has adopted an incremental approach to this requirement. The specific provisions of this approach will be developed over time in collaboration with the FOQA ARC and operators of approved programs. As an interim means of establishing initial compliance with section 13.401, operators of approved FOQA programs should provide the FAA with at least quarterly briefings on observed trends. These operators should also provide any other applicable information of potential safety significance. The FAA will specify the location of the briefing. For the purpose of these briefings, carriers may provide the aggregate data in oral, written, graphical or digital format. As the FOQA ARC works collaboratively with the FAA to develop a more systematic approach to the future sharing of aggregate FOQA information, guidance to industry on acceptable means of compliance with section 13.401 will be updated as appropriate.
d. Need for Appropriate Background and Expertise. While it is recognized that the sharing of FOQA information between operators and the FAA has significant potential for identifying system safety issues, FOQA data (even in aggregate form) has important limitations.
A detailed understanding of the operator’s route structure, equipment types, operating procedures, measurement criteria, and data collection procedures is required so that conclusions drawn from FOQA data will result in effective or productive safety interventions. Analysis of FOQA data should be accomplished by the operator and/or trained representatives from the operator’s pilot association (if applicable) and by individuals thoroughly familiar with its characteristics. FOQA data analysis is a tool for managing safe operations, not an independent objective. FOQA is but one element of a comprehensive operator safety program.
9. FOQA IMPLEMENTATION AND OPERATIONS PLAN.
a. Overview and Plan Development.
Page 20 Par 8
(1) Under section 13.401, an operator seeking protection from the use of FOQA data for enforcement by the FAA must obtain FAA approval of its FOQA I&O Plan. The document that describes an air carrier’s FOQA program for FAA approval purposes is the FOQA I&O Plan. A FOQA I&O Plan is submitted to the FAA for review and approval, as described in paragraph 9a(2) of this AC. The FAA will determine whether an air carrier’s FOQA program is approved and notify the air carrier by letter of any concerns and/or formal approval.
(2) The I&O Plan specifies the organization, technology, policies, procedures, and operational processes used by a certificate holder for its FOQA program. The FAA approval process for an I&O Plan is designed so the air carrier has identified adequate procedures, organizational resources, and material resources to collect, analyze, and act upon information provided by the FOQA data. The I&O Plan should describe the following elements:
(a) Program goals.
(b) Fleet(s) to be equipped for FOQA.
(c) Airborne hardware, analysis software, and other equipment to be used in the program.
(d) Organizational structure for the FOQA program.
(e) FOQA program personnel and associated roles and responsibilities.
(f) Procedures for data acquisition and handling.
(g) Procedures for data analysis and reporting.
(h) Procedures to implement corrective action(s) when adverse safety trends are discovered.
(i) Policies on data retention, data security, and crew contact.
(j) Policies on providing FAA with de-identified aggregate data on the operator’s premises and information on corrective actions undertaken.
(k) Policies and procedures for maintaining and revising the I&O Plan.
(l) A glossary of terms used in the I&O Plan.
(m) Appendices, which should include:
• A copy of the Letter of Agreement on FOQA with the pilots’ collective bargaining unit (if applicable) Par 8 Page 21
• List of events, parameters, and threshold values to be used in the program for each FOQA-equipped aircraft fleet
• A list of the documents referenced or cited
(3) An air carrier should identify its planned FOQA airborne and ground-based equipment in its initial I&O Plan. Subsequent revisions of the I&O Plan should identify any changes to the planned or implemented equipment. The purpose of this information is to ascertain proposed system capabilities, rather than to approve an air carrier’s selection of a particular brand or vendor. Decisions with respect to the selection of software and equipment vendors are left entirely to the air carrier. However, the FAA may assess, for the initial plan and any subsequent revisions, whether the proposed products’ functionality appears to be adequate to accomplish the program’s goals.
(4) The FAA prefers to interact closely with applicants during the development of the I&O Plan, rather than to wait for the formal submittal of the finished plan before establishing substantive dialogue. A discussion and review of rough drafts of document sections early in the development process will facilitate approval. The submittal of the final documents then becomes a formality, with minimal changes required.
(5) To assist air carriers in developing their I&O Plans, a checklist of items to be included in the plan is provided in paragraph 9a(3). Paragraph 9a(4) contains a sample I&O Plan template. Although specific areas should be addressed in the plan, the I&O Plan template is flexible enough to allow the air carrier to tailor the plan to its individual needs.
b. FAA Approval.
(1) Operators seeking approval of a FOQA I&O Plan should submit the plan and a completed I&O Plan checklist to the FAA. The checklist should be used as an aid to see that all required material is included in the plan. The submittal should include a cover letter addressed to the air carrier’s assigned Principal Operations Inspector (POI) that requests approval of the plan.
A copy of the cover letter, plan, and checklist should be sent simultaneously to HQ FAA, Attn:
AFS-230. Electronic transmission of this documentation to AFS-230, Volunteer Safety Program Branch, is encouraged (for which purpose signatures are not required).
(2) The FAA will evaluate the I&O Plan based on the adequacy of the proposed means and methods identified for the collection and analysis of data, as well as procedures for taking corrective actions. The joint evaluation by AFS-230 and the POI will allow the FAA to maintain standardization and continuity throughout the industry while accommodating carrier-specific organization and resource differences best understood by the POI.
(3) The POI and AFS-230 will review the proposed I&O Plan and establish a consensus as to whether the plan should be approved. The FAA procedures for I&O Plan approval are contained in FAA Order 8400.10, Air Transportation Operations Inspector’s Handbook.
AFS-230 and the POI will communicate any plan inadequacies to the air carrier in writing.
Similarly, once AFS-230 and the POI concur that the plan should be approved, the air carrier will receive an approval letter with the signatures of the POI and the manager of AFS-230. Once Page 22 Par 9
an I&O Plan is approved by the FAA, the air carrier’s FOQA program may continue for an indefinite period, unless the carrier elects to terminate the FOQA program or the FAA withdraws its approval.
(4) The I&O Plan is a “living document” and should be updated as necessary. Changes will occur in the FOQA program as an air carrier assimilates new technologies, adds new fleets, modifies event definitions, and changes structures to meet its program’s growing needs. Changes are likely to be particularly frequent during the early stages of an operator’s FOQA program.
When changes occur to previously approved I&O Plan content, the I&O Plan should be revised to incorporate those changes.
(5) A revision control methodology should be established for the I&O Plan (and any subsequent revisions) and included in the I&O Plan. A list of affected pages, or a revision control page that identifies the pages to be added/removed/replaced, should be submitted with any revised pages. Each revised page should contain the page number, revision number, and revision date. Revisions to the I&O Plan are required whenever changes occur to the nature of the FOQA program (e.g., changes to fleet composition, system configuration, flight operating procedures, organizational structure, schedule, and key milestones).
(6) Revisions to approved I&O Plans do not require FAA letters of approval. Because such changes can be potentially frequent and voluminous, revisions to approved plans will be considered to be accepted by the FAA, unless the FAA notifies the carrier in writing within 45 days of revision submittal that the revision is not accepted, except as follows: notwithstanding this 45 day period, if at any time the FAA discovers that the content of a FOQA I&O Plan is not consistent with section 13.401, or is otherwise unacceptable to the FAA, the FAA may notify the operator that revisions are required in order to maintain program approval. In addition to the POI, AFS-230 should be provided with an information copy of all revisions. The POI may permit an air carrier to consolidate and submit revisions on a quarterly basis throughout the calendar year, rather than submit each revision as it occurs. The air carrier should request this authority from the POI. This procedure is intended to reduce workload for the air carrier and FAA.
(7) FOQA is a voluntary program, and the air carrier may elect at any time to terminate its program. The FAA may also elect at any time to withdraw approval of an air carrier’s I&O Plan for failure to comply with the requirements of section 13.410. The protections from civil enforcement actions are predicated upon the expectation that the operator will act upon FOQA information indicative of an adverse safety trend or a continuing violation. If the FAA determines that insufficient effort to develop or implement a plan of corrective action is taking place, and the air carrier is not responsive to FAA efforts to elicit compliance with this requirement, withdrawal of program approval may be appropriate. Withdrawal of FAA approval of the I&O Plan will be transmitted, in writing, to the air carrier.
c. I&O Plan—Topics. The following topics should be included in an I&O Plan:
(1) Background. This section summarizes the foundation and relevant FAA references for FOQA programs.
Par 9 Page 23
(2) Introduction. The introduction section should state the goals and objectives of the airline’s FOQA program.
(3) FOQA Program Stakeholders. This section should identify the key stakeholders in the FOQA program. There may also be stakeholders outside the company that should be identified here.
(4) Protective Provisions, Pilot Association Agreement (if Applicable), and Corporate Policy Statement. Summarize the salient points of the protective provisions that the airline and its pilots are afforded from FAA certificate action or civil penalties from information and data collected and analyzed by the FOQA program. In addition, the protective provisions from the pilots association agreement should be summarized. Provide a copy of the agreement in Appendix 1 of the I&O Plan. If a pilot association agreement is not applicable to the airline, a corporate policy statement should be included in the I&O Plan that establishes protective provisions to its pilots against disciplinary or other pejorative action from the airline from data or information produced by the FOQA program.
(5) Data Protective Provisions and Security.
(a) In this section, include a summary of the protective provisions to be incorporated into the FOQA program that will gain acceptance by all participants, including the pilot association (if applicable).
(b) Describe the pilot association agreement (if applicable) as it pertains to individual protection and data usage. At a minimum, discuss the following security considerations:
• The team member(s) responsible for data protection and security
• Data protection methods (including those provided by the GDRAS, physical security of FOQA media and facilities and information dissemination safeguards, etc.)
• De-identification requirements and procedures
• Methods for ensuring confidentiality
• Data retention policies and procedures
• Data storage policies and procedures
• Procedures for auditing and refining the security policy, methods, and procedures
(6) FOQA Program Components. Describe the specific technology components proposed for use in the FOQA program. The I&O Plan will need to be amended when changes or additions to the fleet types or changes to other technology components are made in the airline’s FOQA program. Program components described should include the following:
(a) Aircraft Fleet. Describe the following:
Page 24 Par 9