Anomaly Detection Reference

The anomaly detection system continuously analyzes operational and safety data to identify unusual patterns that may indicate emerging safety concerns. This reference documents the detection methods, alert types, threshold configuration, and data sources used by the system.

Detection Methods

The system uses multiple detection approaches to identify different types of anomalies.

Method	Description	Best for
Statistical deviation	Flags data points that deviate beyond a configurable number of standard deviations from baseline.	Numeric metrics with stable baselines.
Trend analysis	Detects gradual shifts in a metric’s moving average that indicate a sustained directional change.	Slowly degrading conditions.
Rate change	Identifies sudden spikes or drops in event frequency compared to the rolling average.	Report volume, incident rates.
Pattern matching	Compares current patterns against known precursor signatures from historical data.	Recurrence of previously identified risks.
Cluster analysis	Groups related events to detect emerging patterns that individual events would not reveal.	Multi-factor hazards.

Alert Types

Alert Type	API Value	Trigger	Default Action
SPI Exceedance	`spi_exceedance`	A Safety Performance Indicator crosses a defined threshold level.	Notify safety manager.
Rate Anomaly	`rate_anomaly`	Event frequency exceeds the expected range for the time period.	Review in triage.
Trend Alert	`trend_alert`	A metric’s moving average shows a statistically significant shift.	Review in analytics.
Pattern Match	`pattern_match`	Current data matches a known precursor pattern from historical data.	Investigate immediately.
Cluster Detection	`cluster_detection`	A group of related events exceeds the expected clustering threshold.	Safety committee review.

Alert Severity Levels

Severity	Color	Criteria	Expected Response
Info	Blue	Observation only. No threshold breach, but notable pattern.	Acknowledge and monitor.
Watch	Yellow	Early warning. Metric approaching a threshold.	Review within 5 business days.
Warning	Orange	Threshold breached. Requires attention.	Review within 48 hours.
Critical	Red	Significant breach or rapid deterioration. Potential safety concern.	Review same day. Escalate if needed.

Data Sources

The anomaly detection engine ingests data from the following sources:

Source	Data Type	Update Frequency
Safety reports	Report volume, classification distribution, severity.	Real-time on submission.
ASAP reports	Event types, acceptance rates, corrective actions.	Real-time on submission.
Flight data (FOQA)	Exceedance events, parameter deviations.	Per-flight upload.
Maintenance records	Discrepancy rates, component failure patterns.	On record creation.
Crew scheduling	Duty time patterns, fatigue risk scores.	On schedule change.
Training records	Completion rates, assessment scores, overdue training.	On record update.
Investigation findings	Root cause categories, contributing factor patterns.	On investigation close.

Threshold Configuration

Each alert type supports configurable thresholds that control sensitivity.

Statistical Deviation Thresholds

Parameter	Default	Description
Standard deviations	2.0	Number of standard deviations from baseline for alert.
Minimum data points	30	Minimum observations before detection is active.
Baseline window	90 days	Historical period used to calculate baseline statistics.
Evaluation frequency	Daily	How often the system re-evaluates the data.

Rate Change Thresholds

Parameter	Default	Description
Rate increase trigger	50%	Percentage increase in event rate vs. rolling average.
Rolling average window	30 days	Period used to compute the baseline event rate.
Minimum events	5	Minimum events in the window before rate alerting.

Trend Analysis Thresholds

Parameter	Default	Description
Trend significance	p < 0.05	Statistical significance threshold for trend detection.
Minimum trend duration	14 days	Minimum period showing consistent directional change.
Moving average window	30 days	Window for computing the moving average.

Threshold defaults are designed for a mid-size Part 135 operation. Larger operations with more data should consider tighter thresholds (lower standard deviations, shorter windows) for faster detection. Smaller operations may need looser thresholds to reduce false positives.

Anomaly Lifecycle

Status	Description
Detected	System flagged the anomaly. Awaiting human review.
Reviewed	A safety professional has opened and assessed the anomaly.
Acknowledged	Assessed as benign variation or already addressed. No further action.
Escalated	Assessed as a genuine concern. Linked to a safety report or investigation.
Dismissed	Determined to be a false positive or data artifact. Reason documented.

Monitor Anomaly Detection

Review and act on detected anomalies.

Configure Safety Alerts

Set up alert thresholds and notification rules.

SPI Definitions

Safety Performance Indicators that feed anomaly detection.

Use FOQA

Flight data monitoring that provides anomaly detection input.

SMS Reference

SmartScore

Operations Reference

FBO Reference

Maintenance Reference

Operational Reports

Portal Reference

Platform Reference

API Reference

Detection Methods

Alert Types

Alert Severity Levels

Data Sources

Threshold Configuration

Statistical Deviation Thresholds

Rate Change Thresholds

Trend Analysis Thresholds

Anomaly Lifecycle

Monitor Anomaly Detection

Configure Safety Alerts

SPI Definitions

Use FOQA

​Detection Methods

​Alert Types

​Alert Severity Levels

​Data Sources

​Threshold Configuration

​Statistical Deviation Thresholds

​Rate Change Thresholds

​Trend Analysis Thresholds

​Anomaly Lifecycle

​Related

Monitor Anomaly Detection

Configure Safety Alerts

SPI Definitions

Use FOQA

Detection Methods

Alert Types

Alert Severity Levels

Data Sources

Threshold Configuration

Statistical Deviation Thresholds

Rate Change Thresholds

Trend Analysis Thresholds

Anomaly Lifecycle

Related