The anomaly detection system continuously analyzes operational and safety data to identify unusual patterns that may indicate emerging safety concerns. This reference documents the detection methods, alert types, threshold configuration, and data sources used by the system.
Detection Methods
The system uses multiple detection approaches to identify different types of anomalies.
| Method | Description | Best for |
|---|
| Statistical deviation | Flags data points that deviate beyond a configurable number of standard deviations from baseline. | Numeric metrics with stable baselines. |
| Trend analysis | Detects gradual shifts in a metric’s moving average that indicate a sustained directional change. | Slowly degrading conditions. |
| Rate change | Identifies sudden spikes or drops in event frequency compared to the rolling average. | Report volume, incident rates. |
| Pattern matching | Compares current patterns against known precursor signatures from historical data. | Recurrence of previously identified risks. |
| Cluster analysis | Groups related events to detect emerging patterns that individual events would not reveal. | Multi-factor hazards. |
Alert Types
| Alert Type | API Value | Trigger | Default Action |
|---|
| SPI Exceedance | spi_exceedance | A Safety Performance Indicator crosses a defined threshold level. | Notify safety manager. |
| Rate Anomaly | rate_anomaly | Event frequency exceeds the expected range for the time period. | Review in triage. |
| Trend Alert | trend_alert | A metric’s moving average shows a statistically significant shift. | Review in analytics. |
| Pattern Match | pattern_match | Current data matches a known precursor pattern from historical data. | Investigate immediately. |
| Cluster Detection | cluster_detection | A group of related events exceeds the expected clustering threshold. | Safety committee review. |
Alert Severity Levels
| Severity | Color | Criteria | Expected Response |
|---|
| Info | Blue | Observation only. No threshold breach, but notable pattern. | Acknowledge and monitor. |
| Watch | Yellow | Early warning. Metric approaching a threshold. | Review within 5 business days. |
| Warning | Orange | Threshold breached. Requires attention. | Review within 48 hours. |
| Critical | Red | Significant breach or rapid deterioration. Potential safety concern. | Review same day. Escalate if needed. |
Data Sources
The anomaly detection engine ingests data from the following sources:
| Source | Data Type | Update Frequency |
|---|
| Safety reports | Report volume, classification distribution, severity. | Real-time on submission. |
| ASAP reports | Event types, acceptance rates, corrective actions. | Real-time on submission. |
| Flight data (FOQA) | Exceedance events, parameter deviations. | Per-flight upload. |
| Maintenance records | Discrepancy rates, component failure patterns. | On record creation. |
| Crew scheduling | Duty time patterns, fatigue risk scores. | On schedule change. |
| Training records | Completion rates, assessment scores, overdue training. | On record update. |
| Investigation findings | Root cause categories, contributing factor patterns. | On investigation close. |
Threshold Configuration
Each alert type supports configurable thresholds that control sensitivity.
Statistical Deviation Thresholds
| Parameter | Default | Description |
|---|
| Standard deviations | 2.0 | Number of standard deviations from baseline for alert. |
| Minimum data points | 30 | Minimum observations before detection is active. |
| Baseline window | 90 days | Historical period used to calculate baseline statistics. |
| Evaluation frequency | Daily | How often the system re-evaluates the data. |
Rate Change Thresholds
| Parameter | Default | Description |
|---|
| Rate increase trigger | 50% | Percentage increase in event rate vs. rolling average. |
| Rolling average window | 30 days | Period used to compute the baseline event rate. |
| Minimum events | 5 | Minimum events in the window before rate alerting. |
Trend Analysis Thresholds
| Parameter | Default | Description |
|---|
| Trend significance | p < 0.05 | Statistical significance threshold for trend detection. |
| Minimum trend duration | 14 days | Minimum period showing consistent directional change. |
| Moving average window | 30 days | Window for computing the moving average. |
Threshold defaults are designed for a mid-size Part 135 operation. Larger operations with more
data should consider tighter thresholds (lower standard deviations, shorter windows) for faster
detection. Smaller operations may need looser thresholds to reduce false positives.
Anomaly Lifecycle
| Status | Description |
|---|
| Detected | System flagged the anomaly. Awaiting human review. |
| Reviewed | A safety professional has opened and assessed the anomaly. |
| Acknowledged | Assessed as benign variation or already addressed. No further action. |
| Escalated | Assessed as a genuine concern. Linked to a safety report or investigation. |
| Dismissed | Determined to be a false positive or data artifact. Reason documented. |
Monitor Anomaly Detection
Review and act on detected anomalies.
Configure Safety Alerts
Set up alert thresholds and notification rules.
SPI Definitions
Safety Performance Indicators that feed anomaly detection.
Use FOQA
Flight data monitoring that provides anomaly detection input.
