LOSA (Line Operations Safety Audit)

Line Operations Safety Audit was developed at the University of Texas Human Factors Research Project under the leadership of Captain Robert Helmreich, Dr. James Klinect, and Dr. John Wilhelm through the 1990s. The foundational methodology paper — "The Line/LOS Checklist: A Behavioral Marker System for LOC-I Prevention and CRM Assessment" — was published in 1996, growing from the Line Operational Simulation (LOS) research methodology that Helmreich's group had developed alongside NASA Ames in the late 1980s. ICAO adopted and codified the methodology in Doc 9803 (Line Operations Safety Audit, First Edition, 2002), which remains the authoritative reference. IATA subsequently published the LOSA Implementation Guide, and the methodology has been formally endorsed by FAA, EASA, and Transport Canada as a best-practice proactive safety tool.

The operational mechanics of a LOSA program are precise and deliberately structured to produce statistically valid data rather than anecdotal observations. Trained LOSA observers — typically retired line pilots or senior check airmen who have completed an ICAO-aligned observer calibration course — are positioned in the cockpit jumpseat for normal revenue flights that are selected randomly or systematically from the operator's line schedule. The observer does not intervene in crew operations under any circumstances short of an actual safety emergency. During the flight, the observer codes crew behaviors against a validated taxonomy of four event classes: (1) threats, defined as events or conditions outside the crew's creation that increase operational complexity — adverse weather, non-standard ATC instructions, maintenance-deferred items, time pressure, airport environment complexity; (2) crew errors, defined as crew actions or inactions that deviate from expected crew or organizational intentions — procedural errors, communication errors, proficiency errors (manual flying deviations), and intentional non-compliance; (3) undesired aircraft states (UAS), defined as crew-induced positions, configurations, or flight parameters that reduce safety margins below normal — high on the approach, off centerline at touchdown, wrong altitude cleared, wrong configuration selected; and (4) threat and error management outcomes — whether each threat was identified, whether each error was trapped by normal crew defenses, whether each UAS was recovered. The coding instrument, known as the LOSA observation form or the UT/FAA TEM coding form, has been validated across multiple airline populations for inter-rater reliability.

The non-punitive and confidential design of LOSA is not incidental — it is the entire epistemological premise of the methodology. Normal line behavior, when crews know they are being observed for evaluation, is not the same as behavior during unobserved operations: crews fly more precisely, communicate more formally, and deviate from SOPs less frequently. LOSA produces the true behavioral baseline — what crews actually do on the line — because observer identity, crew names, flight numbers, and individual data are stripped before analysis. ICAO Doc 9803, Section 2 specifies that LOSA data must be de-identified before any analysis and that raw observation forms must never be accessible to management or check standards personnel. Before implementing LOSA, operators must negotiate a formal data-protection agreement with the pilot union (ALPA, BALPA, or the relevant national union) and obtain a no-jeopardy agreement from the competent authority. Without these protections, LOSA data quality degrades as crews adopt modified behavior when observed.

The output of a completed LOSA program is a threat-and-error profile of the operator's line operations, stratified by aircraft type, route group, crew pairing structure, time of day, and phase of flight. This profile feeds the Threat and Error Management (TEM) framework directly: the threats most commonly encountered in actual line operations become the scenario elements that LOFT designers inject into recurrent training. The errors most frequently observed become the SOPs, callout procedures, and cross-check disciplines that the training department reinforces in initial and recurrent programs. LOSA data also feeds the operator's hazard identification process under ICAO Annex 19 and ICAO Doc 9859 — the raw observations are the proactive hazard-identification input that the SMS hazard register requires. EASA Part-ORO ORO.GEN.200(a)(3) and ORO.AOC.130 (Flight Data Monitoring) together form the data infrastructure around which LOSA is intended to operate: FDM provides the parametric hard data; LOSA provides the behavioral soft data; together they define the complete operational safety picture.

Distinguishing LOSA from FOQA/FDM is important for operators designing their safety data architecture. FOQA/FDM captures hard parametric data — airspeed, pitch attitude, vertical speed, gear and flap configuration at defined gates — from the Quick Access Recorder or equivalent. It reveals what the aircraft did with high precision. LOSA captures human behavior — what the crew said, what they noticed, what they chose, what they missed — with trained-observer interpretation. Neither alone is sufficient: an FDM exceedance event (for example, a high-energy approach) cannot be attributed to a cause without behavioral data; a LOSA-observed procedural deviation cannot be quantified for fleet-wide frequency without FDM comparison. Major airline programs that have published LOSA results — Continental Airlines (original FAA-sponsored 1996 program), Delta Air Lines, US Airways, Cathay Pacific, Singapore Airlines, Lufthansa, and others — have consistently reported that LOSA data changed training department priorities in ways that FDM data alone would not have revealed.

The dominant failure mode for smaller operators attempting LOSA-equivalent programs is observer calibration and data-protection architecture. A flight school or regional operator that deploys check airmen as LOSA observers without a formal calibration program produces inconsistent coding across observers — two observers watching the same crew type would code different threats and different error categories, making aggregate analysis meaningless. ICAO Doc 9803 Appendix A specifies the observer training curriculum (minimum 2-day calibration course including video analysis exercises with inter-rater reliability testing); operators that skip this step produce a LOSA database with low internal consistency. The second failure mode is confidentiality compromise: when line pilots learn that a specific flight was observed and the observation was used in a subsequent check airman briefing, the no-jeopardy agreement is functionally void, and voluntary participation collapses.

For combined ATO and AOC operators, LOSA creates a specific design question about scope: do the LOSA observations cover only AOC line flights, or are training flights operated for line currency (IOE, line training, upgrade training) included? Including training flights captures the behavior of line training captains — an important population because their supervision and correction patterns shape how new first officers develop TEM habits. Excluding training flights keeps the LOSA dataset cleaner (training crews are not representative of normal line-crew pairings). ICAO Doc 9803 does not prescribe a definitive answer; the operator's safety review board must make a documented scope decision before the program starts and record the rationale.

Aviatize's safety management module provides a LOSA-compatible observation data structure: observation records can be entered using the TEM coding taxonomy (threats, errors, undesired aircraft states, management outcomes), linked to flight records by aircraft type, route, and crew pairing, and immediately de-identified before storage — the crew name and flight number fields are hashed at entry, satisfying the ICAO Doc 9803 data-protection requirement within the platform's database rather than requiring a manual anonymization step after export. The system aggregates observations by threat category, error type, phase of flight, and aircraft type, presenting the operator's behavioral baseline in the KPI reporting and dashboards module against the SPIs established in the SMS Manual.

For operators using LOSA data to drive training improvements, the connection between the safety management module and the training management module closes the evidence loop: threat categories identified as high-frequency in LOSA data can be tagged as scenario requirements in the training curriculum, ensuring that LOFT scenarios and recurrent training exercises are built from the operator's actual operational risk profile rather than generic syllabus content. The compliance and auditing module maintains the audit trail — LOSA program design documents, data-protection agreements, observer calibration records, and cycle-completion evidence — in a format accessible to EASA competent authority inspectors and FAA POI review.