Legal and Rested Are Not the Same Thing

A flight time limitation is a boundary, not a target

Whatever regime you operate under, the applicable FTL scheme hands you a set of maxima: the longest flight duty period you may plan, the flight time you may accrue, the rest you must provide before the next one. Those numbers were arrived at as the point beyond which a regulator is no longer prepared to accept the risk. They describe the edge of the acceptable. They were never intended to describe the recommended operating point.

Almost every crew scheduling tool nonetheless converts them into exactly that. You build a roster, the system checks it, and you get a tick or a flag. Inside the boundary, silence. Outside it, an error. The instrument has one bit of output and it reports a wall crossing, which is the one event you were already going to avoid.

What fuel planning gets right and duty planning does not

Nobody runs fuel planning this way. No captain lands on legal reserves, notes that the flight was compliant, and considers the matter closed. The whole discipline of fuel is about how much you have left and how fast you are spending it. Duty is the same physical quantity — a finite reserve consumed by the day — and it is almost universally managed with a pass/fail check performed once, days in advance, by a piece of software that never looks again.

Margin is the currency the roster actually spends

Consider two rosters for the same week. One leaves the average duty with several hours of headroom before it touches the limit. The other lands eleven minutes inside. Both pass. A compliance check reports them identically, and if that check is the only signal your planning process produces, they are the same roster as far as the operation is concerned.

They are not the same operation. The first one can absorb a slot delay, a late passenger, a technical hold at the gate and a runway change without anyone making a phone call. The second has already spent its capacity to absorb anything at all. It is not a plan; it is a bet that nothing will happen, placed on a Tuesday, in an industry where something always happens.

Margin is a real resource, and the roster spends it

This is the useful reframing. Margin is a real resource, and a roster is a decision about where to spend it. Most operations spend it without recording the transaction, because nothing in the process ever surfaces the balance. Ask an experienced crewing officer which days this month are thin and they will usually know, but they know it from memory and instinct rather than from anything they can point at — which means the knowledge is not in the operation, it is in a person, and it goes home at five.

What crew rostering software should tell you unprompted

The question worth putting to any crew rostering software is therefore not whether it validates. It is whether it can tell you, without you asking, which duties this week are running on fumes and which cumulative window is closest to running out.

Cumulative duty limits are the ones that catch operations out

The daily check is the easy one. It has a start, an end, and a number, and a competent human with a pen can verify it. Nobody is caught out by a flight duty period.

Cumulative limits behave completely differently. Many regimes stack several rolling windows on top of each other — a rolling week, a rolling month, and longer periods running out to a year — and each window is a box that moves with every day that passes. A duty added today can push a total over a limit three weeks from now. Removing a duty from last Thursday can quietly create capacity in a window nobody is currently looking at.

Two reasons cumulative limits are hard to hold in your head

Two properties make this genuinely hard. The first is that the duty which trips a cumulative limit is almost never the duty that caused it; the cause was distributed across a dozen earlier decisions, each of which looked fine on its own. The second is that no human can hold four moving windows across thirty crew members in working memory. This is not a discipline problem or a training problem. It is an arithmetic problem of a size that people are simply not built for, and an operation that relies on somebody noticing is relying on the one thing that does not scale.

How to tell whether cumulative limits are tracked or merely sampled

The tell is easy to spot. If cumulative duty limits in your operation are discovered rather than managed — if they arrive as a surprise from a crew member, a rostering officer or an auditor rather than as a number you were already watching — then the cumulative dimension is not being tracked, it is being sampled.

A duty calculation is only true at the instant it was made

Here is the failure that quietly undoes everything above. Duty time tracking at the point of rostering computes a result against a set of assumptions: these report times, these sectors, these crew, this rest. The result is correct. It is also perishable.

Every subsequent event invalidates it. A departure slips ninety minutes. A crew member goes sick and somebody is swapped in from standby. A positioning leg is added to recover an aircraft. A duty is extended under a discretion provision. A diversion adds a sector nobody planned. Each of these changes the inputs, and a compliance result computed before the change is now a statement about a day that no longer exists.

Not whether compliance is checked, but when it last was

So the question to ask of any crew system is not whether it checks FTL compliance, but when it last did. A system that computed compliance once, at rostering, and has not recomputed since has stopped being a compliance system without announcing it. It is a record of a decision taken on Thursday about a Tuesday that changed. This is the same disease that afflicts an operations board that draws the plan and calls it the operation: confidently wrong, in a reassuring way, from the first delay of the day.

The three o'clock test

The practical test is the three o'clock test. The day has moved. Two crews are running late, one swap has already happened, and someone is asking whether the last rotation can still be flown. Who answers that, how long do they take, and where do they get the number from? In most operations the answer is a senior crewing officer, several minutes, and a spreadsheet maintained in parallel to the system that was supposed to be doing this.

Fatigue is not duty time, and duty time is a poor proxy for it

Hours arithmetic is a proxy. It is used because it is objective, auditable and cheap to compute, not because it is a good description of how tired a crew member is. Two duties of identical length, flown by the same person in the same week, can produce entirely different levels of impairment, and nothing in the sum distinguishes them.

Why a fatigue risk management system exists at all

A fatigue risk management system exists for precisely this reason: because the numbers were never sufficient, and everyone involved in writing them knew it. An FRMS is an admission that the prescriptive scheme is a floor with known blind spots, and that an operation flying anything other than a simple, stable pattern needs a second instrument.

None of this argues for abandoning duty accounting. It argues for holding it at the right value. The hours tell you what is permitted. They do not tell you what is wise, and an operation that has never separated the two questions has only ever answered one of them.

The second axis: crew currency and qualification tracking

Everything so far has treated availability as a function of rest. It is not. A crew member who is fully rested and comfortably inside every limit is still unable to operate if a recency requirement has lapsed, a check is out of date, a medical has expired or a route or airport qualification does not cover the sector in front of them.

Why eligibility rarely lives next to availability

Operationally these are the same constraint: can this person fly this flight. Administratively they almost never live in the same place. Duty sits in the rostering system. Crew currency tracking sits in a training folder, a spreadsheet, or the training manager's head. Qualification records sit with whoever owns the training records. Three sources, three owners, and no single answer to the only question anyone actually asks.

The consequence is predictable and it is always the same: the discovery happens late. Not at rostering, when substitution is cheap and there are options, but on the morning of, when the options are expensive and few. This is a specific instance of a more general fragmentation problem, and it has the same shape everywhere it appears: the information existed, it just was not next to the decision.

A crew system that answers availability without answering eligibility has solved half the problem, and it is the half that fails less often.

Proving it afterwards is where the gaps show up

Compliance has a second life after the operation, and it is a less forgiving one. During the day, the question is whether a crew member can fly. Afterwards, the question is whether you can demonstrate that they were entitled to, from records, to somebody who was not there.

Records assembled retrospectively for an audit are the ones that reveal the gaps, because assembling them forces every quiet assumption into the open. The duty that was extended by verbal agreement and never written down. The rest period recorded as planned rather than as taken. The swap made at nine in the evening that updated the roster but not the duty log. The positioning sector that appeared in the movement record and nowhere else. Individually each is small. Collectively they are the difference between a compliance position you can evidence and one you can only assert.

Why findings tend to be about documentation rather than flying

The relevant distinction is between a system that records duty as it happens and one that reconstructs it later from other sources. The first produces an audit trail as a by-product of operating. The second produces an exercise, performed under time pressure by people who were not present, using records that were never designed to be joined. The second is far more common than anyone admits, and it is the reason findings tend to be about documentation rather than about flying.

Questions that separate a crew system from a roster with rules bolted on

Every product in this category claims FTL compliance, which means the claim carries no information. These are the questions that still discriminate:

• Does it show remaining margin, or only pass and fail? Can you see which duties this week are thin without opening each one?
• Are cumulative windows continuously visible, or computed on demand when somebody thinks to check?
• When the day moves, does compliance recompute automatically — and does anyone find out, or does the number simply go quietly stale?
• Can you test a proposed change before committing to it, and see what it costs in margin across every affected window?
• Does availability include currency and qualification, or does it answer rest and leave eligibility to another system?
• Does it capture what actually happened, including extensions and unplanned sectors, or only what was planned?
• Could you produce a defensible record for any crew member, for any period, without anyone reconstructing it from three sources?
• Is there anywhere at all to record the things that are not hours — the pattern that keeps producing tired crews, the report that never fits a field?

Margin rather than verdict is the idea we built crew management in Aerotalon around — a roster whose shape you can see, rather than one you have been told has passed.

The distinction underneath all of these is simple enough to state. A rule engine tells you what you are permitted to do. A crew system tells you what you are able to do, how much room you have left, and what it will cost you to use it. Most operations have bought the first and assumed they were getting the second, which is why the roster is always legal right up until the afternoon it stops being either legal or sensible, and nobody can say which happened first.