Threat and Error Management Threat and Error Management & &

Normal Operations Safety Survey:Normal Operations Safety Survey: The Perspective of ICAO The Perspective of ICAO

Captain Dan MaurinoCaptain Dan MaurinoFlight Safety and Human Factors – ICAOFlight Safety and Human Factors – ICAO

Second ICAO Global Symposium on TEM & NOSS in ATCSecond ICAO Global Symposium on TEM & NOSS in ATCWashington, DCWashington, DC

7 – 8 February 20077 – 8 February 2007

Operational performance

Operational performance

OperationalOperationaldeploymentdeployment

System System designdesign

Baseline performanceBaseline performance

Operationaldrift

Learning from Failure & SuccessLearning from Failure & Success

Capturing the DriftCapturing the Drift Reactive systems Reactive systems

Accident investigationAccident investigationIncident investigationIncident investigation

PredictivePredictive systemssystemsElectronic safety data Electronic safety data

acquisition systems acquisition systems Direct observation safety Direct observation safety

data acquisition systems data acquisition systems Proactive systemsProactive systems

Mandatory reporting Mandatory reporting systems systems VoluntaryVoluntary self-reportingself-reporting

systemssystems

Confidential reporting Confidential reporting systems systems

Safety Data Systems and Levels of Intervention Safety Data Systems and Levels of Intervention

Baseline performanceBaseline performance

“Practicaldrift”

Operational performance

Operational performance organization

Predictive Proactive Reactive

Highly efficient Very efficient Efficient

Safety management levelsSafety management levels

Reactive

Desirable managementDesirable managementlevel level

Insufficient

ASRASRSurveysSurveysAuditsAudits

ASRASRMORMOR

AccidentAccidentand incidentand incident

reportsreports

HHii gghhMMiiddddllee

LLooww

HazardsHazards

FDAFDADirectDirect

observationobservationsystemssystems

NOSS & TEM – Predictive Safety ManagementNOSS & TEM – Predictive Safety Management

Hazards in operational contexts – Hazards in operational contexts – ThreatsThreats Potential risk (s) – Potential risk (s) – Operational ErrorsOperational Errors Result (s) of hazards and risk (s) – Result (s) of hazards and risk (s) – Undesired StatesUndesired States

TEM TEM = Framework – = Framework – What What we look forwe look for

NOSSNOSS = Tool – = Tool – HowHow we collect what we look for we collect what we look for

A Day at the Office A Day at the Office To achieve company’s both To achieve company’s both safetysafety and and productionproduction goals, air goals, air

traffic controllers daily musttraffic controllers daily must

Threat Threat ManagementManagement

Error Error ManagementManagement

Undesired StatesUndesired States ManagementManagement3 Manage deviations

Manage operational Manage operational complexitycomplexity

1

Manage their own errorsManage their own errors2 NOSS NOSS IndexesIndexes

ThreatsThreats

SimilarSimilar callcall signssigns

ReducedReduced separationseparation minimaminima

AirspaceAirspace restrictionsrestrictions

RunwayRunway crossingscrossings

SystemSystem malfunctionsmalfunctions

Missed approachesMissed approaches

CommunicationCommunication failurefailure

RunwayRunway inspectionsinspections

LAHSOLAHSO

NoiseNoise restrictionsrestrictions

WeatherWeather

SIROSIRO

HeavyHeavy traffictraffic

AirspaceAirspacereclassificationreclassification

Events or errors that occur beyond the influence of the ATCO, increase Events or errors that occur beyond the influence of the ATCO, increase operational complexity, and which must be managed to maintain the operational complexity, and which must be managed to maintain the margins of safetymargins of safety

ErrorsErrors

Equipment handling errorsEquipment handling errors – incorrect interactions with the – incorrect interactions with the equipmentequipmente.g. selecting an inappropriate radar source; making e.g. selecting an inappropriate radar source; making

incorrect inputs to an automated systemincorrect inputs to an automated system ProceduralProcedural errors errors – deficiencies in execution – deficiencies in execution

e.g. wrong separation minima applied; leaving the e.g. wrong separation minima applied; leaving the position before replacement is ready to take overposition before replacement is ready to take over

CommunicationCommunication errorserrors – deficiencies in the exchange of – deficiencies in the exchange of operational informationoperational informatione.g. missed calls; misinterpretation of a requeste.g. missed calls; misinterpretation of a request

Actions or inactions by the ATCO that lead to deviations from Actions or inactions by the ATCO that lead to deviations from organizational or ATCO expectationsorganizational or ATCO expectations

Undesired StatesUndesired States

Aircraft climbing to a Aircraft climbing to a wrong altitudewrong altitude

Aircraft turning in the Aircraft turning in the wrong directionwrong direction

Aircraft enters a Aircraft enters a wrong taxiway wrong taxiway

Aircraft missing a Aircraft missing a crossing restriction crossing restriction

……

Operational conditions where an unintended traffic Operational conditions where an unintended traffic situation results in a reduction of safety margins situation results in a reduction of safety margins

OutcomesOutcomes Reportable eventsReportable events

IncidentsIncidentsAccidentsAccidents

TEM – A ScenarioTEM – A Scenario

B737 & C550 B737 & C550 (on non-standard route)(on non-standard route) on on reciprocal tracks at reciprocal tracks at FL 310FL 310, rate of closure in excess of 800 knots , rate of closure in excess of 800 knots

When separated by 22 NMWhen separated by 22 NM, ATCO , ATCO (working two combined (working two combined sectors)sectors) instructed both crews to alter heading and flight level instructed both crews to alter heading and flight level

Horizontal radar separation standard of 5 NM was never Horizontal radar separation standard of 5 NM was never infringedinfringed

Short-term conflict alert (STCA) activatedShort-term conflict alert (STCA) activated Vertical separation was established 25 seconds priorVertical separation was established 25 seconds prior to the to the

aircraft passing aircraft passing

TEM AnalysisTEM AnalysisThreatsThreats C550 on non-standard route C550 on non-standard route Use of non-standard levels Use of non-standard levels ATCO managing two combined sectorsATCO managing two combined sectors

ErrorsErrorsATCO’s timing in recognising a potential conflictATCO’s timing in recognising a potential conflict

Undesired StateUndesired StateFrom 09:56:55 till 09:59:55 the B737 & the C550 wereFrom 09:56:55 till 09:59:55 the B737 & the C550 were

on opposite tracks at FL310 without separation provisionon opposite tracks at FL310 without separation provision

Undesired State ManagementUndesired State ManagementThe controller was spending a significant period of coordination The controller was spending a significant period of coordination with another sector controller.with another sector controller. At 09:59:55, he At 09:59:55, he activated the activated the “individual quick look” function“individual quick look” function for the flight plan tracks of both for the flight plan tracks of both aircraft. He immediatelyaircraft. He immediately commenced action commenced action to ensure a to ensure a separation standardseparation standard was maintained. He was maintained. He instructed instructed the 737 to the 737 to expedite descent to FL290 andexpedite descent to FL290 and instructed instructed the Citation to turn the Citation to turn right 30 degrees. At 10:00:15, he furtherright 30 degrees. At 10:00:15, he further instructed instructed the 737 to the 737 to turn right 20 degrees. He turn right 20 degrees. He broadcast broadcast essential traffic information essential traffic information to the 737 about the position of the Citation. During that to the 737 about the position of the Citation. During that transmission, the STCA activated at 10:00:28. At 10:00:34, the transmission, the STCA activated at 10:00:28. At 10:00:34, the controllercontroller told told the pilot of the Citation to climb to FL320. At the pilot of the Citation to climb to FL320. At 10:00:57, a 2,000 ft vertical separation standard was 10:00:57, a 2,000 ft vertical separation standard was established when the aircraft were approximately 9 NM apart.established when the aircraft were approximately 9 NM apart.

TEM & NOSS – ATC SMS Tools TEM & NOSS – ATC SMS Tools

EDAEDAVoluntary Voluntary ReportingReporting

Direct Direct observationsobservations