Threat & Error ManagementChapter 8

Aim

To define the principles of T.E.M., identify the differences between Threats and Errors, and discuss methods of how these may be managed

Objectives1. State the principle of TEM

2. Define Threats, Errors and Undesired Aircraft States (UAS)

3. Discuss management of and mitigation of risks

4. Assign further reading

1. T.E.M.What is T.E.M?

In the past aviation accidents/incidents were considered to be the direct cause of Human Error

Pilots involved in such incidents were generally ‘guilty’. Research now concludes that humans are not infallible

Pilot error is quoted as a likely factor in over 75% of aircraft accidents/incidents

1. T.E.M.What is T.E.M? (cont.)

T.E.M addresses the threats (external) and errors (internal) that impact the safety of flight and how we manage them to avoid undesired aircraft states (UAS)

TEM is the development of a mindset which promotes safe attitudes and actions, in order to help identify threats &

minimize the likelihood of an accident occurring

2. Threats, errors and undesired aircraft statesWhat is a threat?

Threats can come in a range of forms: • External threats• Internal threats • Environmental threats • Organizational threats • Latent threats

An event, situation, or hazard outside/external to the immediate operating environment, which, has potential to

cause errors or impact negatively on safety

External/Environmental Threats Threats originating from the operational environment

Mismanagement of these can lead to errors being committed

Eg: • Distractions by crew• Weather • Heavy Traffic • Missed approach• Diversions • System failures • Terrain • Night operations

2. Threats, errors and undesired aircraft states

Internal Threats Threats originating from within the cockpit and influenced by the pilots personal performance

Eg: • Fatigue • Lack of knowledge • Language/cultural issues • Cockpit authority gradient • Proficiency

2. Threats, errors and undesired aircraft states

Organisational Threats Threats originating from within organisational infrastructure

Eg: • Poor SOP’s• Unsafe attitudes & culture • Poor training/checking • Incomplete documentation• Poor maintenance• Poor scheduling

2. Threats, errors and undesired aircraft states

Latent Threats Similar to external threats, however are not immediately apparent until an incident has occurred

Generally the result of reactive (rather than proactive) risk management

Eg: Systemic organizational deficiencies Poor ergonomic design Poor runway layout/design

2. Threats, errors and undesired aircraft states

Expected or Unexpected threats Threats can either be expected or unexpected

Expected threats: • General threats associated with the line of work (eg: weather) • Identification requires a plan to follow• Management is based upon differences in plans to best minimize

errors

Unexpected threats: • Identification requires broad knowledge to

predict ‘what may’ happen• Relies heavily on transferable skills • Reduced through use of procedures

• Eg, Aviate > Navigate > Communicate, checklists, SOP’s

2. Threats, errors and undesired aircraft states

What is an Error?

Errors can occur in a range of forms: • Handling errors • Procedural errors • Communication errors • Proficiency errors • Operation decision errors

2. Threats, errors and undesired aircraft states

An action or inaction which leads to deviation in expected performanceThe result is a reduced margin of safety, which increases the chances of

adverse events

Classification of errorErrors are actions which lead to deviations in performance/safety These can be intentional or unintentional deviations

Deviations from normal operations on purpose

Execution of a plan based on flawed knowledge/rule based behaviour

Errors in skill based behaviour due memory failures

Errors in skill based behaviour due to failures of attention

2. Threats, errors and undesired aircraft states

Classification of error (cont.)Examples of accidents due slips/lapses: • Eastern Airlines flight 401 – Everglades crash due pilot inattention to Altitude• Helios Air 522 – Hypoxia crash due incorrect pressurization setting• Emirates EK407 – Near miss with terrain due pilot data input error

Examples of accidents due mistakes: • Air France flight 447 – stall over the Atlantic Ocean • Colgan Air 3407 – mismanaged stall due handling errors

Examples of accidents due violations: • Tenerife Disaster – pilot

purposely ignored order to hold position on runway

2. Threats, errors and undesired aircraft states

Handling errors Errors which directly involve the handling or manipulation of an aircraft

Generally the result of a lack of knowledge, and best reduced through continual practice/training

With consistent practice, handling errors reduce with experience

Eg: • Misuse of autopilot • Shutting down incorrect engine • Failing to maintain altitude • Poor landing techniques

2. Threats, errors and undesired aircraft states

Procedural errors Errors induced from incorrect usage of procedures

Applies to both experienced & inexperienced pilots

Generally the result of external threats mismanaged, but not necessarily misunderstood (I.e. the intentions were good, but execution was flawed)

Eg: • Due to time constraint, the pilot flies a left hand circuit instead of a

right hand as listed in ERSA • Using the incorrect checklist from the task at hand • Wrong usage of units in calculations

2. Threats, errors and undesired aircraft states

Communication errors Errors which occur as a result of information being transferred incorrectly

Ambiguous communication can also lead to procedural errors.

• Use of nonstandard phraseology • Thick accents/cultural differences • Poor radio quality • Ambiguous questions/answers

E.g. Air China 981 vs. JFK Airport ATC.

2. Threats, errors and undesired aircraft states

Swiss Cheese model1990 James Reason hypothesized accidents are not the result of a single error. Rather, accidents are caused through the break down of a system and can be traced to a number of errors – rather than a single event This is known as the “Swiss Cheese model”A system has a number of defence mechanisms in place (eg: reporting, safety vests, door locks, etc)As these defence mechanisms are breached, an accident will eventually occur

ACCIDENTErrors committed

2. Threats, errors and undesired aircraft states

So what is an Undesired Aircraft State (UAS)?

Responses to an UAS may be: • Managed - The pilot identifies and remedy’s the threat• Exacerbated - The pilot attempts to correct the situation but

indirectly worsens it (a mistake) • Response failure - The pilot fails to identify the threat and the

situation follows through undetected

E.g.• Stalls, dives, flight into IMC, high nose on flare

2. Threats, errors and undesired aircraft states

A mismanaged threat which leads to an error, and ultimately puts the aircraft in an unsafe state.

Should the UAS be uncorrected an accident will occur

Classification of UASGround UAS:

• Incorrect taxi way or aircraft positioning • Collision with object on apron

Aircraft UAS: • Aircraft control• Performance deviations • Mishandling of aircraft

Configuration UAS:• Incorrect flap settings • Incorrect approach speeds • Incorrect weight & balance

calculations

2. Threats, errors and undesired aircraft states

3. Mitigation of risks & UASResponses

Attention switching • Should the error/hazard be managed? The situation may worsen

before it gets better

E.g. Carburettor icing

• Attention needs to be moved from management of the error to proper handling of the aircraft state. Management of the error may not be actively required

I.e. Response to the threat should be in proportion to the risk!

3. Mitigation of risks & UASRisk Management

Probability vs Impact

With an idea of the total risk, tasks can be prioritised

E.g:Aviate

NavigateCommunicate!

3. Mitigation of risks & UASIdentification of risks/threats

Organizations/Pilot response to threats may be:

ReactiveProactive

PREDICTIVE

T.E.M. effectiveness

The best cure is prevention & anticipation!

3. Mitigation of risks & UASTools for management

Standard Operating Procedures (SOP’s) (Rule based behaviour)

Risk Analysis1. Identify all possible threats & errors2. Identify impact/severity of risk/error3. Implement and enforce procedures/steps to be followed

Eg: Initial actions, trouble checks, Mix Up>Pitch Up>Power Up

Rule based behaviour is enhanced through simulation

Checklists should still be referenced regardless of proficiency

3. Mitigation of risks & UASTools for management (cont.)

Identification & Reasoning (knowledge based behaviour)

The pilot:1. Identifies the issue2. Recalls previous knowledge3. Decides based on the calculated risk4. Assesses decision and applies feedback

=> Limited by the quality of the pilots knowledge

D – Define the problem E – Establish criteria & desired outcomes C – Consider all alternatives & options I – Identify the best alternative D – Develop a plan to implement, what must be done?E – Evaluate and monitor the effectiveness of the decision

3. Mitigation of risks & UASTools for management

Situational Awareness (SA)

“The ability to perceive all elements of ones environment, understand their significance, and

interpret their status with the change of any given variable”

Understanding what is happening around you at all times and the ability to predict what may happen given certain circumstances

(Situational Awareness)

E.g’s:• CLEAROFFS checks • Pre-flight & fuel planning • Reporting systems & SOP’s• Sound safety culture

4. Further readingAir accidents:

Tenerife Disaster – Poor communicationEverglades accident Flight 401 – Poor resource management Helios flight 522 – Hypoxia Alaska Air Flight 261- Maintenance issues w/ good CRM Atlantic Southeast Flight 528 – Poor aircraft design Air France flight 296 – Poor use of Automation Sioux City United 232 – Excellent example of CRM New Zealand Air Flight 901 – Erebus crashUS Air Flight 1549 – ditching, excellent CRMColgan Air Flight 3407 – Fatigue & poor SOP’s

Articles:Heroic compensations – the human factorThe search for resilience Human factors & stress

Questions?