1. Threat and Error Management & Normal Operations Safety Survey: The Perspective of ICAO
Captain Dan Maurino
Flight Safety and Human Factors – ICAO
Second ICAO Global Symposium on TEM & NOSS in ATC
Washington, DC
7 – 8 February 2007 1 1 1

2. Learning from Failure & Success
System
design
Baseline performance
Operational
deployment
Operational performance
Operational
drift

3. Capturing the Drift Reactive systems Accident investigation
Incident investigation
Predictive systems
Electronic safety data acquisition systems
Direct observation safety data acquisition systems
Proactive systems
Mandatory reporting systems
Voluntary self-reporting systems
Confidential reporting systems

4. Safety Data Systems and Levels of Intervention
Safety management levels H i g h M d l e L o w
Baseline performance
“Practical
drift”
Operational performance
organization
Hazards
Reactive
Predictive
Proactive
Reactive
FDA
Direct
observation
systems
ASR
Surveys
Audits
ASR
MOR
Accident
and incident
reports
Highly efficient
Very efficient
Efficient
Insufficient
Desirable management
level

5. NOSS & TEM – Predictive Safety Management
NOSS = Tool – How we collect what we look for
TEM = Framework – What we look for
Hazards in operational contexts – Threats
Potential risk (s) – Operational Errors
Result (s) of hazards and risk (s) – Undesired States

6. A Day at the Office NOSS Indexes
To achieve company’s both safety and production goals, air traffic controllers daily must
Manage operational complexity 1
Threat Management
NOSS
Indexes
Manage their own errors 2
Error
Management
Undesired States Management 3
Manage deviations

7. Threats
Events or errors that occur beyond the influence of the ATCO, increase operational complexity, and which must be managed to maintain the margins of safety
Similar call signs
Reduced separation
minima
Airspace restrictions
Runway crossings
System malfunctions
Missed approaches
Communication failure
Runway inspections
LAHSO
Noise restrictions
Weather
SIRO
Heavy traffic
Airspace
reclassification

8. Errors Actions or inactions by the ATCO that lead to deviations from
organizational or ATCO expectations
Equipment handling errors – incorrect interactions with the equipment
e.g. selecting an inappropriate radar source; making incorrect inputs to an automated system
Procedural errors – deficiencies in execution
e.g. wrong separation minima applied; leaving the position before replacement is ready to take over
Communication errors – deficiencies in the exchange of operational information
e.g. missed calls; misinterpretation of a request

9. Undesired States
Operational conditions where an unintended traffic situation results in a reduction of safety margins
Aircraft climbing to a wrong altitude
Aircraft turning in the wrong direction
Aircraft enters a wrong taxiway
Aircraft missing a crossing restriction …
Outcomes
Reportable events
Incidents
Accidents

10. TEM – A Scenario
B737 & C550 (on non-standard route) on reciprocal tracks at FL 310, rate of closure in excess of 800 knots
When separated by 22 NM, ATCO (working two combined sectors) instructed both crews to alter heading and flight level
Horizontal radar separation standard of 5 NM was never infringed
Short-term conflict alert (STCA) activated
Vertical separation was established 25 seconds prior to the aircraft passing

11. TEM Analysis Threats C550 on non-standard route
Use of non-standard levels
ATCO managing two combined sectors
Errors
ATCO’s timing in recognising a potential conflict
Undesired State
From 09:56:55 till 09:59:55 the B737 & the C550 were
on opposite tracks at FL310 without separation provision

12. Undesired State Management
The controller was spending a significant period of coordination with another sector controller. At 09:59:55, he activated the “individual quick look” function for the flight plan tracks of both aircraft. He immediately commenced action to ensure a separation standard was maintained. He instructed the 737 to expedite descent to FL290 and instructed the Citation to turn right 30 degrees. At 10:00:15, he further instructed the 737 to turn right 20 degrees. He broadcast essential traffic information to the 737 about the position of the Citation. During that transmission, the STCA activated at 10:00:28. At 10:00:34, the controller told the pilot of the Citation to climb to FL320. At 10:00:57, a 2,000 ft vertical separation standard was established when the aircraft were approximately 9 NM apart.

13. TEM & NOSS – ATC SMS Tools
Voluntary Reporting
EDA
Direct observations