TEM as an Analytical Tool Bert Ruitenberg Flight Safety and Human Factors – ICAO First ICAO Global Symposium on TEM & NOSS in ATC Luxembourg 9 – 10 November 2005 1 1 1

Presentation Overview The TEM Framework explained Definitions Examples TEM Case Study Ueberlingen mid-air collision Integrated Threat Analysis The Added Value of TEM

TEM Terminology for ATC Threats: Events or errors that occur beyond the influence of the air traffic controller, increase operational complexity, and which must be managed to maintain the margins of safety Errors: Actions or inactions by the air traffic controller that lead to deviations from organisational or controller intentions or expectations Undesired States: operational conditions where an unintended traffic situation results in a reduction in margins of safety

Threats (TWR) Comsfailure/ sticking mike Distraction Runway crossings VFR traffic Military traffic Photo flights Banner towing Pilots Threats (TWR) Comsfailure/ sticking mike Distraction Runway crossings Shift hand-over Visitors Weather Near-identical call signs Maintenance Missed approaches Airspace restrictions Runway inspections Busy traffic System malfunctions Unfamiliar crews System design errors Non-standard local procedures

Threats (Radar) Comsfailure/ sticking mike Distraction VFR traffic Unfamiliar crews Photo flights Parajumping Pilots Threats (Radar) Comsfailure/ sticking mike Distraction Military traffic Shift hand-over Visitors Weather Near-identical call signs Maintenance Differences in equipment (a/c) Airspace restrictions Busy traffic Diversions Co-ordination other sectors System malfunctions Non-standard procedures System design errors

Error Categories Equipment handling error Procedural error Making incorrect inputs to the automated system; incorrect placement of strips Procedural error Wrong separation minimum applied (e.g. wake turbulence) Communication error Misinterpretation; wrong information given

Undesired States Unique to monitoring normal operations Transient in nature – exists for limited time only "When the traffic is not doing what you want it to do" An Undesired State is often the first indication to a controller that an earlier threat or error was not adequately managed

Undesired States - Examples On the ground: Aircraft continuing taxiing when/where it should stop; aircraft stopping when/where it should continue taxiing Aircraft entering a taxiway that it shouldn’t use; aircraft not entering a taxiway that it should use In the air: Aircraft not turning when it should; aircraft turning when it should not; aircraft turning in direction other than planned Aircraft climbing/descending to another flight level/altitude than it should; aircraft not climbing or descending to the flight level/altitude where it should

TEM Terminology - Example Wrong readback by pilot Climbing FL150 Not detected by controller A/c climbing to other level than expected Loss of separation (?) Threat Error Undesired State Outcome

How it Works Threat Management NOSS Indices Threats Errors Error Management Undesired States Show and discuss model Can use your own pre-drawn if you want. Can show OAK departure video clip Note: Reword tower clearance to “Change departure to the Oakland 5” (So clip will work!) Can talk about it as a Umbrella or shield. Use an example or story to show how this works (How we saw people use it) Undesired State Management Outcome

Presentation Overview The TEM Framework explained Definitions Examples TEM Case Study Ueberlingen mid-air collision Integrated Threat Analysis The Added Value of TEM

Case Study: Ueberlingen Mid-air July 1st 2002; Tupolev 154 and Boeing 757 One aircraft descending to comply with ATC instruction One aircraft descending in response to TCAS Resolution Advisory Airspace delegated by Germany to Zürich ACC, Switzerland Maintenance on automated ATC system Zürich ACC Maintenance on voice communication system between Zürich ACC and other ATC facilities

Ueberlingen Threats No information to controller about scheduled maintenance Maintenance scheduled for multiple systems at the same time ATC system available in "degraded mode" only with reduced functionality No training provided for working with system in "degraded mode" Delayed and unexpected flight to regional airport had to be handled To handle the flight to the regional airport a second working position had to be opened Technical failure in back-up telephone system that had to be used to coordinate with the regional airport Single person nightshift culture Simultaneous and blocked R/T transmissions If there had been no mid-air the same Threats still would have existed

How it Works Threat Management NOSS Indices Threats Errors Error Management Undesired States Show and discuss model Can use your own pre-drawn if you want. Can show OAK departure video clip Note: Reword tower clearance to “Change departure to the Oakland 5” (So clip will work!) Can talk about it as a Umbrella or shield. Use an example or story to show how this works (How we saw people use it) Undesired State Management Outcome

Presentation Overview The TEM Framework explained Definitions Examples TEM Case Study Ueberlingen mid-air collision Integrated Threat Analysis The Added Value of TEM

TEM – Aggregate Safety Analysis Accidents ADREP Incidents STEADES Normal Ops Archie Integrated Threat Analysis (ITA) – A Joint ICAO/IATA Project Case study: TEM analysis – Runway excursions 34 ADREP narratives 36 STEADES narratives The “bridge” between ADREP/STEADES & Archie: UAS Long landings Floated landings Off centre-line landings 164 LOSA narratives

Threats – ITA

Environmental Threats – ITA

Airline Threats – ITA

Flight Crew Errors – ITA

Safety Management: Data, not Opinion Threat Scenarios – ITA ATC Weather (heavy rain,TS, wind gusts, tailwind) Operational pressure A/C malfunctions, RTO Night operations Proficiency and procedural issues Threat scenarios – Accidents & incidents Weather (heavy rain, TS, wind gusts, tailwind) A/C malfunctions, RTO Night operations Proficiency issues

Conclusion Controllers, pilots and other aviation professionals have intuitively been familiar with Threats (and Errors, and Undesired States) throughout their careers – the TEM framework provides a structured way to look at them The TEM framework adds a valuable dimension to the analysis of safety data