1. TEM as an Analytical Tool
Bert Ruitenberg
Flight Safety and Human Factors – ICAO
First ICAO Global Symposium on TEM & NOSS in ATC
Luxembourg
9 – 10 November 2005 1 1 1

2. Presentation Overview
The TEM Framework explained
Definitions
Examples
TEM Case Study
Ueberlingen mid-air collision
Integrated Threat Analysis
The Added Value of TEM

3. TEM Terminology for ATC
Threats: Events or errors that occur beyond the influence of the air traffic controller, increase operational complexity, and which must be managed to maintain the margins of safety
Errors: Actions or inactions by the air traffic controller that lead to deviations from organisational or controller intentions or expectations
Undesired States: operational conditions where an unintended traffic situation results in a reduction in margins of safety

4. Threats (TWR) Comsfailure/ sticking mike Distraction Runway crossings
VFR traffic
Military traffic
Photo flights
Banner towing
Pilots
Threats (TWR)
Comsfailure/
sticking mike
Distraction
Runway crossings
Shift hand-over
Visitors
Weather
Near-identical
call signs
Maintenance
Missed approaches
Airspace
restrictions
Runway inspections
Busy traffic
System
malfunctions
Unfamiliar crews
System design
errors
Non-standard
local procedures

5. Threats (Radar) Comsfailure/ sticking mike Distraction
VFR traffic
Unfamiliar crews
Photo flights
Parajumping
Pilots
Threats (Radar)
Comsfailure/
sticking mike
Distraction
Military traffic
Shift hand-over
Visitors
Weather
Near-identical
call signs
Maintenance
Differences in
equipment (a/c)
Airspace
restrictions
Busy traffic
Diversions
Co-ordination
other sectors
System
malfunctions
Non-standard
procedures
System design
errors

6. Error Categories Equipment handling error Procedural error
Making incorrect inputs to the automated system; incorrect placement of strips
Procedural error
Wrong separation minimum applied (e.g. wake turbulence)
Communication error
Misinterpretation; wrong information given

7. Undesired States Unique to monitoring normal operations
Transient in nature – exists for limited time only
"When the traffic is not doing what you want it to do"
An Undesired State is often the first indication to a controller that an earlier threat or error was not adequately managed

8. Undesired States - Examples
On the ground:
Aircraft continuing taxiing when/where it should stop; aircraft stopping when/where it should continue taxiing
Aircraft entering a taxiway that it shouldn’t use; aircraft not entering a taxiway that it should use
In the air:
Aircraft not turning when it should; aircraft turning when it should not; aircraft turning in direction other than planned
Aircraft climbing/descending to another flight level/altitude than it should; aircraft not climbing or descending to the flight level/altitude where it should

9. TEM Terminology - Example
Wrong readback by pilot
Climbing FL150
Not detected by controller
A/c climbing to other level than expected
Loss of separation (?)
Threat
Error
Undesired State
Outcome

10. How it Works Threat Management NOSS Indices Threats Errors
Error Management
Undesired States
Show and discuss model
Can use your own pre-drawn if you want.
Can show OAK departure video clip
Note: Reword tower clearance to “Change departure to the Oakland 5” (So clip will work!)
Can talk about it as a Umbrella or shield. Use an example or story to show how this works (How we saw people use it)
Undesired State
Management
Outcome

11. Presentation Overview
The TEM Framework explained
Definitions
Examples
TEM Case Study
Ueberlingen mid-air collision
Integrated Threat Analysis
The Added Value of TEM

12. Case Study: Ueberlingen Mid-air
July 1st 2002; Tupolev 154 and Boeing 757
One aircraft descending to comply with ATC instruction
One aircraft descending in response to TCAS Resolution Advisory
Airspace delegated by Germany to Zürich ACC, Switzerland
Maintenance on automated ATC system Zürich ACC
Maintenance on voice communication system between Zürich ACC and other ATC facilities

13. Ueberlingen Threats
No information to controller about scheduled maintenance
Maintenance scheduled for multiple systems at the same time
ATC system available in "degraded mode" only with reduced functionality
No training provided for working with system in "degraded mode"
Delayed and unexpected flight to regional airport had to be handled
To handle the flight to the regional airport a second working position had to be opened
Technical failure in back-up telephone system that had to be used to coordinate with the regional airport
Single person nightshift culture
Simultaneous and blocked R/T transmissions
If there had been no mid-air
the same Threats still would have existed

14. How it Works Threat Management NOSS Indices Threats Errors
Error Management
Undesired States
Show and discuss model
Can use your own pre-drawn if you want.
Can show OAK departure video clip
Note: Reword tower clearance to “Change departure to the Oakland 5” (So clip will work!)
Can talk about it as a Umbrella or shield. Use an example or story to show how this works (How we saw people use it)
Undesired State
Management
Outcome

15. Presentation Overview
The TEM Framework explained
Definitions
Examples
TEM Case Study
Ueberlingen mid-air collision
Integrated Threat Analysis
The Added Value of TEM

16. TEM – Aggregate Safety Analysis
Accidents
ADREP
Incidents
STEADES
Normal Ops
Archie
Integrated Threat Analysis (ITA) – A Joint ICAO/IATA Project
Case study: TEM analysis – Runway excursions
34 ADREP narratives
36 STEADES narratives
The “bridge” between ADREP/STEADES & Archie: UAS
Long landings
Floated landings
Off centre-line landings
164 LOSA narratives

17. Threats – ITA

18. Environmental Threats – ITA

19. Airline Threats – ITA

20. Flight Crew Errors – ITA

21. Safety Management: Data, not Opinion
Threat Scenarios –
ITA
ATC
Weather (heavy rain,TS, wind gusts, tailwind)
Operational pressure
A/C malfunctions, RTO
Night operations
Proficiency and procedural issues
Threat scenarios – Accidents & incidents
Weather (heavy rain, TS, wind gusts, tailwind)
A/C malfunctions, RTO
Night operations
Proficiency issues

22. Conclusion
Controllers, pilots and other aviation professionals have intuitively been familiar with Threats (and Errors, and Undesired States) throughout their careers – the TEM framework provides a structured way to look at them
The TEM framework adds a valuable dimension to the analysis of safety data