TEM as an Analytical ToolTEM as an Analytical Tool

Bert RuitenbergBert RuitenbergFlight Safety and Human Factors – ICAOFlight Safety and Human Factors – ICAO

First ICAO Global Symposium on TEM & NOSS in ATCFirst ICAO Global Symposium on TEM & NOSS in ATCLuxembourgLuxembourg

9 – 10 November 20059 – 10 November 2005

Presentation OverviewPresentation Overview

• The TEM Framework explained• Definitions• Examples

• TEM Case Study• Ueberlingen mid-air collision

• Integrated Threat Analysis• The Added Value of TEM

TEM Terminology for ATCTEM Terminology for ATC Threats: Events or errors that occur

beyond the influence of the air traffic controller, increase operational complexity, and which must be managed to maintain the margins of safety

Errors: Actions or inactions by the air traffic controller that lead to deviations from organisational or controller intentions or expectations

Undesired States: operational conditions where an unintended traffic situation results in a reduction in margins of safety

Threats (TWR)Threats (TWR)

WeatherWeather

MaintenanceMaintenance

AirspaceAirspacerestrictionsrestrictions

VisitorsVisitors

Runway crossingsRunway crossingsComsfailure/Comsfailure/sticking mikesticking mike

Shift Shift hand-hand-overoverNear-identicalNear-identical

callcall signssigns

Missed Missed approachesapproaches

Busy trafficBusy traffic

UnfamiliarUnfamiliar crewscrews

System designSystem designerrorserrors

Non-standardNon-standardlocal procedureslocal procedures

Runway Runway inspectioinspectionsnsSystemSystem

malfunctionsmalfunctions

DistractionDistraction

•VFR traffic

•Military traffic

•Photo flights

•Banner towing

•Pilots

Threats (Radar)Threats (Radar)

WeatherWeather

MaintenanceMaintenance

AirspaceAirspacerestrictionsrestrictions

VisitorsVisitors

Military trafficMilitary trafficComsfailure/Comsfailure/sticking mikesticking mike

Shift Shift hand-hand-overoverNear-identicalNear-identical

callcall signssigns

Differences Differences ininequipment equipment (a/c)(a/c)Busy trafficBusy traffic

Co-ordinationCo-ordinationother sectorsother sectors

System designSystem designerrorserrors

Non-standardNon-standardproceduresprocedures

DiversionDiversionssSystemSystem

malfunctionsmalfunctions

DistractionDistraction

•VFR traffic

•Unfamiliar crews

•Photo flights

•Parajumping

•Pilots

Error CategoriesError Categories

• Equipment handling error• Making incorrect inputs to the

automated system; incorrect placement of strips

• Procedural error• Wrong separation minimum applied

(e.g. wake turbulence)• Communication error

• Misinterpretation; wrong information given

Undesired StatesUndesired States

Unique to monitoring normal operations Transient in nature – exists for limited

time only "When the traffic is not doing what you

want it to do" An Undesired State is often the first

indication to a controller that an earlier threat or error was not adequately managed

Undesired States - ExamplesUndesired States - Examples

• On the ground:• Aircraft continuing taxiing when/where it should

stop; aircraft stopping when/where it should continue taxiing

• Aircraft entering a taxiway that it shouldn’t use; aircraft not entering a taxiway that it should use

• In the air:• Aircraft not turning when it should; aircraft turning

when it should not; aircraft turning in direction other than planned

• Aircraft climbing/descending to another flight level/altitude than it should; aircraft not climbing or descending to the flight level/altitude where it should

TEM Terminology - ExampleTEM Terminology - Example

Wrong readback by pilot• Climbing FL150

Not detected by controller

A/c climbing to other level than expected

Loss of separation (?)

Threat

Error

Undesired State

Outcome

How it WorksHow it WorksThreatsThreats

ErrorsErrors

Undesired StatesUndesired States

OutcomeOutcome

Threat ManagementThreat Management

Error ManagementError Management

Undesired StateUndesired StateManagementManagement

NOSSNOSSIndicesIndices

Presentation OverviewPresentation Overview

• The TEM Framework explained• Definitions• Examples

• TEM Case Study• Ueberlingen mid-air collision

• Integrated Threat Analysis• The Added Value of TEM

Case Study: Ueberlingen Mid-airCase Study: Ueberlingen Mid-air July 1st 2002; Tupolev 154 and Boeing

757 One aircraft descending to comply with

ATC instruction One aircraft descending in response to

TCAS Resolution Advisory Airspace delegated by Germany to

Zürich ACC, Switzerland Maintenance on automated ATC

system Zürich ACC Maintenance on voice communication

system between Zürich ACC and other ATC facilities

Ueberlingen ThreatsUeberlingen Threats No information to controller about scheduled

maintenance Maintenance scheduled for multiple systems at the

same time ATC system available in "degraded mode" only with

reduced functionality No training provided for working with system in

"degraded mode" Delayed and unexpected flight to regional airport had

to be handled To handle the flight to the regional airport a second

working position had to be opened Technical failure in back-up telephone system that had

to be used to coordinate with the regional airport Single person nightshift culture Simultaneous and blocked R/T transmissions

If there had been no mid-air

the same Threats still would have existed

How it WorksHow it WorksThreatsThreats

ErrorsErrors

Undesired StatesUndesired States

OutcomeOutcome

Threat ManagementThreat Management

Error ManagementError Management

Undesired StateUndesired StateManagementManagement

NOSSNOSSIndicesIndices

Presentation OverviewPresentation Overview

• The TEM Framework explained• Definitions• Examples

• TEM Case Study• Ueberlingen mid-air collision

• Integrated Threat Analysis• The Added Value of TEM

Normal Ops Normal Ops ArchieArchie

IncidentsIncidentsSTEADES STEADES

AccidentsAccidentsADREP ADREP

TEM – Aggregate Safety AnalysisTEM – Aggregate Safety Analysis

Integrated Threat Analysis (ITA) – A Joint ICAO/IATA ProjectIntegrated Threat Analysis (ITA) – A Joint ICAO/IATA ProjectCase study: TEM analysis – Runway excursions Case study: TEM analysis – Runway excursions

34 ADREP narratives34 ADREP narratives36 STEADES narratives36 STEADES narratives

Long landingsLong landings Floated landingsFloated landings Off centre-line landingsOff centre-line landings

The “bridge” between ADREP/STEADES & The “bridge” between ADREP/STEADES & ArchieArchie: UAS: UAS

164 LOSA narratives164 LOSA narratives

Threats – ITAThreats – ITA

25

67

20

85

58

17

13

15

0 20 40 60 80 100

Normal Operations

Incidents

Accidents

Environmental Threats – ITAEnvironmental Threats – ITA

60

5

5

21

69

5

35

5

42

30

5

18

0 20 40 60 80

WX

Airport

Terrain

Unfamiliarrunway

ATC

Normal operations

Incidents

Accidents

Airline Threats – ITAAirline Threats – ITA

25

80

20

26

75

74

0 20 40 60 80 100

A/Cmalfunction

Ferry flight

OPS pressure(airline)

Normal Operations

Incidents

Accidents

Flight Crew Errors – ITAFlight Crew Errors – ITA

6

72

11

61

32

7

94

17

0 20 40 60 80 100

Normal Operations

Incidents

Accidents

Safety Management: Data, not OpinionSafety Management: Data, not Opinion

Threat scenarios – Threat scenarios – Accidents & incidentsAccidents & incidents Weather (heavy rain, Weather (heavy rain,

TS, wind gusts, TS, wind gusts, tailwind)tailwind)

A/C malfunctions, A/C malfunctions, RTORTO

Night operationsNight operations Proficiency issuesProficiency issues

Threat Scenarios – Threat Scenarios – ITAITA ATCATC Weather (heavy Weather (heavy

rain,TS, rain,TS, wind gusts, wind gusts, tailwind)tailwind)

OperationalOperational pressurepressure A/C malfunctions, A/C malfunctions,

RTORTO Night operationsNight operations Proficiency Proficiency and and

proceduralprocedural issues issues

ConclusionConclusion

Controllers, pilots and other aviation professionals have intuitively been familiar with Threats (and Errors, and Undesired States) throughout their careers – the TEM framework provides a structured way to look at them

The TEM framework adds a valuable dimension to the analysis of safety data