Threat and Error Management

The University of Texas The University of Texas Threat and Error ManagementThreat and Error ManagementModel: Application to Accident Model: Application to Accident

and Incident Analysisand Incident Analysis

Robert L. Helmreich, PhDRobert L. Helmreich, PhDJames Klinect, MAJames Klinect, MA

John A. Wilhelm, MSJohn A. Wilhelm, MSMichelle Harper, MSMichelle Harper, MS

University of Texas University of Texas Human Factors Research ProjectHuman Factors Research ProjectThe University of Texas at AustinThe University of Texas at Austin

2

OverviewOverview

Introduction to the University of Texas Introduction to the University of Texas Threat and Error Management Model Threat and Error Management Model (UTTEMM)(UTTEMM) DefinitionsDefinitions Use of a modelUse of a model The model The model

Demonstration of UT-TEMM in accident Demonstration of UT-TEMM in accident analysisanalysis Air Ontario Flight 1363 at Dryden, OntarioAir Ontario Flight 1363 at Dryden, Ontario Avianca Flight 052 at New York, JFK Avianca Flight 052 at New York, JFK

Application to accident and incident Application to accident and incident analysisanalysis

3

The University of Texas Threat The University of Texas Threat and Error Management Model and Error Management Model

The model was derived empirically The model was derived empirically from observations of flight crew from observations of flight crew performance in normal line performance in normal line operationsoperations

Line Operations Safety Audit (LOSA)Line Operations Safety Audit (LOSA) UT-TEMM has three partsUT-TEMM has three parts

1.1. External threats and external errors and External threats and external errors and their managementtheir management

2.2. Crew errors and their managementCrew errors and their management3.3. Undesired aircraft states and their Undesired aircraft states and their

managementmanagement

4

UT-TEMMUT-TEMMTh re ats:

Late n t an d Ov e rt

Th re at M an ag e me n t

In co n se q ue n tial In cide n t / Accide n t

Erro rs

Erro r M an age me n t

Un de sire d AircraftState

Un de sire d AircraftState M an age me n t

5

Use of the ModelUse of the Model

Framework for analysis of data and Framework for analysis of data and application of empirical taxonomies inapplication of empirical taxonomies in

Line Operations Safety Audits (LOSA)Line Operations Safety Audits (LOSA) Analysis of incidents and accidentsAnalysis of incidents and accidents Training that stresses threat and error Training that stresses threat and error

management as a central focus of management as a central focus of Crew Resource Management (CRM 6Crew Resource Management (CRM 6thth generation)generation)

6

ThreatsThreats Definition: Overt and latent factors

external to the flight crew that originate outside a flight crew’s influence and must be actively managed to avoid becoming consequential to safetyThreats increase the complexity of the operational environment

7

External ThreatsExternal Threats ExpectedExpected

Forecast weatherForecast weather TerrainTerrain

UnexpectedUnexpected AbnormalsAbnormals TrafficTraffic

External errorExternal error Air Traffic Control errors Air Traffic Control errors Dispatch errorsDispatch errors

8

External Threat ExamplesExternal Threat Examples Adverse weatherAdverse weather TerrainTerrain TrafficTraffic Airport conditionsAirport conditions A/C malfunctionsA/C malfunctions Automation eventsAutomation events Communication eventsCommunication events

Operational time pressuresOperational time pressures Non-normal operationsNon-normal operations ATC commands / errorsATC commands / errors Cabin events / errorsCabin events / errors MX events / errorsMX events / errors Dispatch events / errorsDispatch events / errors Ground crew events / errorsGround crew events / errors

9

ErrorsErrors

Definition: deviations from crew crew or organizational intentions or or organizational intentions or expectationsexpectations

10

Global Flight Crew Error TypesGlobal Flight Crew Error TypesProcedural – Followed procedures but wrong execution

example) Wrong altitude setting dialed into the MCP

Communication – Missing information or misinterpretation within cockpit

example) Miscommunication by crew with ATC

Violation - Intentional non-compliance with required procedure

example) Performing a checklist from memory

Decision – Discretionary choice of action that unnecessarily increases risk

example) Unnecessary navigation through adverse weather

Proficiency – lack of skill or knowledge needed for activityexample) Inability to program FMS properly

11

Specific Error Categories:Specific Error Categories:LOSA Handbook - ICAO Doc 9803LOSA Handbook - ICAO Doc 9803

Aircraft handlingAircraft handling Flt path deviations, Flt path deviations,

speed, Wx speed, Wx penetrationpenetration

A/C systems and A/C systems and radio errorradio error

Automation useAutomation use ChecklistChecklist SOP cross-SOP cross-

verificationverification Other procedural Other procedural

deviationsdeviations

DocumentationDocumentation ATIS, Jeppesens, ATIS, Jeppesens,

clearances, etcclearances, etc External External

communicationcommunication Crew Crew

communicationcommunication DecisionDecision ViolationViolation

Latent ThreatsLatent Threats

13

Latent ThreatsLatent Threats

Factors not directly linked to Factors not directly linked to observable threat and error that observable threat and error that increase risk and the probability of increase risk and the probability of errorerror

Crew management of latent threats Crew management of latent threats is difficult because they are not is difficult because they are not immediately visibleimmediately visible

Latent threat identification is key to Latent threat identification is key to accident and incident analysisaccident and incident analysis

14

Latent Threat ExamplesLatent Threat Examples Inadequate management oversightInadequate management oversight Inadequate regulatory oversightInadequate regulatory oversight Flawed procedures Flawed procedures Organizational culture and climateOrganizational culture and climate Scheduling and rostering practicesScheduling and rostering practices Crew fatigueCrew fatigue Performance assessment practicesPerformance assessment practices Inadequate accident and incident Inadequate accident and incident

investigationinvestigation

Threat and Error Threat and Error Management and Management and

OutcomesOutcomes

16

Threat and Error Threat and Error ManagementManagement

InIn response to a threat or error crews can:response to a threat or error crews can: TrapTrap - - threat or error is detected and managed threat or error is detected and managed

before it becomes consequential before it becomes consequential ExacerbateExacerbate - - threat or error is detected and threat or error is detected and

the crew’s action makes it the crew’s action makes it consequentialconsequential Fail to RespondFail to Respond – no action to deal with a – no action to deal with a

threat or error (threat or error (undetected or ignoredundetected or ignored) ) Outcome may be Outcome may be inconsequential or consequential

17

Threat and Error OutcomesThreat and Error Outcomes InconsequentialInconsequential – the threat or error – the threat or error

has no operational effecthas no operational effect Additional errorAdditional error – the response leads – the response leads

to an additional error (error chain)to an additional error (error chain) Undesired Aircraft StateUndesired Aircraft State - deviation - deviation

from normal flight that compromises from normal flight that compromises safetysafety

18

Undesired Aircraft StateUndesired Aircraft State

• Lateral deviation

• Vertical deviation

• Speed too high

• Speed too low

• Incorrect aircraft configuration– Flight controls– Systems– Fuel– Automation

• Unstable approach

• Abrupt aircraft control

• Long landing – no go

around

• Firm landing

• Forced landing

• Wrong taxiway, ramp,

runway, country

• Runway incursion

A compromised situation placing the flight at increased risk

Accident ExamplesAccident Examples

Air Ontario 1363Air Ontario 1363

Avianca 52Avianca 52

Air Ontario Flight 1363Air Ontario Flight 136310 March 198910 March 1989

21

22

Dryden ScenarioDryden Scenario Air Ontario Flight 1363 took off from Air Ontario Flight 1363 took off from

Winnipeg, Manitoba on March 10, Winnipeg, Manitoba on March 10, 1989 It was a Fokker F-28 recently 1989 It was a Fokker F-28 recently bought from a Turkish airline. The bought from a Turkish airline. The aircraft had a number of mechanical aircraft had a number of mechanical problems problems

Weather was deteriorating and the Weather was deteriorating and the flight experienced delays due to de-flight experienced delays due to de-icing at Winnipeg icing at Winnipeg

23

Dryden Scenario - 2Dryden Scenario - 2

The flight went from Winnipeg to Dryden The flight went from Winnipeg to Dryden then on to Thunder Bay and back to Drydenthen on to Thunder Bay and back to Dryden

It experienced additional delays at Dryden, It experienced additional delays at Dryden, then took off, stalled and crashed in woods then took off, stalled and crashed in woods off the end of the runwayoff the end of the runway

The post-crash fire was so fierce that the The post-crash fire was so fierce that the voice and data recorders were destroyedvoice and data recorders were destroyed

24

InvestigationInvestigation Despite the relatively minor loss of life and Despite the relatively minor loss of life and

identified cause, the largest investigation identified cause, the largest investigation of an air crash to date was launched by a of an air crash to date was launched by a Commission of Inquiry, headed by a justice Commission of Inquiry, headed by a justice of the Supreme Courtof the Supreme Court Robert Helmreich was human factors Robert Helmreich was human factors

consultant to the commissionconsultant to the commission A four volume report investigating all A four volume report investigating all

aspects of the Canadian aviation system aspects of the Canadian aviation system resultedresulted This is not to imply that this level of This is not to imply that this level of

investigation is needed to apply the Threat and investigation is needed to apply the Threat and Error Management ModelError Management Model

25

External ThreatsExternal Threats Worsening weather – increasing snowfallWorsening weather – increasing snowfall

Possibly below minimumsPossibly below minimums Increased passenger loadIncreased passenger load

Need to offload fuelNeed to offload fuel Dispatch release with errorsDispatch release with errors Small plane lost above airport delaying take Small plane lost above airport delaying take

offoff Inoperative APU – no ground start abilityInoperative APU – no ground start ability CA and FO lack jet experience <100 hrsCA and FO lack jet experience <100 hrs Pax needsPax needs

MisconnectionsMisconnections No facilities at DrydenNo facilities at Dryden

26

Threat ManagementThreat Management

Inquiry about de-icing capabilities at Inquiry about de-icing capabilities at DrydenDryden

27

Crew ErrorsCrew Errors Fail to inspect wings for ice accumulationFail to inspect wings for ice accumulation Fail to de-ice after inquiry about Fail to de-ice after inquiry about

capabilitiescapabilities Taxi out in increasingly heavy snowfallTaxi out in increasingly heavy snowfall Fail to re-assess situation after delay for Fail to re-assess situation after delay for

lost small plane to landlost small plane to land Did not verify windshear reportDid not verify windshear report

28

Threat and Error Summary:Threat and Error Summary:DrydenDryden

1) Weather - icing1) Weather - icing

2) Pax Load 2) Pax Load increaseincrease

3) Dispatch errors3) Dispatch errors

4) Take-off delay4) Take-off delay

5) Inop APU5) Inop APU

6) Pax needs – no 6) Pax needs – no faciltitiesfaciltities

AskAsk

NN

NN

NN

NN

NN

1) No ice 1) No ice inspectioninspection

2) No de-icing 2) No de-icing

3) Taxi in 3) Taxi in increasing snowincreasing snow

4) No 4) No reassessment reassessment after delay on taxiafter delay on taxi

5) No verification 5) No verification of windshear of windshear reportreport

NN

NN

NN

NN

NN

1)Certification of 1)Certification of F28F28

2) No formal de-2) No formal de-icing requirementsicing requirements

3) No audit of ops3) No audit of ops

4) No 4) No manuals/MELmanuals/MEL

5) Inconsistent 5) Inconsistent trngtrng

6) Org pressure to 6) Org pressure to flyfly

7) Rostering - Lo 7) Rostering - Lo experience in typeexperience in type

7) Personal 7) Personal pressure to pressure to complete flightcomplete flight

Threats Mgt Errors Mgt Latent Threats

29

Undesired Aircraft States Undesired Aircraft States

Initial lift-off and bounce backInitial lift-off and bounce back Second lift-offSecond lift-off Un-recovered stall after second lift-offUn-recovered stall after second lift-off

UAS management – unsuccessfulUAS management – unsuccessful

Outcome - accidentOutcome - accident

30

Latent ThreatsLatent ThreatsRegulatorRegulator

Certification of design that allows cold soaking Certification of design that allows cold soaking of fuel (and icing of wing)of fuel (and icing of wing)

Failure to define de-icing requirementsFailure to define de-icing requirements Failure to audit jet program at Air OntarioFailure to audit jet program at Air Ontario

OrganizationOrganization No company manuals or MELNo company manuals or MEL Inconsistent training of pilots on F-28 aircraftInconsistent training of pilots on F-28 aircraft

At different airlines with different proceduresAt different airlines with different procedures

31

Latent Threats - 2Latent Threats - 2

Organizational pressure to fly with iceOrganizational pressure to fly with ice Chief pilot known as ‘The Iceman’Chief pilot known as ‘The Iceman’

Rostering practices – both pilots Rostering practices – both pilots inexperienced in F-28inexperienced in F-28

CrewCrew Lack of experience in typeLack of experience in type Personal pressure to complete flightPersonal pressure to complete flight

Captain scheduled to marry on arrivalCaptain scheduled to marry on arrival

32

ConclusionsConclusions

The root cause was the failure of the The root cause was the failure of the crew to de-ice before take off in crew to de-ice before take off in heavy snow.heavy snow.

A number of threats and errors A number of threats and errors contributed to this decision and contributed to this decision and actionaction

Avianca Flight 52Avianca Flight 5225 January, 199025 January, 1990

34

ScenarioScenario Avianca Flight 52, a B-707, was bound Avianca Flight 52, a B-707, was bound

from Medellin, Colombia to New York, from Medellin, Colombia to New York, JFK on 25 January, 1990JFK on 25 January, 1990

The flight experienced three extended The flight experienced three extended holding patterns due to bad weather holding patterns due to bad weather up the Atlantic coast and at JFKup the Atlantic coast and at JFK

The fuel state was becoming critical The fuel state was becoming critical by the end of the third holdby the end of the third hold

The Flight Engineer indirectly The Flight Engineer indirectly indicated crisis by pointing to Boeing indicated crisis by pointing to Boeing Manual instructions for flight with Manual instructions for flight with minimum fuelminimum fuel

35

Scenario - 2Scenario - 2

On the first approach to JFK the On the first approach to JFK the runway not seen at MDA and a runway not seen at MDA and a missed approach was executedmissed approach was executed

The crew accepted a lengthy vector The crew accepted a lengthy vector from ATC after the missed approachfrom ATC after the missed approach

The plane ran out of fuel and crashed The plane ran out of fuel and crashed on Long Island before beginning on Long Island before beginning another approach to JFKanother approach to JFK

Robert Helmreich participated in investigation of the accident Helmreich, R.L. Robert Helmreich participated in investigation of the accident Helmreich, R.L. (1994). Anatomy of a system accident: The crash of Avianca Flight 052. (1994). Anatomy of a system accident: The crash of Avianca Flight 052. International Journal of Aviation Psychology 4International Journal of Aviation Psychology 4(3), 265-284. (3), 265-284.

36

Avianca Flight 52Avianca Flight 52

37

External ThreatsExternal Threats Autopilot not working, requiring hand Autopilot not working, requiring hand

flying throughout flightflying throughout flight Weather poor along East Coast of USWeather poor along East Coast of US Conditions at JFK marginalConditions at JFK marginal Increasing delays due to ATC Increasing delays due to ATC

congestion congestion Multiple holding patterns along East Multiple holding patterns along East

CoastCoast

38

Flight Crew ErrorsFlight Crew Errors

Crew did not update weather after Crew did not update weather after entering U.S. airspace entering U.S. airspace

Crew did not alert captain to growing Crew did not alert captain to growing fuel emergencyfuel emergency

Crew did not declare emergency Crew did not declare emergency when fuel state became critical when fuel state became critical

Crew did not respond to Ground Crew did not respond to Ground Proximity Warning System (17 alerts)Proximity Warning System (17 alerts)

39

Errors - 2Errors - 2

Crew accepted delay after Crew accepted delay after executing missed approach executing missed approach (vector to end of Long Island)(vector to end of Long Island)

Cabin was not informed of fuel Cabin was not informed of fuel crisis and prepared for crisis and prepared for emergency landingemergency landing

40

Undesired Aircraft StatesUndesired Aircraft States

Critical fuel stateCritical fuel state Fuel exhaustionFuel exhaustion UAS management – unsuccessfulUAS management – unsuccessful

Outcome - crashOutcome - crash

41

42

Threat and Error Summary:Threat and Error Summary:AviancaAvianca

1) Autopilot inop1) Autopilot inop

2) Weather East 2) Weather East CoastCoast

3) Increasing delays 3) Increasing delays from ATCfrom ATC

4) Conditions 4) Conditions marginal at JFKmarginal at JFK

NN

NN

NN

NN

1) No update of 1) No update of available wxavailable wx

2) Fail to inform 2) Fail to inform CA of fuel crisisCA of fuel crisis

3) Fail to declare 3) Fail to declare emergencyemergency

4) Fail to respond 4) Fail to respond to GPWSto GPWS

5) Accept long 5) Accept long vector after vector after missed appmissed app

6) Fail to inform 6) Fail to inform and prepare cabinand prepare cabin

NN

NN

NN

NN

NN

NN

1) National culture1) National culture

2) Language 2) Language w/ATCw/ATC

3) ATC unaware of 3) ATC unaware of cultural issuescultural issues

4) Inadequate co 4) Inadequate co dispatch and dispatch and wxwx

5) Poor 5) Poor maintenancemaintenance

6) Lack of GPWS 6) Lack of GPWS trainingtraining

7) Inadequate CRM 7) Inadequate CRM trainingtraining

8) Fatigue8) Fatigue

Threats Mgt Errors Mgt Latent Threats

43

Avianca Latent ThreatsAvianca Latent Threats

National cultureNational culture Power distance impedes communication Power distance impedes communication

with captain and ATCwith captain and ATC Language difficulties (understanding Language difficulties (understanding

ATC)ATC) SystemSystem

ATC unawareness of cultural issues ATC unawareness of cultural issues regarding clearancesregarding clearances

44

Latent Threats - 2Latent Threats - 2 Organizational Organizational

Inadequate dispatch and weather serviceInadequate dispatch and weather service Inadequate maintenance of aircraft (autopilot Inadequate maintenance of aircraft (autopilot

inoperative)inoperative) Lack of training in GPWSLack of training in GPWS CRM course taken from US training CRM course taken from US training

organizationorganization Without permission or modification for organizationWithout permission or modification for organization

Professional cultureProfessional culture Denial of fatigueDenial of fatigue

45

Culture as Latent ThreatCulture as Latent ThreatJunior crew were fully aware of fuel Junior crew were fully aware of fuel

emergency but did not communicate emergency but did not communicate concerns to captainconcerns to captain Read from Boeing manual about low fuel Read from Boeing manual about low fuel

procedure (pitch angle during missed approach)lprocedure (pitch angle during missed approach)l Made non-verbal signal to Steward (cutting Made non-verbal signal to Steward (cutting

throat) when asked about statusthroat) when asked about status

Crew did not communicate status directly to Crew did not communicate status directly to ATCATC General communication about fuelGeneral communication about fuel Accepted lengthy vector and return after missed Accepted lengthy vector and return after missed

approachapproach

Using the Model in Using the Model in AnalysisAnalysis

47

UT-TEMMUT-TEMMTh re ats:

Late n t an d Ov e rt

Th re at M an ag e me n t

In co n se q ue n tial In cide n t / Accide n t

Erro rs

Erro r M an age me n t

Un de sire d AircraftState

Un de sire d AircraftState M an age me n t

48

Using the ModelUsing the Model

Identify overt threats and errorsIdentify overt threats and errors Including operational contextIncluding operational context

Identify crew errorsIdentify crew errors Identify Undesired Aircraft StatesIdentify Undesired Aircraft States Identify crew threat, error and undesired Identify crew threat, error and undesired

aircraft state management behaviorsaircraft state management behaviors CRM deficiencies CRM deficiencies

Identify latent threatsIdentify latent threats Specify corrective actionsSpecify corrective actions

49

Threat CategoriesThreat Categories Adverse weatherAdverse weather Operational environmentOperational environment

Traffic-TCAS-communicationTraffic-TCAS-communication ATCATC

Clearances, error, languageClearances, error, language CabinCabin

Distraction, pax behaviorDistraction, pax behavior Procedures/Procedures/

documentationdocumentation Policy guidelines, navigation Policy guidelines, navigation

databases, etcdatabases, etc

Aircraft malfunctionAircraft malfunction MEL, automation, MEL, automation,

displaysdisplays Ground maintenanceGround maintenance

ErrorError Ramp operationsRamp operations

Ground handling, errorGround handling, error DispatchDispatch

ErrorError PaperworkPaperwork

50

Global Error CategoriesGlobal Error Categories

ProceduralProcedural CommunicationCommunication Intentional non-compliance/violationIntentional non-compliance/violation DecisionDecision ProficiencyProficiency

51

Specific Error CategoriesSpecific Error Categories

Aircraft handlingAircraft handling Flt path deviations, Flt path deviations,

speed, Wx penetrationspeed, Wx penetration A/C systems and radio A/C systems and radio

errorerror Automation useAutomation use ChecklistChecklist SOP cross-verificationSOP cross-verification Other procedural Other procedural

deviationsdeviations

DocumentationDocumentation ATIS, Jeppesens, ATIS, Jeppesens,

clearances, etcclearances, etc External External

communicationcommunication Crew communicationCrew communication DecisionDecision ProficiencyProficiency ViolationViolation

Intentional non-Intentional non-compliancecompliance

52

Error Management Error Management OutcomesOutcomes

Mitigated – error inconsequentialMitigated – error inconsequential Not recognized or no responseNot recognized or no response Additional Error – error chainAdditional Error – error chain

53

Threat and Error Summary:Threat and Error Summary:

1)1) 1)1) 1)1)

Threats Mgt Errors Mgt Latent Threats

1)1)

Undesired Aircraft State Mgt Outcome

54

Identify Latent ThreatsIdentify Latent Threats

Using empirical threats and errors, Using empirical threats and errors, organizational factors, identify latent organizational factors, identify latent threats in the operating environmentthreats in the operating environment

55

Identify Corrective ActionsIdentify Corrective Actions

Specify immediate and long term Specify immediate and long term actions to prevent recurrence of actions to prevent recurrence of event or accident (Targets for event or accident (Targets for improvement in LOSA)improvement in LOSA)

The University of Texas The University of Texas Human Factors Research ProjectHuman Factors Research Project

www.psy.utexas.edu/HumanFactors