Threat & Error Management Chapter 8

Aim To define the principles of T.E.M., identify the differences between Threats and Errors, and discuss methods of how these may be managed

Objectives State the principle of TEM Define Threats, Errors and Undesired Aircraft States (UAS) Discuss management of and mitigation of risks Assign further reading

1. T.E.M. What is T.E.M? In the past aviation accidents/incidents were considered to be the direct cause of Human Error Pilots involved in such incidents were generally ‘guilty’. Research now concludes that humans are not infallible Pilot error is quoted as a likely factor in over 75% of aircraft accidents/incidents

1. T.E.M. What is T.E.M? (cont.) TEM is the development of a mindset which promotes safe attitudes and actions, in order to help identify threats & minimize the likelihood of an accident occurring T.E.M addresses the threats (external) and errors (internal) that impact the safety of flight and how we manage them to avoid undesired aircraft states (UAS)

2. Threats, errors and undesired aircraft states What is a threat? Threats can come in a range of forms: External threats Internal threats Environmental threats Organizational threats Latent threats An event, situation, or hazard outside/external to the immediate operating environment, which, has potential to cause errors or impact negatively on safety

2. Threats, errors and undesired aircraft states External/Environmental Threats Threats originating from the operational environment Mismanagement of these can lead to errors being committed Eg: Distractions by crew Weather Heavy Traffic Missed approach Diversions System failures Terrain Night operations

2. Threats, errors and undesired aircraft states Internal Threats Threats originating from within the cockpit and influenced by the pilots personal performance Eg: Fatigue Lack of knowledge Language/cultural issues Cockpit authority gradient Proficiency

2. Threats, errors and undesired aircraft states Organisational Threats Threats originating from within organisational infrastructure Eg: Poor SOP’s Unsafe attitudes & culture Poor training/checking Incomplete documentation Poor maintenance Poor scheduling

2. Threats, errors and undesired aircraft states Latent Threats Similar to external threats, however are not immediately apparent until an incident has occurred Generally the result of reactive (rather than proactive) risk management Eg: Systemic organizational deficiencies Poor ergonomic design Poor runway layout/design

2. Threats, errors and undesired aircraft states Expected or Unexpected threats Threats can either be expected or unexpected Expected threats: General threats associated with the line of work (eg: weather) Identification requires a plan to follow Management is based upon differences in plans to best minimize errors Unexpected threats: Identification requires broad knowledge to predict ‘what may’ happen Relies heavily on transferable skills Reduced through use of procedures Eg, Aviate > Navigate > Communicate, checklists, SOP’s

An action or inaction which leads to deviation in expected performance 2. Threats, errors and undesired aircraft states What is an Error? Errors can occur in a range of forms: Handling errors Procedural errors Communication errors Proficiency errors Operation decision errors An action or inaction which leads to deviation in expected performance The result is a reduced margin of safety, which increases the chances of adverse events

2. Threats, errors and undesired aircraft states Classification of error Errors are actions which lead to deviations in performance/safety These can be intentional or unintentional deviations Errors in skill based behaviour due to failures of attention Errors in skill based behaviour due memory failures http://www.skybrary.aero/index.php/Human_Error_Types#Slips_and_Lapses SLIP/LAPSE: THE SUBJECT HAS THE RIGHT INTENTION & RIGHT SKILLS, BUT THE ORDER OF IT IS INCORRECT MISTAKE: THE SUBJECT EXECUTES A PLAN BUT THE BASE KNOWLEDGE IS INCORRECT TO BEGIN WITH Execution of a plan based on flawed knowledge/rule based behaviour Deviations from normal operations on purpose

2. Threats, errors and undesired aircraft states Classification of error (cont.) Examples of accidents due slips/lapses: Eastern Airlines flight 401 – Everglades crash due pilot inattention to Altitude Helios Air 522 – Hypoxia crash due incorrect pressurization setting Emirates EK407 – Near miss with terrain due pilot data input error Examples of accidents due mistakes: Air France flight 447 – stall over the Atlantic Ocean Colgan Air 3407 – mismanaged stall due handling errors Examples of accidents due violations: Tenerife Disaster – pilot purposely ignored order to hold position on runway

2. Threats, errors and undesired aircraft states Handling errors Errors which directly involve the handling or manipulation of an aircraft Generally the result of a lack of knowledge, and best reduced through continual practice/training With consistent practice, handling errors reduce with experience Eg: Misuse of autopilot Shutting down incorrect engine Failing to maintain altitude Poor landing techniques

2. Threats, errors and undesired aircraft states Procedural errors Errors induced from incorrect usage of procedures Applies to both experienced & inexperienced pilots Generally the result of external threats mismanaged, but not necessarily misunderstood (I.e. the intentions were good, but execution was flawed) Eg: Due to time constraint, the pilot flies a left hand circuit instead of a right hand as listed in ERSA Using the incorrect checklist from the task at hand Wrong usage of units in calculations

2. Threats, errors and undesired aircraft states Communication errors Errors which occur as a result of information being transferred incorrectly Ambiguous communication can also lead to procedural errors. Use of nonstandard phraseology Thick accents/cultural differences Poor radio quality Ambiguous questions/answers E.g. Air China 981 vs. JFK Airport ATC.

2. Threats, errors and undesired aircraft states Swiss Cheese model 1990 James Reason hypothesized accidents are not the result of a single error. Rather, accidents are caused through the break down of a system and can be traced to a number of errors – rather than a single event This is known as the “Swiss Cheese model” A system has a number of defence mechanisms in place (eg: reporting, safety vests, door locks, etc) As these defence mechanisms are breached, an accident will eventually occur ACCIDENT Errors committed

Should the UAS be uncorrected an accident will occur 2. Threats, errors and undesired aircraft states So what is an Undesired Aircraft State (UAS)? Responses to an UAS may be: Managed - The pilot identifies and remedy’s the threat Exacerbated - The pilot attempts to correct the situation but indirectly worsens it (a mistake) Response failure - The pilot fails to identify the threat and the situation follows through undetected E.g. Stalls, dives, flight into IMC, high nose on flare A mismanaged threat which leads to an error, and ultimately puts the aircraft in an unsafe state. Should the UAS be uncorrected an accident will occur

2. Threats, errors and undesired aircraft states Classification of UAS Ground UAS: Incorrect taxi way or aircraft positioning Collision with object on apron Aircraft UAS: Aircraft control Performance deviations Mishandling of aircraft Configuration UAS: Incorrect flap settings Incorrect approach speeds Incorrect weight & balance calculations

3. Mitigation of risks & UAS Responses Attention switching Should the error/hazard be managed? The situation may worsen before it gets better E.g. Carburettor icing Attention needs to be moved from management of the error to proper handling of the aircraft state. Management of the error may not be actively required I.e. Response to the threat should be in proportion to the risk!

3. Mitigation of risks & UAS Risk Management Probability vs Impact With an idea of the total risk, tasks can be prioritised E.g: Aviate Navigate Communicate! Example, there is a risk I may get hit with a propeller. consequence is high, however probability is low, why? Because I use my eyes as to manage it There is a risk that the traffic tonight will make me late for home consequence is minimal, yet probability is high. There is no mgt for this, yet it is acceptable risk

3. Mitigation of risks & UAS Identification of risks/threats Organizations/Pilot response to threats may be: Reactive Proactive PREDICTIVE T.E.M. effectiveness The best cure is prevention & anticipation!

3. Mitigation of risks & UAS Tools for management Standard Operating Procedures (SOP’s) (Rule based behaviour) Risk Analysis Identify all possible threats & errors Identify impact/severity of risk/error Implement and enforce procedures/steps to be followed Eg: Initial actions, trouble checks, Mix Up>Pitch Up>Power Up Rule based behaviour is enhanced through simulation Checklists should still be referenced regardless of proficiency

3. Mitigation of risks & UAS Tools for management (cont.) Identification & Reasoning (knowledge based behaviour) The pilot: Identifies the issue Recalls previous knowledge Decides based on the calculated risk Assesses decision and applies feedback => Limited by the quality of the pilots knowledge D – Define the problem E – Establish criteria & desired outcomes C – Consider all alternatives & options I – Identify the best alternative D – Develop a plan to implement, what must be done? E – Evaluate and monitor the effectiveness of the decision

3. Mitigation of risks & UAS Tools for management Situational Awareness (SA) “The ability to perceive all elements of ones environment, understand their significance, and interpret their status with the change of any given variable” Understanding what is happening around you at all times and the ability to predict what may happen given certain circumstances (Situational Awareness) E.g’s: CLEAROFFS checks Pre-flight & fuel planning Reporting systems & SOP’s Sound safety culture http://www.skybrary.aero/index.php/Situational_Awareness http://www.skybrary.aero/index.php/Category:Safety_Culture

4. Further reading Air accidents: Tenerife Disaster – Poor communication Everglades accident Flight 401 – Poor resource management Helios flight 522 – Hypoxia Alaska Air Flight 261- Maintenance issues w/ good CRM Atlantic Southeast Flight 528 – Poor aircraft design Air France flight 296 – Poor use of Automation Sioux City United 232 – Excellent example of CRM New Zealand Air Flight 901 – Erebus crash US Air Flight 1549 – ditching, excellent CRM Colgan Air Flight 3407 – Fatigue & poor SOP’s Articles: Heroic compensations – the human factor The search for resilience Human factors & stress

Questions?