Threat and Error Management & Normal Operations Safety Survey: The Perspective of ICAO Captain Dan Maurino Flight Safety and Human Factors – ICAO Second ICAO Global Symposium on TEM & NOSS in ATC Washington, DC 7 – 8 February 2007 1 1 1

Learning from Failure & Success System design Baseline performance Operational deployment Operational performance Operational drift

Capturing the Drift Reactive systems Accident investigation Incident investigation Predictive systems Electronic safety data acquisition systems Direct observation safety data acquisition systems Proactive systems Mandatory reporting systems Voluntary self-reporting systems Confidential reporting systems

Safety Data Systems and Levels of Intervention Safety management levels H i g h M d l e L o w Baseline performance “Practical drift” Operational performance organization Hazards Reactive Predictive Proactive Reactive FDA Direct observation systems ASR Surveys Audits ASR MOR Accident and incident reports Highly efficient Very efficient Efficient Insufficient Desirable management level

NOSS & TEM – Predictive Safety Management NOSS = Tool – How we collect what we look for TEM = Framework – What we look for Hazards in operational contexts – Threats Potential risk (s) – Operational Errors Result (s) of hazards and risk (s) – Undesired States

A Day at the Office NOSS Indexes To achieve company’s both safety and production goals, air traffic controllers daily must Manage operational complexity 1 Threat Management NOSS Indexes Manage their own errors 2 Error Management Undesired States Management 3 Manage deviations

Threats Events or errors that occur beyond the influence of the ATCO, increase operational complexity, and which must be managed to maintain the margins of safety Similar call signs Reduced separation minima Airspace restrictions Runway crossings System malfunctions Missed approaches Communication failure Runway inspections LAHSO Noise restrictions Weather SIRO Heavy traffic Airspace reclassification

Errors Actions or inactions by the ATCO that lead to deviations from organizational or ATCO expectations Equipment handling errors – incorrect interactions with the equipment e.g. selecting an inappropriate radar source; making incorrect inputs to an automated system Procedural errors – deficiencies in execution e.g. wrong separation minima applied; leaving the position before replacement is ready to take over Communication errors – deficiencies in the exchange of operational information e.g. missed calls; misinterpretation of a request

Undesired States Operational conditions where an unintended traffic situation results in a reduction of safety margins Aircraft climbing to a wrong altitude Aircraft turning in the wrong direction Aircraft enters a wrong taxiway Aircraft missing a crossing restriction … Outcomes Reportable events Incidents Accidents

TEM – A Scenario B737 & C550 (on non-standard route) on reciprocal tracks at FL 310, rate of closure in excess of 800 knots When separated by 22 NM, ATCO (working two combined sectors) instructed both crews to alter heading and flight level Horizontal radar separation standard of 5 NM was never infringed Short-term conflict alert (STCA) activated Vertical separation was established 25 seconds prior to the aircraft passing

TEM Analysis Threats C550 on non-standard route Use of non-standard levels ATCO managing two combined sectors Errors ATCO’s timing in recognising a potential conflict Undesired State From 09:56:55 till 09:59:55 the B737 & the C550 were on opposite tracks at FL310 without separation provision

Undesired State Management The controller was spending a significant period of coordination with another sector controller. At 09:59:55, he activated the “individual quick look” function for the flight plan tracks of both aircraft. He immediately commenced action to ensure a separation standard was maintained. He instructed the 737 to expedite descent to FL290 and instructed the Citation to turn right 30 degrees. At 10:00:15, he further instructed the 737 to turn right 20 degrees. He broadcast essential traffic information to the 737 about the position of the Citation. During that transmission, the STCA activated at 10:00:28. At 10:00:34, the controller told the pilot of the Citation to climb to FL320. At 10:00:57, a 2,000 ft vertical separation standard was established when the aircraft were approximately 9 NM apart.

TEM & NOSS – ATC SMS Tools Voluntary Reporting EDA Direct observations