TEM as an Analytical Tool

1
TEM as an Analytical Tool

• Bert Ruitenberg
• Flight Safety and Human Factors ICAO
• First ICAO Global Symposium on TEM NOSS in ATC
• Luxembourg
• 9 10 November 2005

2
Presentation Overview

• The TEM Framework explained
• Definitions
• Examples
• TEM Case Study
• Ueberlingen mid-air collision
• Integrated Threat Analysis
• The Added Value of TEM

3
TEM Terminology for ATC

• Threats Events or errors that occur beyond the
  influence of the air traffic controller, increase
  operational complexity, and which must be managed
  to maintain the margins of safety
• Errors Actions or inactions by the air traffic
  controller that lead to deviations from
  organisational or controller intentions or
  expectations
• Undesired States operational conditions where an
  unintended traffic situation results in a
  reduction in margins of safety

4

• VFR traffic
• Military traffic
• Photo flights
• Banner towing
• Pilots

Threats (TWR)
Comsfailure/ sticking mike
Distraction
Runway crossings
Shift hand-over
Visitors
Weather
Near-identical call signs
Maintenance
Missed approaches
Airspace restrictions
Runway inspections
Busy traffic
System malfunctions
Unfamiliar crews
System design errors
Non-standard local procedures
5

• VFR traffic
• Unfamiliar crews
• Photo flights
• Parajumping
• Pilots

Threats (Radar)
Comsfailure/ sticking mike
Distraction
Military traffic
Shift hand-over
Visitors
Weather
Near-identical call signs
Maintenance
Differences in equipment (a/c)
Airspace restrictions
Busy traffic
Diversions
Co-ordination other sectors
System malfunctions
Non-standard procedures
System design errors
6
Error Categories

• Equipment handling error
• Making incorrect inputs to the automated system
  incorrect placement of strips
• Procedural error
• Wrong separation minimum applied (e.g. wake
  turbulence)
• Communication error
• Misinterpretation wrong information given

7
Undesired States

• Unique to monitoring normal operations
• Transient in nature exists for limited time
  only
• "When the traffic is not doing what you want it
  to do"
• An Undesired State is often the first indication
  to a controller that an earlier threat or error
  was not adequately managed

8
Undesired States - Examples

• On the ground
• Aircraft continuing taxiing when/where it should
  stop aircraft stopping when/where it should
  continue taxiing
• Aircraft entering a taxiway that it shouldnt
  use aircraft not entering a taxiway that it
  should use
• In the air
• Aircraft not turning when it should aircraft
  turning when it should not aircraft turning in
  direction other than planned
• Aircraft climbing/descending to another flight
  level/altitude than it should aircraft not
  climbing or descending to the flight
  level/altitude where it should

9
TEM Terminology - Example

• Wrong readback by pilot
• Climbing FL150
• Not detected by controller
• A/c climbing to other level than expected
• Loss of separation (?)

• Threat
• Error
• Undesired State
• Outcome

10
How it Works
Threats
Threat Management
Errors
Error Management
Undesired States
Undesired State Management
Outcome
11
Presentation Overview

• The TEM Framework explained
• Definitions
• Examples
• TEM Case Study
• Ueberlingen mid-air collision
• Integrated Threat Analysis
• The Added Value of TEM

12
Case Study Ueberlingen Mid-air

• July 1st 2002 Tupolev 154 and Boeing 757
• One aircraft descending to comply with ATC
  instruction
• One aircraft descending in response to TCAS
  Resolution Advisory
• Airspace delegated by Germany to Zürich ACC,
  Switzerland
• Maintenance on automated ATC system Zürich ACC
• Maintenance on voice communication system between
  Zürich ACC and other ATC facilities

13
Ueberlingen Threats

• No information to controller about scheduled
  maintenance
• Maintenance scheduled for multiple systems at the
  same time
• ATC system available in "degraded mode" only with
  reduced functionality
• No training provided for working with system in
  "degraded mode"
• Delayed and unexpected flight to regional airport
  had to be handled
• To handle the flight to the regional airport a
  second working position had to be opened
• Technical failure in back-up telephone system
  that had to be used to coordinate with the
  regional airport
• Single person nightshift culture
• Simultaneous and blocked R/T transmissions

If there had been no mid-air the same Threats
still would have existed
14
How it Works
Threats
Threat Management
Errors
Error Management
Undesired States
Undesired State Management
Outcome
15
Presentation Overview

• The TEM Framework explained
• Definitions
• Examples
• TEM Case Study
• Ueberlingen mid-air collision
• Integrated Threat Analysis
• The Added Value of TEM

16
TEM Aggregate Safety Analysis
Normal Ops Archie
Incidents STEADES
Accidents ADREP

• Integrated Threat Analysis (ITA) A Joint
  ICAO/IATA Project
• Case study TEM analysis Runway excursions
• 34 ADREP narratives
• 36 STEADES narratives

• The bridge between ADREP/STEADES Archie UAS

• Long landings
• Floated landings
• Off centre-line landings

• 164 LOSA narratives

17
Threats ITA
18
Environmental Threats ITA
19
Airline Threats ITA
20
Flight Crew Errors ITA
21
Safety Management Data, not Opinion

• Threat Scenarios
• ITA
• ATC
• Weather (heavy rain,TS, wind gusts, tailwind)
• Operational pressure
• A/C malfunctions, RTO
• Night operations
• Proficiency and procedural issues

• Threat scenarios Accidents incidents
• Weather (heavy rain, TS, wind gusts, tailwind)
• A/C malfunctions, RTO
• Night operations
• Proficiency issues

22
Conclusion

• Controllers, pilots and other aviation
  professionals have intuitively been familiar with
  Threats (and Errors, and Undesired States)
  throughout their careers the TEM framework
  provides a structured way to look at them
• The TEM framework adds a valuable dimension to
  the analysis of safety data