The University of Texas Threat and Error Management Model: Application to Accident and Incident Anal - PowerPoint PPT Presentation

1 / 56
About This Presentation
Title:

The University of Texas Threat and Error Management Model: Application to Accident and Incident Anal

Description:

Air Ontario Flight 1363 took off from Winnipeg, Manitoba on March 10, ... Weather was deteriorating and the flight experienced delays due to de-icing at Winnipeg ... – PowerPoint PPT presentation

Number of Views:688
Avg rating:3.0/5.0
Slides: 57
Provided by: Helmr
Category:

less

Transcript and Presenter's Notes

Title: The University of Texas Threat and Error Management Model: Application to Accident and Incident Anal


1
The University of Texas Threat and Error
ManagementModel Application to Accident and
Incident Analysis
  • Robert L. Helmreich, PhD
  • James Klinect, MA
  • John A. Wilhelm, MS
  • Michelle Harper, MS
  • University of Texas
  • Human Factors Research Project
  • The University of Texas at Austin

2
Overview
  • Introduction to the University of Texas Threat
    and Error Management Model (UTTEMM)
  • Definitions
  • Use of a model
  • The model
  • Demonstration of UT-TEMM in accident analysis
  • Air Ontario Flight 1363 at Dryden, Ontario
  • Avianca Flight 052 at New York, JFK
  • Application to accident and incident analysis

3
The University of Texas Threat and Error
Management Model
  • The model was derived empirically from
    observations of flight crew performance in normal
    line operations
  • Line Operations Safety Audit (LOSA)
  • UT-TEMM has three parts
  • External threats and external errors and their
    management
  • Crew errors and their management
  • Undesired aircraft states and their management

4
UT-TEMM
5
Use of the Model
  • Framework for analysis of data and application of
    empirical taxonomies in
  • Line Operations Safety Audits (LOSA)
  • Analysis of incidents and accidents
  • Training that stresses threat and error
    management as a central focus of Crew Resource
    Management (CRM 6th generation)

6
Threats
  • Definition Overt and latent factors external to
    the flight crew that originate outside a flight
    crews influence and must be actively managed to
    avoid becoming consequential to safety
  • Threats increase the complexity of the
    operational environment

7
External Threats
  • Expected
  • Forecast weather
  • Terrain
  • Unexpected
  • Abnormals
  • Traffic
  • External error
  • Air Traffic Control errors
  • Dispatch errors

8
External Threat Examples
  • Adverse weather
  • Terrain
  • Traffic
  • Airport conditions
  • A/C malfunctions
  • Automation events
  • Communication events
  • Operational time pressures
  • Non-normal operations
  • ATC commands / errors
  • Cabin events / errors
  • MX events / errors
  • Dispatch events / errors
  • Ground crew events / errors

9
Errors
  • Definition deviations from crew or
    organizational intentions or expectations

10
Global Flight Crew Error Types
  • Procedural Followed procedures but wrong
    execution
  • example) Wrong altitude setting dialed into the
    MCP
  • Communication Missing information or
    misinterpretation within cockpit
  • example) Miscommunication by crew with ATC
  • Violation - Intentional non-compliance with
    required procedure
  • example) Performing a checklist from memory
  • Decision Discretionary choice of action that
    unnecessarily increases risk
  • example) Unnecessary navigation through adverse
    weather
  • Proficiency lack of skill or knowledge needed
    for activity
  • example) Inability to program FMS properly

11
Specific Error CategoriesLOSA Handbook - ICAO
Doc 9803
  • Aircraft handling
  • Flt path deviations, speed, Wx penetration
  • A/C systems and radio error
  • Automation use
  • Checklist
  • SOP cross-verification
  • Other procedural deviations
  • Documentation
  • ATIS, Jeppesens, clearances, etc
  • External communication
  • Crew communication
  • Decision
  • Violation

12
Latent Threats
13
Latent Threats
  • Factors not directly linked to observable threat
    and error that increase risk and the probability
    of error
  • Crew management of latent threats is difficult
    because they are not immediately visible
  • Latent threat identification is key to accident
    and incident analysis

14
Latent Threat Examples
  • Inadequate management oversight
  • Inadequate regulatory oversight
  • Flawed procedures
  • Organizational culture and climate
  • Scheduling and rostering practices
  • Crew fatigue
  • Performance assessment practices
  • Inadequate accident and incident investigation

15
Threat and Error Management and Outcomes
16
Threat and Error Management
  • In response to a threat or error crews can
  • Trap - threat or error is detected and managed
    before it becomes consequential
  • Exacerbate - threat or error is detected and the
    crews action makes it consequential
  • Fail to Respond no action to deal with a threat
    or error (undetected or ignored)
  • Outcome may be inconsequential or consequential

17
Threat and Error Outcomes
  • Inconsequential the threat or error has no
    operational effect
  • Additional error the response leads to an
    additional error (error chain)
  • Undesired Aircraft State - deviation from normal
    flight that compromises safety

18
Undesired Aircraft State
A compromised situation placing the flight at
increased risk
  • Unstable approach
  • Abrupt aircraft control
  • Long landing no go around
  • Firm landing
  • Forced landing
  • Wrong taxiway, ramp, runway, country
  • Runway incursion
  • Lateral deviation
  • Vertical deviation
  • Speed too high
  • Speed too low
  • Incorrect aircraft configuration
  • Flight controls
  • Systems
  • Fuel
  • Automation

19
Accident Examples
  • Air Ontario 1363
  • Avianca 52

20
Air Ontario Flight 136310 March 1989
21
(No Transcript)
22
Dryden Scenario
  • Air Ontario Flight 1363 took off from Winnipeg,
    Manitoba on March 10, 1989 It was a Fokker F-28
    recently bought from a Turkish airline. The
    aircraft had a number of mechanical problems
  • Weather was deteriorating and the flight
    experienced delays due to de-icing at Winnipeg

23
Dryden Scenario - 2
  • The flight went from Winnipeg to Dryden then on
    to Thunder Bay and back to Dryden
  • It experienced additional delays at Dryden, then
    took off, stalled and crashed in woods off the
    end of the runway
  • The post-crash fire was so fierce that the voice
    and data recorders were destroyed

24
Investigation
  • Despite the relatively minor loss of life and
    identified cause, the largest investigation of an
    air crash to date was launched by a Commission of
    Inquiry, headed by a justice of the Supreme Court
  • Robert Helmreich was human factors consultant to
    the commission
  • A four volume report investigating all aspects of
    the Canadian aviation system resulted
  • This is not to imply that this level of
    investigation is needed to apply the Threat and
    Error Management Model

25
External Threats
  • Worsening weather increasing snowfall
  • Possibly below minimums
  • Increased passenger load
  • Need to offload fuel
  • Dispatch release with errors
  • Small plane lost above airport delaying take off
  • Inoperative APU no ground start ability
  • CA and FO lack jet experience lt100 hrs
  • Pax needs
  • Misconnections
  • No facilities at Dryden

26
Threat Management
  • Inquiry about de-icing capabilities at Dryden

27
Crew Errors
  • Fail to inspect wings for ice accumulation
  • Fail to de-ice after inquiry about capabilities
  • Taxi out in increasingly heavy snowfall
  • Fail to re-assess situation after delay for lost
    small plane to land
  • Did not verify windshear report

28
Threat and Error SummaryDryden
Threats Mgt Errors
Mgt Latent Threats
29
Undesired Aircraft States
  • Initial lift-off and bounce back
  • Second lift-off
  • Un-recovered stall after second lift-off
  • UAS management unsuccessful
  • Outcome - accident

30
Latent Threats
  • Regulator
  • Certification of design that allows cold soaking
    of fuel (and icing of wing)
  • Failure to define de-icing requirements
  • Failure to audit jet program at Air Ontario
  • Organization
  • No company manuals or MEL
  • Inconsistent training of pilots on F-28 aircraft
  • At different airlines with different procedures

31
Latent Threats - 2
  • Organizational pressure to fly with ice
  • Chief pilot known as The Iceman
  • Rostering practices both pilots inexperienced
    in F-28
  • Crew
  • Lack of experience in type
  • Personal pressure to complete flight
  • Captain scheduled to marry on arrival

32
Conclusions
  • The root cause was the failure of the crew to
    de-ice before take off in heavy snow.
  • A number of threats and errors contributed to
    this decision and action

33
Avianca Flight 5225 January, 1990
34
Scenario
  • Avianca Flight 52, a B-707, was bound from
    Medellin, Colombia to New York, JFK on 25
    January, 1990
  • The flight experienced three extended holding
    patterns due to bad weather up the Atlantic coast
    and at JFK
  • The fuel state was becoming critical by the end
    of the third hold
  • The Flight Engineer indirectly indicated crisis
    by pointing to Boeing Manual instructions for
    flight with minimum fuel

35
Scenario - 2
  • On the first approach to JFK the runway not seen
    at MDA and a missed approach was executed
  • The crew accepted a lengthy vector from ATC after
    the missed approach
  • The plane ran out of fuel and crashed on Long
    Island before beginning another approach to JFK
  • Robert Helmreich participated in investigation of
    the accident Helmreich, R.L. (1994). Anatomy of
    a system accident The crash of Avianca Flight
    052. International Journal of Aviation
    Psychology 4(3), 265-284.

36
Avianca Flight 52
37
External Threats
  • Autopilot not working, requiring hand flying
    throughout flight
  • Weather poor along East Coast of US
  • Conditions at JFK marginal
  • Increasing delays due to ATC congestion
  • Multiple holding patterns along East Coast

38
Flight Crew Errors
  • Crew did not update weather after entering U.S.
    airspace
  • Crew did not alert captain to growing fuel
    emergency
  • Crew did not declare emergency when fuel state
    became critical
  • Crew did not respond to Ground Proximity Warning
    System (17 alerts)

39
Errors - 2
  • Crew accepted delay after executing missed
    approach (vector to end of Long Island)
  • Cabin was not informed of fuel crisis and
    prepared for emergency landing

40
Undesired Aircraft States
  • Critical fuel state
  • Fuel exhaustion
  • UAS management unsuccessful
  • Outcome - crash

41
(No Transcript)
42
Threat and Error SummaryAvianca
Threats Mgt Errors
Mgt Latent Threats
43
Avianca Latent Threats
  • National culture
  • Power distance impedes communication with captain
    and ATC
  • Language difficulties (understanding ATC)
  • System
  • ATC unawareness of cultural issues regarding
    clearances

44
Latent Threats - 2
  • Organizational
  • Inadequate dispatch and weather service
  • Inadequate maintenance of aircraft (autopilot
    inoperative)
  • Lack of training in GPWS
  • CRM course taken from US training organization
  • Without permission or modification for
    organization
  • Professional culture
  • Denial of fatigue

45
Culture as Latent Threat
  • Junior crew were fully aware of fuel emergency
    but did not communicate concerns to captain
  • Read from Boeing manual about low fuel procedure
    (pitch angle during missed approach)l
  • Made non-verbal signal to Steward (cutting
    throat) when asked about status
  • Crew did not communicate status directly to ATC
  • General communication about fuel
  • Accepted lengthy vector and return after missed
    approach

46
Using the Model in Analysis
47
UT-TEMM
48
Using the Model
  • Identify overt threats and errors
  • Including operational context
  • Identify crew errors
  • Identify Undesired Aircraft States
  • Identify crew threat, error and undesired
    aircraft state management behaviors
  • CRM deficiencies
  • Identify latent threats
  • Specify corrective actions

49
Threat Categories
  • Adverse weather
  • Operational environment
  • Traffic-TCAS-communication
  • ATC
  • Clearances, error, language
  • Cabin
  • Distraction, pax behavior
  • Procedures/documentation
  • Policy guidelines, navigation databases, etc
  • Aircraft malfunction
  • MEL, automation, displays
  • Ground maintenance
  • Error
  • Ramp operations
  • Ground handling, error
  • Dispatch
  • Error
  • Paperwork

50
Global Error Categories
  • Procedural
  • Communication
  • Intentional non-compliance/violation
  • Decision
  • Proficiency

51
Specific Error Categories
  • Aircraft handling
  • Flt path deviations, speed, Wx penetration
  • A/C systems and radio error
  • Automation use
  • Checklist
  • SOP cross-verification
  • Other procedural deviations
  • Documentation
  • ATIS, Jeppesens, clearances, etc
  • External communication
  • Crew communication
  • Decision
  • Proficiency
  • Violation
  • Intentional non-compliance

52
Error Management Outcomes
  • Mitigated error inconsequential
  • Not recognized or no response
  • Additional Error error chain

53
Threat and Error Summary
Threats Mgt Errors
Mgt Latent Threats
Undesired Aircraft State Mgt Outcome

54
Identify Latent Threats
  • Using empirical threats and errors,
    organizational factors, identify latent threats
    in the operating environment

55
Identify Corrective Actions
  • Specify immediate and long term actions to
    prevent recurrence of event or accident (Targets
    for improvement in LOSA)

56
  • The University of Texas
  • Human Factors Research Project
  • www.psy.utexas.edu/HumanFactors
Write a Comment
User Comments (0)
About PowerShow.com