Title: The University of Texas Threat and Error Management Model: Application to Accident and Incident Anal
1The University of Texas Threat and Error
ManagementModel Application to Accident and
Incident Analysis
- Robert L. Helmreich, PhD
- James Klinect, MA
- John A. Wilhelm, MS
- Michelle Harper, MS
- University of Texas
- Human Factors Research Project
- The University of Texas at Austin
2Overview
- Introduction to the University of Texas Threat
and Error Management Model (UTTEMM) - Definitions
- Use of a model
- The model
- Demonstration of UT-TEMM in accident analysis
- Air Ontario Flight 1363 at Dryden, Ontario
- Avianca Flight 052 at New York, JFK
- Application to accident and incident analysis
3The University of Texas Threat and Error
Management Model
- The model was derived empirically from
observations of flight crew performance in normal
line operations - Line Operations Safety Audit (LOSA)
- UT-TEMM has three parts
- External threats and external errors and their
management - Crew errors and their management
- Undesired aircraft states and their management
4UT-TEMM
5Use of the Model
- Framework for analysis of data and application of
empirical taxonomies in - Line Operations Safety Audits (LOSA)
- Analysis of incidents and accidents
- Training that stresses threat and error
management as a central focus of Crew Resource
Management (CRM 6th generation)
6Threats
- Definition Overt and latent factors external to
the flight crew that originate outside a flight
crews influence and must be actively managed to
avoid becoming consequential to safety - Threats increase the complexity of the
operational environment
7External Threats
- Expected
- Forecast weather
- Terrain
- Unexpected
- Abnormals
- Traffic
- External error
- Air Traffic Control errors
- Dispatch errors
8External Threat Examples
- Adverse weather
- Terrain
- Traffic
- Airport conditions
- A/C malfunctions
- Automation events
- Communication events
- Operational time pressures
- Non-normal operations
- ATC commands / errors
- Cabin events / errors
- MX events / errors
- Dispatch events / errors
- Ground crew events / errors
9Errors
- Definition deviations from crew or
organizational intentions or expectations
10Global Flight Crew Error Types
- Procedural Followed procedures but wrong
execution - example) Wrong altitude setting dialed into the
MCP - Communication Missing information or
misinterpretation within cockpit - example) Miscommunication by crew with ATC
- Violation - Intentional non-compliance with
required procedure - example) Performing a checklist from memory
- Decision Discretionary choice of action that
unnecessarily increases risk - example) Unnecessary navigation through adverse
weather - Proficiency lack of skill or knowledge needed
for activity - example) Inability to program FMS properly
11Specific Error CategoriesLOSA Handbook - ICAO
Doc 9803
- Aircraft handling
- Flt path deviations, speed, Wx penetration
- A/C systems and radio error
- Automation use
- Checklist
- SOP cross-verification
- Other procedural deviations
- Documentation
- ATIS, Jeppesens, clearances, etc
- External communication
- Crew communication
- Decision
- Violation
12Latent Threats
13Latent Threats
- Factors not directly linked to observable threat
and error that increase risk and the probability
of error - Crew management of latent threats is difficult
because they are not immediately visible - Latent threat identification is key to accident
and incident analysis
14Latent Threat Examples
- Inadequate management oversight
- Inadequate regulatory oversight
- Flawed procedures
- Organizational culture and climate
- Scheduling and rostering practices
- Crew fatigue
- Performance assessment practices
- Inadequate accident and incident investigation
15Threat and Error Management and Outcomes
16Threat and Error Management
- In response to a threat or error crews can
- Trap - threat or error is detected and managed
before it becomes consequential - Exacerbate - threat or error is detected and the
crews action makes it consequential - Fail to Respond no action to deal with a threat
or error (undetected or ignored) - Outcome may be inconsequential or consequential
17Threat and Error Outcomes
- Inconsequential the threat or error has no
operational effect - Additional error the response leads to an
additional error (error chain) - Undesired Aircraft State - deviation from normal
flight that compromises safety
18Undesired Aircraft State
A compromised situation placing the flight at
increased risk
- Unstable approach
- Abrupt aircraft control
- Long landing no go around
- Firm landing
- Forced landing
- Wrong taxiway, ramp, runway, country
- Runway incursion
- Lateral deviation
- Vertical deviation
- Speed too high
- Speed too low
- Incorrect aircraft configuration
- Flight controls
- Systems
- Fuel
- Automation
19Accident Examples
- Air Ontario 1363
- Avianca 52
20Air Ontario Flight 136310 March 1989
21(No Transcript)
22Dryden Scenario
- Air Ontario Flight 1363 took off from Winnipeg,
Manitoba on March 10, 1989 It was a Fokker F-28
recently bought from a Turkish airline. The
aircraft had a number of mechanical problems - Weather was deteriorating and the flight
experienced delays due to de-icing at Winnipeg
23Dryden Scenario - 2
- The flight went from Winnipeg to Dryden then on
to Thunder Bay and back to Dryden - It experienced additional delays at Dryden, then
took off, stalled and crashed in woods off the
end of the runway - The post-crash fire was so fierce that the voice
and data recorders were destroyed
24Investigation
- Despite the relatively minor loss of life and
identified cause, the largest investigation of an
air crash to date was launched by a Commission of
Inquiry, headed by a justice of the Supreme Court - Robert Helmreich was human factors consultant to
the commission - A four volume report investigating all aspects of
the Canadian aviation system resulted - This is not to imply that this level of
investigation is needed to apply the Threat and
Error Management Model
25External Threats
- Worsening weather increasing snowfall
- Possibly below minimums
- Increased passenger load
- Need to offload fuel
- Dispatch release with errors
- Small plane lost above airport delaying take off
- Inoperative APU no ground start ability
- CA and FO lack jet experience lt100 hrs
- Pax needs
- Misconnections
- No facilities at Dryden
26Threat Management
- Inquiry about de-icing capabilities at Dryden
27Crew Errors
- Fail to inspect wings for ice accumulation
- Fail to de-ice after inquiry about capabilities
- Taxi out in increasingly heavy snowfall
- Fail to re-assess situation after delay for lost
small plane to land - Did not verify windshear report
28Threat and Error SummaryDryden
Threats Mgt Errors
Mgt Latent Threats
29Undesired Aircraft States
- Initial lift-off and bounce back
- Second lift-off
- Un-recovered stall after second lift-off
- UAS management unsuccessful
- Outcome - accident
30Latent Threats
- Regulator
- Certification of design that allows cold soaking
of fuel (and icing of wing) - Failure to define de-icing requirements
- Failure to audit jet program at Air Ontario
- Organization
- No company manuals or MEL
- Inconsistent training of pilots on F-28 aircraft
- At different airlines with different procedures
31Latent Threats - 2
- Organizational pressure to fly with ice
- Chief pilot known as The Iceman
- Rostering practices both pilots inexperienced
in F-28 - Crew
- Lack of experience in type
- Personal pressure to complete flight
- Captain scheduled to marry on arrival
32Conclusions
- The root cause was the failure of the crew to
de-ice before take off in heavy snow. - A number of threats and errors contributed to
this decision and action
33Avianca Flight 5225 January, 1990
34Scenario
- Avianca Flight 52, a B-707, was bound from
Medellin, Colombia to New York, JFK on 25
January, 1990 - The flight experienced three extended holding
patterns due to bad weather up the Atlantic coast
and at JFK - The fuel state was becoming critical by the end
of the third hold - The Flight Engineer indirectly indicated crisis
by pointing to Boeing Manual instructions for
flight with minimum fuel
35Scenario - 2
- On the first approach to JFK the runway not seen
at MDA and a missed approach was executed - The crew accepted a lengthy vector from ATC after
the missed approach - The plane ran out of fuel and crashed on Long
Island before beginning another approach to JFK - Robert Helmreich participated in investigation of
the accident Helmreich, R.L. (1994). Anatomy of
a system accident The crash of Avianca Flight
052. International Journal of Aviation
Psychology 4(3), 265-284.
36Avianca Flight 52
37External Threats
- Autopilot not working, requiring hand flying
throughout flight - Weather poor along East Coast of US
- Conditions at JFK marginal
- Increasing delays due to ATC congestion
- Multiple holding patterns along East Coast
38Flight Crew Errors
- Crew did not update weather after entering U.S.
airspace - Crew did not alert captain to growing fuel
emergency - Crew did not declare emergency when fuel state
became critical - Crew did not respond to Ground Proximity Warning
System (17 alerts)
39Errors - 2
- Crew accepted delay after executing missed
approach (vector to end of Long Island) - Cabin was not informed of fuel crisis and
prepared for emergency landing
40Undesired Aircraft States
- Critical fuel state
- Fuel exhaustion
- UAS management unsuccessful
- Outcome - crash
41(No Transcript)
42Threat and Error SummaryAvianca
Threats Mgt Errors
Mgt Latent Threats
43Avianca Latent Threats
- National culture
- Power distance impedes communication with captain
and ATC - Language difficulties (understanding ATC)
- System
- ATC unawareness of cultural issues regarding
clearances
44Latent Threats - 2
- Organizational
- Inadequate dispatch and weather service
- Inadequate maintenance of aircraft (autopilot
inoperative) - Lack of training in GPWS
- CRM course taken from US training organization
- Without permission or modification for
organization - Professional culture
- Denial of fatigue
45Culture as Latent Threat
- Junior crew were fully aware of fuel emergency
but did not communicate concerns to captain - Read from Boeing manual about low fuel procedure
(pitch angle during missed approach)l - Made non-verbal signal to Steward (cutting
throat) when asked about status - Crew did not communicate status directly to ATC
- General communication about fuel
- Accepted lengthy vector and return after missed
approach
46Using the Model in Analysis
47UT-TEMM
48Using the Model
- Identify overt threats and errors
- Including operational context
- Identify crew errors
- Identify Undesired Aircraft States
- Identify crew threat, error and undesired
aircraft state management behaviors - CRM deficiencies
- Identify latent threats
- Specify corrective actions
49Threat Categories
- Adverse weather
- Operational environment
- Traffic-TCAS-communication
- ATC
- Clearances, error, language
- Cabin
- Distraction, pax behavior
- Procedures/documentation
- Policy guidelines, navigation databases, etc
- Aircraft malfunction
- MEL, automation, displays
- Ground maintenance
- Error
- Ramp operations
- Ground handling, error
- Dispatch
- Error
- Paperwork
50Global Error Categories
- Procedural
- Communication
- Intentional non-compliance/violation
- Decision
- Proficiency
51Specific Error Categories
- Aircraft handling
- Flt path deviations, speed, Wx penetration
- A/C systems and radio error
- Automation use
- Checklist
- SOP cross-verification
- Other procedural deviations
- Documentation
- ATIS, Jeppesens, clearances, etc
- External communication
- Crew communication
- Decision
- Proficiency
- Violation
- Intentional non-compliance
52Error Management Outcomes
- Mitigated error inconsequential
- Not recognized or no response
- Additional Error error chain
53Threat and Error Summary
Threats Mgt Errors
Mgt Latent Threats
Undesired Aircraft State Mgt Outcome
54Identify Latent Threats
- Using empirical threats and errors,
organizational factors, identify latent threats
in the operating environment
55Identify Corrective Actions
- Specify immediate and long term actions to
prevent recurrence of event or accident (Targets
for improvement in LOSA)
56- The University of Texas
- Human Factors Research Project
- www.psy.utexas.edu/HumanFactors