The University of Texas Threat and Error Management Model: Application to Accident and Incident Analysis

Robert L. Helmreich, PhD James Klinect, MA John A. Wilhelm, MS Michelle Harper, MS

University of Texas Human Factors Research Project The University of Texas at Austin

Overview


Introduction to the University of Texas Threat and Error Management Model (UTTEMM)
  

Definitions Use of a model The model Air Ontario Flight 1363 at Dryden, Ontario Avianca Flight 052 at New York, JFK

Demonstration of UT-TEMM in accident analysis UT 

Application to accident and incident analysis

2

The University of Texas Threat and Error Management Model



The model was derived empirically from observations of flight crew performance in normal line operations


Line Operations Safety Audit (LOSA) External threats and external errors and their management Crew errors and their management Undesired aircraft states and their management
3

UTUT-TEMM has three parts

1. 2. 3.

UTUT-TEMM
Thre ats: Late nt and Ove rt Thre at M anagement

Errors

Inconseque ntial

Error M anage me nt

Incident / Accide nt

Unde sired Aircraft State

Unde sired Aircraft State M anage me nt

Use of the Model

Framework for analysis of data and application of empirical taxonomies in  Line Operations Safety Audits (LOSA)  Analysis of incidents and accidents  Training that stresses threat and error management as a central focus of Crew Resource Management (CRM 6th generation)

Threats


Definition: Overt and latent factors external to the flight crew that originate outside a flight crew s influence and must be actively managed to avoid becoming consequential to safety
 Threats

increase the complexity of the operational environment

External Threats


Expected
Forecast weather  Terrain


Unexpected
Abnormals  Traffic


External error
Air Traffic Control errors  Dispatch errors

7

External Threat Examples

     

Adverse weather Terrain Traffic Airport conditions A/C malfunctions Automation events Communication events

      

Operational time pressures NonNon-normal operations ATC commands / errors Cabin events / errors MX events / errors Dispatch events / errors Ground crew events / errors

Errors


Definition: deviations from crew or organizational intentions or expectations

Global Flight Crew Error Types

Procedural Followed procedures but wrong execution
example) Wrong altitude setting dialed into the MCP

Communication

Missing information or misinterpretation within cockpit

example) Miscommunication by crew with ATC

Violation - Intentional non-compliance with required

procedure
example) Performing a checklist from memory

Decision

Discretionary choice of action that unnecessarily increases risk

example) Unnecessary navigation through adverse weather

Proficiency lack of skill or knowledge needed for activity

example) Inability to program FMS properly
10

Specific Error Categories:

LOSA Handbook - ICAO Doc 9803


Aircraft handling


Documentation


Flt path deviations, speed, Wx penetration



ATIS, Jeppesens, clearances, etc

   

A/C systems and radio error Automation use Checklist SOP cross-verification crossOther procedural deviations

  

External communication Crew communication Decision Violation

11

Latent Threats

Latent Threats


Factors not directly linked to observable threat and error that increase risk and the probability of error Crew management of latent threats is difficult because they are not immediately visible Latent threat identification is key to accident and incident analysis

13

Latent Threat Examples

Inadequate management oversight  Inadequate regulatory oversight  Flawed procedures  Organizational culture and climate  Scheduling and rostering practices  Crew fatigue  Performance assessment practices  Inadequate accident and incident investigation

14

Threat and Error Management and Outcomes

Threat and Error Management

In response to a threat or error crews can:  Trap - threat or error is detected and managed before it becomes consequential  Exacerbate - threat or error is detected and the crew s action makes it consequential  Fail to Respond no action to deal with a threat or error (undetected or ignored) (undetected ignored)


Outcome may be inconsequential or consequential

16

Threat and Error Outcomes



Inconsequential the threat or error has no operational effect Additional error the response leads to an additional error (error chain) Undesired Aircraft State - deviation from normal flight that compromises safety

17

Undesired Aircraft State

A compromised situation placing the flight at increased risk
Lateral deviation Vertical deviation Speed too high Speed too low Incorrect aircraft configuration Flight controls Systems Fuel Automation Unstable approach Abrupt aircraft control Long landing no go around Firm landing Forced landing Wrong taxiway, ramp, runway, country
18

Runway incursion

Accident Examples
Air Ontario 1363 Avianca 52

Air Ontario Flight 1363 10 March 1989

21

Dryden Scenario


Air Ontario Flight 1363 took off from Winnipeg, Manitoba on March 10, 1989 It was a Fokker F-28 recently bought Ffrom a Turkish airline. The aircraft had a number of mechanical problems Weather was deteriorating and the flight experienced delays due to dedeicing at Winnipeg
22

Dryden Scenario - 2


The flight went from Winnipeg to Dryden then on to Thunder Bay and back to Dryden It experienced additional delays at Dryden, then took off, stalled and crashed in woods off the end of the runway The post-crash fire was so fierce that the postvoice and data recorders were destroyed

23

Investigation


Despite the relatively minor loss of life and identified cause, the largest investigation of an air crash to date was launched by a Commission of Inquiry, headed by a justice of the Supreme Court


Robert Helmreich was human factors consultant to the commission

A four volume report investigating all aspects of the Canadian aviation system resulted


This is not to imply that this level of investigation is needed to apply the Threat and Error Management Model
24

External Threats


Worsening weather


increasing snowfall

Possibly below minimums Need to offload fuel

Increased passenger load



    

Dispatch release with errors Small plane lost above airport delaying take off Inoperative APU no ground start ability CA and FO lack jet experience <100 hrs Pax needs
 

Misconnections No facilities at Dryden

25

Threat Management


Inquiry about de-icing capabilities at deDryden

26

Crew Errors
 

 

Fail to inspect wings for ice accumulation Fail to de-ice after inquiry about decapabilities Taxi out in increasingly heavy snowfall Fail to re-assess situation after delay for relost small plane to land Did not verify windshear report

27

Threat and Error Summary: Dryden

Threats Mgt Errors Mgt Latent Threats

1) Weather - icing 2) Pax Load increase 3) Dispatch errors 4) Take-off delay Take5) Inop APU 6) Pax needs no faciltities

Ask N N N N N

1) No ice inspection 2) No de-icing de3) Taxi in increasing snow 4) No reassessment after delay on taxi 5) No verification of windshear report

N N N N N

1)Certification of F28 2) No formal de-icing derequirements 3) No audit of ops 4) No manuals/MEL 5) Inconsistent trng 6) Org pressure to fly 7) Rostering - Lo experience in type 7) Personal pressure to complete flight

28

Undesired Aircraft States

  

Initial lift-off and bounce back liftSecond lift-off liftUnUn-recovered stall after second lift-off liftUAS management Outcome - accident
29

unsuccessful

Latent Threats


 

 

Regulator Certification of design that allows cold soaking of fuel (and icing of wing) Failure to define de-icing requirements deFailure to audit jet program at Air Ontario Organization No company manuals or MEL Inconsistent training of pilots on F-28 aircraft F

At different airlines with different procedures

30

Latent Threats - 2


Organizational pressure to fly with ice



Chief pilot known as The Iceman

 

Rostering practices both pilots inexperienced in F-28 FCrew Lack of experience in type Personal pressure to complete flight


Captain scheduled to marry on arrival

31

Conclusions


The root cause was the failure of the crew to de-ice before take off in heavy snow. deA number of threats and errors contributed to this decision and action

32

Avianca Flight 52 25 January, 1990

Scenario


 

Avianca Flight 52, a B-707, was bound Bfrom Medellin, Colombia to New York, JFK on 25 January, 1990 The flight experienced three extended holding patterns due to bad weather up the Atlantic coast and at JFK The fuel state was becoming critical by the end of the third hold The Flight Engineer indirectly indicated crisis by pointing to Boeing Manual instructions for flight with minimum fuel
34

Scenario - 2


 

On the first approach to JFK the runway not seen at MDA and a missed approach was executed The crew accepted a lengthy vector from ATC after the missed approach The plane ran out of fuel and crashed on Long Island before beginning another approach to JFK


Robert Helmreich participated in investigation of the accident Helmreich, R.L. (1994). Anatomy of a system accident: The crash of Avianca Flight 052. International Journal of Aviation Psychology 4(3), 265-284. 4(3), 265-

35

Avianca Flight 52

36

External Threats


  

Autopilot not working, requiring hand flying throughout flight Weather poor along East Coast of US Conditions at JFK marginal Increasing delays due to ATC congestion


Multiple holding patterns along East Coast

37

Flight Crew Errors



Crew did not update weather after entering U.S. airspace Crew did not alert captain to growing fuel emergency Crew did not declare emergency when fuel state became critical Crew did not respond to Ground Proximity Warning System (17 alerts)
38

Errors - 2


Crew accepted delay after executing missed approach (vector to end of Long Island) Cabin was not informed of fuel crisis and prepared for emergency landing

39

Undesired Aircraft States

  

Critical fuel state Fuel exhaustion UAS management Outcome - crash

unsuccessful

40

41

Threat and Error Summary: Avianca

Threats Mgt Errors Mgt Latent Threats

1) Autopilot inop 2) Weather East Coast 3) Increasing delays from ATC 4) Conditions marginal at JFK

N N N N

1) No update of available wx 2) Fail to inform CA of fuel crisis 3) Fail to declare emergency 4) Fail to respond to GPWS 5) Accept long vector after missed app 6) Fail to inform and prepare cabin

N N N N N N

1) National culture 2) Language w/ATC 3) ATC unaware of cultural issues 4) Inadequate co dispatch and wx 5) Poor maintenance 6) Lack of GPWS training 7) Inadequate CRM training 8) Fatigue

42

Avianca Latent Threats



National culture


Power distance impedes communication with captain and ATC Language difficulties (understanding ATC) ATC unawareness of cultural issues regarding clearances

System


43

Latent Threats - 2


Organizational
 

 

Inadequate dispatch and weather service Inadequate maintenance of aircraft (autopilot inoperative) Lack of training in GPWS CRM course taken from US training organization


Without permission or modification for organization

Professional culture


Denial of fatigue
44

Culture as Latent Threat

Junior crew were fully aware of fuel emergency but did not communicate concerns to captain


Read from Boeing manual about low fuel procedure (pitch angle during missed approach)l Made non-verbal signal to Steward (cutting throat) nonwhen asked about status

Crew did not communicate status directly to ATC

 

General communication about fuel Accepted lengthy vector and return after missed approach
45

Using the Model in Analysis

UTUT-TEMM
Thre ats: Late nt and Ove rt Thre at M anagement

Errors

Inconseque ntial

Error M anage me nt

Incident / Accide nt

Unde sired Aircraft State

Unde sired Aircraft State M anage me nt

47

Using the Model



Identify overt threats and errors



Including operational context

  

Identify crew errors Identify Undesired Aircraft States Identify crew threat, error and undesired aircraft state management behaviors


CRM deficiencies

 

Identify latent threats Specify corrective actions

48

Threat Categories
 

Adverse weather Operational environment



Aircraft malfunction


MEL, automation, displays Error Ground handling, error Error Paperwork

Traffic-TCASTraffic-TCAS-communication Clearances, error, language Distraction, pax behavior Policy guidelines, navigation databases, etc

Ground maintenance


ATC



Ramp operations


Cabin


Dispatch
 

Procedures/documentation


49

Global Error Categories

    

Procedural Communication Intentional non-compliance/violation nonDecision Proficiency

50

Specific Error Categories



Aircraft handling


Documentation


Flt path deviations, speed, Wx penetration

    

ATIS, Jeppesens, clearances, etc

   

A/C systems and radio error Automation use Checklist SOP cross-verification crossOther procedural deviations

External communication Crew communication Decision Proficiency Violation



Intentional non-compliance non-

51

Error Management Outcomes

  

Mitigated error inconsequential Not recognized or no response Additional Error error chain

52

Threat and Error Summary:

Threats Mgt Errors Mgt Latent Threats

1)

1)

1)

Undesired Aircraft State Mgt

Outcome

1)

53

Identify Latent Threats



Using empirical threats and errors, organizational factors, identify latent threats in the operating environment

54

Identify Corrective Actions



Specify immediate and long term actions to prevent recurrence of event or accident (Targets for improvement in LOSA)

55

The University of Texas Human Factors Research Project www.psy.utexas.edu/HumanFactors