1 “Threat & Error Management (TEM) Workshop”3rd IATA –ICAO LOSA & TEM Conference September 13-14, 2005 Kuala Lumpur, Malaysia Captain Don Gunther Managing Director Human Factors & Safety

2 TEM Workshop Agenda Developing a TEM programLOSA TEM and an Automation Policy TEM applied outside of Flight Operations TEM applied to incident and accident analysis TEM as an integral part of a Safety Management System (SMS)

3 Flight Operations TEM Training

4 Why are we still doing CRM training?Ask and facilitate this question How are we doing on the line? Are we doing a good job? Can we do better?

5 We Need to Continuously Improve Aviation Safety 1965 - 2004Airplanes in service Departures 2004 17.5 Million 25,400 2015 Business as usual 19,077 438 1960 2004 Hull loss accidents per year Accident Rate / Million Departure Our goal is to reduce the accident rate Our Goal Millions of departures Hull loss accident rate 1965 1975 1985 1995 2005 2015 Year Boeing 2004 Statistical Data – May 2005

6 Accidents by Primary Cause 1994 - 2003Number of accidents Percentage of total accidents with known causes Primary Factor Total 10 20 30 40 50 60 70 62% Flight crew Airplane Weather Miscellaneous/other Maintenance Airport/ATC 84 19 16 7 5 66% 69.1% 14% 12% 5% 4% 4% Total with known causes Unknown or awaiting reports Total 136 50 186 Excludes: Sabotage Military action Boeing 2003 Statistical Data – May 2004

7 Accidents by Primary Cause Hull Loss Accidents – Worldwide Commercial Jet Fleet – 1995 through 2004- 0% 10% 20% 30% 40% 50% 60% 70% 80% Flight Crew 75 56% Airplane 23 17% Weather 17 13% Misc./Other 8 6% Maintenance 5 4% Airport/Air Traffic Control 5 4% Total with known causes 133 Unknown or awaiting reports 44 *As determined by the investigating authority, percent of accidents with known causes. Total 177

8 Aviation Week Article on Healthy OrganizationsSafety Culture Aviation Week Article on Healthy Organizations “Investing the time and money needed to get at the root cause of a problem takes total commitment at the most senior levels of a company or organization. In most organizational settings, communicators learn early in life how bad news can impact their leaders. If the news is valued and the communicator is protected, there is a real chance information can and will routinely flow upward in time for proper action to be taken.”

9 The Safety Change Program “Tailored to Continental”To properly target change we need current operational data, specifically for Continental, which is unique due to its… History & Culture Areas of operation (CMI, polar routes, etc.) Philosophy

10 Line Observation Safety Audit(LOSA)

11 “Normal” Performance FAA LOSA 1 LOSA 2 Perfect Angel NormalCheck Airmen LOSA 1 LOSA 2 Perfect Angel Normal Distance between “Perfect” and “Normal performance varies as a function of culture, training, etc. LOSA enables us to get as closer to normal performance than was previously possible.

12 The Continental LOSA Process1st year LOSA and data analysis followed by course development 2nd & 3rd years Training course for all crewmembers, Check Airmen training and imbedding of TEM into courseware, policy & procedures, etc. 4th year Preparation for next LOSA and targeting areas to be measured and new areas to be emphasized.

13 Line Observation Safety Audit LOSA 1996

14 Error Management’s early focus was:Managing crew error As we discussed earlier the focus of our first EM class was to “manage crew error” And while we still need to continue this focus, we also need to expand our awareness of things that affect us on the flightdeck

15 Line Observation Safety Audit LOSA 2000

16 LOSA 1996 vs. 2000 A 70% reduction in Checklist errorsA 60% reduction in unstable approaches (confirmed by FOQA data) Overall improvement in crew performance Still a need for improvement in Leadership skills

17 Threat and Error ManagementTHREATS

18 Threats Threats Threats = Red Flags Do not equal errors"A threat is anything external to the crew that increases operation complexity and, if not managed properly, can decrease the safety margins." Threats Do not equal errors Increase error potential Threats = Red Flags RED FLAG This is our introduction to the RED FLAG concept. It is important to build recognition here. Many more Red Flags will be shown in the discussion of AA1420. Also important to note here that, as the slide states, “a threat does not equal an error”. It only allows for the potential to commit an error. However, a threat should be perceived as a Red Flag to the crew, and even talked about amongst themselves as such. Take one of the threats previously listed by the group and use as an example of how the threat could have become an error or not an error.

19 Influences that can lead to crew errorTHREATS Influences that can lead to crew error Weather Maintenance Ground Crew Cabin Crew Passenger events ATC Terrain Similar call sign Time pressures Heavy traffic Unfamiliar airport Automation event Missed approach Flight diversion System malfunction Distractions Slide will appear with the cockpit and title only. ONE MOUSE CLICK will start the animation and automatically show many of the LOSA observer threats. This is a good opportunity to compare the list that the class developed with those that were specifically looked for on the observations. This list is not exhaustive are there any others?

20 Threat and Error ManagementTHREATS Strategies

21 Strategies/CountermeasuresThreat Management Strategies/Countermeasures (Industry, Corporate and/or Personal) To reduce the number of errors To improve the error management process by increasing the awareness of potential errors

22 Threat and Error ManagementTHREATS Strategies Resist Resolve CONSEQUENCE ERRORS

23 Error Actions or inactions by the flight crew that lead to deviations from organizational or flightcrew intentions or expectations

24 Error Management Actions taken to deal with errors committed by eitherDetecting and correcting them, or by Containing and reducing the severity

25 Error Management ERRORS CONSEQUENCE Resist ResolveReview of Error Management: Use this slide to start a discussion of the previous course. Asking these questions in other classes such as Upgrade has is general produced the following. Few remember much of the specifics of EM. They remember something about errors and the fact that we cannot avoid them totally. Recall of the resist and resolve tools is sketchy at best. Do a review as necessary to bring them up to speed, but keep it short! Use pre-made chart as a center for your discussion. Possible questions: What do you remember from our previous course? How is it working? Has admitting we make mistakes changed your approach any? How do you resist errors? What are some of the resist tools? See next slide How do you resolve error that have occurred in your cockpit? What are some of the resolve tools? See the slide after that Additions questions to keep the discussion going. How do you use these tools? How have you seen these tools abused?

26 HARDWARE & SOFTWARE THAT EXISTS BEFORE THE HUMAN ENTERSError Management RESIST HARDWARE & SOFTWARE THAT EXISTS BEFORE THE HUMAN ENTERS Resist Resolve CONSEQUENCE ERRORS

27 HARDWARE & SOFTWARE THAT EXISTS BEFORE THE HUMAN ENTERSRESISTANCE HARDWARE & SOFTWARE THAT EXISTS BEFORE THE HUMAN ENTERS GPWS TCAS TRAINING MANUALS SOP’s CHECKLISTS AUTOMATION ATC Ask the question; what are some resist tool? Write a few of the answers on the pre-made chart (Use dry ease marker) Field a few responses and then click again to bring up rest of responses.

28 Error Management RESIST ERRORS CONSEQUENCE RESOLVE Resist ResolveHARDWARE & SOFTWARE THAT EXISTS BEFORE THE HUMAN ENTERS Resist Resolve CONSEQUENCE ERRORS RESOLVE WHAT THE HUMAN BRINGS TO THE SYSTEM

29 RESOLVE PROFICIENCY VIGILANCE EXPERIENCE ASSERTIVENESS LEADERSHIPWHAT THE HUMAN BRINGS TO THE SYSTEM PROFICIENCY VIGILANCE ASSERTIVENESS MONITORING & CROSSCHECKING DECISION MAKING EXPERIENCE LEADERSHIP SIT. ASSESSMENT CHECKLIST DISCIPLINE Same thing for Resolve tools

30 Threat and Error ManagementTHREATS Strategies Resist Resolve CONSEQUENCE ERRORS

31 Monitoring & CrosscheckingNASA Guidelines Monitoring & Crosschecking

32 NASA Guidelines Positively delegate flying and monitoring dutiesMonitoring is as important as flying Flying pilot does not become involved with secondary tasks When conflict arises-resolve with outside source When in doubt-must express!

33 Monitoring and CrosscheckingPilot Monitoring (PM) Take Action Crosschecking Steps Express Your View Error Resolved

34 Monitoring and CrosscheckingPilot Monitoring (PM) Take Action Crosschecking Steps Express Your View Error Resolved

35 Monitoring and CrosscheckingPilot Monitoring (PM) Take Action Crosschecking Steps Express Your View Error Resolved

36 Monitoring and Crosschecking(PM) Take Action Crosschecking Steps Solution Problem Express Your View Error Resolved

37 “Look in the mirror first”Case Studies “Look in the mirror first”

38 How to improve “Threat” Identification? “Get it on the Radar!”TEM “the challenge” How to improve “Threat” Identification? “Get it on the Radar!” RED FLAG This is our introduction to the RED FLAG concept. It is important to build recognition here. Many more Red Flags will be shown in the discussion of AA1420. Also important to note here that, as the slide states, “a threat does not equal an error”. It only allows for the potential to commit an error. However, a threat should be perceived as a Red Flag to the crew, and even talked about amongst themselves as such. Take one of the threats previously listed by the group and use as an example of how the threat could have become an error or not an error.

39 Distractions Explain to the class that after takeoff a duck impacted the windshield and entered the cockpit killing the captain. The discussion can be started by asking the question “why did this accident happen?” Typical answer bird hit the windshield. OK, why was it able to penetrate the cockpit? Windshield heat was off. That is on most checklist, “why do you think it was off?” The chain of events for this accident started when a flight attendant came into the cockpit while the cockpit crew was running the “Receiving Aircraft” checklist at the gate. The crew allowed the flight attendant to interrupt the checklist, then picked up the checklist one item after “windshield heat”. The total flight time from the first event in the chain until back on the ground was less than 30. The reading of the checklist was recorded by the CVR.

40 Threat and Error ManagementLOW VISIBILITY TAXI THREATS DE - ICING Strategies Decision Making & Leadership WRONG TURN Resist Resolve CONSEQUENCE ERRORS ALTITUDE DEVIATION

41 DECISION-MAKING “Plan, Review, Monitor & Modify”The purpose of this module is to review decision making both in the tactical (reactive) stage when time is often very limited and during the strategic (proactive) stage which allows more time to better manage threats and thus ensure better performance. Looking at the tire tracks leads one to wonder what in the decision making process that led to this event.

42 Decision Making Strategic Perceive Situation Develop Plan Share PlanExecute Plan Monitor Results What we really do. So lets look at these two aspects. Most of the time we: Situation Assessment -- Look for what we recognize or have seen before then select a course of action, usually something we have tried before. Then if that doesn’t work we’ll start over with a more involved process. So let’s look at these steps.

43 Select a Course of ActionDecision Making Strategic Tactical Perceive Situation Develop Plan Share Plan Execute Plan Monitor Results Situation Assessment Select a Course of Action What we really do. So lets look at these two aspects. Most of the time we: Situation Assessment -- Look for what we recognize or have seen before then select a course of action, usually something we have tried before. Then if that doesn’t work we’ll start over with a more involved process. So let’s look at these steps.

44 Situation Assessment The Nature of the Threats RISK TIME

45 Leadership What have you seen?Introduce the topic of flightdeck leadership Build a verbal bridge from what the participants have said earlier, such as in Good Crew discussion, in AA 1420 or in the DM discussions on the topic of leadership. Then go into questions on the next slide Who was providing the leadership in American 1420 or in our FOQA events? Is leadership important in our cockpit? If there is no leadership what fills the void?

46 Threat and Error Management“Training” THREATS Strategies Resist Resolve CONSEQUENCE ERRORS

47 TEM TRAINING CLASS Ideal class size 15-20The value of the introduction Opening question Facilitation training Line pilots Follow-on Check Airmen training

48 Crew Resource ManagementEffective Crew Resource Management is the bedrock of Threat and Error Management.

49 Feedback to the pilots is essential for continued program success.Newsletter Feedback to the pilots is essential for continued program success.

50 The Role of the Check Airman in Threat & Error Management

51 TEM & Automation

52 To REALLY make a mess of things, you need a computer!To ERR is Human To REALLY make a mess of things, you need a computer!

53 Verbalize Verify MonitorThe Continental Airlines Automation Policy Verbalize Verify Monitor

54 To help “Get it on the RADAR”TEM “the challenge” Improve “Threat & Error” identification by using To help “Get it on the RADAR” Verbalize, Verify, Monitor

55 Verbalize, Verify, MonitorThreat and Error Management AUTOMATION THREATS Strategies Verbalize, Verify, Monitor ERRORS Hardware & Software that exists before the human enters ` Resist Resist Resolve What the human brings to the system Resolve CONSEQUENCE

56 TEM Training outside of Flight Operations

57 Maintenance Threat & Error Management (MTEM) Food Services Threat & Error Management Field Services Threat & Error Management

58 Influences that can lead to agent errorThreats Influences that can lead to agent error Passenger events Distractions Late Bags Cabin Crew Weather Ramp slope Maintenance Late Gate Change New Agent Time pressures Heavy traffic Flight diversion System malfunction Unfamiliar gate Flight Crew Late Cargo

59 Ramp LOSA

60 Why Ramp LOSA? The first step in managing threats is to collect dataPrecursors (Threats) are identified and evaluated Countermeasures (Strategies) are developed, communicated throughout the organization, and then implemented in the system

61 Identified Threats Threats can be prioritized according toThe probability of an incident or accident occurring and then by The severity of an incident or accident that may occur if the “threat” is mismanaged

62 Threat Management The objective of “Threat Management” is toObtain an understanding of how to assess the various risk levels of the threats and to Gain an insight on logical approaches (strategies) to deal them

63 TEM applied to Incident & Accident Analysis

64 TEM Toolkit for Incident & Accident (IA) Analysis

65 IATA Safety Advisory Committee Incident & Accident analysis

66 IATA Safety Advisory Committee Incident & Accident analysis

67 Incident Example Aircraft taxiing toward the gate757 parked at adjacent gate Catering truck parked properly within the adjacent gate clearance zone Arrival gate has an auxiliary J-line, requires 2 marshallers and clearance zones overlap Pre-arrival briefing not done Wing-walker had less than 30 days on job & unfamiliar with these gates New wing-walker panicked and failed to give the STOP signal when he saw the wing was going to strike the catering truck Damage to wing and catering truck

68 Diagram of incident

69 Diagram of incident

70 Diagram of incident

71 Threat and Error Management (TEM)THREATS Strategies Resist Resolve CONSEQUENCE ERRORS

72 Threats 1. List of the Threats 2. 3. 4. 5. 6. 7. 8.

73 Threats 757 parked at adjacent gate Catering truckArrival gate has an auxiliary J-line, requires 2 marshallers and clearance zones overlap Wing-walker had less than 30 days on job & unfamiliar with these gates

74 Threat Management 1. Identify the Threat1. Was the threat managed or mismanaged? How? 2. 2. 3. 3. 4. 4.

75 Threat Management 1. 757 parked at adjacent gate 1. Managed2. Catering truck 2. Managed 3. Arrival gate… auxiliary J-line… clearance zones overlap 3. Mismanaged – clearance zone not properly marked (latent) 4. Wing-walker had less than 30 days on job & unfamiliar with gates 4. Mismanaged – Crew brief not accomplished

76 Errors 1. List of the Errors 2. 3. 4. 5. 6. 7. 8.

77 Errors 1. Pre-arrival briefing not accomplished2. Catering truck parked in clearance zone 3. Wing-walker did not give stop signal 4.

78 Error Management 1. Identify the Error1. Was the error managed or mismanaged? How? 2. 2. 3. 3. 4. 4.

79 Error Management 1. Pre-arrival briefing not accomplished1. Mismanaged – Awareness of threat not established 2. Catering truck parked in over-lapping clearance zone 2. Mismanaged – improper markings not detected (T3) 3. Wing-walker did not give stop signal 3. Mismanaged – (latent?) training/ crew brief (E1) 4. 4.

80 Undesired State ManagementList how the Undesired State was managed or mismanaged.

81 Undesired State ManagementManaged Post mishap procedures followed PAX, fuel spill, etc Etc. Mismanaged…

82 Prevention StrategiesList initial corrective actions at the present time and any proposed actions. Crew Briefs Training Auditing procedures/policy

83 TEM an integral part of a Safety Management System (SMS)

84 Continental Airlines Safety Management System (SMS)

85 SMS Documents and TrainingIATA & ICAO SMS Documents and Training

86 SMS Essential PrerequisitesA comprehensive corporate approach to safety, An effective organization for delivering safety, and Systems to achieve safety oversight.

87 Developing the Continental Safety Management System (SMS)Safety statement from CEO Corporate Safety Policy Add SMS description and Corporate Safety Policy to the Safety manual Establish the Corporate Safety Review Board Begin development of the Safety Action Team within each division Audit the remainder of the Continental SMS

88 Corporate Safety Review Board (CSRB)Accountability The CSRB is chaired by the CEO Membership CSRB membership comprises the CEO, (Sr/Exec) VPs of Flight Operations, Field Services, Tech Ops and Marketing (heads of the ‘functional areas’). The Director of Safety will attend the CSRB as the facilitator.

89 Safety Action Team (SAT)Accountability SATs are responsible to the Corporate Safety Review Board and the chair is determined by the appropriate (Sr/Exec) VP. Membership SAT membership will normally be drawn from directors, managers, supervisors and staff, from within the appropriate functional area and when appropriate the FAA and labor. Terms of Reference As a minimum each SAT is responsible for the following: To oversee operational safety within the functional area. To ensure that any necessary corrective action is taken in a timely manner. To report to and accept strategic direction from the Corporate Safety Review Board via the appropriate Exec/Sr VP.

90 Corporate Safety Review BoardContinental SMS Corporate Safety Review Board CSRB Director of Safety Flight Operations Safety Action Team Tech Ops Safety Action Team Field Services Safety Action Team Mkt/Rsv Safety Action Team

91 Flight Operations Safety Action Team (SAT)Develop the process by which safety data and crew performance and behavior data from FOQA, LOSA, ASAP, CASIS, Line Checks,… are analyzed by Safety, Flight Operations, Inflight, Flight Standards & Training, FAA and ALPA Safety in order to facilitate change.

92 To have an effective SMS…Safety & Operational Efficiency need to be combined into a Corporate “Safety Culture”

93 Goal Become a better Threat Manager – actively identify threats in your operation “Threat Management is managing your future.” “Error Management is managing your past” Continue building a Safety Culture by encouraging open, honest communications

94 Threat and Error ManagementTHREATS Strategies Resist Resolve CONSEQUENCE ERRORS