Professional Documents
Culture Documents
Tem Ba 10-07
Tem Ba 10-07
Error-management
Behaviors Undesired Undesired state
(avoid, trap, contain, aircraft management
mitigate, exacerbate, state behaviors
fail to respond)
Additional Additional
error error
Incident
Accident
Error-management
Behaviors Undesired Undesired state
(avoid, trap, contain, aircraft management
mitigate, exacerbate, state behaviors
fail to respond)
Additional Additional
error error
Incident
Accident
Error-management
Behaviors Undesired Undesired state
(avoid, trap, contain, aircraft management
mitigate, exacerbate, state behaviors
fail to respond)
Additional Additional
error error
Incident
Accident
Error-management
Behaviors Undesired Undesired state
(avoid, trap, contain, aircraft management
mitigate, exacerbate, state behaviors
fail to respond)
Additional Additional
error error
Incident
Accident
Error-management
Behaviors Undesired Undesired state
(avoid, trap, contain, aircraft management
mitigate, exacerbate, state behaviors
fail to respond)
Additional Additional
error error
Incident
Accident
Heinrich 2007
Fortunately, not all events become accidents…
Accident 1
Serious incident 10
Significant event 30
Routine occurrence
200
Statistical event
600
…but events/occurrences can lead to incidents and accidents
Flight Safety Foundation, 2006; Adapted with permission.
Latent Threats
Latent Threats – factors residing in the system,
organization or individual that increase risk.
Latent threats are not directly observable at
the ‘sharp end’ of operations
Latent threats are usually uncovered by
analysis of aggregate data such as confidential
incident reports, e.g.,
Equipment design issues
Optical illusions
Air traffic system design
Training philosophy and practices
Organizational culture (positive or negative)
Heinrich 2007
Typical Latent Errors
Poor planning or scheduling
Inadequate design/poor equipment
Improper allocation/lack of resources
Flawed procedures
Defective communications
Training deficiencies
Inadequate selection procedures
Inspection and oversight flaws
Neglect of known hazards
Lack of motivation
Note that these are all management problems!
Heinrich 2007
Pilots are human…
and humans make errors!
(Note: this does not mean that errors are OK!)
Flight Crew
Airplane
Maintenance
Excludes:
Weather • Sabotage
• Military Action
Airport/ATC • Turbulence Injury
• Evacuation Injury
Other • Servicing Injury
Exacerbate Mitigate
Miss Errors Trap Errors
Errors Errors
* Helmreich, 1998
Strategies/Countermeasures
Heinrich 2007
Safeguards
Safeguards are the hardware & software that
serve as additional barriers to problems*:
GPWS SOPs
TCAS CHECKLISTS
EVS AUTOMATION
MANUALS ATC
*Note: Because these are also developed by humans, the potential
still exists for latent defects and errors.
Heinrich 2007
Awareness, Anticipation
Heinrich 2007
Desired OUTCOMES
or Undesired CONSEQUENCES ?
Heinrich 2007
TEM Principles
TEM Principles
The objective of Threat and Error
Management (TEM) …
Heinrich 2007
TEM Principles
TEM is central to all safety processes and
provides defences against hazards in
operational situations; it involves…
Identifying hazards to safety, i.e., threats,
errors, or undesired states (deviations)
Assessing the risks of these hazards (the
consequence of accepting hazards)
Avoiding or trapping threats and errors
Containing the end result (mitigation)
Heinrich 2007
Important TEM Concepts
TEM Concepts
Heinrich 2007
TEM Concepts
Heinrich 2007
Accurate Decision-Making
Heinrich 2007
A Case Study
Case Study
G-III Fatal Accident, Aspen, March 2001
The Accident:
On March 29, 2001, about 1902 MST, a
Gulfstream III, N303GA, owned by
Airbourne Charter, Inc., and operated by
Avjet Corporation of Burbank, California,
crashed while on final approach to
runway 15 at Aspen-Pitkin County
Airport (ASE), Aspen, CO. The charter
flight had departed Los Angeles
International Airport (LAX) about 1711
with 2 pilots, 1 flight attendant, and 15
passengers. The airplane crashed into
sloping terrain about 2,400 feet short of
the runway threshold. All of the
passengers and crewmembers were
killed, and the airplane was destroyed.
The flight was being operated on an IFR
flight plan under CFR Part 135.
Case Study
G-III Fatal Accident, Aspen, March 2001
Latent External Crew TRM/CRM CRM
Threats & Outcomes Outcomes
Threats Errors Behaviors Behaviors
Errors
Organizational
System
Professional
Decision-making, SA,
Unexpected Threat recognition,
Events/Risks Error avoidance, Safe Flight
Safeguards,
Countermeasures
Expected
Events/Risks Violations,
Communication,
Procedural,
External Proficiency,
Error Decision Recovery to
Inconsequential Safe Flight
Error-management
Behaviors Undesired Undesired state
(avoid, trap, contain, aircraft management
mitigate, exacerbate, state behaviors
fail to respond)
Additional Additional
error error
Incident
Accident
External
Communication,
System
Procedural,
Proficiency,
Error Decision SOPs Recovery to
Policies Safe Flight
Inconsequential
Procedures
Techniques
Error-management
Behaviors Undesired Undesired state
Professional
(avoid, trap, contain,
mitigate, exacerbate,
aircraft
state
management
behaviors
failtoOperators
respond)
Crew
Additional Additional
Team error error
Incident
Accident
Heinrich 2007
Organizational
Latent Threats System
Professional
Heinrich 2007
What would have happened if the
Organization…
Heinrich 2007
Latent External Crew TRM/CRM CRM
Threats & Outcomes Outcomes
Threats Errors Behaviors Behaviors
Errors
Unexpected External Threats
Organizational
System Threats/Events/Risks Events that occur
Professional Latent threats outside the influence
System failures SA, of the flight crew, but
Decision-making, which require crew
Unexpected WX/ Environmental
Threat recognition, changes attention and
Events/Risks Error avoidance,
Other dynamics Safe Flight management if safety
Safeguards, margins are to be
Countermeasures maintained.
Expected
Events/Risks
Expected External
Violations,
Threats/Events/Risks
Communication,
Destination
Procedural, issues
External
Proficiency,
Terrain
Error Decision Recovery to
Environmental problems Safe Flight
Inconsequential
Logistics
Error-management
Behaviors Undesired Undesired state
External Error
(avoid, trap, contain, aircraft management
ATC errors
mitigate, exacerbate, state behaviors
fail to respond)
Other aircraft
Communication issues Additional Additional
Time pressures error error
Incident
Accident
External
Error
External
Error
Heinrich 2007
In the Dynamic environment…
What would have happened if…
…The organization had advised the
passengers of the need to arrive on time
because of the night curfew at Aspen? Safe Flight
Heinrich 2007
Latent External Crew TRM/CRM CRM
Threats & Outcomes Outcomes
Threats Errors Behaviors Behaviors
Errors
Organizational
System Crew Errors *
Professional
Non-compliance (violation)
Crew Errors
Unexpected
Decision-making, SA,
Communication
Threat recognition,
Actions or
Events/Risks Error avoidance,
Procedural
Safe Flight
inactions by
Safeguards,
Countermeasures
the flight crew
Expected Proficiency
Events/Risks
that lead to Violations,
Communication, Poor or uninformed decision
deviations Procedural,
from intention
External
Error
Proficiency,
Decision
* All humans
Recovery to
or expectation make mistakes!
Inconsequential Safe Flight
Error-management
Behaviors Undesired Undesired state
(avoid, trap, contain, aircraft management
mitigate, exacerbate, state behaviors
fail to respond)
Additional Additional
error error
Incident
Accident
Heinrich 2007
Latent External Crew TRM/CRM CRM
Threats & Outcomes Outcomes
Threats Errors Behaviors Behaviors
Errors
TRM/CRM Behaviors
Organizational
Decision-making – must have “information” from all Team resources (integration)
System
Situation Awareness and “Projection” in a very dynamic environment
Professional
Threat recognition
Error avoidance Decision-making, SA,
Unexpected Threat recognition,
Safeguards – hardware and software
Events/Risks that serve asSafe
Error avoidance, additional
Flight
barriers to problems
Countermeasures – increase awareness
Safeguards,and reduce number of threats/errors
Countermeasures
Expected
Events/Risks Error Management Behaviors
Violations,
Avoid Communication,
Trap Procedural,
External Proficiency,
Contain Error Decision Recovery to
Mitigate Inconsequential Safe Flight
Exacerbate
Fail to respond Error-management
Behaviors Undesired Undesired state
(trap, contain, aircraft management
Undesired State Management Behaviors
mitigate, exacerbate, state behaviors
Errors/deviations require immediate action before negative
fail to respond) consequences occur!
Additional error can lead to an incident or accidentAdditional Additional
Note: Pilots can always elect to abandon a dangerous approach or phase oferror
error flight!
Incident
Accident
?
Decision-making, SA,
Threat recognition,
Error avoidance,
?
Safeguards,
Countermeasures
Error-management
Behaviors (+/-)
(avoid, trap, contain,
?
mitigate, exacerbate,
fail to respond)
Undesired state
management
Behaviors (+/-) ?
TRM/CRM Decision-making, SA,
Threat recognition,
Error-management
Behaviors (+/-)
Error avoidance , (avoid, trap, contain,
Behaviors
Undesired state
Safeguards, mitigate, exacerbate, management
Countermeasures fail to respond) Behaviors (+/-)
Decision-making, SA, Captain and another Avjet captain discussed nighttime landing
Threat recognition, restriction at ASE.
Error avoidance,
Safeguards, Captain asked controller whether the pilot of N527JA was practicing or
Countermeasures had actually missed.
Error-management
When airplane is at 10,400 feet, captain states, “Okay...I'm breaking
Behaviors (+/-) out," and asks local controller, about 5 seconds later, whether runway
(avoid, trap, contain, lights are all way up. The controller indicates, “Affirmative they're on
mitigate, exacerbate,
fail to respond)
high." First officer says, “Okay you can go...ten thousand two hundred
[the MDA].”
Undesired state Descended below MDA, even though aircraft maneuvers and comments
management on CVR indicated neither pilot had established or maintained visual
Behaviors (+/-)
contact with the runway or its environment.
Heinrich 2007
In the Dynamic environment…
What would have happened if…
…The crew had expected to execute a missed Missed
Approach!
approach after hearing that the Challenger
ahead (N527JA) had executed the missed Safe Flight
approach?
The crew had realized that when they were Missed
“breaking out” that they were not in a Approach!
Heinrich 2007
Latent External Crew TRM/CRM CRM
Threats & Safe Flight Outcomes Outcomes
Threats Errors Behaviors Behaviors
Effective
ErrorsDM, SA, threat recognition, error
avoidance
Organizational
Appropriate application of T&E strategies
System
result in desirable outcomes
Professional
Decision-making, SA,
Inconsequential Outcome
Unexpected Threat recognition,
Management
Events/Risks of threats & errors (i.e.,
Error avoidance, Safe Flight
avoiding, trapping, containing) results in little
Safeguards,
or no adverse consequences Countermeasures
Expected
Events/Risks Violations,State
Undesired Aircraft
Communication,
Aircraft deviation or incorrect configuration
Procedural,
associated with a clearProficiency,
External reduction in safety
margins Error Decision Recovery to
Inconsequential Safe Flight
Recovery to SafeError-management
Flight
Effective undesired state management
Behaviors Undesired Undesired state
behaviors (avoid, trap, contain, aircraft management
mitigate, exacerbate, state behaviors
fail to respond)
Additional Error
Additional error(s) requires further error Additional Additional
management behaviors error error
Exacerbation or failure to respond can result
in an incident or accident Incident
Accident
What are some of the Crew CRM Behaviors and subsequent Outcomes in
the Aspen Accident?
Safe Flight ?
Inconsequential ?
Recovery to
Safe Flight ?
?
Additional
error
Undesired
aircraft
?
state
Accident ?
Safe Flight Undesired
aircraft
Safe Flight Flight crew properly certificated & qualified; aircraft properly certified, equipped,
& maintained; the first officer obtained a weather briefing
Inconsequential Crew crossed the FAF 100’ low, descended 300’ below the next stepdown, and
crossed the 9.5 DME fix 900’ low
Recovery to
Safe Flight
At about 1901:53, the captain added max power (less than a second before
impact)
Additional
error
Determination to continue with the original plan of action despite the presence
of cues suggesting the need for a modified course of action
Undesired
aircraft High descent rate (GPWS sink rate alerts) & excessive bank angle near ground
state
Descent below MDA without visual contact with the runway or environment
Accident
Heinrich 2007
In the Dynamic environment…
What would have happened if…
The crew had received general TEM training? Safe Flight
Error avoidance
Error management strategies
The crew had learned and practiced techniques to
apply in specific situations? Safe Flight
Heinrich 2007
Gulfstream III - Aspen, Colorado
March 2001
* Eighteen Fatalities
NTSB Findings
Procedural Errors
Poor Crew Coordination
Time Pressures
Passenger Expectations
Latent External Crew TRM/CRM CRM Outcomes
Threats & Errors
Threats Errors Behaviors Behaviors
Errors Additional
“Oh, really!”
error
PAX to FA:
YES Captain :
“Can I ride
Reminds PAX
on the
about 3 MAs Safe Flight
jumpseat?”
and Safety #1!
Additional
FA to PAX: No sterile
error
“Would anyone No! cockpit
like to ride on Captain:
the jumpseat?” “Please,
flight issues Safe Flight
only!”
Additional
First officer
error
hesitant to
challenge
captain First officer:
“You’re too low! Safe Flight
Let’s miss!”
Additional
Captain
error
determined
to land Captain:
“3 MAs! Let’s Safe Flight
plan for MA!”
Safe Flight
Heinrich 2007
Latent External Crew TRM/CRM CRM Outcomes
Threats & Errors
Threats Errors Behaviors Behaviors
Errors Additional
“Oh, really!”
error
PAX to FA:
YES Captain :
“Can I ride
Reminds PAX
on the
about 3 MAs Safe Flight
jumpseat?”
and Safety #1!
Additional
FA to PAX: No sterile
error
“Would anyone No! cockpit
like to ride on Captain:
the jumpseat?” “Please,
flight issues Safe Flight
only!”
Additional
First officer
error
hesitant to
challenge
captain First officer:
“You’re too low! Safe Flight
Let’s miss!”
Additional
Captain
error
determined
to land Captain:
“3 MAs! Let’s Safe Flight
plan for MA!”
Safe Flight
Incident
Accident
Heinrich 2007
Latent External Crew TRM/CRM CRM Outcomes
Threats & Errors
Threats Errors Behaviors Behaviors
Errors Additional
“Oh, really!”
error
PAX to FA:
YES Captain :
“Can I ride
Reminds PAX
on the
about 3 MAs Safe Flight
jumpseat?”
and Safety #1!
Additional
FA to PAX: No sterile
error
“Would anyone No! cockpit
like to ride on Captain:
the jumpseat?” “Please,
flight issues Safe Flight
only!”
Additional
First officer
error
hesitant to
challenge
captain First officer:
“You’re too low! Safe Flight
Let’s miss!”
Additional
Captain
error
determined
to land Captain:
“3 MAs! Let’s Safe Flight
plan for MA!”
Safe Flight
Heinrich 2007
Latent External Crew TRM/CRM CRM Outcomes
Threats & Errors
Threats Errors Behaviors Behaviors
Errors Additional
“Oh, really!”
error
PAX to FA:
YES Captain :
“Can I ride
Reminds PAX
on the
about 3 MAs Safe Flight
jumpseat?”
and Safety #1!
Additional
FA to PAX: No sterile
error
“Would anyone No! cockpit
like to ride on Captain:
the jumpseat?” “Please,
flight issues Safe Flight
only!”
Additional
First officer
error
hesitant to
challenge
captain First officer:
“You’re too low! Safe Flight
Let’s miss!”
Additional
Captain
error
determined
to land Captain:
“3 MAs! Let’s Safe Flight
plan for MA!”
Safe Flight
Heinrich 2007
Latent External Crew TRM/CRM CRM
Threats & Outcomes Outcomes
Threats Errors Behaviors Behaviors
Errors
Organizational
System
Professional
Decision-making, SA,
Unexpected Threat recognition,
Events/Risks Error avoidance, Safe Flight
Safeguards,
Countermeasures
Expected
Events/Risks Violations,
Communication,
Procedural,
External Proficiency,
Error Decision Recovery to
Inconsequential Safe Flight
Error-management
Behaviors Undesired Undesired state
(avoid, trap, contain, aircraft management
mitigate, exacerbate, state behaviors
fail to respond)
Additional Additional
error error
Incident
Accident
Heinrich 2007
Organizations that have a proactive safety culture…
Understand that…
…aviation professionals are human and
therefore prone to error
acceptance of vulnerability is the first step in
taking responsibility and avoiding risk-taking
behaviors
detecting, reducing, and containing human
errors are the most effective ways of
improving safety
it is important to have incident reporting
programs that are confidential and non-
punitive
Heinrich 2007
Organizations that have a proactive safety culture…
Understand that…
… adherence to SOPs can greatly reduce
the opportunities for accidents and
incidents
internal and external audits are critical to
safety “health”
risks can most times be mitigated by risk-
compensation
when risk compensation cannot be
accomplished, alternatives must be found
that provide adequate margins of safety
Heinrich 2007
Organizations that have a proactive safety culture…
Understand that…
…safety is an attitude on and off the job
safety can be proactively managed, i.e., all
accidents and incidents can be prevented
all operating exposures can be safeguarded;
barriers must be erected and maximized
safety comes from proper decision-making,
usually a product of good CRM, MRM, or TRM
safety should be continually recognized and
re-enforced
Heinrich 2007
Organizations that have a proactive safety culture…
Understand that…
…both management and employees are
responsible for avoiding accidents and
incidents
employees must be trained and given the
tools/resources to work safely – i.e., there
should be no incentives to take short cuts or
break the rules
prevention of personal injuries is a product of
caring, but it is also good business
working safely and responsibly should be a
condition of employment
Heinrich 2007
Latent External Crew CRM CRM
Threats & Outcomes Outcomes
Threats Errors Behaviors Behaviors
Errors
Organizational
System
Professional
Decision-making, SA,
Unexpected Threat recognition,
Events/Risks Error avoidance, Safe Flight
Safeguards,
Countermeasures
Expected
Events/Risks Violations,
Communication,
Procedural,
External Proficiency,
Error Decision Recovery to
Inconsequential Safe Flight
Error-management
Behaviors Undesired Undesired state
(avoid, trap, contain, aircraft management
mitigate, exacerbate, state behaviors
fail to respond)
Additional Additional
error error
Incident
Accident