TEM (Threat & Error Management)

Threats

Threats are defined as ‘events or errors that occur beyond the influence of the flight crew, increase operational complexity and which must be managed to maintain the margins of safety’.

During flight operations, flight crew manage various contextual complexities, such as, for example, dealing with adverse meteorological conditions, airports surrounded by high mountains, congested airspace, aircraft malfunctions, errors committed by other people who are not present in the cockpit, such as ATC, cabin crew, maintenance workers, etc.

The TEM model considers these complexities as threats because they all have the potential to negatively affect flight operations by reducing margins of safety. We can anticipate many of the threats we face, such as thunderstorms, turbulence, airport delays and congestion.

Others occur unexpectedly, such as inflight malfunctions or medical emergencies and violent passengers.

Some threats may not be directly obvious to flight crew and may need to be uncovered by safety analyses. These are considered Latent Threats. Examples of latent threats include equipment design issues, optical illusions, fatiguing roster patterns or shortened turn-around schedules.

Regardless of which type of threat, a high performing crew will recognise the threat and deploy counter measures to ensure that it is ‘trapped’.

Should this not occur, it is likely that an error will occur, which if not spotted will lead to the aircraft entering an undesired state. This relationship is complex and not always linear but in general a failure to react to threats lead to errors which in turn lead to undesired aircraft states.

Threats are categorised in two types;

• Environmental Threats
  — Associated with weather, ATC, airports, terrain, etc.
• Organisational Threats
  — Operational pressure, aircraft, cabin, maintenance, ground, dispatch, documentation, etc.

Errors

Errors are defined as ‘actions or inactions by the flight crew that lead to deviations from the intentions or expectations of the flight crew.’

Mismanaged errors, or errors left unmanaged, frequently lead to undesired aircraft states (UAS) which reduce margins of safety and increase the probability of adverse events.
Errors can be spontaneous, linked to threats, or part of an error chain.

Examples of errors would include;

• The inability to maintain stabilised approach parameters.
• Executing a wrong automation mode.
• Failing to give required callout.
• Misinterpreting ATC clearances

Regardless of the type of error, an error’s effects on safety depends on whether the flight crew detects and responds to it before leading to an undesired aircraft state and to a potential unsafe outcome.

This is why one of the objectives of TEM is to understand error management rather than solely focusing on error causality. From a safety perspective, errors that are timely detected and promptly responded to do not lead to UAS, do not reduce margins of safety in flight operations, and thus become operationally inconsequential.

“To err is human…”

We all know that humans make errors. TEM is therefore vital as a safety tool as it assists flight crew to detect threats and errors, and deal with them so that they become inconsequential.

In addition to its safety value, proper error management represents an example of successful human performance, presenting both learning and training value.

Undesired Aircraft States

Undesired Aircraft States, or UAS, are defined as ‘flight crew-induced aircraft position or speed deviations, misapplication of flight controls, or incorrect systems configuration, associated with a reduction in margins of safety’.

UAS resulting from ineffective threat or error management may lead to compromising situations and reduced margins of safety in flight operation. Often considered at the cusp of becoming an incident or accident — UAS must be managed by flight crews.

Examples of UAS would include;

• Lining up for an incorrect runway on approach to land.
• Exceeding an ATC speed restriction during approach.
• Long landing on short runway requiring maximum braking.

Events such as equipment malfunction or ATC errors can also reduce margins of safety in flight operations, but these would be considered as threats. UAS can be managed effectively and restore margins of safety.
If not managed effectively, a flight crew response could induce an additional error, incident and accident.

An often overlooked aspect of TEM is timely switching from ERROR management to UAS management. Here’s an example of this;

A flight crew is flying an ILS into London Heathrow. Inadvertently the pilot flying selects the wrong runway and the pilot monitoring fails to spot this until they are about to descend on the glideslope.

Instead of reverting to a basic mode of operation by disengaging the automation, both flight crew go heads down in the FMC and attempt to resolve the problem. This results in the aircraft failing to descend on profile and ends up in an unstable approach because the crew became absorbed in Error Management rather than switching to UAS management.

The SWISS CHEESE MODEL of Accident Causation is a mode used in risk analysis and risk management, including aviation safety. It likens human systems to multiple slices of Swiss cheese, stacked side by side, in which the risk of threat becoming a reality is mitigated by the differing layers and types of defences which are layered.

Therefore, in theory, lapses and weaknesses in one defence do not allow a risk to materialise, since other defences also exist, to prevent single point of failure.