Threat Error Management (TEM)
Threat and error management (TEM) is an overarching safety concept regarding aviation operations and human performance. TEM is not a revolutionary concept, but it evolved gradually, as a consequence of the constant drive to improve the margins of safety in aviation operations through the practical integration of Human Factors knowledge.
TEM developed as a product of the collective industry experience. Such experience fostered the recognition that past studies and, most importantly, operational consideration of human performance in aviation had largely overlooked the most important factor influencing human performance in dynamic work environments: the interaction between people and the operational context (i.e., organizational, regulatory and environmental factors) within which people discharge their operational duties.
The recognition of the influence of the operational context in human performance further led to the conclusion that study and consideration of human performance in aviation operations must not be an end in itself. In regard to the improvement of margins of safety in avaition operations, the study and consideration of human performance without context address only part of a larger issue. TEM therefore aims to provide a principled approach to the broad examination of the dynamic and challenging complexities of the operational context in human performance, for it is the influence of these complexities that generates consequences directly affecting safety.
The Threat and Error Management (TEM) model is a conceptual framework that assists in understanding, from an operational perspective, the inter-relationship between safety and human performance in dynamic and challenging operational contexts.
The TEM model focuses simultaneously on the operational context and the people discharging operational duties in such context. The model is descriptive and diagnostic of both human and system performance. It is descriptive because it captures human and system performance in the normal operational context, resulting in realistic descriptions. It is diagnostic because it allows quantifying complexities of the operational context in relation to the description of human performance in that context, and vice-versa.
The TEM model can be used in several ways. As a safety analysis tool, the model can focus on a single event, as is the case with accident/incident analysis; or it can be used to understand systemic patterns within a large set of events, as is the case with operational audits. The TEM model can be used as a licensing tool, helping clarify human performance needs, strengths and vulnerabilities, allowing the definition of competencies from a broader safety management perspective. The TEM model can be used as a training tool, helping an organisation improve the effectiveness of its training interventions, and consequently of its organisational safeguards.
Originally developed for flight deck operations, the TEM Model can nonetheless be used at different levels and sectors within an organization, and across different organizations within the aviation industry. It is therefore important, when applying TEM, to keep the user's perspective in the forefront. Depending on "who" is using TEM (front-line personnel, intermediate management, senior management; flight operations, maintenance, air traffic control), slight adjustments to related definitions may be required. This paper focuses on the flight crew as "user", and the discussion herein presents the perspective of flight crews' use of TEM.
Components of the TEM Model
There are three basic components in the TEM model, from the perspective of flight crews: Threats, Errors and Undesired Aircraft States.
The model proposes that threats and errors are part of everyday aviation operations that must be managed by flight crews, since both threats and errors carry the potential to generate undesired aircraft states. Flight crews must also manage undesired aircraft states, since they carry the potential for unsafe outcomes. Undesired state management is an essential component of the TEM model, as important as threat and error management. Undesired aircraft state management largely represents the last opportunity to avoid an unsafe outcome and thus maintain safety margins in flight operations.
Threats are defined as "events or errors that occur beyond the influence of the flight crew, increase operational complexity, and which must be managed to maintain the margins of safety". During typical flight operations, flight crews have to manage various contextual complexities. Such complexities would include, for example, dealing with adverse meteorological conditions, airports surrounded by high mountains, congested airspace, aircraft malfunctions, errors committed by other people outside of the cockpit, such as air traffic controllers, flight attendants or maintenance workers, and so forth. The TEM model considers these complexities as threats because they all have the potential to negatively affect flight operations by reducing margins of safety.
Some threats can be anticipated, since they are expected or known to the flight crew. For example, flight crews can anticipate the consequences of a thunderstorm by briefing their response in advance, or prepare for a congested airport by making sure they keep a watchful eye for other aircraft as they execute the approach.
Some threats can occur unexpectedly, such as an in-flight aircraft malfunction that happens suddenly and without warning. In this case, flight crews must apply skills and knowledge acquired through training and operational experience.
Lastly, some threats may not be directly obvious to, or observable by, flight crews immersed in the operational context, and may need to be uncovered by safety analyses. These are considered latent threats. Examples of latent threats include equipment design issues, optical illusions, or shortened turn-around schedules.
Regardless of whether threats are expected, unexpected, or latent, one measure of the effectiveness of a flight crew's ability to manage threats is whether threats are detected with the necessary anticipation to enable the flight crew to respond to them through deployment of appropriate countermeasures.
Threats can originate from outside or inside the cockpit. They are NOT directly attributed to something the crew did. Threats can be classified as Latent, Anticipated or Unexpected.
These are unknown to the pilot, hidden waiting for particular set of circumstances to occur before they become obvious. A lot of the syllabus sub sections referred to in Human Factors would be known as latent threats.
- pilot fatigue.
- optical illusions.
- physiological stresses.
- poor training.
- poor work environment.
- poor work environment.
- instrument layout.
- cockpit design.
- aircraft design.
- aircraft handling characteristics.
- policies within the company.
- inadequate maintenance issues.
These are known to the pilot and are needed to be managed.
- weather issues.
- unfamiliar aerodrome procedures.
- maintenance requirements.
- keeping to timed flight schedules.
- communications from air traffic control.
A pilot needs to identify unexpected threats as they occur and be prepared to resolve a threat before it induces an error which adversely affects the safety of a flight.
- in-flight diversion.
- system failure.
- missed approach.
- unfamiliar crew.
- busy traffic situations.
The lists below present some examples of threats, grouped under two basic categories derived from the TEM model. Environmental threats occur due to the environment in which flight operations take place. Some environmental threats can be planned for and some will arise spontaneously, but they all have to be managed by flight crews in real time. Organizational threats, on the other hand, can be controlled (i.e., removed or, at least, minimised) at source by aviation organizations. Organizational threats are usually latent in nature. Flight crews still remain the last line of defense, but there are earlier opportunities for these threats to be mitigated by aviation organizations themselves.
- Weather: thunderstorms, turbulence, icing, wind shear, cross/tailwind, very low/high temperatures.
- ATC: traffic congestion, TCAS RA/TA, ATC command, ATC error, ATC language difficulty, ATC non-standard phraseology, ATC runway change, ATIS communication, units of measurement (QFE/meters).
- Airport: contaminated/short runway; contaminated taxiway, lack of/confusing/faded signage/markings, birds, aids U/S, complex surface navigation procedures, airport constructions.
- Terrain: High ground, slope, lack of references, "black hole".
- Other: similar call-signs.
- Operational Pressure: delays, late arrivals, equipment changes.
- Aircraft: aircraft malfunction, automation event/anomaly, MEL/CDL.
- Cabin: flight attendant error, cabin event distraction, interruption, cabin door security.
- Maintenance: maintenance event/error.
- Ground: ground handling event, de-icing, ground crew error.
- Dispatch: dispatch paperwork event/error.
- Documentation: manual error, chart error.
- Other: crew scheduling event.
Threat management is a building block to error management and undesired aircraft state management. Although the threat-error linkage is not necessarily straightforward, although it may not be always possible to establish a linear relationship, or one-to-one mapping between threats, errors and undesired states, archival data demonstrates that mismanaged threats are normally linked to flight crew errors, which in turn are oftentimes linked to undesired aircraft states. Threat management provides the most proactive option to maintain margins of safety in flight operations, by voiding safety-compromising situations at their roots. As threat managers, flight crews are the last line of defense to keep threats from impacting flight operations.
Threat management provides a way of being able to identify and respond to threats using procedural techniques together with tools that will allow the pilot to anticipate and resolve issues before they become errors that would otherwise adversely affect the safety of a flight.
Available techniques and tools:
- studying weather forecasts.
- maintain flight within operational limitations.
- up-to-date training with flight skills and fitness.
- gathering and studying available documentation.
- following aerodrome special procedures.
- diligent pre-flight aircraft inspection.
- up-to-date on emergency procedures.
- carrying out Standard Operational Procedures (SOP).
Aircraft accidents when surveyed have statistically shown worldwide that at least 80% of accidents are caused by human error while 20% of accidents are caused by external environmental factors and aviation system failures.
Errors are defined "actions or inactions by the flight crew that lead to deviations from organizational or flight crew intentions or expectations". Unmanaged and/or mismanaged errors frequently lead to undesired aircraft states. Errors in the operational context thus tend to reduce the margins of safety and increase the probability of adverse events.
Errors can be spontaneous (i.e., without direct linkage to specific, obvious threats), linked to threats, or part of an error chain. Examples of errors would include the inability to maintain stabilized approach parameters, executing a wrong automation mode, failing to give a required callout, or misinterpreting an ATC clearance.
Regardless of the type of error, an error's effect on safety depends on whether the flight crew detects and responds to the error before it leads to an undesired aircraft state and to a potential unsafe outcome. This is why one of the objectives of TEM is to understand error management (i.e. detection and response), rather than solely focusing on error causality (i.e. causation and commission). From the safety perspective, operational errors that are timely detected and promptly responded to (i.e. properly managed), errors that do not lead to undesired aircraft states, do not reduce margins of safety in flight operations, and thus become operationally inconsequential. In addition to its safety value, proper error management represents an example of successful human performance, presenting both learning and training value.
Capturing how errors are managed is then as important, if not more, than capturing the prevalence of different types of error. It is of interest to capture if and when errors are detected and by whom, the response(s) upon detecting errors, and the outcome of errors. Some errors are quickly detected and resolved, thus becoming operationally inconsequential, while others go undetected or are mismanaged. A mismanaged error is defined as an error that is linked to or induces an additional error or undesired aircraft state.
While errors may be inevitable, safety of flight requires that errors that occur are identified and managed before flight safety margins are compromised. Typical errors in GA flight might include:
- incorrect performance calculations.
- inaccurate flight planning.
- non-standard communications.
- aircraft mis-handling.
- incorrect systems operation or management.
- checklist errors.
- failure to meet flight standards e.g. poor airspeed control.
The TEM model accepts that it is unavoidable that pilots, as human beings, will make errors. Errors are defined as flight crew actions or inactions that:
- lead to a deviation from crew or organisational intentions or expectations.
- reduce safety margins.
- increase the probability of adverse operational events on the ground and during flight.
Human errors by pilots originate from within the cockpit when the pilot fails to take action or have taken actions that adversely affect the safety of the flight. The three most common error classifications are:
These errors are unpredictable and occur at different stages. Typically a student pilot when learning to fly can become overloaded and their mental capacity to perform tasks cannot cope with the amount of information they need to simulate which lead to random mistakes. When this situation occurs the student pilot requires revision and practice of basic fundamental training.
This is a repetition of the same error being carried out. Once the error has been identified it usually can be easily corrected.
A pilot may carry out procedures in flight many times without an occurrence of an error but on occasion a serious error can be made, unfortunately this error is most difficult to correct because humans are not 100% error free.
Human error can never be entirely eliminated and for this reason an Error-Caused-Removal approach has been developed to identify and encourage reporting potential sources of errors to help prevent them occurring in the future.
Errors can be grouped under three basic categories derived from the TEM model. In the TEM concept, errors have to be "observable" and therefore, the TEM model uses the "primary interaction" as the point of reference for defining the error categories. These types of errors can occur on the ground or in flight and are categorized as Aircraft Handling Errors, Procedural Errors or Communication Errors.
Aircraft Handling Errors
These errors are caused by pilot inputs through the manipulation of the aircraft controls. Typically student pilots when learning to fly create the greatest number of handling errors. These errors continue to occur in low flight time hour pilots who have not much experience or pilots who have just received an endorsement on a new type of aircraft. Experienced pilots who rely on an automated system such as an 'autopilot' tend to become complacent and can over time lose a level of skilled competency that is required to deal with threats.
- trouble maintaining height when flying manually.
- misjudging round out when too high or too late on landing.
- failure to intercept the desired course by overshooting or undershooting.
- mistaking the amount of power required during an approach
- overcompensating or undercompensating during the gusty wind conditions
Failure to carry out the application of Standard Operating Procedures (SOP) that occur as a consequence of external or internal threats such as time schedule constraints, inadequate communication, distractions from procedures and out of date documentation.
- not adhering to a checklist.
- not carrying out unique procedural requirements at an aerodrome.
- confusion over aerodrome markings.
- failure to successfully follow ATC instructions.
- mistakes made through calculations during flight planning.
- forgetting items of a pre-flight inspection.
Occur from day to day due to a number of reasons.
- poor instructional documentation.
- not using radio phraseology structure.
- poor radio reception.
- foreign speech accents.
- simultaneous receipt of instructions from more than one party.
The TEM model classifies errors based upon the primary interaction of the pilot or flight crew at the moment the error is committed. Thus, in order to be classified as aircraft handling error, the pilot or flight crew must be interacting with the aircraft (e.g. through its controls, automation or systems). In order to be classified as procedural error, the pilot or flight crew must be interacting with a procedure (e.g. checklists; SOPs; etc). In order to be classified as communication error, the pilot or flight crew must be interacting with people ( ATC; groundcrew; other crewmembers, etc).
Aircraft handling errors, procedural errors and communication errors may be unintentional or involve intentional non-compliance. Similarly, proficiency considerations (i.e., skill or knowledge deficiencies, training system deficiencies) may underlie all three categories of error. In order to keep the approach simple and avoid confusion, the TEM model does not consider intentional non-compliance and proficiency as separate categories of error, but rather as sub-sets of the three major categories of error.
Undesired Aircraft States (UAS)
Undesired aircraft states are defined as ‘flight crew-induced aircraft position or speed deviations, misapplication of flight controls, or incorrect systems configuration, associated with a reduction in margins of safety". Undesired aircraft states that result from ineffective threat and/or error management may lead to compromising situations and reduce margins of safety in flight operations. Often considered at the cusp of becoming an incident or accident, undesired aircraft states must be managed by flight crews.
Threats and errors that are not detected and managed correctly can lead to an undesired aircraft state, which could be a deviation from flight path or aircraft configuration that reduces normal safety margins.
Once an undesired aircraft state is recognised, it is important to manage the undesired state through the correct remedial solution and prioritise aircraft control for return to normal flight, rather than to fixate on the error that may have initiated the event.
Examples of undesired aircraft states would include lining up for the incorrect runway during approach to landing, exceeding ATC speed restrictions during an approach, or landing long on a short runway requiring maximum braking. Events such as equipment malfunctions or ATC controller errors can also reduce margins of safety in flight operations, but these would be considered threats.
To put it simply; and Undesired Aircraft State is a result of either a threat or an error that has been mismanaged or not managed. If a pilot miss manages a threat it could be in an undesirable aircraft state. If a pilot miss manages an error it could be in an undesirable aircraft state.
An undesired aircraft state can still be recovered to normal flight but, if not managed appropriately, may lead to an outcome such as an accident or incident. Safe flight in an aircraft requires recognition and recovery from an undesired aircraft state in a very short timeframe before an outcome, such as loss of control, failure to achieve optimum performance or uncontrolled flight into terrain occurs.
Examples of errors and an associated undesired aircraft states in GA aircraft might be:
- mis-management of aircraft systems (error) resulting in aircraft anti-ice settings not turned on during icing conditions (state);
- loss of directional control during a stall (error) resulting in an unusual aircraft attitude (state);
- inappropriate scan of aircraft instruments (error) resulting in flight below VYSE (best single-engine rate of climb speed [blue line speed]) or VXSE (best single-engine angle of climb speed) (state); or
- flying a final approach below appropriate threshold speed (error) resulting in excessive deviations from specified performance (state).
This list is the actual state the aircraft is placed in. Undesired aircraft states can be categorized into three states; Aircraft Handling, Ground Navigation or Aircraft Configuration. Note the items listed below are also listed under Threat or Error management categories above.
Aircraft Handling State
- aircraft controls.
- maintaining track speed and altitude.
- maintaining speed and structural limitations.
- bad flying techniques.
Ground Navigation State
- using the wrong runway or taxiway.
- inappropriate taxi speed.
- hovering too close to other aircraft.
- not conforming to ground operational procedures.
Aircraft Configuration State
- wrong flat or speed brake selection
- inappropriate use of the autopilot mode.
- errors when programming the GPS.
- incorrect navigational aid settings.
- loading the aircraft incorrectly
- misconfiguration of the fuel setting.
An important learning and training point for flight crews is the timely switching from error management to undesired aircraft state management. An example would be as follows: a flight crew selects a wrong approach in the Flight Management Computer (FMC). The flight crew subsequently identifies the error during a crosscheck prior to the Final Approach Fix (FAF).
However, instead of using a basic mode (e.g. heading) or manually flying the desired track, both flight crew become involved in attempting to reprogram the correct approach prior to reaching the FAF. As a result, the aircraft "stitches" through the localiser, descends late, and goes into an unstable approach. This would be an example of the flight crew getting "locked in" to error management, rather than switching to undesired aircraft state management.
The use of the TEM model assists in educating flight crews that, when the aircraft is in an undesired state, the basic task of the flight crew is undesired aircraft state management instead of error management. It also illustrates how easy it is to get locked in to the error management phase.
Also from a learning and training perspective, it is important to establish a clear differentiation between undesired aircraft states and outcomes. Undesired aircraft states are transitional states between a normal operational state (i.e., a stabilised approach) and an outcome. Outcomes, on the other hand, are end states, most notably, reportable occurrences (i.e., incidents and accidents).
An example would be as follows: a stabilised approach (normal operational state) turns into an unstablised approach (undesired aircraft state) that results in a runway excursion (outcome).
The training and remedial implications of this differentiation are of significance. While at the undesired aircraft state stage, the flight crew has the possibility, through appropriate TEM, of recovering the situation, returning to a normal operational state, thus restoring margins of safety. Once the undesired aircraft state becomes an outcome, recovery of the situation, return to a normal operational state, and restoration of margins of safety is not possible.
Flight crews must, as part of the normal discharge of their operational duties, employ countermeasures to keep threats, errors and undesired aircraft states from reducing margins of safety in flight operations. Examples of countermeasures would include checklists, briefings, call-outs and SOPs, as well as personal strategies and tactics.
Flight crews dedicate significant amounts of time and energies to the application of countermeasures to ensure margins of safety during flight operations. Empirical observations during trainig and checking suggest that as much as 70% of flight crew activities may be countermeasures-related activities.
All countermeasures are necessarily flight crew actions. However, some countermeasures to threats, errors and undesired aircraft states that flight crews employ build upon "hard" resources provided by the aviation system. These resources are already in place in the system before flight crews report for duty, and are therefore considered as systemic-based countermeasures. The following would be examples of "hard" resources that flight crews employ as systemic-based countermeasures:
- Airborne Collision Avoidance System (ACAS).
- Ground Proximity Warning System (GPWS).
- Standard operation procedures (SOPs).
- And there are many more avaliable.
Other countermeasures are more directly related to the human contribution to the safety of flight operations. These are personal strategies and tactics, individual and team countermeasures, that typically include canvassed skills, knowledge and attitudes developed by human performance training, most notably, by Crew Resource Management (CRM) training.
Good TEM requires the pilot to plan and use appropriate countermeasures to prevent threats and errors leading to an undesired aircraft state. Countermeasures used in TEM include many standard aviation practices and may be categorised as follows:
- Planning Countermeasures: Including flight planning, briefing, and contingency planning.
- Execution Countermeasures: Including monitoring, cross-checking, workload and systems management.
- Review Countermeasures: Including evaluating and modifying plans as the flight proceeds, and inquiry and assertiveness to identify and address issues in a timely way.
Enhanced TEM is the product of the combined use of systemic-based and individual and team countermeasures.
- SOP Briefing: The required briefing was interactive and operationally thorough.
- Concise, not rushed, and met SOP requirements.
- Bottom lines were established.
- Plans Stated: Operational plans and decisions were communicated and acknowledged.
- Shared understanding about plans "Everybody on the same page".
- Workload Assignment: Roles and responsibilities were defined for normal and non-normal situations.
- Workload assignments were communicated and acknowledged.
- Contingency Management: Crew members developed effective strategies to manage threats to safety .
- Threats and their consequences were anticipated.
- Used all available resources to manage threats.
- Monitor / Cross-Check : Crew members actively monitored and cross-checked systems and other crew members.
- Aircraft position, settings, and crew actions were verified.
- Workload Management: Operational tasks were prioritized and properly managed to handle primary flight duties.
- Avoided task fixation.
- Did not allow work overload.
- Automation Management: Automation was properly managed to balance situational and/or workload requirements.
- Automation setup was briefed to other members.
- Effective recovery techniques from automation anomalies.
- Evaluation / Modification Of Plans: Existing plans were reviewed and modified when necessary.
- Crew decisions and actions were openly analyzed to make sure the existing plan was the best plan.
- Inquiry : Crew members asked questions to investigate and/or clarify current plans of action.
- Crew members not afraid to express a lack of knowledge "Nothing taken for granted" attitude.
- Assertiveness : Crew members stated critical information and/or solutions with appropriate persistence.
- Crew members spoke up without hesitation.
Threats and errors occur during every flight as demonstrated by the considerable database that has been built up in observing threats and errors in flight operations worldwide through the LOSA collaborative. One interesting fact revealed by this programme is that around 45% of flight crew errors go undetected or are not responded to by crew members.
TEM must be integral to every flight, and includes anticipation of potential threats and errors as well as planning of countermeasures. Also included must be the identification of potential threats, errors and countermeasures in the self-briefing process at each stage of flight, and avoiding becoming complacent about threats that are commonly encountered (e.g. weather, traffic, terrain etc).
The following summary is intended to help pilots apply TEM in GA operations:
- Just as you perform a number of tasks on a regular basis in preparation for flight (e.g. interpreting NOTAMs and MET information, checking fuel contents), pilots must include TEM as part of routine pre-flight planning and preparation;
- A few minutes (or more) spent on the ground anticipating possible threats and errors associated with each flight will provide the opportunity to plan and develop countermeasures (e.g. action in the event of unpredicted weather changes). A good starting point is to ask what actions, conditions or events are likely to promote errors, leading to the identification of internal and/or external threats applicable to that flight. This can reduce your workload airborne as you may have already partially prepared yourself with how to deal with those threats and errors.
- brief (self-brief and passengers) planned procedures before take-off and prior to commencing each significant flight sequence (eg. approach to an unfamiliar aerodrome, low-level operations etc);
- include anticipated threats and countermeasures in briefings;
- continuously monitor and cross-check visual and instrument indications and energy state to maintain situation awareness;
- prioritise tasks and manage workload to avoid being overloaded, and to maintain SA;
- identify and manage threats and errors;
- when confronted by threats and/or errors a priority is to ensure the aircraft is in an appropriate configuration to optimise your ability to maintain control of the aircraft and flight path;
- monitor the progress of every sequence and abort if necessary;
- do not fixate on threat or error management to the detriment of aircraft control;
- identify and manage any undesired aircraft state; and;
- recover to planned flight and normal safety margins before dealing with other problems.
take a few minutes at the end of each flight to reconsider what threats, errors and/or undesired aircraft states were encountered during the flight. Ask yourself how well they were managed and what you would do differently to improve management of those threats and errors;
record your threats, errors, and/or undesired aircraft states and discuss them with more experienced pilots to assist with the development of improved TEM strategies.