Understanding Safety / SMS More


Threat & Error Management

Threat and Error Management (TEM) was developed by the University of Texas, Austin, Human Factors Research team. It is an overarching safety model depicting the relationship between human and environmental factors in a dynamic and challenging operational context. It can be used theoretically as well as practically. The two main targets of TEM framework is to categorise the factors contributing in events and as a training aid for pilots for managing errors. It is primarily based on James Reason Swiss Cheese Model.

The model is an applied methodology and was empirically developed through audits and observations of actual operations. For this TEM was developed and evolved gradually. It recognises the important influence of Human Factors in a dynamic environment, for it is the influence of the complexities that consequentially affect safety. Threats are defined as any issues occurring outside the control of a pilot (external factors) – which can increase complexity, but the crew still has to manager them for the safe conduct of the flight. Many times, these threats come in the form of simple distractions from primary tasks and if not properly managed they can consequentially lead to errors and influence safety. Errors are the mistakes the crew makes and can lead to deviations from the intended flight path or expectations. Errors can be classified as hard (e.g. improper handling, or wrong FMS programming), soft (e.g. communication errors) or procedural (e.g. rushed checklist). Mismanage of errors lead to an Undesired Aircraft State, which is incorrect position, wrong location, improper configuration, wrong energy of the aircraft in relation to the intended plan. The model becomes very useful at the functional level as it directly relates to the actual duties performed and on situations experienced. It is thus easier for front-line employees like pilots and technicians, to identify the threats and manage them accordingly. TEM is considered one of the few initiatives that are collective industry experiences. It is a descriptive model as it captures System performance and Human performance in the normal operational context in reality. TEM can also be a diagnostic model as it allows the quantification of issues and complexities- threats.

TEM allows to be used as a safety analysis tool (both in single events or in large audits), as a licensing tool or as a training tool in all levels of the organisation.

Threats increase complexity. Some of them are known in advance (e.g. weather, terrain, traffic) and can be briefed and be prepared for. Others are unexpected (e.g. malfunctions) where the application of knowledge and skills is required. However, the third category of threats is the most dangerous which is the threats that are uncovered only after the safety analysis. Examples are optical illusions, system design faults etc.

Managing threats is the building of the foundations of error management, as the more threats we anticipate and prepare for, the more appropriately we deploy the necessary countermeasures and the less exposed we are to events. The first and most important step to threat dealing is to identify them. Briefings prior the initiation of a function helps, but most important is the sharing of information between colleagues creating vigilance and awareness. Threats can be environmental - weather, ATC, airport infrastructure and traffic, terrain, equipment etc; or organisational – operational pressure, dispatchability issues, cabin/ passenger issues, maintenance, documentation, scheduling, rostering etc. Threat management can be summarised in Asses, Act Monitor, whilst the barriers to an effective threat management can be form of distractions, interruptions or pre-occupations.

Errors can be either actions or inactions. They can be intentional or unintentional. These categories are not mutually exclusive, meaning that an error can be classified in more than one category. Errors result in a reduction of safety margins. In TEM more emphasis is given on the detection and response of errors rather than the causality, as the timely detection and response will re-establish the safety margins. Error responses can be trapping the error – detected and managed, exacerbate – detected but the wrong action worsens the situation, or failure to respond – where the errors remains undetected.

Undesired Aircraft States can be any of the following examples: wrong taxiway (incursion), unstabilised approach, incorrect system operation, wrong weather penetration, incomplete checklist etc. Correct response to an undesired state will restore safety, whilst a wrong response can further escalate the situation.

It is important for the front-line employees (especially pilots who experience high speed and high energy with fast decision-making) to be trained to differentiate between error management and undesired aircraft state response, and when to switch from one skill to the other. It is also possible to move directly from threat to undesired state without an error occurring or a threat existing prior.

Similar to error, undesired state can be mitigated, exacerbated or failed to respond. The resolution of U.A.S. will be either recovery, additional error, or a crew caused incident/ accident.

TEM has assisted in establishing many safety and training tools (e.g. LOSA, NOOS, OJT)