--by Paul Preidecker, FAA Safety Briefing Guest Writer
If I told you that you had only had five minutes to buy a new car, would you make the right decision? I definitely would not. I would need to take my time, do some research, maybe create a database of information, analyze, and compare. Only then would I feel ready to make that kind of decision. Put another way, most of us do not make good decisions under time pressure.
As pilots, though, we make dozens of decisions … literally on the fly, without the luxury of time. Most often, we manage decisions concerning our flight with relative ease. Our experiences have helped build an internal database of answers. We have a host of flight planning resources available, and technology such as ADS-B to help make the right decisions en route.
Effective risk management is essential to safe operations, so the well-known mantra of aviate, navigate, and communicate has evolved to add mitigate. But in order to mitigate risk, we have to know, or at last anticipate, what those risks are. The risk management section of the Airman Certification Standards (ACS) can help, but let me offer an additional idea. GA pilots can also mitigate risk by using a model borrowed from the airlines: Threat and Error Management (TEM).
The goal of TEM is simply to identify and recognize threats, reduce errors, and prevent undesired aircraft states. TEM acknowledges that there is no such thing as a perfect flight, that we operate in a complex environment, and that we will make mistakes.
TEM further recognizes that accidents rarely occur due to a single event or error; rather, they result from a chain or series of events or errors. Breaking the chain can stop an accident, and the best approach is to break the chain at the earliest point. That means you must become aware of threats and errors that constitute the beginning of the accident chain. So, the TEM approach is designed to help pilots recognize and prevent those mistakes from escalating into operational errors.
TEM Terms
In the parlance of TEM, a threat is an event or situation that occurs outside the pilot’s ability to influence, increases the operational complexity of a flight, and requires attention/management to maintain safety margins. For example, dealing with adverse meteorological conditions, airports surrounded by high mountains, congested airspace, aircraft malfunctions, and errors committed by other people outside of the cockpit, such as air traffic controllers, flight attendants, or maintenance workers. Threats can be classified into three categories: operational threats (e.g., equipment malfunctions or taxiway closures); environmental threats (e.g., weather and ATC); and mismanaged threats (e.g., stepping on the wrong rudder in an engine out situation.) The threat in this example starts as an engine out. Stepping on the correct rudder helps mitigate the threat of the engine out. Stepping on the wrong rudder (mismanaged) is an error that now induces another threat, loss of control. It’s important to know that threats are not just observable events or situations; they can also arise from the decisions we make about those situations. The all-too-familiar visual meteorological conditions (VMC) into instrument meteorological conditions (IMC) scenario is just one example.
An error is a pilot action or inaction that leads to a deviation from intentions or expectations, reduces safety margins, and increases the probability of adverse operational events on the ground or during flight. Errors also come in three categories: aircraft handling errors (e.g., speed, configuration, or automation); procedural errors (e.g., intentional or unintentional deviation from regulations or aircraft operating limitations); and communication errors (e.g., misunderstanding between you and ATC). Note that errors do not always arise from threats. Selecting flaps above published flap operating speed is an error that may not be associated with any threat.
Although what I have described above is not an all-inclusive description of the typical TEM model, here’s a simple way to distinguish between threats and errors:
Threats come at you; errors come from you.
How Do CRM/SRM Play with TEM?
CRM and SRM are both valuable players on the safety team. As you will read in other articles, CRM — now generally known as crew resource management (CRM) — is about leveraging all available resources to help you manage a flight. Adapted from CRM, single pilot resource management (SRM) is a tool that individual pilots can use for this purpose. When I fly for the airlines, I have the benefit of fellow crew members, ATC, dispatchers, gate agents, and others. When I fly GA, I view ATC and flight service as part of my crew. GA pilots also have flight planning tools, maybe a pilot partner, and technology such as GPS and ADS-B.
Here’s the distinction:
CRM/SRM is about managing resources, and TEM is about managing threats.
Setting the Trap
Most threats, and the errors that may arise from them, increase the complexity of a flight. Typically, they require time or action to manage. Therefore, workload increases. Increasing workload is in fact a threat. The sooner we manage threats and break the chain, the more effective we will be at maintaining safety. Left unmanaged, threats can compound creating a multiplying effect of errors.
In the language of TEM, we talk about trapping errors. A trapped error is the first step in breaking the chain of events that may lead to trouble. Here’s an example: ATC clears you to a new altitude while you are listening to ATIS. You are not certain you heard the assigned altitude. Rather than changing to the altitude you thought you heard, you request clarification.
An un-trapped error is just that: You make an error and you fail to recognize it. Un-trapped errors may or may not have associated safety consequences. For example, suppose you are flying an instrument approach and you do not set or brief the missed approach altitude. If you land without incident, there is no safety consequence. But if you miss the approach and fail to climb to the appropriate altitude, there’s an obvious safety problem.
So here’s another definition: The result of not effectively managing threats and trapping errors is the undesired aircraft state. An undesired aircraft state is an aircraft position, speed, altitude, or configuration that results from pilot error, actions, or inactions. It clearly reduces safety margins. It can result from something as simple as flying an incorrect heading or crossing a hold short line without a clearance.
We Are the Problem, and We Are the Solution
Human beings are most often the problem in that we fail to recognize our errors or the errors of others. Fortunately, we are also the solution. Through training and practicing TEM, we can adopt strategies and countermeasures to effectively mitigate risks.
The TEM approach starts with anticipation. Anticipation is recognizing that something is likely to go wrong, even if we do not know exactly what or when. Anticipation thus leads to vigilance, which means following the discipline of always being on guard, even on the most routine flight. The next step is recognizing a problem, and after recognition comes recovery, correcting the situation before it leads to an error or unintended aircraft state.
Recognition and recovery are both countermeasures. There are many other countermeasures we can use to prevent threats from turning into errors. For example:
Technology (e.g., flight planning tools, GPS, and ADS-B) can help provide increased situational awareness and information both prior to, and after departure. However, keep in mind that technology can be a threat if it is a distraction. Don’t forget to look outside and know your equipment well.
Briefings are essential in a crew environment, as they create a shared mental model. In GA, though, you can brief yourself. Some pilots like to brief an approach out loud. Proper pre-flight planning requires getting a weather briefing from a qualified briefer or from flight planning programs.
Checklists and procedures that you consistently follow are also safeguards. Creating and following standard operating procedures on every flight will help you become a more reliable pilot, especially if you are tired, distracted, or dealing with unexpected weather or a mechanical issue.
As PIC, you are the last line of defense. As final authority, it is your responsibility to mitigate risk and manage safety. You trust your mechanic, but it is up to you to thoroughly preflight your aircraft and make sure paperwork is in order. You trust the fuel handler, but always check to make sure you received fuel. You trust ATC, but it’s up to you to embrace the meaning of PIC.
The PAVE model can be a starting point to help you apply TEM strategy.
Paul J. Preidecker (paul@flightdeckinsights.com) is a pilot and check airman for a regional airline. He is active in GA and seeks to improve training by developing best practices and standard operating procedures for GA pilots.