Threat and Error Management (TEM)

Threat and error management (TEM) is a way of describing, and managing, the safety of a flight. It sorts everything that can erode safety margins into three components: threats that arise outside the flight crew, errors the crew make themselves, and the undesired aircraft state (UAS) that can result when either is mismanaged. The crew's task is to anticipate threats, catch errors early and recover from any undesired state before it turns into an incident or accident.

TEM grew out of airline line audits in the 1990s and now runs through ICAO guidance, the EASA theoretical knowledge syllabus and airline training worldwide. It is closely tied to crew resource management: CRM supplies the communication, monitoring and decision-making skills, and TEM gives them an operational target by saying what those skills are defending against. Exam questions test the definitions and classifications below almost word for word.

Origins of the TEM framework

The model was developed by the University of Texas at Austin Human Factors Research Project, led by Robert Helmreich with James Klinect and John Wilhelm. In 1994 Delta Air Lines, which had introduced a new CRM course, asked whether its lessons were actually being used on the line. The university and the airline developed a method of observing normal scheduled flights from the jump seat, the forerunner of the Line Operations Safety Audit (LOSA). At first the observers mostly rated CRM behaviour. From 1997, work with Continental Airlines widened the method to record the threats crews met and the errors they made, and how both were handled. That coding scheme became the TEM model.

ICAO took the model up through its Flight Safety and Human Factors Programme. Its Human Factors Training Manual (Doc 9683) covers TEM training, Annex 1 defines threats and errors, and the training procedures in PANS-TRG (Doc 9868) treat pilot competencies as countermeasures to threats, errors and undesired aircraft states. TEM is often described as the sixth generation of CRM, following a fifth generation that had already shifted the emphasis from avoiding error to managing it.

The TEM framework

The three components are defined as follows:

Two points of the definitions matter in practice. First, threats and errors are a normal part of every flight; TEM does not assume they can be eliminated, only that they must be managed. Second, a mistake made by someone else, such as a controller or a maintenance engineer, is a threat to the flight crew, not a crew error.

The components form a chain. A threat that is not managed can induce an error; an error that is not trapped can produce an undesired aircraft state; and a state that is not recovered can end in an incident or accident. Each link corresponds to one of the three defences of error management: avoid (manage the threat), trap (catch the error) and mitigate (recover the aircraft). The model is deliberately neutral about blame. It records what happened and how well it was managed, not whose fault it was.

Types of threat

ICAO classifies threats by how predictable they are.

• Anticipated threats are known or expected before they arise: forecast thunderstorms, a congested destination, a runway with a known illusion, an aircraft dispatched with an inoperative item. They are managed mainly by briefing them in advance.
• Unanticipated (unexpected) threats appear suddenly and without warning: an in-flight malfunction, a late runway or route change, a medical emergency in the cabin. The crew must apply general knowledge and skill, because there was nothing specific to brief.
• Latent threats are not directly obvious to, or observable by, crews immersed in the operation, and usually have to be uncovered by safety analysis. ICAO's examples are equipment design issues, optical illusions and shortened turnaround schedules.

Environmental and organisational threats

Threats are also grouped by where they come from. Environmental threats arise from the environment in which the flight takes place. Some can be planned for and some appear without warning, but all have to be managed by the crew in real time. Organisational threats originate in the aviation organisation and can, in principle, be removed or reduced at source. They are usually latent in nature, so the crew is often the last line of defence against them.

Errors in TEM

An error in TEM is always a flight crew action or inaction. Errors are grouped by the kind of activity in which they occur:

The classification describes what went wrong, not why. It is therefore different from James Reason's split into slips, lapses and mistakes, which depends on the person's intention, and from Rasmussen's skill, rule and knowledge levels of behaviour (see human error). An error that is detected and corrected quickly is said to be trapped and has no consequence. One that is not may lead to a further error or to an undesired aircraft state. TEM teaches that error detection and response matter as much as error avoidance, because even the best crews make errors.

Undesired aircraft states

An undesired aircraft state is the last point in the chain at which the outcome is still under the crew's control. ICAO groups UAS into three categories:

• Aircraft handling: vertical, lateral or speed deviations, unnecessary flight into adverse weather, penetration of airspace without clearance, operation outside aircraft limitations, an unstable approach, continuing to land after an unstable approach, or a long, floated or firm landing.
• Ground navigation: proceeding towards the wrong taxiway or runway, or to the wrong stand or holding point.
• Incorrect aircraft configuration: wrong settings of systems, flight controls, automation or engines, or an incorrect weight and balance configuration.

The key lesson is a change of priority. Once a UAS exists, the crew must stop concentrating on the error that caused it and concentrate on recovering the aircraft. The classic example is the approach that is high and fast at the stabilisation gate: the right response is a go-around, not a debate about why the descent was started late (see stabilised approach).

An event such as an engine failure is not in itself a UAS, because it was not caused by the crew; it is a threat. A UAS is crew-induced by definition, although it may follow from a threat that was poorly managed.

Countermeasures

TEM countermeasures are what crews use to manage threats, errors and states. They come in two families.

Systemic-based countermeasures, often called the hard resources, are built into the aircraft and the operation: ACAS, GPWS and TAWS, standard operating procedures, checklists, briefings and training. Individual and team countermeasures, the human resources, are the skills, knowledge and attitudes developed chiefly by CRM training. The best results come from combining the two: a checklist traps errors only if the crew runs it with attention, and an alert protects only if the crew responds to it.

ICAO divides the individual and team countermeasures by phase:

View full schematic

A good threat briefing is short and specific. Rather than reciting the approach chart, the crew names the two or three things most likely to catch them out on this particular flight, agrees what each pilot will watch for and decides in advance what will trigger a go-around or a diversion. The same habit extends to single-pilot flying, where the pilot names the threats aloud and sets personal limits before departure.

TEM in training and audits

The LOSA method is the main source of TEM data. ICAO describes it in Doc 9803 and lists ten operating characteristics, among them peer observations of normal flights from the jump seat, anonymous, confidential and non-punitive data collection, voluntary crew participation, trusted and trained observers, joint management and pilot union sponsorship, an observation form based on TEM, a secure data repository, data verification roundtables, improvement targets derived from the data, and feedback of the results to the workforce. If a crew declines to be observed, the observer simply takes another flight. The findings show an airline where its threats, errors and undesired states cluster and whether its procedures work as intended.

In Europe, TEM is part of licensing as well as operator training. EASA ED Decision 2018/001/R, published in February 2018 and often called the 2020 syllabus, introduced TEM into the learning objectives for the theoretical knowledge examinations. It also expects exercises during theory training to apply TEM, preferably in scenario form. In commercial air transport, TEM is normally delivered through the CRM training required by ORO.FC.115 and ORO.FC.215, whose elements AMC1 ORO.FC.220 requires to be integrated into all appropriate phases of operator conversion training.

In the United States, TEM reaches pilots mainly through CRM training for Part 121 crews under 14 CFR 121.404, with guidance in Advisory Circular 120-51E, and through LOSA, which AC 120-90 (2006) describes for voluntary use by operators. The FAA presents TEM as a framework for applying CRM skills on the line.

Competency-based and evidence-based training take the idea further. PANS-TRG treats each pilot competency, such as communication, situation awareness, workload management and flight path management, as a countermeasure in its own right, so that TEM becomes the lens through which training scenarios are designed and crew performance is assessed. See also situational awareness and decision making.

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.