Threat and Error Management
Part 2
Continuing the Threat and Error Management (TEM) discussion....
Necessary preamble.... Yes, there were many other factors leading to this accident, many of which were outside the control of the crew. The TEM model can be applied to those pieces of the puzzle, but my interest is in what can be learned and applied at the professional flight crew level. What are the takeaways so that pilots can avoid a similar situation in the future?
Using the TEM model to analyze the Ethiopian accident, we can look at the factors that were directly bearing on the crew. We can start by asking "What were the threats?"
Threats can be external or internal (inside or outside the crew's direct control). External threats are things such as weather, terrain, language barriers, external pressure to meet schedule, etc). Internal threats could include such things as fatigue, distraction, and crew experience. Threats can also be known and unknown (but not necessarily unknowable). A known threat might be an inoperative aircraft system that has been placarded. Unknown threats which could still be anticipated would include such things as possible aircraft malfunctions during the flight, a pop-up TCAS alert, or a sudden call by tower to execute a go-around from low altitude. Once identified, the next step is to attempt to mitigate the threat using the tools available to the flight crew.
For ET302, environmental threats might include field conditions (high altitude) and high terrain in the general area. Specific detail on the crew pairing and schedule has not been released, but we can probably categorized a low-time First Officer as a potential threat. If the crew had not flown together much, lack of familiarity with each other could have been a threat. Insufficient rest could have created a fatigue issue. It has been suggested that there may have been a steep authority gradient gradient at Ethiopian which would have discouraged a First Officer from correcting a Captain. If so, this would be a threat, but perhaps an unappreciated one if this authority gradient was deeply embedded in the airline culture. The primary unknown threat was the pending AOA malfunction. Another possible unknown threat was a lack of specific systems knowledge as it related to MCAS and the subsequent trim problem.
For each of the identified (known) threats, what could have the crew done to mitigate them? Primarily, by actually identifying the threats and briefing any appropriate procedures - forewarned is forearmed. For example, one thing I do whenever I fly with a new First Officer is that I explicitly state that anyone on the flight deck can make an error and it was the job of the other pilot to correct those errors. I want my FO's to feel free to speak up. Slowing down and methodically using checklists and flows is another good mitigation strategy. In the more extreme cases, simply refusing to depart until the situation has been satisfactorily changed for the better may be the most appropriate mitigation strategy.
The next question in this analysis is, "What were the errors?"
Errors are caused by human actions or inaction that increase the likelihood of an adverse event. The difference between an error and a threat is that an error can, with careful attention, be quickly identified and crew members can find prompt solutions to the error. This is sometimes known as "trapping" the error. The impact of an error can, therefore, be quickly reduced if properly managed. If not managed correctly, an untrapped error can lead to an undesired aircraft state or create a new threat (known or unknown). Examples of errors include procedural errors, perception errors, miscommunications, and violations of SOP's (intentional or unintentional).
The crew errors seem to fall in the following categories: perception errors (not picking up on obvious cues), procedural errors, CRM errors, and basic airmanship errors. Most of these have been extensively discussed, so I won't repeat them here.
The next question is what were the barriers that should have enabled the crew to trap any error before they led to an undesired aircraft state?
Traditional aviation barriers include policies and procedures, checklists, CRM, knowledge and aircraft handling skills, as well as external resources (ATC, maintenance, etc).
As we look at this accident through the TEM lens, I think there are two very important questions:
Why did the existing barriers fail?
What happens when a barrier actually becomes a threat?
Last edited by 737 Driver; 7th May 2019 at 13:22.