Threat and Error Management
Part 4
Continuing the Threat and Error Management discussion..... If you are just joining this sub-topic, please go back to the first post with the TEM graphic (Part 1)
First, a quick refresher. There are three components of the TEM model that are relevant here:
Threats are external and internal factors that can increase complexity or introduce additional hazards into a flight operations. Weather, unfamiliar airports, terrain, placarded aircraft systems, language barriers, fatigue, and distraction are examples of threats. Once a threat has been identified, the crew can take steps to mitigate that threat.
Errors are divergences from expected behavior caused by human actions or inaction that increase the likelihood of an adverse event. The difference between an error and a threat is that an error can, with careful attention, be quickly identified and crew members can find prompt solutions to the error. This is sometimes known as "trapping" the error. Untrapped errors can turn into new threats.
Barriers are structures, procedures and tools available to flight crew to trap errors and contain threats. Since no barrier is perfect, the goal is to build sufficient barriers so that all threats are contained and all errors trapped. Untrapped errors and uncontained threats can ultimately lead to an undesired aircraft state, incident, or accident.
The TEM model assumes that there are no perfect aircraft, perfect environments, or perfect humans. The goal is not to create a flawless system, but rater a resilient system.
The standard TEM model lists these available barriers for flight deck operations: Policies and procedures (SOP's), checklists, CRM, aircraft systems (particularly warning and alert systems), knowledge, and airmanship. Knowledge and airmanship are related to not only to training and experience, but also to an individual's commitment to develop their knowledge and airmanship. CRM includes such things as crew communications, monitoring, flight deck discipline, assignment and execution of specific duties. The Captain is the primary driver behind CRM, but the First Officer has obligations here as well.
In Part 3 of this series, I used the TEM model as a lens to analyze where and how the existing barriers failed. The primary reason that multiple barriers failed is that the effective employment of virtually all of these barriers depends heavily on the mental states of the two pilots. SOP's, checklists, CRM, knowledge, and airmanship only work as barriers when the crew can actually draw on them. It is unclear how much of this failure was due to lack of particular knowledge and/or skill as opposed to the inability to draw on existing knowledge and/or skill under pressure. There are indications that the Captain had achieved cognitive overload. This might have also applied to the First Officer, but we must also acknowledge that the FO had far less experience to draw on and may have had discomfort in speaking up. I believe one of the key takeaways from this accident is to appreciate the critical role of the First Officer in safe aircraft operations. A First Officer must not only be able operate the aircraft, run the checklists, and demonstrate knowledge of systems and procedures, he must be able to act as an effective barrier to trap not only his errors, but also the errors of the Captain.
When the traditional barriers failed, they effectively became new threats. These threats were subsequently uncontained and allowed errors to go untrapped leading ultimately to a hull loss and the death of all passenger and crew.
I ended Part 3 with the following question: What should one do when a barrier actually becomes a threat?
I'll be the first to admit that the "barrier as threat" is a bit different take on the TEM model, but I believe it is both valid and useful. From practical experience, I think TEM theory sometimes assumes that barriers are more resilient than they really are in practice and largely ignores the possibility that what was meant to be a barrier could actually become a threat.
However, by adopting a "barrier as potential threat" perspective, the TEM model actually provides some useful guidance. Threats should be identified or anticipated and steps should be taken to mitigate and contain those threats.
The key step here is awareness of the threat, or more specifically, awareness that what was initially considered a barrier might actually become a threat.
Let's go back to that list of potential barriers for flight deck operations - Policies and procedures (SOP's), checklists, CRM, aircraft systems, knowledge, and airmanship - and consider how these "barriers" might actually become threats.
Policy and procedures - I believe most airline SOP's provide useful barriers to the degree that the flight crew actually uses them. However, in some situations those policies may create unappreciated threats. For example, does the airline's policy drive an over-reliance on automation by mandating its use at all times? Do existing policies require/encourage Captains to do most of the actual flying leaving the First Officer ill-equipped to serve as an effective back-up? Do airline policies and/or culture create or sustain a steep authority gradient which discourages First Officers from speaking up or correcting errors by the Captain?
Checklists - Are the checklists (normal and non-normal) well designed? Do they help trap likely crew errors? If a crew member believes a checklist contains a potential threat, how amenable is their airline to modifying that checklist?
Crew resource management - Is the level of knowledge and proficiency of your Captain/First Officer sufficient to be an effective barrier? Is yours? Do the pilots use effective communication and social skills? Do they maintain cockpit discipline? Do they feel free to speak up and correct each other without creating tension?
Knowledge and airmanship - Does the crew receive the right kind of training to be effective? (Just refer to the "mantra" discussion if you need to be reminded of my position on this). Does that training prepare the crew for the known as well as the unknown? Does that training help mitigate the well-known startle and fear reflexes? Does that training emphasize systems management at the expense of basic aircraft skills? Does that training emphasize the need for the execution of NNC in a methodical and deliberate manner?
As we go through this list of questions (please add more if you like), we can develop a picture of where these barriers may actually morph into threats.
Once these new threats are identified, the next step is to attempt to mitigate those threats.
To be continued.....