Human Error and Threat Management (SHELL, TEM, CRM)
This domain tests human error and threat management: the SHELL model, threat and error management (TEM), error types, and the countermeasures that trap errors before they become undesired aircraft states.
SHELL
- Software (procedures, checklists, manuals), Hardware (aircraft and equipment), Environment (weather, traffic, organisation), and Liveware (people).
- The central Liveware is the pilot; mismatches at the interfaces - for example, a confusing checklist or poor cockpit lighting - create error opportunities.
Error and threat
- Slips are execution errors; lapses are memory failures; mistakes are planning failures; violations are deliberate deviations from rules.
- Active errors are immediate; latent conditions sit in procedures, design or training and combine to breach defences - the Swiss-cheese model.
- Threats are events or errors outside the pilot's control; TEM countermeasures avoid, trap or mitigate them.
Worked example
A pilot selects the wrong radio frequency. This is a slip, not a mistake. A readback and cross-check trap it before it causes a communication failure. If the wrong frequency is undetected and airspace is entered, the error becomes an undesired aircraft state.
Traps that cost marks
- Blaming the individual rather than examining the system.
- Calling every deviation a violation; many are slips or lapses.
- Treating a threat as an error; they are different categories.
- Relying on one defence instead of layered countermeasures.