Threat and Error Management: The Safety Margin You Cannot See

Safety statistics are reassuring until you ask what they actually count. They count outcomes: accidents, serious incidents, the events that cross a threshold. They do not count the flights that ended in a normal landing because a controller queried a clearance, an engineer noticed the wrong part number, or a captain recognised that the mental model in the flight deck no longer matched the aircraft.

That quiet space between a threat and its consequence is where Threat and Error Management actually operates. It is the safety margin you cannot see on a dashboard.

Threats are not only weather

Most crews think of threats as environmental: a thunderstorm, a contaminated runway, an unfamiliar airfield. Those are the obvious ones. The threats that cost the most are organisational and human — a late crew change, an MEL that reshapes the workload, a language barrier with a controller, a first officer in their first week on type, a captain with four sectors and six hours of sleep.

The discipline is to name them before they become pressure. A threat identified at the gate is a planning problem. The same threat identified at five hundred feet is an emergency.

Errors are evidence, not failure

Every pilot makes errors. The question is not whether a crew will err, but whether the error will be detected and recovered. Detection depends on three things: workload, expectation and communication.

• Workload. The busiest phases are the least forgiving. Distraction during a checklist is how an item gets skipped, and a skipped item rarely announces itself.
• Expectation. We see what we expect. A crew that believes the aircraft is configured will read back a configuration that is not there.
• Communication. An error spoken aloud can be caught. An error silently corrected — or silently repeated — usually cannot.

The most valuable sentence in a flight deck is not "I have got it". It is "I am not sure — check this with me".

Detection is a trainable skill

In training we rehearse responses. We should also rehearse detection. The techniques that work in the simulator and on the line are unglamorous:

1. Read the checklist aloud, and mean it. The reading is the barrier, not a formality.
2. Use the challenge, including when you are certain. Especially when you are certain.
3. Narrate deviations. If the plan changed, say how and why, so the other crew member's mental model stays aligned.
4. Pause after interruptions. Return to the interrupted task deliberately, not from memory.
5. Debrief the near-misses. The error that was caught is the most instructive event of the sector, and the one that never reaches a safety report.

Making it part of the operation

A briefing that names the three most likely threats for this sector is worth more than a paragraph in a manual. It takes two minutes and produces a shared vocabulary for the rest of the flight.

The margin you cannot see

An operator's safety performance is often judged by its accident rate. A better indicator is the quality of its conversations about error: whether crews report the mistakes they caught, whether those reports are read, and whether the findings change anything.

The visible margin — the extra fuel, the alternate, the longer runway — protects a flight. The invisible margin — the habit of speaking up, of checking the certain, of pausing after the interruption — protects the operation.

Both are engineered. Only one is usually taught.