How Pilots Think About Risk

What psychologists have proven over the years is that humans willingly accept voluntary risks but shun danger that they believe is out of their control. We often take on voluntary risks that are hundreds of times greater than an involuntary danger that worries us and we try to avoid.

An example would be those guys weaving in and out of traffic at extreme speeds on superbike motorcycles. To those of us sitting in our cars it's hard to imagine more risky behavior, but clearly the riders have accepted that risk. And clearly those riders feel like they are in control of what to the rest of us is an obvious danger.

The fearful airline passenger is another example of involuntary risk. There is no safer way to cover long distances than in a jet airliner operated by a major airline, but strapped into the passenger seat, you have given up all control of your fate. The same guy swerving around cars on the freeway may in fact be afraid to fly, or at least concerned about, his safety on an airliner. It's not logical, but that's why it is important to understand how we handle risk.

Terrorists, at least at some subliminal level, understand our conflicted reaction to various risks. The chance of being harmed by a terrorist in the United States is infinitesimal compared to all types of ordinary danger such as accidents or major disease, but we worry about terrorists and have spent large sums and disrupted our lives to prevent another terrorist attack. People who gladly pay large sums to own homes in high-probability earthquake zones, or live on a hurricane-prone beach, worry about terrorists when they have paid to have homes that hold hundreds of times more risk. But one chooses where to live so that risk is voluntary while terrorists strike their terror by remaining beyond our control.

These attitudes explain a great deal about how aviation has evolved with its various levels of safety. The paying passenger has no control over his safety in flight so we demand the highest standard of safety for airlines and charter flights. Passengers in their own airplane -- even though not always flying themselves -- have a great deal of control over how risky a flight may be so regulation of that type of flying under FAR Part 91 rules is less strict than for airlines. And at the highest level of risk is the airplane owner flying his own airplane where the rules allow him to take on as much risk as he is willing to accept.

Flying a single-engine airplane is the most obvious form of voluntary risk acceptance. If the engine fails everybody knows the airplane will make a forced landing. What makes it acceptable to fly a single is that engine failures are infrequent and the success of forced landings when the motor does quit is high. We can also improve our odds by keeping a big reserve of fuel on board and paying careful attention to maintenance.

In return for the voluntary acceptance of the single-engine risk we reap enormous cost savings over a multi, making available airplanes and levels of performance that would otherwise be economically out of reach. The pilot accepts this risk voluntarily and few spend much time worrying about it, but those who do not have control -- passengers -- are often consumed by worry over engine failure, and many people simply won't get in a single-engine airplane.

But this varied attitude toward risk explains to me why pilots worry about some aspects of flying safety more than others that are statistically more significant. In other words, the voluntary risk studies explain why many pilots mistrust automated systems in an airplane while accepting other even larger risks without a thought.

I have noted and commented on the anti-autopilot attitude of many light airplane pilots and instructors for years. I believe that is changing and autopilots are now much more accepted and used as a fundamental part of flying in piston airplanes than was true even a few years ago. But piston airplane pilots still don't use autopilots at the same universal level as do pilots flying turbine airplanes.

But the crash of the Air France Airbus 330 has uncovered a level of mistrust in automation among even the most experienced and sophisticated pilots. With the mystery surrounding the crash, many experienced jet pilots I know focus on the fly-by-wire computerized control system of the Airbus. The computer system and its sensors almost immediately became the focus of speculation about the cause of the accident.

It's odd that pilots who completely trust a thin flexible wire that is routed through the airplane out to a hydraulic actuator at the flight control surface are suspicious of a multiply redundant electronic system that uses several paths to send commands to redundant actuators at the flight control. But that thin wire is connected directly to the controls in the pilot's hands. He has accepted the risk that the wire could break or the hydraulic system lose fluid. But there is nothing between the pilot of a conventionally controlled airplane and the control surfaces to modify or change his commands. He is in control without a computer to restrain his inputs even though they may endanger the airplane.

The FAA takes the opposite view in its current certification standards. It would be almost impossible to find enough redundant paths for control cables and hydraulic lines to certify an all-new large business jet or airliner with conventional controls. The current rules worry about uncontained engine failures, or various structural failures that could sever the conventional control cables and lines. And it is not an unfounded concern. We all remember the DC-10 where the uncontained failure of the center engine severed all three flight control hydraulic lines and left the crew with little more than differential engine power manipulation to crash at Sioux City. And there have been other incidents of conventional control system failure.

With a fly-by-wire system the wires between flight controls, computers and flight control actuators can be run over widely separated paths so the odds of losing all paths are huge. Vital components are physically isolated from one another and also have independent sources of power. And every important function is at least triplicate.

But many pilots worry about the computers that convert their control inputs into actual movement by the flight controls. Those computers are programmed to protect the airplane from pilot mistakes. For example, typical fly-by-wire systems will not allow the airplane to be pitched to the stalling angle of attack. If a pilot persists on pulling back on the controls the computers will simply refuse to pitch up to the stall. The computers will also prevent the pilot from overstressing the airframe.

There are varying attitudes about how much authority to give the fly-by-wire computers with some airplane makers giving the pilot more direct control than others. Airbus is one of the most automated systems and is thus the target of the most suspicion by pilots.

I can't think of any new advance in aircraft automation that hasn't improved safety. Certainly the invention of the flight director/autopilot system decades ago made a perfect approach possible every time. And autothrottles maintain perfect speed. The automatic landing system found in nearly all airline jets has not missed the runway yet as far as I know after more than 40 years of experience. The collision and terrain warning systems, the flight management systems and so on have all helped prevent accidents that had happened in the past.

But fly-by-wire is different. In some pilots' minds it has taken control away and thus the risks accepted by those pilots are no longer voluntary.

No amount of certification data is going to change the way pilots think about automation, at least not entirely. Fly-by-wire is not new, and has been accepted if sometimes grudgingly. It's here to stay and I think it can play a part in advancing safety. But unless the flight data recorder of the Air France flight can be recovered and contain conclusive evidence absolving the fly-by-wire system of blame, suspicion will continue.

I don't believe that I or other pilots can change the way we choose to accept risk but I do hope to understand why I make the choices I do. And it is clear that we need to worry most about the risks we accept voluntarily because those are the greatest of all.

Flying's New Owner In June Flying magazine was acquired by Bonnier Corporation. All of your favorite writers and columnists will be here, but we have a new corporate parent.

Bonnier is a 200-year-old family-owned media company based in Sweden. Over the past several years Bonnier has been acquiring special interest magazines in the United States and now has nearly 50 titles. Many of the magazines are familiar, such as Popular Science, Yachting and Field & Stream. Other magazines serve much narrower niches. But in every case the magazines focus on a special interest such as, well, flying.

It is this total devotion to special interest publishing that bodes well for the future of Flying. While all types of media are impacted by the economic downturn and the effects of the internet, special interest magazines are holding up better. Our readers are passionate about aviation and want to have a magazine devoted to it to hold in their hands, refer to many times, and even store away for reference in the future. Bonnier understands this and promises to invest in the magazine's future and keep all of our passion alive for Flying.

Blown Forecast Just a couple of months ago I wrote about how accurate the computerized flight planning programs have become. I had grown accustomed to flight plans that were within a couple of minutes, with a 10 minute difference between the plan and the real flight being a big miss. But this past June the forecasters really blew it.

I was on the usual path from White Plains airport just north of New York City to Wichita, which means yet another interminable flight over Pennsylvania, home of bad weather and turbulence. And it's really a long way across in the east-west direction. The flight plan, using the winds aloft forecasts from the government, predicted an easy trip with only about 10 to 12 knots lost to headwinds.

But even the TV forecast people I watched before departure showed a north-south front in the middle of the state. Some showed it as a cold front, others as stationary, but all agreed it was there. Not long after takeoff both XM Weather and Avidyne/Sirius showed about 100 miles worth of light to moderate rain where the front was shown on TV. But the winds forecast ignored the presence of the front and showed a consistent light eight to 10 knots of westerly wind at 9,000 feet all the way across PA.

It seemed like the forecasters and their computer models had somehow figured out that this front was different and that, like every other front, strong winds wouldn't be near the frontal area. I started to believe the winds forecast because the winds were light for the first part of the trip. But as I neared the precipitation that so clearly marked the front, the winds picked up. Instead of 10 knots the headwind was more than 40 knots. That's a miss of 400 percent. And the unforecast strong winds continued all the way to Indianapolis where I stopped for fuel.

My question is how can the same computer software programs that correctly showed the location and existence of a strong front not figure out that there would be a big wind change at the front? Isn't predicting the existence of a weather front enough to suggest that the wind will change at the front? Who knows?

But, the winds aloft forecasting accuracy is much better than it was even a few years ago. Perfection, or near perfection, is still in the future. I should have applied my own Kentucky windage to the flight plan and I would probably have been pretty close.