What is Pilot Error?

Real pilot errors can only occur in transport-category airplanes that are being flown to the FAR Part 121 standards that govern the major airlines. This type of flying is the safest that we know how to do, or at least is the safest tradeoff our society is willing to make when it compares risk to financial costs and convenience. Business jet operators may choose to fly their transport-category airplanes to an even higher safety standard than the airlines, and many do.

The reason that true pilot errors can only happen in this highest level of flying is because every reasonably foreseeable circumstance has been addressed in the design and certification of the airplane, the training of the pilots and the operational rules they fly under.

For example, a transport-category airplane must have multiple electrical systems, each capable of powering the entire airplane under night IFR conditions. But even two or three independent electrical systems with their own generating sources do not rise to the very highest level of redundancy required, so the aircraft batteries must be able to power essential IFR equipment for at least 30 minutes to allow the pilots to land the airplane after even the worst happens.

Redundant engine power is another obvious requirement in the transport category. Flight control operation, brakes, pressurization, lighting and all other critical systems must be backed up to the point that certification authorities agree the total loss of any critical function will not happen more than once in a billion flights. That is the same standard applied to the primary structure of the airplane.

The pilots must be trained to the highest level and retrained regularly. And there must always be more than one pilot fully qualified to fly the airplane under all conditions. The operating rules stipulate significant margins of runway length for takeoff and landing and set absolute limits on weather conditions such as visibility and wind. In other words, a large number of people have been sitting around for years thinking of things that can go wrong in flight and then defining a way to prevent those inevitable failures from leading to a crash.

So when a transport airplane flying to the airline standards does crash, somebody made an error. It could be a mistake by the pilots, for sure, but it could also be an error in design, certification, maintenance or dispatch, because every function is held to the same high standard. After most major jet accidents a series of errors is documented because the layers of redundancy in the operation are so complete that a single mistake won't bring the airplane down.

A pilot error in transport flying is a failure to follow the proper procedure, because there is a specific procedure for every event, and, if correctly implemented, the procedure leads to a safe landing. For example, if an engine fails at the worst time the pilot flying has been trained and retrained to step on the correct rudder pedal, maintain the predetermined optimum climb speed and continue the flight. Before takeoff all factors, including weight, elevation, runway availability, atmospheric conditions, obstructions, and so on, have been considered, and the pilots know the airplane will fly if the proper procedure is applied.

All bets are off, however, if there is an error in the design, certification, manufacture or maintenance of a transport airplane. The procedures pilots fly only assure a successful outcome to foreseeable events. For example, certification authorities do their best to make sure that the rotating components of a jet engine stay inside the engine if they fail. As another layer of protection against an uncontained engine failure, critical aircraft components that are located in the so-called "engine rotor burst zone" are spaced as far apart as possible and shielded as much as possible to try to prevent a single piece of flying shrapnel from a failed engine from damaging all components of a redundant system. But if something went wrong in the design, certification, manufacture or maintenance of a jet engine and the parts come flying out, no absolute pilot procedure can apply to the potential damage, and the pilots are on their own.

Let's now compare the world of transport flying to personal aviation. In the typical light airplane there is only one of each critical system, including propulsion in the case of a single-engine airplane. There is also usually only one pilot. And the operational rules allow that pilot enormous latitude to decide when and where to fly. That's the best thing about our system. We have enormous freedom to fly our personal airplanes, but in turn we individually shoulder the responsibility.

When the pilot of a personal airplane fails to complete a flight successfully the cause is often labeled pilot error. But where is the error? If the pilot ran out of fuel or forgot to lower the landing gear, there was an error, but I maintain that crews of two or more simply don't forget the gear, so the decision to fly as a single pilot removes the backup to a potentially damaging event. By not requiring a licensed dispatcher to plan the flight and back up the pilot's fuel decisions, the running out of gas was a foreseeable event that was not prevented.

What is usually called pilot error in personal flying is actually the result of a pilot decision. In perfect hindsight, the decision to fly without all of the support we insist on for transport flying was an error, but that is like saying that every stock price that goes down represents investor error. An investor never makes money unless he takes the chance of losing it by investing. The pilot of a personal airplane never fulfills his passion for flying unless he takes the risk of crashing.

The reason that I object to the wholesale application of the pilot error epithet to personal airplane pilots is that the only method offered for avoiding the alleged error is not to fly. For example, when the pilot of a personal airplane crashes in bad weather many call it a pilot error, saying the mistake was in attempting the flight. Since even highly trained and experienced pilots occasionally crash in personal airplanes, the only solution to the alleged "error" of flying in poor weather is not to do it.

If we replace the pilot error label with the term "pilot decision," we have a more accurate picture of the situation and can apply the information more directly to our own flying. When the pilot of a personal airplane decides to fly in poor weather, land or take off at a short runway, stretch the range of his airplane or make any other crucial pilot decision, he doesn't believe the flight will end in a crash, and he has a reason for taking on some extra risk.

By studying the accident history of personal flying we can determine where the greatest risks lie, and we can try to include that information in our own decision-making process. In the end, we balance the risks with the rewards. For example, I will make flights by myself that I wouldn't make with anyone else onboard. That makes no sense in terms of absolute safety, but I am unwilling to pass on the same level of risk to others that I am willing to accept for myself. If I come to grief on such a flight, was it a pilot error or one of the foreseeable potential outcomes of a pilot decision?

The biggest reason that I believe we must stay focused on pilot decisions instead of pilot errors is that the term error implies a mistake that can be avoided through superior skill, experience or training. In the case of transport flying, that is true. In personal airplanes we don't have the redundancy and margins at all levels to prevent every crash even with the perfect error-free pilot at the controls. By making informed and conservative decisions about our flying in personal airplanes we greatly improve the odds, but there could be a day when the risk-reward ratio breaks the wrong way. If that ever happens to me I hope nobody says it was pilot error, but that old Mac knew the chance he was taking and drew the short straw on that day.

Decisions, decisionsSo if I'm not making errors but decisions, how does the process work? Not with absolutes, that's for sure.

I was flying to Wichita on a Sunday in late April knowing that a big line of strong and severe thunderstorms stretched from Texas to Canada. I had stopped for fuel in Indianapolis and looked at the WSI radar presentation in the Signature FBO there. The solid line of storms was on the radar, and the FSS briefer couldn't add any information except that the line, which was west of Wichita at the time, was forecast to hold together or intensify into the night.

The first part of the decision was easy: take off. The weather was bumpy but benign at Indy, and thunderstorms were forecast to be scattered until reaching Kansas. The Indy and Kansas City Center controllers regularly read sigmets for lines of severe thunderstorms to the west, but I bounced along between, and occasionally through, scattered clouds with nothing on my weather radar and only distant lightning detected by the Stormscope.

As I flew south of Kansas City a new sigmet described a line of severe thunderstorms between my position and Wichita. I started to encounter some light rain and layered clouds, and my weather radar started to detect heavier rain ahead. I asked the controller if he saw any breaks in the line of storms, and he said no. I then called Flight Watch and the specialist described the same line and, with my prodding, said there was a "thin" spot, but not clear, to the south of Emporia, which is about midway to Wichita.

Three strikes and I was out. The controller, the Flight Watch specialist and my own weather radar agreed. I told the controller I wanted to divert to Kansas City Downtown because of the weather ahead.

I was vectored onto the Runway 19 ILS to Downtown behind a Citation CJ2, and we both had our hands full landing in the 30-plus knot gusts. I chatted with the CJ2 crew in the Executive Beech FBO and learned they, too, were headed to Wichita. After they got a look at the cells on their radar they talked about turning around. The controller told them some guy in a Baron had just pulled the plug and was turning back, and it made their decision a little easier. We pilots all hate to be first into the weather but may be even more hesitant to be first to call it off. That's probably one of many reasons crews have better safety records than single pilots: they can talk things over and share the decision as much as possible.

While I pause in congratulating myself on making such a prudent decision you must know that I really didn't need to be in Wichita until 9:30 the next morning. It was easy to abort knowing that a leisurely departure time with a 50-minute flight in the sunshine awaited the next morning. What would I have done if I really had to be in Wichita Sunday night? Well, those are the hard decisions.

Back in the BoxThis year I did my annual recurrent training in the Cessna CJ1 at FlightSafety in Wichita. The simulator is a brand-new Level D that can replace the actual airplane in every way in terms of training and checking requirements. The visual display represents daylight, night and dusk conditions and has plenty of texture and detail that make it easy to fly the airplane-I mean simulator-visually. That wasn't true of simulator visual displays even a few years ago.

The CJ is an unusual business jet training class because many of the pilots there also own the airplane, and that is uncommon in other larger jets. These owner-pilots are as passionate about flying as you would expect, but they also do something else in life to earn enough money to buy and fly their own jet, and that creates an interesting mix of people.

I was paired with David Lenz, a real estate developer from Madison, Wisconsin, for the three four-hour simulator training sessions. David is an owner-pilot who has one of the first CJ1s delivered and was back for his first recurrent training.

I'm sure most pilots have a stereotype of the jet owner-pilot in mind: lots of money, not much flying experience and an unprofessional attitude toward flying. Other than the obvious need for money, I have never encountered a business jet owner-pilot who met that description. In fact, David is an extreme example of how wrong that image usually is.

David is actually a military-trained pilot who flew F-102 Delta Daggers, a demanding single-seat jet fighter. Hardly the aviation dilettante many pilots expect. He is one of the most organized and methodical pilots I have ever flown with, down to the point of crafting a Velcro strap to hold the checklist on his knee. Those fighter jock habits stick with you.

Before the CJ1, David owned a Cessna 414 piston twin. A CJ2 is next later this year. And David and his brother are nearing completion of a Glasair homebuilt. He is actually the typical CJ owner pilot who is as serious about, and involved in, aviation as any pilot can be.

The CJ1 is equipped with the big Collins Pro Line 21 flat-panel displays that eliminate all standard instruments from the cockpit except for the battery-powered standby gyro and backup altimeter and airspeed indicator. This entry-level business jet actually has one of the most advanced cockpits, and the FlightSafety instructors teach it in an advanced way.

For example, our sim instructor, Walter Rowhuff, encouraged us to use the Universal flight management system (FMS) for everything. Fly an NDB approach. It was on the list, but the FMS, not the ADF receiver, provided all of the guidance. Enter a holding pattern. Of course, but the Universal knew how to do that too.

But it wasn't all autopilot and FMS. Both David and I flew ILS approaches in minimums conditions with the primary displays failed, leaving only the battery-powered backup instruments. Engines failed repeatedly, most often just after rotation into a ceiling of 100 feet. The primary brakes failed on taxi and once on touchdown; the flaps failed to come down several times; and the autopilot would drop off at the most inconvenient times. It was a challenge, but that is what we were there for.

Perhaps the hardest work was flying the steep turns. The new Collins displays have greatly expanded scales for altitude and airspeed. The ATP target tolerances for the steep turns are to hold altitude within 100 feet and airspeed within the 10 knots all the way around the turn. But the expanded scales show each knot of airspeed variance or five feet of altitude change. If you used all of the allowable tolerance it looked like you were wandering all over the sky. So, I give the Pro Line 21 an A-plus for being easier to fly than conventional EFIS or instruments, except for the steep turns when you have to crank up all of your concentration to stay on the numbers. And any pilot you would want to fly with is competitive enough to tackle that challenge.