As pilots, we spend a lot of time focusing on obvious hazards to our flight operations: convective activity, icing, low ceilings and other conditions. Pilots who fail to manage such risks constitute a disproportionate share of fatal accidents. These flight conditions, however, are not the only potential hazards that we should consider for the purposes of managing risk. Tasks and procedures required on every flight are also potential hazard sources and should be viewed through the risk management lens. These include such routine and necessary tasks as takeoffs and landings, even under benign conditions, as well as operations under calm skies in VMC conditions when there is still other traffic to avoid.
288
How you choose to evaluate and analyze such risks will determine how well you manage the total risk in all of your flight operations, not just those risks associated with high hazard operation. Before we look at some specific examples, you should understand risk evaluation in the context of regulations and normal procedures and have a good understanding of risk assessment and risk mitigation.
Legal Isn’t Risk-Free
Most pilots understand that compliance with FAA regulations is a bedrock element of a professional flight operation. But in my experience, a surprising number of pilots also believe regulatory compliance ensures safe flight operations. This belief is misplaced and erroneous. Even the FAA does not buy such an argument, and the agency’s own training material suggests that regulatory compliance is a necessary but not sufficient element of safe flight operations. I recall the system safety course I took at the FAA Academy stating (approximately) that “a pilot can be in compliance with the regulations while still conducting unsafe operations.”
Most pilots understand this after considering a few operating scenarios. For example, 1000 and three is legal VFR, but we really should consider safe VFR under these conditions to be very limited. Similarly, it’s legal under Part 91 to take off under IFR when the ceiling and visibility are zero, and then fly hundreds of miles in the same weather with a single engine, single radio and alternator, and shoot an approach to 200 and a half-mile.
I consider these types of operations to be generally unsafe despite their apparent legality. The key, of course, is that the overall risk level is high, but because it’s legal, pilots also consider it safe. This conundrum highlights the fact it’s often necessary to perform a formal risk assessment to make such a determination. If the risk is assessed as too high, then it must be mitigated in order for the flight to continue.
This example helps demonstrate risk management is a three-part process, which includes identification, assessment and mitigation. As pilots gain experience and encounter different sets of conditions, they eventually perform these three steps subconsciously, without the need to refer to the formal risk management matrix and other tools—although it never hurts to use them, especially in complex or marginal situations. As mentioned earlier, some hazards are obvious and easily mitigated. For example, a Level 6 thunderstorm is an obvious “red” risk level if you penetrate it, but many times a simple route deviation can turn “red” to “green.”
The hard part is assessing and mitigating risk in more subtle situations. Let’s take a look at two common examples.
Mandatory Takeoff?
Each successful flight also includes both a takeoff and a landing. In the typical rote world of flight training, we are taught (knowledge test) to calculate required takeoff distance and then must demonstrate (practical test) we can perform the correct procedures and maintain the proper speed to obtain that performance. Seldom, however, are we taught how to perform a proper risk analysis for these critical maneuvers.
Consider two takeoff examples. In the first, we are taking off from a 10,000-foot runway in Kansas, surrounded by flat wheat fields, on a sunny day. In the second, we are taking off from a 2000-foot runway, surrounded by a dense urban environment, on a clear VFR night. Obviously the risks of the hazard from a sudden engine failure on takeoff are different, but how different?
The constant in this case may be the likelihood of a sudden engine failure on takeoff. All other factors being equal, the risk likelihood is the same in both scenarios. So, time for the first subjective assessment. I propose that the risk likelihood for the engine failure in both of these takeoffs is remote, that is it’s unlikely to occur, but it’s possible (I’m assuming a typical single-engine GA machine with a piston engine).
I propose that the risk severity is different for each of these scenarios. In the Kansas takeoff, the risk severity is probably marginal, but it could be critical. That is, I believe that a forced landing will probably result in minor injuries or damage at most, but the worst case scenario would be major damage or injuries. Much of this might be due to technique, but we’ll cover that in a moment under mitigations. The takeoff at night from a short runway in a dense urban area is another matter: the maximum severity of losing an engine in this scenario is easily catastrophic. In other words, fatalities and aircraft loss are quite possible.
So, consulting the risk matrix, we find that the overall risk of the Kansas takeoff is “green,” regardless of the two hypothesized severity levels. Does that mean we should forgo any risk mitigation beyond normal procedures? That depends on your risk preferences. As I become a “senior” airman, I find myself becoming more conservative. However, in this easy scenario I would likely just climb out at best rate of climb as I head en route to wherever.
The night takeoff in the urban area is entirely different. Looking at the risk matrix, we see that the combination of “remote” likelihood and “catastrophic” severity labels this takeoff as a “yellow” or serious risk. Thus, according to the guidelines I cited earlier, some sort of mitigation is required to reduce the level of risk likelihood and/or severity. Normal procedures can’t do much to reduce the likelihood, beyond double checking the quantity and quality of fuel, conducting a thorough pre-flight, and ensuring adequate maintenance of the engine. To reduce the risk’s severity, I might climb at best rate, make a close downwind departure and circle the airport until reaching a safe altitude. Other steps perhaps could be implemented, also.
The night example with a short runway brings to mind another related scenario. For about nine years, I was based at Marlboro, Mass. (9B1), an airport with a 1660-foot runway featuring trees at one end and assorted hazards at the other (one of which being a fence with a big red stop sign). At the time, I was operating a Cessna 172; before that, I had learned to fly there in a J3 Cub in 1965 and instructed for several years there in Cessna 150s. I thought little about the risk at the time.
Every takeoff was a maximum-effort obstacle clearance procedure. The landings were the same, but they became the limiting factor when I sold the 172 and bought a Mooney 201. Now we’re talking maximum-performance landings, also. Every approach had to be on the backside of the power curve, where the 201 got nice and draggy, but also came with a reduced stall margin. I eventually gave up and moved to a 3000-foot runway with clean approaches about 30 miles further away.
One point here is considering how the airlines do business. Subpart I of Part 121 requires all operations to be able to make “guaranteed” engine-out takeoffs on the available runway (no single-engine aircraft are permitted under Part 121) and the calculated landing distance must not exceed 60 percent of the runway length. While I’m not advocating these extremes for your Part 91 operations, you might want to consider your own set of “cushions.” Perhaps you might use an 80 percent factor rather than 60.
While I admire the use of “personal minimums” for GA operations, I believe they are not always flexible enough as a risk management tool. Savvy risk mitigation requires that we account for all factors and be flexible in our response. For example, a personal minimum might mandate never using less than a 3000-foot runway. That might be excessive if you’re operating a Cessna 172 at sea level at reduced gross weight, but it might be exceedingly hazardous at gross weight from a runway at 7000 feet msl on an 85-degree day. The bottom line is that, regardless of the “normality” of your typical takeoff and landing scenarios, risk management should always be a part of your calculus. And remember: Takeoffs are optional; landings are mandatory.
Mid-Air risks
I’ll cite one other example of risk management in normal operations, since conflicting traffic and the threat of mid-air collisions is one that exists to some degree on nearly every flight. For this threat, the primary mitigations include a mixture of procedures and technology.
Again, let’s look at two examples. In the first, we’re operating at 11,500 feet msl eastbound over north central Nebraska, far from any Class B or C terminal area, and the weather is CAVU with 80-mile visibility. In the second example, we’re operating below 3000 feet near a busy non-towered GA airport in the Los Angeles basin when the sky is cloudless, but the visibility is only three miles.
For this scenario, the fixed parameter is likely to be the risk severity level. Please consult the risk assessment matrix as you follow me through. Cutting to the chase, I think I have consensus when I postulate that the maximum severity level is catastrophic. The maximum likelihood, however, is variable for these scenarios. For the Nebraska scenario, I would like to say that the likelihood is improbable, but it could also be remote. I know it’s splitting hairs, but the difference is between “yellow” and “green” on the risk assessment. Similarly, for the L.A. basin example, the likelihood could be remote, but it could also be occasional. That’s the difference between a “yellow” and a “red” assessment.
I would suggest that the bottom line for all of us on this particular hazard is to not rely on the “big sky theory” (although I’m thankful that the U.S. has millions of cubic miles of usable airspace below 18,000 feet). Nor should you rely totally on the “see and avoid” concept. The NTSB has repeatedly and scientifically debunked the effectiveness of see and avoid and you should, too. That doesn’t mean that you shouldn’t do it. You must use see and avoid, and you also need to use other effective mitigation techniques. These range from flight following to IFR to VFR radio calls on the procedure side. My favorite (but don’t tell anyone) is to cruise at either 2250 or 2750 feet when operating below 3000 feet msl.
However, the big gorilla in collision avoidance in the future is likely to be technology, namely automatic dependent surveillance broadcast (ADS-B). It’s more accurate and effective than radar-based ground or in-cockpit transponder-based technologies. As soon as it hits the right price point, it should be a part of every pilot’s risk mitigation arsenal for collision avoidance.
What’s your risk preference?
The basic procedures and examples I’ve covered here are only meant to illustrate the need for proper risk management in all normal operations, even those that seem routine and “safe.” The best way to approach this is to think like an airline operations manager, but without the regulations, bureaucracy or inflexibility of a Part 121 operation.
First, determine the maximum level of risk you are comfortable with. Then analyze all of your flight operations and determine where the assessed risk is highest. Then put in place mitigations that will reduce the risk likelihood and/or severity of the high-risk areas so that you’re always operating inside your desired risk envelope.
Robert Wright is a former FAA executive and President of Wright Aviation Solutions LLC. He is also a 9600-hour ATP and holds a Flight Instructor Certificate. His opinions in this article do not necessarily represent those of clients or other organizations that he represents.
