Systems 1

Three primary flight controls move an airplane about its three axes. The handbook says "the ailerons, elevator (or stabilator), and rudder constitute the primary control system and are required to control an aircraft safely during flight" 1. The ailerons roll the airplane about the longitudinal axis, the nose-to-tail line. The elevator or stabilator pitches it about the lateral axis, wingtip to wingtip. The rudder yaws it about the vertical axis. Flaps and trim are secondary controls.

The Warrior's stabilator

The Warrior has no elevator. Its pitch control is a stabilator, a horizontal tail that moves as one piece. The Warrior's manual says "the horizontal surface (stabilator) is of the flying tail design with a trim tab mounted on the trailing edge. This tab serves the dual function of providing trim control and pitch control forces" 2. An antiservo tab deflects "in the same direction as the stabilator," which "results in an increase in the force required to move the stabilator, thus making it less prone to pilot-induced overcontrolling" 3. A stabilator without the tab would be light and sensitive in pitch. The tab adds the control force, and the same tab is the trim tab.

Trim

Trim relieves control pressure. The Airplane Flying Handbook says trim surfaces "are required to offset any constant flight control pressure inputs provided by the pilot," and that trimming "provides an opportunity for the pilot to divert attention to other tasks" 4. The trim wheel in the Warrior sits on the console between the front seats. Forward rotation gives nose-down trim, and aft rotation gives nose-up trim 2.

The pilot sets trim for one condition: one airspeed, one power setting, one configuration. A change in airspeed or configuration changes the pressure, and the pilot trims again. The order is attitude, power, then trim. A pilot who changes the attitude with the trim wheel instead of the control wheel corrects late and overshoots.

What flaps do

Flaps increase lift and drag. The handbook says they "increase both lift and induced drag for any given AOA" and "allow a compromise between high cruising speed and low landing speed because they may be extended when needed and retracted into the wing's structure when not needed" 5. More lift at a given angle of attack lowers the stall speed, so the pilot can fly the approach slower. More drag makes the descent steeper at the same speed, without the airspeed building. The airplane reaches the runway at a lower speed and stops shorter.

The Warrior's manual flaps

The Warrior's flaps are manual. The manual describes them: "a control handle, which is located between the two front seats on the control console, extends the flaps by the use of a control cable. To extend the flaps, the handle is pulled up to the desired flap setting of 10, 25 or 40 degrees. To retract, depress the button on the end of the handle and lower the control" 2. The flaps "are balanced for light operating forces and spring loaded to return to the retracted (up) position."

A cable and a handle have two advantages over an electric motor. There is no motor to fail. Retraction is instant, and the pilot needs instant retraction on a go-around or a balked landing.

The right flap is the step

The manual says that "when the flaps are in the retracted (up) position the right flap, provided with an over-center lock mechanism, acts as a step." The note under that sentence says "The right flap will support a load only in the fully retracted (up) position." A passenger who steps on an extended flap bends it. The flaps go up before anyone boards, and the pilot tells each passenger at the wing where to step.

The pitch change

The manual says that "when extending or retracting flaps, there is a pitch change in the airplane. This pitch change can be corrected either by stabilator trim or increased control wheel force." The handbook says why: extending a plain flap "moves the center of pressure (CP) aft on the airfoil, resulting in a nose-down pitching moment" 5. A pilot who expects the change holds the attitude through it and retrims. A pilot who does not expect it corrects late and overshoots.

The flight of N6571J

On May 15, 2024, a flight instructor and a student pilot with 18 hours flew a Piper Cherokee 180 on a lesson in the practice area. They returned toward Memorial Field in Hot Springs, Arkansas. During the descent checklist the student moved the fuel selector. On the approach the instructor called for power, and the engine stopped. The airplane struck a vacant lot in a residential neighborhood and burned. The instructor had serious injuries, and the student had minor injuries 6.

The airplane was a 1968 PA-28-180, a Cherokee with a 180-horsepower Lycoming O-360. Its fuel system matches a Warrior's: two wing tanks and a selector on the left side panel with LEFT, RIGHT, and OFF. The instructor was 42, held commercial and flight instructor certificates, and had about 698 hours. The student was 19 and had about 18 hours, all of them recent. The sky was clear, the visibility 10 miles, the wind 3 knots, and the temperature 29 degrees Celsius. The runway was 6,595 feet long.

The instructor told investigators that the student "made a fuel tank selection change while they performed the descent checklist." The student flew the approach. The instructor "told the student pilot to add engine power, but the engine exhibited a total loss of engine power." The instructor took the controls. The airplane did not reach the runway.

Investigators examined the fuel selector. The valve "did not intersect any of the valve body ports." The handle stopped between two positions. "With the fuel selector valve between port positions, fuel was unable to flow downstream to the engine." No other part of the airplane failed.

The NTSB's probable cause is "the student pilot's selection of an improper fuel tank selector position, which resulted in fuel starvation and a total loss of engine power. Contributing to the accident was the instructor's inadequate oversight" 6.

Where the accident chain could have been broken

The accident was three decisions. Each is listed below with its PAVE category and the decision that would have ended the flight safely at that point. The Warrior's handbook states all three safe decisions.

The engine

The Warrior's engine is a Lycoming O-320-E3D. The manual describes it as a "four cylinder, direct drive, horizontally opposed engine rated at 150 HP at 2700 RPM" 7. The specifications page gives the displacement, 319.8 cubic inches, and the compression ratio, 7 to 1 8. The engine is air-cooled and carbureted. Air enters through the nose cowling, passes over the cylinder fins, and leaves under the cowling.

The propeller and the tachometer

The propeller is fixed-pitch: a McCauley or a Sensenich, with the blade angle set at the factory. The handbook says "the pitch of this propeller is set by the manufacturer and cannot be changed," and that a fixed-pitch propeller "achieves the best efficiency only at a given combination of airspeed and rpm" 9. With no propeller control, the throttle sets the rpm, and the tachometer is the power instrument. The tachometer's green arc runs from 500 to 2700 rpm 10, and the red line is 2700, the maximum continuous power.

Two magnetos

The ignition is two engine-driven magnetos. The handbook says "a magneto uses a permanent magnet to generate an electrical current completely independent of the aircraft's electrical system" 11. The magnetos need no battery and no alternator. The engine keeps running with the master switch off. A magneto stops only when the ignition switch grounds it. For that reason the pilot treats a propeller as live until the pilot confirms the switch is off.

The handbook gives two reasons for two magnetos. "Each magneto operates independently to fire one of the two spark plugs in each cylinder. The firing of two spark plugs improves combustion of the fuel-air mixture and results in a slightly higher power output. If one of the magnetos fails, the other is unaffected." The two reasons are redundancy and better combustion. The runup magneto check tests both: each magneto alone must run the engine, and the rpm drop on each shows how much the second plug added.

The mixture control

The mixture control sets the ratio of fuel to air. Air density falls with altitude, and a carburetor that meters fuel for sea-level air delivers too much fuel at altitude. The handbook says "the mixture must be leaned using the mixture control. Leaning the mixture decreases fuel flow, which compensates for the decreased air density at high altitude" 12. The Warrior's manual says to lean at 75 percent power or less, and to enrich the mixture before increasing power. Full rich is the setting for takeoff and landing at low field elevations, and the manual's before-landing list says "Mixture - full rich" 13.

The carburetor

The carburetor mixes fuel and air by suction. Air passes through a narrow throat, the venturi, and speeds up. The pressure in the throat falls, and the low pressure draws fuel from the discharge nozzle into the airstream.

The handbook describes the hazard: "carburetor ice occurs due to the effect of fuel vaporization and the decrease in air pressure in the venturi, which causes a sharp temperature drop in the carburetor" 14. The temperature drop "can be as much as 60 to 70" degrees Fahrenheit. Water vapor in the air freezes on the throttle valve and in the venturi throat. Ice "is most likely to occur when temperatures are below 70 degrees Fahrenheit (°F) or 21 degrees Celsius (°C) and the relative humidity is above 80 percent," and it can form in air as warm as 100 degrees.

Carburetor heat

Carburetor heat sends warm air into the carburetor. In the Warrior the air comes from a shroud on the muffler. The manual says "heated air enters the carburetor air box through a hose connected to the heater shroud" 7. The air bypasses the filter, which is why the manual says to "avoid prolonged operation with carburetor heat ON as the air is unfiltered" 15.

Carburetor heat reduces power and changes the rpm in a known pattern. The handbook says "the use of carburetor heat causes a decrease in engine power, sometimes up to 15 percent, because the heated air is less dense than the outside air that had been entering the engine. This enriches the mixture" 16. With a fixed-pitch propeller and ice present, "there is a decrease in rpm, followed by a gradual increase in rpm as the ice melts." With no ice, "the rpm decreases and then remains constant." The runup checks the control, and the manual says heat is off for takeoff.

Two tanks, 48 gallons

The Warrior holds 50 gallons in two 25-gallon wing tanks. The manual says the tanks give "a total capacity of fifty U.S. gallons (48 gallons usable)" 17. Each tank holds 24 usable gallons. The 2 gallons the engine cannot draw are not a reserve. The pilot plans the reserve above the usable figure, from 48 gallons, not 50.

The selector

The fuel selector sits on the left side panel, forward of the pilot's seat. It has three positions, LEFT, RIGHT, and OFF, and no BOTH. The manual says "the button on the selector cover must be depressed and held while the handle is moved to the OFF position" 17. Each position is a detent, and the handle must seat in one. A handle between detents is a closed valve. The Cherokee's selector at Hot Springs stopped between two ports.

A Warrior pilot manages fuel by switching tanks on a schedule. The manual recommends one hour on the first tank after takeoff, then two hours on the other, then back to the first 13. That schedule keeps the airplane in lateral trim. The manual's fuel management list gives three rules for the selector:

• take off on the fuller tank, selected before or just after the start, and land on the tank with more fuel
• do not change tanks at low altitude, because "adequate recovery time is essential in the event of an error in fuel selection"
• change tanks before the tank in use runs dry, and never run a tank dry in flight.

The manual's engine power loss procedure begins with the same selector. "The most common cause of engine power loss is mismanagement of fuel. Therefore, the first step to take after engine power loss is to move the fuel selector to the tank not being used" 18.

Two pumps

The tanks in a low-wing airplane sit below the carburetor, so a pump must lift the fuel. The handbook says such airplanes "have two fuel pumps. The main pump system is engine driven with an electrically-driven auxiliary pump provided for use in engine starting and in the event the engine pump fails" 19. The Warrior's manual says "the electric pump should be ON for all takeoffs and landings and when switching tanks" 17. The FAA-approved section makes it a rule: "Electric fuel pump must be on for both landing and takeoff" 20. If the engine-driven pump fails on the takeoff roll, the electric pump is already supplying the fuel.

Off in cruise

The pilot turns the electric pump off in cruise. The manual's fuel management list says the pump "should be in the off position so that any malfunction of the engine driven fuel pump is immediately apparent" 13. With the electric pump running, a failed engine-driven pump gives no indication. With it off, the failure shows at once as a drop on the fuel pressure gauge. The pilot turns the electric pump on and lands. At the runup the pilot switches the electric pump off for a moment to confirm that the engine-driven pump holds the pressure alone 15.

Fuel grade

The manual says "the minimum aviation grade fuel for the PA-28-151 is 80/87," and that "whenever 80/87 is not available, the lowest lead 100 grade should be used" 21. That grade is 100LL, the grade the school buys. The handbook gives the rule for substitution: "If the proper grade of fuel is not available, use the next higher grade as a substitute. Never use a grade lower than recommended" 22. A lower grade detonates. Avgas is dyed by grade, so a pilot can identify the grade by color. 100LL is blue, and jet fuel is clear or straw-colored with a kerosene smell.

What oil does

Engine oil does four jobs, and the handbook lists them 23:

• lubrication of the moving parts
• cooling
• "providing a seal between the cylinder walls and pistons"
• "carrying away contaminants".

The Warrior's O-320 is a wet-sump engine, with the oil in a sump that is part of the engine. The manual gives the quantities: "the oil capacity of the Lycoming O-320-E3D series engines is 8 quarts and the minimum safe quantity is 2 quarts" 24. The dipstick reads to 8, and the pilot checks it on the walk-around before each flight.

The school's minimum

Two quarts is the manufacturer's minimum safe quantity. It is not the quantity a pilot dispatches with. North Aero sets a higher minimum for the day's flying, for three reasons:

• the engine burns oil in flight
• a cross-country lasts hours
• the oil above the manufacturer's minimum is the only margin against that consumption.

A student who is asked why the school's number is higher than the book's answers with those three reasons.

Oil grade

The manual's oil requirements page carries a table of grades by temperature, and any grade whose range includes the day's temperature is acceptable 24. Multigrade oils cover a wider band. A mechanic changes the oil each 50 hours, and sooner in hard service.

The only hydraulic system

The Warrior's only hydraulic system is the brakes. The handbook says a hydraulic system on a small airplane is often used "to operate wheel brakes, retractable landing gear, and some constant-speed propellers" 25. The Warrior has fixed gear and a fixed-pitch propeller, so only the brakes remain. The manual describes them: "The brakes are actuated by toe brake pedals which are attached to the rudder pedals or by a hand lever and master cylinder located below and behind the center of the instrument sub panel. Hydraulic cylinders are located above each pedal and adjacent to the hand brake lever" 26. The parking brake is the same hand lever, pulled back with the knob on its left side depressed.

The fluid is MIL-H-5606, a red petroleum-based hydraulic fluid 24. The reservoir is on the upper left of the firewall. A red stain under the engine compartment or at a wheel is brake fluid. A brake with air in the line has a soft pedal.

Fixed tricycle gear with oleo struts

The landing gear is fixed tricycle: a nosewheel and two mains. The handbook gives three advantages of the tricycle layout 27:

• harder braking without nosing over
• better forward visibility on the ground
• resistance to ground loops, because the center of gravity is ahead of the main wheels.

The Warrior's nosewheel "is steerable through a 30 degree arc each side of center by the use of the rudder pedals and toe brakes" 26.

The three struts are air-oil, or oleo, struts. The manual gives their normal extensions: "3.25 inches for the nose gear and 4.50 inches for the main gear." Those two numbers are on the walk-around list. A strut with less showing has lost air or oil, and it will bottom on a firm landing.

The seat belt rule

14 CFR 91.107(a) puts three duties on the pilot in command 28. Before takeoff, the PIC "ensures that each person on board is briefed on how to fasten and unfasten that person's safety belt and, if installed, shoulder harness." Before the airplane moves on the surface, takes off, or lands, the PIC ensures each person "has been notified to fasten" the belt and harness. And "each person on board" must "occupy an approved seat or berth with a safety belt and, if installed, shoulder harness, properly secured about him or her during movement on the surface, takeoff, and landing."

The exception is a child. A person "may be held by an adult" in an approved seat, "provided that the person being held has not reached his or her second birthday and does not occupy or use any restraining device." Each occupant 2 or older needs a belt of their own.

Checklists are used

The Airplane Flying Handbook says "the checklist is a memory aid and helps to ensure that critical items necessary for the safe operation of aircraft are not overlooked or forgotten. Checklists need not be 'do lists.' In other words, the proper actions can be accomplished, and then the checklist used to quickly ensure all necessary tasks or actions have been completed with emphasis on the 'check' in checklist" 29. The handbook also says "pilots who fail to take the use of checklists seriously become complacent and begin to rely solely on memory."

Two methods exist. In a do-verify flow the pilot does the items from memory, then reads the list to confirm. In a read-do list the pilot reads each item and does it. In both methods the pilot reads the list. Memory alone is for the immediate-action items of an emergency, and the pilot reads the checklist afterward to confirm them.

Charts and databases

Navigation data must be current and appropriate for the flight. A paper sectional has an edition date, and the chart in the airplane is the current edition. A GPS database has a cycle. The AIM says to "check the currency of the database," that databases "must be updated for IFR operations and should be updated for all other operations," and that a pilot "using an outdated database should verify waypoints using current aeronautical products" 30. A student who finds an expired database on the panel does not navigate by the moving map. The student navigates from the chart.

Loose items

A loose item in the cabin becomes a projectile in turbulence, and on the floor it can jam a control. A water bottle under the rudder pedals blocks a pedal. A tablet on the glareshield falls into a lap in turbulence. The Airplane Flying Handbook says "baggage loading and security should also be supervised by the pilot" 31. Before the engine starts, each item in the cabin has a place: a pocket, a bag, a belt, or the baggage compartment behind its closed door.

Portable electronics and automation

A tablet with a chart, a GPS, and an autopilot are systems, and a pilot manages them like the fuel system. The handbook says "no one level of automation is appropriate for all flight situations, but in order to avoid potentially dangerous distractions when flying with advanced avionics, the pilot must know how to manage the course deviation indicator (CDI), the navigation source, and the autopilot" 32. The Airplane Flying Handbook adds the hazard: automation "essentially removes the pilot from the process of managing the aircraft, thereby reducing situational awareness and leading to complacency" 33. A student sets the devices up on the ground, before the engine starts. When a device takes attention from flying the airplane, the student stops using the device.

The passenger brief

The pilot gives the passenger brief before engine start, when the passenger can hear it. It covers the belt, which 91.107 requires, and the door, and it covers sterile-cockpit moments, which the rules do not. During takeoff, landing, and radio work the pilot does not answer questions. A passenger who knows that rule in advance waits. A passenger who does not know it asks on short final. The brief also says where to look for traffic, what to touch and what not to touch, and what happens if the pilot says "my airplane."

On the ramp

The pilot's duty to passengers continues after the airplane is parked. The Airplane Flying Handbook says "passengers may have little experience with the open ramp of an airport. The pilot should ensure the safety of the passengers by cautioning them to move on the surface only as directed. If not under the pilot's direct supervision, passengers should have an escort to ensure their safety and ramp security" 31. Passengers walk the path the pilot briefed, behind the wing and away from the propeller, and they walk it with the pilot. The duty ends when they are off the ramp.

Three starts

The Warrior's manual has three starting procedures, and each has its own throttle, mixture, and pump settings 34:

• cold: throttle open about a quarter inch, master on, electric pump on, mixture full rich, then the starter
• hot: throttle open about a half inch, master on, electric pump on, mixture in idle cut-off, then the starter
• flooded: throttle full open, master on, electric pump off, mixture in idle cut-off, then the starter.

On a cold start, if the engine does not fire in five to ten seconds, the pilot primes one to three strokes and tries again. On a hot start or a flooded start the pilot advances the mixture when the engine fires. On a flooded start the pilot also pulls the throttle back.

A pilot who guesses the engine's condition risks two errors. A cold start on a hot engine floods it. A flooded start with the throttle full open and a mixture advanced too fast over-revs a cold engine. An engine primed, cranked, and primed again can catch fire in the induction system. The pilot identifies the condition and uses the manual's procedure for it.

Clear prop

Before the propeller turns, the pilot sets the airplane and checks the area. The manual's starting list begins with "set parking brake ON" 34. The Airplane Flying Handbook says that "prior to engine start, the pilot needs to ensure that the ramp area surrounding the airplane is clear of persons, equipment, and other hazards," that the pilot "should check what is behind the airplane prior to engine start as standard practice," and that "just prior to starter engagement, the pilot should always call 'CLEAR' out of the side window and wait for a response from anyone who may be nearby before engaging the starter" 35. The pilot calls loudly and waits for an answer. The pilot treats the propeller as live whenever the magnetos are not verified off, because a magneto needs no battery to fire.

Oil pressure

After the start the engine idles at 800 rpm 34 and the pilot watches one gauge. The manual says "if oil pressure is not indicated within 30 seconds, stop the engine and determine the trouble. In cold weather it will take a few seconds longer to get an oil pressure indication" 34. The Airplane Flying Handbook says the same: "To prevent damage, the engine should be shut down immediately if the oil pressure does not rise to the AFM/POH values within the required time" 36. An engine running without oil pressure destroys itself in minutes.

External power

For a start from an external battery, the pilot follows the manual's switch sequence exactly. With Piper External Power the master switch is off to connect the cable, on for the start, off to disconnect, then on to check the alternator 37. The last step is in capitals: "DO NOT ATTEMPT FLIGHT IF THERE IS NO INDICATION OF ALTERNATOR OUTPUT." A battery too weak to start the engine can be too weak to show a charging failure after takeoff. The alternator check proves that the alternator will supply the airplane's electricity in flight.

Starter limits

The starter is an electric motor, and it heats. The manual says "starter manufacturers recommend that cranking periods be limited to thirty seconds with a two minute rest between cranking periods. Longer cranking will shorten the life of the starter" 34. A starter that burns out on the ramp ends the lesson. A starter that burns out at another airport on a cross-country keeps the airplane there.

The before-takeoff check

The runup is the last check before takeoff, made while the airplane can still taxi back. The Airplane Flying Handbook says "the before-takeoff check is the systematic AFM/POH procedure for checking the engine, controls, systems, instruments, and avionics prior to flight" 38. Each line on the Warrior's ground check finds one specific failure 15:

• a dead magneto
• a carburetor heat control that does not move
• a worn vacuum pump
• an engine-driven fuel pump that does not pump
• an oil temperature too low for full power.

The magneto check

The manual gives the procedure and the limits: "Check the magnetos at 2000 RPM by switching from BOTH to RIGHT, then back to BOTH before switching to LEFT. The drop on either magneto should not exceed 175 RPM, and each magneto should read within 50 RPM of the other" 15. Each magneto runs the engine alone for a moment. The drop shows that the other plug in each cylinder contributed.

A drop of zero is also a failure. An engine that shows no change on LEFT or RIGHT still runs on both magnetos. The switch does not ground the magneto it is meant to ground. That magneto is hot with the switch off, and the propeller is live on the ramp. The airplane goes to the mechanic before the flight.

Where the runup happens

The handbook says a runup location "should be firm (a smooth, paved or turf surface if possible) and free of debris. Otherwise, the propeller may pick up pebbles, dirt, mud, sand, or other loose objects and hurl them backwards" 38. The pilot points the airplane so the propeller blast clears other airplanes and people. The pilot also points it so the approach path and the runway are in view. The brakes hold. The pilot looks up from the checklist often, because an airplane at 2000 rpm with the brakes slipping moves.

Shutdown and securing

The manual gives the shutdown order: "The engine stopped by putting the mixture control in idle cut-off. The throttle should be left full aft to avoid engine vibration while stopping. The magneto and master switches should be turned off and the parking brake set" 39. The order is avionics off, then mixture, then magnetos, then master. Cutting the mixture stops the fuel to the engine. No unburned fuel remains in the cylinders, so a hot magneto cannot fire the engine when someone moves the propeller.

The pilot secures the airplane after the engine stops. The manual says the controls are secured "by looping the seat belt through the control wheel and pulling it snug." The tie-down ropes go to the rings under each wing and to the tail skid. The flaps stay up, where they lock. The Airplane Flying Handbook adds pitot covers and cowl plugs, and says "a flight is not complete until the engine is shut down and the airplane is secured" 40. A gust can move or overturn an untied airplane.