Redundancy – a Life Saver in Diving and Aviation

Photo taken from the author’s aircraft one stormy Florida Panhandle morning. (click to enlarge)

I was recently flying a private aircraft down the Florida Peninsula to Ft. Lauderdale to give a presentation on diving safety. As I continually checked the cockpit instruments, radios and navigation devices, it occurred to me that the redundancy that I insist upon in my aircraft could benefit divers as well.

In technical and saturation diving, making a free ascent to the surface is just as dangerous as making a free descent to the ground in an airplane, at night, in the clouds. In both aviation and diving, adequate redundancy in equipment and procedures just might make life-threatening emergencies a thing of the past.


As I took inventory of the redundancy in my simple single engine, retractable gear Piper, I found the following power plant redundancies: dual ignitions systems, including dual magnetos each feeding their own set of spark plug wires and redundant spark plugs (two per cylinder). There are two sources of air for the fuel-injected 200 hp engine.

There are two ways to lower the landing gear, and both alarms and automatic systems for minimizing the odds of pilot error — landing with wheels up instead of down. (I’ve already posted about how concerning that prospect can be.)

I also counted three independent sources of weather information, including lightning detection, and two powerful communication  radios and one handheld backup radio. For navigation there is a compass and four electronic navigation devices: one instrument approach (in the clouds) approved panel mount GPS with separate panel-mounted indicator, an independent panel mounted approach certified navigation radio, plus two portable GPS with moving map displays and superimposed weather. Even the portable radio has the ability to perform simple navigation.

photo (17) - no Exif
There’s two of just about everything in this Arrow panel.

The primary aircraft control gyro, the artificial horizon or attitude indicator, also has a fully independent backup. One gyro operates off the engine-powered vacuum pump, and the second gyro horizon is electrically driven. Although by no means ideal, the portable GPS devices also provide attitude indicators based upon GPS signals. In a pinch in the clouds, it’s far better than nothing. Of course, even if all else fails, the plane can still be flown by primary instruments like rate of climb, altimeter, and compass.

There is only one sensitive altimeter, but two GPS devices also provide approximate altitude based on GPS satellite information.


But what about divers? How are we set for redundancy?

Starting with scuba (self-contained underwater breathing apparatus), gas supplies are like the fuel tanks in an aircraft. I typically dive with one gas bottle, but diving with two or more bottles is common, especially in technical diving. In a similar fashion, most small general aviation aircraft have at least two independent fuel tanks, one in each wing.

The scuba’s engine is the first stage regulator, the machine that converts high pressure air into lower pressure air. Most scuba operations depend on one of those “engines”, but in extreme diving, such as low temperature diving, redundant engines can be a life saver. While most divers carry dual second stage regulators attached to a single first stage, for better redundancy polar divers carry two independent first stages and second stages. Two first stage regulators can be placed on a single tank.

An H-valve for a single scuba bottle. Two independent regulators can be attached.
Two Regs
A Y-valve for Antarctic diving with two independent scuba regulators attached.













Even then, I’ve witnessed dual regulator failures under thick Antarctic ice. The only thing saving that very experienced diver was a nearby buddy diver with his own redundant system.

There is a lot to be gained by protecting the face in cold water by using a full face mask. But should the primary first or second stage regulator freeze or free flow, the diver would normally have to remove the full face mask to place the second regulator in his mouth.

Two regulators, one full face mask. Photo courtesy of Michael Lang and Scuba Pro.

Reportedly, sudden exposure of the face to cold water can cause abnormal heart rhythms, an exceedingly rare but potentially dangerous event in diving. If the backup or bail out regulator could be incorporated into the full face mask, that problem would be eliminated. The photo on the right shows one such implementation of that idea.


Inner Space 2014_Divetech _Nikki Smith_Rosemary E Lunn__Roz Lunn_The Underwater Marketing Company_Nancy Easterbrook_rebreather diving_2014-05-27 22.30.47
Nikki Smith, rebreather diver with open circuit bailout in her right hand. Photo courtesy of Rosemary E Lunn (Roz), The Underwater Marketing Company.

Rebreathers are a different matter. Most rebreather divers carry a bailout system in case their primary rebreather fails or floods. For most technical divers, that redundancy is an open circuit regulator and bailout bottle. However, there are options for the bail-out to be an independent, and perhaps small rebreather. (One option for a bail-out semiclosed rebreather is found here.) Such a bail-out plan should provide greater duration than open-circuit bailout, especially if the divers are deep when they go “off the loop”.

U.S. Navy photo by Bernie Campoli.

For some military rebreather divers, there is at least one complete closed-circuit rebreather available where a diver can reach it in case of a rebreather flood-out.

A commercial saturation diver with semi-closed rebreather backpack as emergency bail-out gas.

For deep sea helmet diving, the bail-out rebreather is on their back and a simple valve twist will remove the diver from umbilical-supplied helmet gas to fresh rebreather gas.

The most common worry for electronically controlled rebreather divers is failure of the rig’s oxygen sensors. For that reason it is common for rebreathers to carry three oxygen sensors. Unfortunately, as the Navy and others have noted, triple redundancy really isn’t. Electronic rebreathers are largely computer controlled, and computer algorithms can allow the oxygen controller to become confused, resulting in oxygen control using bad sensors, and ignoring a correctly functioning oxygen sensor.

The U.S. Navy has performed more than one diving accident investigation where that occurred. Safety in this case can be improved by adding an independent, redundant sensor, by improving sensor voting algorithms, by better maintenance, or by methods for testing all oxygen sensors throughout a dive.

In summary, safe divers and safe pilots are always asking themselves, “What would I do if something bad happens right now?” Unfortunately, private pilots and divers quickly discover that redundancy is not cheap. However, long ago I decided that if something unexpected happened during a flight or a dive, I wouldn’t want my last thoughts to be, “If only I’d spent a little more money on redundant systems, I wouldn’t be running out of time.”

Time, like fuel and breathing air, is a commodity you can only buy before you run out of it.

Separator smallDisclaimer: This blog post is not an endorsement of any diving product. Diving products shown or mentioned merely serve as examples of redundancy, and are mentioned only to further diver safety. A search of the internet by interested readers will reveal a panoply of alternative and equally capable products to enhance diver safety.

Root Causes: Some Accidents Are No Accident

Interesting flights and interesting dives provide an opportunity for post-event introspection; debriefing if you will.

Professionally, I am called upon to analyze fatalities and near-misses for the Navy and, occasionally, the Air Force. Personally, I spend even more time analyzing “what ifs” for my own activities.

For example, recently I was preparing a video of one of my more beautiful nighttime flights with a passenger, departing the coal-mining regions of Pennsylvania, heading south over the valleys and mountains of Appalachia as the early morning sun began to brighten our part of the world. Sunrise crop Editing that video gave me a chance to reflect on the pre-flight and in-flight decisions I made that day. There were many decisions to be made, and those decisions resulted in not only a safe flight, but a spectacular flight.

But like most things, there was also a risk, calculated, and weighted, and recalculated as conditions in flight and on the ground changed in the face of aggressive weather.

In very real ways, single pilot IFR (instrument flight rules) flight is akin to cave diving. They are both technically challenging, rewarding solo activities. However, you better be on your game, or else not play.

I was cave diving before cave diving was cool; before it was considered a technical diving specialty, before safety rules and high quality equipment was available. Trimix, scooters, and staged decompression were all decades in the future, and frankly the safety record at that time was atrocious. I am alive because I had the good sense to limit my penetration; “just a little” was enough of a sobering experience, about which I have previously written.

But this posting is not about moderation; it is a warning to those who would, for whatever reason, deliberately make bad decisions, one after the other. If after a chain of such deliberate misadventures, a fatality results, then I would say that fatality is no accident. It is a procedure; a flawed process of decision making with a more or less guaranteed fatal outcome.

Dr. Tom Iliffe, Texas A&M University at Galveston

Lest you lose interest in reading this post because you believe all cave divers are loonies, rest assured that could not be further from the truth. Where I work we have four very active cave divers, highly intelligent, experienced, diving deep breathing trimix (helium/nitrogen/oxygen) when necessary using scuba and rebreathers. They are safe divers who are on the cutting edge of diving research when they’re not diving for pleasure. In fact, two of them are the U.S Navy’s diving accident investigators, so they know all too well about underwater misadventures.

Friends met early in my career have been the cave explorers of the 70’s and 80’s; names you may know like Bill Gavin and John Zumrick. Another long-time friend from the Navy’s Scientist in the Sea Program, and of whom I am quite envious, is Dr. Tom Iliffe, a biologist constantly on the front edge of underwater cave biology. (My draft novel, Children of the Middle Waters, includes a story about his beloved Remipedes.)

All these cave divers have survived due to their sane and balanced approach to risk management; moderation in all things. But sadly, not all divers I’ve come to know, one way or the other, have been so sensible and measured.

One was a wonderfully gracious man, a Navy diver who had a hobby: free diving. He’d tell me how he enjoyed surprising divers in the main cave at Morrison Springs, Florida when he would swim up to them and wave, while wearing no breathing equipment at all except that with which he was born.

I’m sure they were shocked; I know I would be.

After a while, as he gained experience with this solo recreation, he began to confide in me, and ask me questions about events he’d experienced. He told me how pleasant it was sometimes when he would surface. I warned him about shallow water blackout, loss of consciousness on ascent, and explained the physical laws that made breath-hold diving so dangerous; at least in the manner in which he practiced it.

Morrison Springs, Florida. Photo licensed under Wikimedia Commons.

The last day I saw him alive, he once again came in for consultation, and told me about the euphoria he had experienced a few days before. I was of course extremely concerned and told him that what he described sounded like a near death experience. The next time he might not be lucky enough to survive, I told him. Later I heard more of that story; the previous weekend he had been found floating unconscious on the surface, but was revived.

Soon after that, this diver was again found, but this time his dive had proven fatal. His personal agenda for thrills exceeded all bounds of either training or common sense. And those thrills killed him.

The only solace I could find was that he wanted to share his experience and bravado, but he clearly was not interested in really hearing the truth, no matter how hard I worked to educate and dissuade him. While some might call this young man’s mental status as a perpetual death wish, I would argue that he never consciously thought he would die; at least not that way. Life was good, in his perspective, and I suspect he thought he was smart enough to make sure it continued that way.

Unfortunately when we were talking, we did not know just how close the end was.

Jackson Blue Spring, Marianna, Florida. Photo by Paul Clark, released under Creative Commons license.

The same was true I suspect for another well-liked diver who was the subject of a fatality report I helped write several years later. It was a rebreather fatality at Jackson Blue Spring in Marianna, Florida. The decedent was reportedly an experienced diver. I won’t belabor the story because the NEDU report is available on the internet (released by his family and available on the Rebreather Forum).

Nevertheless, the sequence of events leading to his demise involved a surprisingly long list of decision points which should have prevented the fatal dive from occurring. As each opportunity to change the course of events was reached, poor choices were made. In combination those choices led inexorably to his demise.

By now we know that even the U.S. Navy is not immune to poor decision trees. In fact, I would argue that wishful thinking is a common factor among people with intelligence and technical ability, and those with a “get it done” attitude. People who fix problems for a living are seemingly resistant to admitting that sometimes the bridge really is too far, and some problems are better fixed in the shop than in the field.

Separator small

Gareth Lock of Cranfield University, Bedfordshire, U.K. is currently collecting data on diving incidents through a questionnaire on “The Role of Human Factors in SCUBA Diving Incidents and Accidents”. Like me, he has both an aviation and diving background. Gareth is serious about trying to understand and reduce diving accidents. Links to a description of his work, and his questionnaire can be found here and here. If you are a diver, please consider contributing much needed information.

The Patients, the Pilot, and the Politicians

A Beechcraft Baron similar to the one used by Quest Diagnostics. (From Wikimedia Commons).

Every night a pilot from Atlanta makes a round-robin cargo flight to Albany GA and Dothan AL, then continues down to the coast to load cargo from Panama City FL, Pensacola, and Mobile AL before returning home. He used to fly a single engine Beech Bonanza, but now pilots a Baron, a twin-engine, 190 kt fast mover.

On really rough weather nights I’ve watched vicariously through as he scurries away from lethal skies and diverts to any safe harbor. His cargo is your lifeblood, literally, but it’s not worth dying for.

He makes that flight each night because during the day in each of those cities patients had blood drawn at their doctor’s office. The samples that will tell the doctor the life and death stories of the day’s patients are whisked away to a large laboratory near Atlanta for processing overnight.

After taking off from Gwinnett County Airport near Lawrenceville, GA at 6 PM or so, the solitary pilot returns to his home base about midnight.

Centurion C210
A Centurion 210; not your ordinary Cessna.

I was alerted one night that a plane I’d flown to Houston and back, a Cessna Centurion 210, had a gear collapse at the local Panama City Airport. I knew the plane well.

Unfortunately, shortly after the only runway was closed the Quest Diagnostics Baron approached the area, attempting to land. I turned on my aviation radio and heard the “850”, as it’s called, being told to hold, circling, while airfield crews attempted to move the damaged Centurion off the runway.

PFN 2007
The original two-runway Panama City Airport, circa 2007. (Click to enlarge)

And that’s where the politicians come in.

Local Panama City politicians felt obliged to close down the Panama City airport with two runways (formerly known as PFN) and relocate to a larger facility, again with two runways. The new two runway airport, KECP, looked great in an artist’s rendition.

But artists don’t build airports. The reason why the second runway was not built is not a subject for this blog posting. What is the subject, is that promises made to the citizens of Panama City were not promises kept. And on that night as “850” circled overhead, there would be real consequences for the political decisions which had been made.

Once construction began on the main 10,000 ft long runway at the donated site, all mention of the second runway was forgotten; not by the local pilots, but by the local politicians and the land company.

Second runways serve important purposes. They are usually called “cross-wind” runways. I’ve landed many times on the cross-wind runway at PFN, and I’ve also been on Delta flights that used that runway when the wind across the main runway was dangerously high.

Cross-wind runways are not only a safety factor for overbearing wind conditions, but also provide an alternate landing site in case the main-runway is closed due to an aircraft being stuck on the runway.

That night as “850” was trying to land to pick up the day’s tissue samples from the Panama City area, the main runway was closed by the broken Centurion, and there was no backup runway. The pilot circled Panama City until his fuel became critical, and then he flew on to his next  stop in Pensacola.

So all the blood drawn from patients in the Panama City area that day missed the trip to the Quest Diagnostics laboratory, due to a promise made but not kept.

But I suppose that is hardly news. Rather, it appears to be deeply woven into the very fabric of politics.







I Too Landed at the Wrong Airport

As a professional in underwater diving, and an amateur airman, I’ve been thinking a lot lately about the causes of accidents and “near-misses”. If you’re reading this in early 2014, you are no doubt aware of several recent incidents of commercial and military jets landing at the wrong airport. In the latest case there was a potential for massive casualties, but disaster was averted at the last possible moment.

As they say, to err is human. From my own experience, I know the truth of that adage in science, medicine, diving, and the subject of this posting, aviation. Pilot errors catch everyone’s attention because we, the public, know that such errors could personally inconvenience us, or worse. But lesser known are the sometimes subtle factors that cause human error.

I can honestly tell you  exactly what I was doing and thinking that caused errors at the very end of long flights. Those errors, none of which were particularly dangerous or newsworthy, were nonetheless caused by the same elements that have been discovered in numerous fatal accidents. Namely, what I was seeing, was not at all what I thought I was seeing.

The small but capable Cessna 150B.

Long before the advent of GPS navigation, cell phones and electronic charts,  I was flying myself and an Army friend (we had both been in Army ROTC at Georgia Tech) from Aberdeen Proving Ground, MD to Georgia. I was dropping him off in Atlanta at Peachtree-Dekalb Airport, and then I would fly down to Thomasville in Southwest Georgia where my young wife awaited me.

Since it was February most of the planned six hour flight was at night. We couldn’t take-off until we both got off duty on a Friday.

I had planned the flight meticulously, but I had not counted on the fuel pumps being shut down at our first planned refueling spot. After chatting with some local aviators about the closest source of fuel, we took off on a detour to an airport some thirty miles distant. That unplanned detour was stressful, as I was not entirely sure we’d find fuel when we arrived. Fortunately, we were able to tank up, and continue on our slow journey. We were flying in my 2-seat Cessna 150, and traveling no faster than about 120 mph, so the trip to Atlanta was a fatiguing and dark flight.

As we eventually neared Atlanta, I was reading the blue, yellow and green paper sectional charts under the glow of red light from the overhead cabin lamp. Lights of the Peachtree-Dekalb airport were seemingly close at hand, surrounded by a growing multitude of other city lights. Happy that I was finally reaching Atlanta, I called the tower and got no answer. No matter, it was late, and many towers shut down operations  fairly early, about 10 PM or so. So I announced my position and intentions, and landed.

The runway was in the orientation I had expected, and my approach to landing was just as I had planned. However, as I taxied off the runway, I realized the runway environment was not as complex as it should have been. We taxied back and forth for awhile trying to sort things out, before I realized I’d landed 18 nautical miles short of my planned destination.

My unplanned refueling stop in South Carolina placed me far enough off course to take me directly over an airport that looked at night like my destination, Peachtree-Dekalb, Atlanta. (Solid line: original course, dashed line: altered course.)

I had so much wanted that airport to be PDK, but in my weariness I had missed the signs that it was not. I had landed at Gwinnett County Airport, not Peachtree-Dekalb.

No harm was done, but my flight to Thomasville was seriously delayed by the two extra airport stops. It was after 1 AM before I was safe at the Thomasville, GA airport, calling my worried wife to pick me up.

She was not a happy young wife.

A few years later, I added an instrument ticket to  my aviation credentials, and thought that the folly of my youth was far behind me. Now, advance quite a few decades, to a well-equipped, modern cross-country traveling machine, a Piper Arrow with redundant GPS navigation and on-board weather. I often fly in weather, and confidently descend through clouds to a waiting runway. So what could go wrong?

Piper Arrow 200B at home in Panama City, Fl.

Wrong no. 2 happened when approaching Baltimore-Washington International airport after flying with passengers from the Florida Panhandle. Air Traffic Control was keeping me pretty far from the field as we circled Baltimore to approach from the west. I had my instrumentation set-up for an approach to the assigned runway, but after I saw a runway, big and bold in the distance, I was cleared to land, and no longer relied on the GPS as I turned final.

As luck would have it, just a minute before that final turn we saw President George W. Bush and his decoy helicopters flying in loose formation off our port side. I might have been a little distracted.

In the city haze it had been hard to see the smaller runway pointing in the same direction as the main runway. So I was lining up with the easy-to-see large runway, almost a mile away from where I should have been. It was the same airport of course, but the wrong parallel runway.

I was no doubt tired, and somewhat hurried by the high traffic flow coming into a major hub for Baltimore and Washington. Having seen what I wanted to see, a large runway pointed in the correct direction, I assumed it was the right one, and stopped referring to the GPS and ILS (Instrument Landing System) navigation which would have revealed my error.

The tower controller had apparently seen that error many times before and gently nudged me verbally back on course. The flight path was easily corrected and no harm done. But I had proven to myself once again that at the end of a long trip, you tend to see what you want to see.

Several years later I had been slogging through lots of cloud en-route to Dayton, Ohio. I had meetings to attend at Wright Patterson Air Force base. It was again a long flight, but I was relaxed and enjoying the scenery as I navigated with confidence via redundant GPS (three systems operating at the same time).

As I was approaching Dayton, Dayton Approach was vectoring me toward the field. They did a great job I thought as they set me up perfectly for the left downwind at the landing airport. But then I became a bit perturbed that they had vectored me almost on top of the airport and then apparently forgotten about me. So I let them know that I had the airport very much in sight. They switched me to tower, and I was given clearance to land.

As I began descending for a more normal pattern altitude, the Dayton Tower called and said I seemed to be maneuvering for the wrong airport. In fact, I was on top of Wright Patterson Airbase, not Dayton International.

Rats! Not again.

Dayton airports
Wish my electronic Foreflight chart on my iPad had these sorts of markings.

Well, the field was certainly large enough, but once again I had locked eyes on what seemed to be the landing destination, and in fact was being directed there by the authority of the airways, Air Traffic Control (ATC). And so I was convinced during a busy phase of flight that I was doing what I should have been doing, flying visually with great care and attention. However, I was so busy that my mind had tunnel vision. I had once again not double checked the GPS navigator to see that I was being vectored to a large landmark which happened to lie on the circuitous path to the landing airport. (I wish they’d told me that, but detailed explanations are rarely given over busy airwaves.)

Oddly enough, if I had been in the clouds making an instrument approach, these mind-bending errors could not have happened. But when flight conditions are visual, the mind can easily pick a target that meets many of the correct criteria like direction and proximity, and then fill in the blanks with what it expects to see. In other words, it is easy in the visual environment to focus with laser beam precision on the wrong target. With all the situational awareness tools at my disposal, they were of no use once my brain made the transition outside the cockpit.

To be fair, distracting your gaze from the outside world to check internal navigation once you’re in a critical visual phase of approach and landing can be dangerous. That’s why it’s good to have more than one pilot in the cockpit. But my cockpit crew that day was me, myself and I; in that respect I was handicapped.

Apparently, even multiple crew members in military and commercial airliners are occasionally lulled into the same trap. At least that’s what the newspaper headlines say.

My failings are in some ways eerily similar to reports from military and commercial incidents. Contributing factors in the above incidents are darkness, fatigue, and distraction. When all three of these factors are combined, the last factor that can cause the entire house of cards, and airplane, to come tumbling down, is the brain’s ability to morph reality into an image which the mind expects to see. Our ability to discern truth from fiction is not all that clear when encountering new and unexpected events and environments.

The saving grace that aviation has going for it is generally reliable communication. ATC saved me from major embarrassment on two of these three occasions.

I only wish that diving had as reliable a means for detecting and avoiding errors.












The Aesthetics of Flying in Clouds

When it comes to vocations and avocations, I know of none more aesthetically pleasing than flying and diving. I’m sure there are many others, but I simply don’t know them.

My vocation is diving, and flying is my avocation. I also know commercial pilots who dive in caves simply for the joy of diving. Those two activities, flying and diving, are fairly similar, as I’ve noted before.

There are experiences in flying and diving that make them more than enjoyable. They are actually breathtaking, when one takes the time to appreciate them.

For me, the breath taking part is flying into and out of clouds; what is called instrument flying. It’s called that because when you’re in clouds you can’t see the horizon, and you can’t trust bodily sensations, so you are entirely dependent upon your aircraft instruments to make sure you, your passengers, and the aircraft, do not come to harm.

Granted, there are times during an instrument flight when you see absolutely nothing outside the aircraft. Some have compared it to flying inside a milk bottle, which is in my opinion an apt analogy. If it happens to be smooth flight, then there is no sensation of flight at all. The electronic equipment counts down the miles, but as far as you can tell you are in aerial limbo, seemingly suspended in time and space, encroaching on the edges of the twilight zone. 

But when you eventually break out of those clouds, you instantaneously switch from sensory deprivation to sensory overload. The view can be spectacular. 


When I was an instrument student, long before GPS navigation, instrument flying was hard work, especially when training. It still is in many ways, but technology has made flight in the clouds more precise, and frankly easier over all than it used to be.

But in the clouds a pilot is still too busy “aviating, navigating, and communicating”, to catch more than a brief glance outside, to enjoy the ever shifting textures of white clouds, blue sky and a multitude of grays in between. Occasionally you spy greens and browns of the ground, seen fleetingly through breaks in the cloud cover.

It is a grand theater in the sky not visible from the ground. For that reason, it is special, and to be seen in that moment and that place by no one else in the world except you and your passengers.

The video below gives a sample of such variable flows of scenery, with visibility ranging from zero to miles. The entire flight looped around my home airport in Panama City, FL, as I was radar vectored along a large rectangle, eventually joining a course bringing the aircraft back to a straight-in approach for landing.

This particular flight was a currentcy flight, so the departure and approach to landing was repeated several times. The video, however, ends just after I set up the navigation devices for the next approach. (I suggest you watch the video full screen at the highest resolution possible – 1440p HD.)

The only way I can hope to describe the beauty of such a flight is through the music which accompanies it. The quietness, the excitement, is all there. And from one who has experienced all those emotions during the flight, I can attest to the relevance of that music.