When Your Instruments Stop Working: The Aviation Doctrine

You are in cloud at eight thousand feet and everything is fine.

The aircraft is trimmed. Your hands are steady. Your inner ear reports wings level and a gentle climb, and it reports this with total confidence, the way it has every day of your life since you learned to stand. Nothing hurts. Nothing feels off. There is no warning tone, no shudder, no moment of doubt.

The aircraft is in a descending right turn losing five hundred feet a minute.

This is spatial disorientation, and it is the reason instrument training exists. The vestibular system is not a bad instrument. It is an excellent instrument operating outside the conditions it was designed for. Sustained turns fool it. The fluid in the semicircular canals catches up to the rotation and settles, and once it settles the canal reports no turn at all. Roll out of that turn and the same system now reports a turn in the opposite direction. Your body will tell you, without hesitation and without any sensation of error, that you are banking left when you are flying straight.

The graveyard spiral follows from there with a kind of arithmetic cruelty. The aircraft descends in a turn. The pilot notices the altitude loss and pulls back on the yoke, because pulling back is what you do when you are descending. In a bank, pulling back tightens the turn and steepens the descent. The correction accelerates the failure. The pilot’s sensation and the pilot’s response are both internally consistent, both competent, and both routed off an instrument that has gone quietly out of specification.

Every pilot flying in cloud has been trained on one line: believe the instruments, not the sensation.

The doctrine is not about feelings

The instruction sounds like a lesson about emotional discipline. It is not. It is a lesson about calibration ranking, and the distinction matters more than anything else in this piece.

The attitude indicator does not win because it is a machine and the inner ear is soft and human. It wins because someone tests it. It is checked before flight. It is checked on a schedule by people who sign their names. Its known failure modes are documented, and when it fails there are procedures for recognising the failure and reverting to the standby instruments and the compass and the clock.

The inner ear has no such regime. It is never tested. Its failure modes are known in general and never in the specific case. There is no procedure for cross-checking your own vestibular system in flight, because there is no way to do it from inside.

So the doctrine reduces to something less mystical and considerably more useful: in a disagreement between two instruments, trust the one that has been calibrated. Aviation resolved that question a long time ago in favour of the panel, correctly, given what the panel is and what the inner ear is. It did not resolve the question by declaring internal signals worthless. It resolved it by observing that one instrument was verified and the other was not.

The panel does not win because it is a machine. It wins because someone checks it on a schedule and signs their name.

Now run the same failure in the other direction

An operator in their forties runs a company doing four million in revenue with eighteen people. Ask them how the business is doing and the answer arrives in seconds, with numbers. Revenue against last year. Gross margin. Headcount and the two roles open. Pipeline. Cash position and runway. Churn, if the model has churn. They can produce this from memory in a lift.

This is a panel. It is a good panel. It is checked monthly by an accountant, quarterly by an advisor, and constantly by the operator. It has documented failure modes and correction procedures. It is, in every meaningful sense, calibrated.

Now ask them a different question. How are you reading the business? Not what the numbers say. What is your own instrument returning.

The answer to that one takes longer, arrives in worse language, and is usually offered with an apology attached. Something about being tired. Something about a rough quarter. Something that gets waved off within a sentence and a half.

Watch what happened there. The panel reading was delivered as data. The internal reading was delivered as an excuse.

That is the whole failure, and it is the mirror image of the pilot’s.

The pilot’s external reference disappears into cloud and the internal instrument is left running unchecked. The operator’s external reference is bright, detailed and constantly refreshed, and the internal instrument is left running unchecked in a different way: it is still producing readings, and every one of them is discarded on arrival.

The pilot’s problem is a missing horizon. The operator’s problem is a horizon so vivid that they stop looking at anything else.

Why this failure is invisible from inside

Three properties make internal drift undetectable to the person it is happening to, and they compound.

It is gradual, so no alarm fires. Instruments do not usually fail by going blank. They fail by developing an offset, and an offset that arrives over eighteen months has no moment of onset to notice. There is no day on which the reading became wrong. There is only a slow migration in what registers as normal, and the reference against which you would detect the migration is the same instrument that is migrating.

The panel keeps reading fine, which is taken as proof. This is the Regulation Gap in one line: dysregulation masked by external competence. Output holds. Revenue holds. The board is satisfied and the team is shipping. The operator concludes, reasonably, that a system producing correct outputs cannot have a failing component. That inference is false and it is false in a specific way. Output tells you the aggregate is inside tolerance today. It tells you nothing about which component is carrying the load or how much margin is left.

The correction is competent and wrong. The graveyard spiral does not kill people through panic. It kills them through a correct-looking control input applied to a misread situation. The operator equivalent is the extra quarter of push. Sharper focus. Tighter execution. Another hire. Each of these is a reasonable response to the situation the internal instrument is reporting, and each one steepens the descent when the report is off. Effort applied along a wrong vector is not neutral. It is the mechanism of the loss.

The spiral does not kill through panic. It kills through a competent correction applied to a misread situation.

The cost, in numbers you can run yourself

I will not hand you a statistic here, because the only honest version of this number is the one you compute from your own operation. The arithmetic is straightforward and most operators have never done it.

Count the consequential decisions you made in the last twelve months: a hire at a senior level, a market you entered or declined, a partnership, a product line, a person you kept eighteen months longer than the evidence supported. For a company at four million with eighteen people, that list is usually somewhere between eight and fifteen items.

Now assign each one a rough value in the range of what it moved or cost. Not precisely. An order of magnitude is enough.

Now ask the only question that matters: on how many of them was the analysis sound and the outcome still wrong.

That subset is your miscalibration bill. It is not the decisions where you lacked information, and it is not the decisions where the market moved. It is the ones where the panel was accurate, the reasoning was clean, and something in your own read of the situation was pointing a few degrees off true. In most operations of this size the subset is small in count and enormous in value, because the internal read is what selects which analysis you run at all.

The number is real. It sits in your own history. What makes it invisible is that miscalibration does not produce a line item. It produces a decision that looked correct in the meeting and cost you a year.

Fifteen years reading an instrument nobody else believed

In 2011 my body began to shut down from the navel outward. Within seven days, downward through the legs into full lower-body paralysis. Three days later, upward toward the chest, tightening until I was breathing with only the top of my lungs. The clinical expectation at that point was a ventilator.

That was the second event. The first was in 2008, when the right side of my body went from functional to paralysed from the neck down inside twenty-four hours, and took three years to come back to about 95 per cent.

Here is what those years actually taught me, and it is not what people expect.

The prognosis was not stupid. It was the correct output of a calibrated instrument. The scans, the neurology and the recorded case histories were the panel, and the panel was reading the situation accurately at the level of the population. What the panel could not do was read one specific body from inside it. There was exactly one instrument in the room with access to that signal, and it was the one everybody, including me at first, was trained to discount.

So I did the only thing available. I started treating my internal read as an instrument rather than as a mood. I recorded what I sensed before I tested it. Where sensation seemed to be returning, when a muscle felt like it was answering, which days were genuinely worse and which ones only felt worse. Then I tested against something external and I found out how wrong I had been.

Early on, badly wrong, and in both directions. I read progress that was not there. I missed progress that was. Over years the offset came down, and by the end I could feel where function was returning weeks before there was anything anyone could point to.

That is not intuition. Intuition is what I started with, and it was unreliable. What I ended with was a calibrated instrument, and the difference between the two is a decade and a half of recorded reads checked against outcomes. Motor control returned to the waist. Deep sensation continues to come back. The chair is still here, and so is a functioning internal instrument that I now trust in the specific and narrow way you trust anything that has been tested.

Intuition is where I started, and it was unreliable. What I ended with was a calibrated instrument, and the difference between them is fifteen years of recorded reads checked against outcomes.

I write for operators who are sceptical of anything that sounds like it belongs in a wellness seminar. That scepticism is correct and I would keep it. The claim here is not that your feelings are wise. The claim is narrower and considerably more demanding: you are carrying an instrument that produces continuous readings on the single variable your external panel cannot measure, you have never once tested it, and you have concluded from that absence of testing that it reads nothing worth having.

Five countermeasures, each with a mechanism

Aviation did not solve disorientation with awareness. It solved it with procedures that work while the operator is compromised, which is the only kind of procedure worth writing. The same standard applies here. Each of the following states the mechanism it operates on and a question you can put to yourself before you finish reading.

1. Record the read before the outcome

Mechanism. An instrument can only be calibrated against a known true value, and the true value arrives later than the reading. If you assess your internal read after you know how the decision turned out, the outcome has already rewritten the memory of the read. You get a story, not a data point. Recording first is what converts an impression into something checkable.

Practically: before any decision of consequence, one line in a file. Not the reasoning, which the panel already covers. The read. What is my own instrument saying about this, independent of the analysis. Date it. Do not revisit it for ninety days.

Diagnostic question. When did I last write down what I sensed about a decision before I knew whether it worked?

If the answer is never, you do not currently know whether your internal read is accurate or worthless, and neither position is available to you. You are operating an instrument with no test history.

2. Cross-check on a fixed scan, not on suspicion

Mechanism. Instrument pilots do not consult the panel when something feels wrong. They run a continuous scan across several instruments in a fixed pattern, precisely because the moment something feels wrong is already too late and the feeling is the thing under suspicion. A scan run on schedule catches disagreement between instruments early. A scan run on suspicion only fires when the failing instrument decides to report a failure.

Practically: a fixed weekly slot, thirty minutes, where the panel reading and the internal reading are both written down and compared. Where they disagree, the disagreement is the finding. It does not need resolving in the session. It needs recording.

Diagnostic question. Does my review of how I am reading the business happen on a schedule, or only when something has already gone wrong?

The schedule is the whole of it. A calibration run once, at an offsite, in a good week, produces one data point and the feeling of having done the work. That feeling is the same one the workshop high runs on, and it decays the same way.

Suspicion-triggered checking is not checking. It is a smoke alarm wired to a sensor inside the fire.

3. Instrument the body as signal, not as health

Mechanism. Physiological state changes precede conscious framing. Sleep architecture, resting heart rate, appetite, jaw and shoulder tension and the specific time you wake in the night all shift before the operator has a narrative for why. These are not wellness metrics in this context. They are leading indicators on the same instrument, available earlier and harder to argue with, because they are quantitative and the internal narrative is not.

Practically: three numbers, tracked, whatever they are for you. Not to optimise them. To have a record of the instrument’s output that you cannot retrospectively edit.

Diagnostic question. Can I state, from a record rather than from memory, how my sleep in the four weeks before my last significant decision compared with the four weeks before that?

If not, you have been discarding the highest-frequency data your internal instrument produces.

4. Appoint one person authorised to contradict the read

Mechanism. An operator’s information environment filters itself. Staff moderate what they bring. Advisors respond to how the question was framed. Peers at similar stages share the same distortions and confirm them. The result is an external environment that reflects the internal read back rather than testing it. One person, explicitly given standing to say “your read on this is off”, restores an independent reference. The standing has to be explicit, because without it nobody uses it.

Practically: name the person. Tell them the specific brief. Ask them, quarterly and directly, where your read has been wrong. The quality of the answer depends entirely on whether they believe you meant it.

Diagnostic question. Who told me my read was wrong in the last six months, and what did I do in the ten seconds after they said it?

If nobody did, that is not evidence that your read was right.

5. Debrief the read, not the decision

Mechanism. This is the step that closes the loop and it is the one almost nobody runs. Decision reviews assess the decision. Calibration requires assessing the instrument: retrieve the read you recorded in step one, compare it against what actually happened, and score the read itself. Was it accurate, optimistic, pessimistic, or pointing at the wrong variable entirely. Repeated across a dozen decisions, this produces the one thing you cannot get any other way, which is your own error profile. Not whether you are calibrated in general. In which direction you are off, and by how much, under which conditions.

Practically: quarterly, ninety minutes, with the recorded reads open in front of you. The output is one sentence describing your current offset.

Diagnostic question. Do I know the direction of my own bias - whether I read situations warmer or colder than they turn out to be - from evidence rather than from self-image?

Almost every operator has a confident answer to this and almost none of them have checked it. The confident answer is itself produced by the uncalibrated instrument.

What is actually being proposed here

Not that you should trust yourself more. That instruction is worthless and slightly dangerous, and it is the reason this territory is full of people selling intuition as a virtue. An uncalibrated internal read is precisely what puts an aircraft into the ground.

The proposal is structural, and it has three parts.

First, that the internal read is an instrument rather than a mood. It produces continuous output on variables the external panel does not measure: whether the work still points where you pointed it, whether the operation is drawing on capacity you actually have, whether the version of you making these decisions is the one you intended to become.

Second, that it is currently uncalibrated, and that this is a fact about your test history rather than a judgement about you. The overwhelming majority of operators have never recorded a read before an outcome. That is not a character flaw. It is a missing procedure.

Third, that calibration is available and cheap. It is a record, a schedule, three tracked numbers, an outside reference and a debrief. Five procedures, none of which require a belief system, all of which produce data within a quarter.

---