Figure 2-10. Risk management processing can take place in any of three timeframes.
Strategic Deliberate Time-Critical
Purpose
Used in a complex operation (e.g.,
introduction of new equipment); involves
research, use of analysis tools, formal
testing, or long term tracking of risks.
Uses experience and brainstorming to identify
hazards, assess risks, and develop controls
for planning operations, review of standard
operating or training procedures, etc.
“On the fly” mental or verbal review using
the basic risk management process
during the execution phase of an activity.
Passengers can also be pilots. If no one is designated as pilot
in command (PIC) and unplanned circumstances arise, the
decision-making styles of several self-confident pilots may
come into conflict.
Pilots also need to understand that non-pilots may not
understand the level of risk involved in flight. There is an
element of risk in every flight. That is why SRM calls it risk
management, not risk elimination. While a pilot may feel
comfortable with the risk present in a night IFR flight, the
passengers may not. A pilot employing SRM should ensure
the passengers are involved in the decision-making and given
tasks and duties to keep them busy and involved. If, upon a
factual description of the risks present, the passengers decide
to buy an airline ticket or rent a car, then a good decision has
generally been made. This discussion also allows the pilot
to move past what he or she thinks the passengers want to
do and find out what they actually want to do. This removes
self-induced pressure from the pilot.
The Programming
The advanced avionics aircraft adds an entirely new
dimension to the way GA aircraft are flown. The electronic
instrument displays, GPS, and autopilot reduce pilot
workload and increase pilot situational awareness. While
programming and operation of these devices are fairly
simple and straightforward, unlike the analog instruments
they replace, they tend to capture the pilot’s attention and
hold it for long periods of time. To avoid this phenomenon,
the pilot should plan in advance when and where the
programming for approaches, route changes, and airport
information gathering should be accomplished, as well as
times it should not. Pilot familiarity with the equipment, the
route, the local ATC environment, and personal capabilities
vis-à-vis the automation should drive when, where, and how
the automation is programmed and used.
The pilot should also consider what his or her capabilities
are in response to last minute changes of the approach (and
the reprogramming required) and ability to make large-scale
changes (a reroute for instance) while hand flying the aircraft.
Since formats are not standardized, simply moving from one
manufacturer’s equipment to another should give the pilot
pause and require more conservative planning and decisions.
The SRM process is simple. At least five times before
and during the flight, the pilot should review and consider
the “Plan, the Plane, the Pilot, the Passengers, and the
Programming” and make the appropriate decision required
by the current situation. It is often said that failure to make
a decision is a decision. Under SRM and the 5 Ps, even the
decision to make no changes to the current plan is made
through a careful consideration of all the risk factors present.
Perceive, Process, Perform (3P) Model
The Perceive, Process, Perform (3P) model for ADM offers
a simple, practical, and systematic approach that can be used
during all phases of flight. To use it, the pilot will:
• Perceive the given set of circumstances for a flight
• Process by evaluating their impact on flight safety
• Perform by implementing the best course of action
Use the Perceive, Process, Perform, and Evaluate method as
a continuous model for every aeronautical decision that you
make. Although human beings will inevitably make mistakes,
anything that you can do to recognize and minimize potential
threats to your safety will make you a better pilot.
Depending upon the nature of the activity and the time
available, risk management processing can take place in
any of three timeframes. [Figure 2-10] Most flight training
activities take place in the “time-critical” timeframe for
risk management. The six steps of risk management can be
combined into an easy-to-remember 3P model for practical
risk management: Perceive, Process, Perform with the PAVE,
CARE and TEAM checklists. Pilots can help perceive
hazards by using the PAVE checklist of: Pilot, Aircraft,
enVironment, and External pressures. They can process
hazards by using the CARE checklist of: Consequences,
Alternatives, Reality, External factors. Finally, pilots can
perform risk management by using the TEAM choice list
of: Transfer, Eliminate, Accept, or Mitigate.
PAVE Checklist: Identify Hazards and Personal
Minimums
In the first step, the goal is to develop situational awareness
by perceiving hazards, which are present events, objects, or
circumstances that could contribute to an undesired future
event. In this step, the pilot will systematically identify and
Gayle is a healthy and well-rested private pilot with
approximately 300 hours total flight time. Hazards include her
lack of overall and cross-country experience and the fact that
she has not flown at all in 2 months.
Pilot
Departure and destination airports have long runways.
Weather is the main hazard. Although it is VFR, it is a typical
summer day in the Mid-Atlantic region: hot (near 90 °F) hazy
(visibility 7 miles), and humid with a density altitude of 2,500
feet. Weather at the destination airport (located in the
mountains) is still IMC but forecast to improve to visual
meteorological conditions (VMC) prior to her arrival. En route
weather is VMC, but there is an AIRMET Sierra for pockets of
IMC over mountain ridges along the proposed route of flight.
EnVironment
Aircraft
Although it does not have a panel-mount GPS or weather
avoidance gear, the aircraft—a C182 Skylane with long-range
fuel tanks—is in good mechanical condition with no inoperative
equipment. The instrument panel is a standard “six-pack.”
External pressures
Gayle is making the trip to spend a weekend with relatives she
does not see very often. Her family is very excited and has
made a number of plans for the visit.
Pilots can perceive hazards by using the PAVE checklist:
Figure 2-11. A real-world example of how the 3P model guides decisions on a cross-country trip using the PAVE checklist.
list hazards associated with all aspects of the flight: Pilot,
Aircraft, enVironment, and External pressures, which makes
up the PAVE checklist. [Figure 2-11] For each element,
ask “what could hurt me, my passengers, or my aircraft?”
All four elements combine and interact to create a unique
situation for any flight. Pay special attention to the pilot-
aircraft combination, and consider whether the combined
“pilot-aircraft team” is capable of the mission you want to fly.
For example, you may be a very experienced and proficient
pilot, but your weather flying ability is still limited if you
are flying a 1970s-model aircraft with no weather avoidance
gear. On the other hand, you may have a new technically
advanced aircraft with moving map GPS, weather datalink,
and autopilot—but if you do not have much weather flying
experience or practice in using this kind of equipment, you
cannot rely on the airplane’s capability to compensate for
your own lack of experience.
CARE Checklist: Review Hazards and Evaluate Risks
In the second step, the goal is to process this information to
determine whether the identified hazards constitute risk, which
is defined as the future impact of a hazard that is not controlled
or eliminated. The degree of risk posed by a given hazard
can be measured in terms of exposure (number of people or
resources affected), severity (extent of possible loss), and
probability (the likelihood that a hazard will cause a loss). The
goal is to evaluate their impact on the safety of your flight,
and consider “why must I CARE about these circumstances?”
For each hazard that you perceived in step one, process by
using the CARE checklist of: Consequences, Alternatives,
Reality, External factors. [Figure 2-12] For example, let's
evaluate a night flight to attend a business meeting:
C onsequences—departing after a full workday creates
fatigue and pressure
A lternatives—delay until morning; reschedule
meeting; drive
R eality —dangers and distractions of fatigue could
lead to an accident
E xternal pressures—business meeting at destination
might influence me
A good rule of thumb for the processing phase: if you find
yourself saying that it will “probably” be okay, it is definitely
time for a solid reality check. If you are worried about missing
a meeting, be realistic about how that pressure will affect
not just your initial go/no-go decision, but also your inflight
decisions to continue the flight or divert.
TEAM Checklist: Choose and Implement Risk
Controls
Once you have perceived a hazard (step one) and processed
its impact on flight safety (step two), it is time to move to the
third step, perform. Perform risk management by using the
TEAM checklist of: Transfer, Eliminate, Accept, Mitigate
to deal with each factor. [Figure 2-13]
Transfer—Should this risk decision be transferred to
someone else (e.g., do you need to consult the chief
flight instructor?)
Eliminate—Is there a way to eliminate the hazard?
Accept—Do the benefits of accepting risk outweigh
the costs?
Mitigate—What can you do to mitigate the risk?
The goal is to perform by taking action to eliminate hazards
or mitigate risk, and then continuously evaluate the outcome
of this action. With the example of low ceilings at destination,
for instance, the pilot can perform good ADM by selecting
a suitable alternate, knowing where to find good weather,
Figure 2-12. A real-world examples of how the 3P model guides decisions on a cross-country trip using the CARE checklist.
• Consequences: Gayle’s inexperience and lack of recent
flight time create some risks for an accident, primarily because
she plans to travel over mountains on a hazy day and land
at an unfamiliar mountain airport that is still in IMC
conditions.
• Alternatives: Gayle might mitigate the pilot-related risk by
hiring a CFI to accompany her and provide dual cross-
country instruction. An added benefit is the opportunity to
broaden her flying experience in safe conditions.
• Reality: Accepting the reality that limited experience can
create additional risks is a key part of sound risk management
and mitigation.
• External Factors: Like many pilots, Gayle must contend with
the emotional pressure associated with acknowledging that
her skill and experience levels may be lower than she would
like them to be. Pride can be a powerful external factor!
Pilot
• Consequences: For a pilot whose experience consists
mostly of local flights in good VMC, launching a long cross-
country flight over mountainous terrain in hazy conditions
could lead to pilot disorientation and increase the risk of an
accident.
• Alternatives: Options include postponing the trip until the
visibility improves, or modifying the route to avoid extended
periods of time over the mountains.
• Reality: Hazy conditions and mountainous terrain clearly
create risks for an inexperienced VFR-only pilot.
• External Factors: Few pilots are immune to the pressure of
“get-there-itis,” which can sometimes induce a decision to
launch or continue in less than ideal weather conditions.
Environment
Aircraft
• Consequences: This area presents low risk because the
aircraft is in excellent mechanical condition and Gayle is
familiar with its avionics.
• Alternatives: Had there been a problem with her aircraft,
Gayle might have considered renting another plane from her
flight school. Bear in mind, however, that alternatives
sometimes create new hazards. In this instance, there may
be hazards associated with flying an unfamiliar aircraft with
different avionics.
• Reality: It is important to recognize the reality of an aircraft’s
mechanical condition. If you find a maintenance discrepancy
and then find yourself saying that it is “probably” okay to fly
with it anyway, you need to revisit the consequences part of
this checklist.
• External Factors: Pilot decision-making can sometimes be
influenced by the external pressure of needing to return the
airplane to the FBO by a certain date and time. Because
Gayle owns the airplane, there was no such pressure in this
case.
External pressures
• Consequences: Any number of factors can create the risk of
emotional pressure from a “get-there” mentality. In Gayle’s
case, the consequences of her strong desire to visit family,
her family’s expectations, and personal pride could induce
her to accept unnecessary risks.
• Alternatives: Gayle clearly needs to develop a mitigating
strategy for each of the external factors associated with this
trip.
• Reality: Pilots sometimes tend to discount or ignore the
potential impact of these external factors. Gayle’s open
acknowledgement of these factors (e.g., “I might be
pressured into pressing on so my mother won’t have to
worry about our late arrival.”) is a critical element of effective
risk management.
• External Factors: (see above)
Pilots can perceive hazards by using the CARE checklist:
and carrying sufficient fuel to reach it. This course of action
would mitigate the risk. The pilot also has the option to
eliminate it entirely by waiting for better weather.
Once the pilot has completed the 3P decision process and
selected a course of action, the process begins anew because
now the set of circumstances brought about by the course of
action requires analysis. The decision-making process is a
continuous loop of perceiving, processing, and performing.
With practice and consistent use, running through the 3P
cycle can become a habit that is as smooth, continuous, and
automatic as a well-honed instrument scan. This basic set
of practical risk management tools can be used to improve
risk management.
Your mental willingness to follow through on safe decisions,
especially those that require delay or diversion is critical. You
can bulk up your mental muscles by:
• Using personal minimums checklist to make some
decisions in advance of the flight. To develop a good
personal minimums checklist, you need to assess your
abilities and capabilities in a non-flying environment,
when there is no pressure to make a specific trip. Once
developed, a personal minimums checklist will give
you a clear and concise reference point for making
your go/no-go or continue/discontinue decisions.
• In addition to having personal minimums, some pilots
also like to use a preflight risk assessment checklist to
help with the ADM and risk management processes.
This kind of form assigns numbers to certain risks
and situations, which can make it easier to see when
a particular flight involves a higher level of risk
• Develop a list of good alternatives during your
processing phase. In marginal weather, for instance,
you might mitigate the risk by identifying a reasonable
Figure 2-13. A real-world example of how the 3P model guides decisions on a cross-country trip using the TEAM checklist.
To manage the risk associated with her inexperience and lack
of recent flight time, Gayle can:
• Transfer the risk entirely by having another pilot act as PIC.
• Eliminate the risk by canceling the trip.
• Accept the risk and fly anyway.
• Mitigate the risk by flying with another pilot.
Gayle chooses to mitigate the major risk by hiring a CFI to
accompany her and provide dual cross-country instruction.
An added benefit is the opportunity to broaden her flying
experience.
Pilot
To manage the risk associated with hazy conditions and
mountainous terrain, Gayle can:
• Transfer the risk of VFR in these conditions by asking an
instrument-rated pilot to fly the trip under IFR.
• Eliminate the risk by canceling the trip.
• Accept the risk.
• Mitigate the risk by careful preflight planning, filing a VFR
flight plan, requesting VFR flight following, and using
resources such as Flight Watch.
Detailed preflight planning must be a vital part of Gayle’s
weather risk mitigation strategy. The most direct route would
put her over mountains for most of the trip. Because of the
thick haze and pockets of IMC over mountains, Gayle might
mitigate the risk by modifying the route to fly over valleys. This
change will add 30 minutes to her estimated time of arrival
(ETA), but the extra time is a small price to pay for avoiding
possible IMC over mountains. Because her destination airport
is IMC at the time of departure, Gayle needs to establish that
VFR conditions exist at other airports within easy driving
distance of her original destination. In addition, Gayle should
review basic information (e.g., traffic pattern altitude, runway
layout, frequencies) for these alternate airports. To further
mitigate risk and practice good cockpit resource management,
Gayle should file a VFR flight plan, use VFR flight following,
and call Flight Watch to get weather updates en route. Finally,
basic functions on her handheld GPS should also be practiced.
Environment
Aircraft
To manage risk associated with any doubts about the aircraft’s
mechanical condition, Gayle can:
• Transfer the risk by using a different airplane.
• Eliminate the risk by canceling the trip.
• Accept the risk.
• Mitigate the remaining (residual) risk through review of
aircraft performance and careful preflight inspection.
Since she finds no problems with the aircraft’s mechanical
condition, Gayle chooses to mitigate any remaining risk
through careful preflight inspection of the aircraft.
External pressures
To mitigate the risk of emotional pressure from family
expectations that can drive a “get-there” mentality, Gayle can:
• Transfer the risk by having her co-pilot act as PIC and make
the continue/divert decision.
• Eliminate the risk by canceling the trip.
• Accept the risk.
• Mitigate the risk by managing family expectations and
making alternative arrangements in the event of diversion to
another airport.
Gayle and her co-pilot choose to address this risk by agreeing
that each pilot has a veto on continuing the flight, and that they
will divert if either becomes uncomfortable with flight conditions.
Because the destination airport is still IMC at the time of
departure, Gayle establishes a specific point in the trip—an en
route VORTAC located between the destination airport and the
two alternates—as the logical place for her “final” continue/
divert decision. Rather than give her family a specific ETA that
might make Gayle feel pressured to meet the schedule, she
manages her family’s expectations by advising them that she
will call when she arrives.
Pilots can perform risk management by using the TEAM checklist:
alternative airport for every 25–30 nautical mile
segment of your route.
• Preflight your passengers by preparing them for the
possibility of delay and diversion, and involve them
in your evaluation process.
• Another important tool—overlooked by many pilots—
is a good post-flight analysis. When you have safely
secured the airplane, take the time to review and
analyze the flight as objectively as you can. Mistakes
and judgment errors are inevitable; the most important
thing is for you to recognize, analyze, and learn from
them before your next flight.
The DECIDE Model
Using the acronym “DECIDE,” the six-step process DECIDE
Model is another continuous loop process that provides the
pilot with a logical way of making decisions. [Figure 2-14]
DECIDE means to Detect, Estimate, Choose a course of
action, Identify solutions, Do the necessary actions, and
Evaluate the effects of the actions.
First, consider a recent accident involving a Piper Apache (PA-
23). The aircraft was substantially damaged during impact
with terrain at a local airport in Alabama. The certificated
airline transport pilot (ATP) received minor injuries and the
certificated private pilot was not injured. The private pilot
1.
2.
3.
4
5.
6.
The DECIDE model
Aeronautical Decision-Making
A. Analytical B. Automatic/Naturalistic
Evaluation of event
Outcome desired
What is best action to do
Effect of decision
Detection
Situation
Pilot
Aircraft
Enviroment
External factors
• Risk or hazard
• Potential outcomes
• Capabilities of pilot
• Aircraft capabilities
• Outside factors
Solutions to get you there
Solution 1
Solution 2
Solution 3
Solution 4
Problem remains
Done
Evaluation of event
Outcome desired
Take action
Detection
Pilot
Aircraft
Enviroment
External factors
• Risk to flight
• Pilot training
• Pilot experience
Successful
Figure 2-14. The DECIDE model has been recognized worldwide. Its application is illustrated in column A while automatic/naturalistic
decision-making is shown in column B.
was receiving a checkride from the ATP (who was also a
designated examiner) for a commercial pilot certificate with
a multi-engine rating. After performing airwork at altitude,
they returned to the airport and the private pilot performed a
single-engine approach to a full stop landing. He then taxied
back for takeoff, performed a short field takeoff, and then
joined the traffic pattern to return for another landing. During
the approach for the second landing, the ATP simulated a right
engine failure by reducing power on the right engine to zero
thrust. This caused the aircraft to yaw right.
The procedure to identify the failed engine is a two-step
process. First, adjust the power to the maximum controllable
level on both engines. Because the left engine is the only
engine delivering thrust, the yaw increases to the right, which
necessitates application of additional left rudder application.
The failed engine is the side that requires no rudder pressure,
in this case the right engine. Second, having identified the
failed right engine, the procedure is to feather the right engine
and adjust power to maintain descent angle to a landing.
However, in this case the pilot feathered the left engine because
he assumed the engine failure was a left engine failure. During
twin-engine training, the left engine out is emphasized more
than the right engine because the left engine on most light
twins is the critical engine. This is due to multiengine airplanes
being subject to P-factor, as are single-engine airplanes.
The descending propeller blade of each engine will produce
greater thrust than the ascending blade when the airplane is
operated under power and at positive angles of attack. The
descending propeller blade of the right engine is also a greater
distance from the center of gravity, and therefore has a longer
moment arm than the descending propeller blade of the left
engine. As a result, failure of the left engine will result in the
most asymmetrical thrust (adverse yaw) because the right
engine will be providing the remaining thrust. Many twins are
designed with a counter-rotating right engine. With this design,
the degree of asymmetrical thrust is the same with either engine
inoperative. Neither engine is more critical than the other.
Since the pilot never executed the first step of identifying
which engine failed, he feathered the left engine and set the
right engine at zero thrust. This essentially restricted the
aircraft to a controlled glide. Upon realizing that he was
not going to make the runway, the pilot increased power to
both engines causing an enormous yaw to the left (the left
propeller was feathered) whereupon the aircraft started to turn
left. In desperation, the instructor closed both throttles and
the aircraft hit the ground and was substantially damaged.
This case is interesting because it highlights two particular
issues. First, taking action without forethought can be just
as dangerous as taking no action at all. In this case, the
pilot’s actions were incorrect; yet, there was sufficient
time to take the necessary steps to analyze the simulated
emergency. The second and more subtle issue is that decisions
made under pressure are sometimes executed based upon
limited experience and the actions taken may be incorrect,
incomplete, or insufficient to handle the situation.
Detect (the Problem)
Problem detection is the first step in the decision-making
process. It begins with recognizing a change occurred or an
expected change did not occur. A problem is perceived first
by the senses and then it is distinguished through insight
and experience. These same abilities, as well as an objective
analysis of all available information, are used to determine
the nature and severity of the problem. One critical error
made during the decision-making process is incorrectly
detecting the problem. In the previous example, the change
that occurred was a yaw.
Estimate (the Need To React)
In the engine-out example, the aircraft yawed right, the pilot
was on final approach, and the problem warranted a prompt
solution. In many cases, overreaction and fixation excludes
a safe outcome. For example, what if the cabin door of a
Mooney suddenly opened in flight while the aircraft climbed
through 1,500 feet on a clear sunny day? The sudden opening
would be alarming, but the perceived hazard the open door
presents is quickly and effectively assessed as minor. In
fact, the door’s opening would not impact safe flight and
can almost be disregarded. Most likely, a pilot would return
to the airport to secure the door after landing.
The pilot flying on a clear day faced with this minor problem
may rank the open cabin door as a low risk. What about
the pilot on an IFR climb out in IMC conditions with light
intermittent turbulence in rain who is receiving an amended
clearance from ATC? The open cabin door now becomes
a higher risk factor. The problem has not changed, but the
perception of risk a pilot assigns it changes because of the
multitude of ongoing tasks and the environment. Experience,
discipline, awareness, and knowledge influences how a pilot
ranks a problem.
Choose (a Course of Action)
After the problem has been identified and its impact
estimated, the pilot must determine the desirable outcome
and choose a course of action. In the case of the multiengine
pilot given the simulated failed engine, the desired objective
is to safely land the airplane.
Identify (Solutions)
The pilot formulates a plan that will take him or her to the
objective. Sometimes, there may be only one course of action
available. In the case of the engine failure already at 500
feet or below, the pilot solves the problem by identifying
one or more solutions that lead to a successful outcome. It is
important for the pilot not to become fixated on the process
to the exclusion of making a decision.
Do (the Necessary Actions)
Once pathways to resolution are identified, the pilot selects the
most suitable one for the situation. The multiengine pilot given
the simulated failed engine must now safely land the aircraft.
Evaluate (the Effect of the Action)
Finally, after implementing a solution, evaluate the decision
to see if it was correct. If the action taken does not provide
the desired results, the process may have to be repeated.