PAVE and ADM

Most fatal general aviation accidents come from a sequence of pilot decisions, not from a failure of the airplane. Each decision in the sequence looks reasonable at the time. A preflight checklist finds the bad decision on the ground, where changing it costs a conversation or a cancelled trip. The same decision in flight can cost the flight.

PAVE: the four categories

PAVE is a checklist of the four categories of risk to a flight: Pilot, Aircraft, enVironment, and External pressures 1. A pilot runs it before each flight.

Pilot. Are you fit and qualified for this flight, today, in these conditions?

Aircraft. Can this airplane, as equipped and loaded today, do this mission? The question is about the mission, not about legality. An airplane can be airworthy, with inspections current and each instrument working, and still be the wrong airplane for today's mission.

enVironment. Weather, terrain, route, obstructions, airports, and airspace, for the whole route and the whole flight.

External pressures. Each influence outside the cockpit that makes the pilot want to complete the flight. Examples:

• a party at the destination
• a passenger who took time off work
• rental money already spent
• the wish not to look timid.

Pilots are least honest about this category. Accidents from external pressure happen to careful planners. The defense is an alternative planned before takeoff: a firm alternate airport, or a backup plan the passengers heard about in advance. Pressure decreases when the alternative already exists.

PAVE is the checklist that satisfies 14 CFR 91.103. The rule opens: "Each pilot in command shall, before beginning a flight, become familiar with all available information concerning that flight" 2. All available information includes an unfavorable forecast.

The flight of N36402

On December 19, 2015, a private pilot flew his wife and three children from Reid-Hillview Airport in San Jose toward Henderson, Nevada. The airplane was a turbocharged Piper Lance. The family was on vacation. A surprise party was scheduled in Henderson that evening. All five died when the airplane broke apart in flight near Bakersfield. Each of the four PAVE categories showed a problem before takeoff.

The pilot had 269.5 hours. He held no instrument rating. His logbook showed 0.8 hours of actual instrument time, from two training flights almost two years earlier.

He filed a VFR flight plan. He got a weather briefing the night before and a second one at 6:53 the next morning. The morning briefing carried AIRMETs along his route for IFR conditions, mountain obscuration, and moderate icing. A series of winter storms crossed the route.

The airplane was not approved for flight in icing conditions. It carried oxygen equipment with three cannulas for five people.

He departed at 2:35 in the afternoon.

For the next hour he climbed to stay above the cloud tops: 15,500 feet, then 16,500, then 17,500. He deviated south around precipitation. Other pilots on the frequency reported tops at 18,000 feet, then 21,000 feet. A VFR flight cannot enter Class A airspace, which starts at 18,000 feet. For more than half the flight the airplane was above 15,000 feet, where each occupant must have oxygen.

Sunset was one hour away. A band of rain lay across his track.

At about 3:50 pm, the controller offered him an IFR clearance to Henderson. He accepted it. He was not rated to fly it, and the airplane was probably already in or near the clouds.

About four minutes later, while he turned and reconfigured the airplane for the clearance, he lost control. He transmitted "mayday" twice. The airplane entered a spiral. The aerodynamic loads exceeded the structural limits, and the airplane broke apart.

The NTSB found two probable causes: the decision to conduct and continue the flight into forecast instrument conditions, and the decision to accept the clearance. The report adds: "Contributing to the accident was the pilot's self-induced pressure to arrive at the destination for a party that night." The full report is here: 3.

The pressure was self-induced. No one in the family would have chosen the flight over the party. External pressure in PAVE is pressure the pilot puts on the flight.

The video below is the AOPA Air Safety Institute's reconstruction of the flight. It uses the radar track, the controller recordings, and the weather the pilot saw.

Where the accident chain could have been broken

The FAA calls the sequence of decisions that ends in an accident the accident chain. A different decision at any point in the sequence prevents the accident. The eight decisions of this flight are listed below. Each carries the PAVE category it belongs to and the decision that would have ended the flight safely.

The four ground decisions came first. A decision on the ground costs a conversation or a cancelled trip. The same decision in flight costs the flight. That cost difference is why the pilot runs PAVE before takeoff.

The pilot check: IMSAFE

IMSAFE is the checklist for PAVE's Pilot category: Illness, Medication, Stress, Alcohol, Fatigue, Emotion 4. Some FAA materials use Eating for the E. Both forms are correct.

Run it before each flight, not only when you feel unwell. It is a go/no-go decision about you, and only you can make it. A medical certificate shows that a doctor found you fit on one past day. Only you know how you slept last night and how you feel this morning.

Illness. "Am I sick?" A minor illness can degrade performance of the tasks vital to safe flight. A fever impairs judgment, memory, alertness, and the ability to make calculations 5. A head cold is the common case. A blocked eustachian tube on descent causes an ear block, with severe pain and a possible ruptured eardrum. The AIM's rule is not to fly while suffering from any illness.

Medication. "Am I taking any medicines that might affect my judgment or make me drowsy?" Under 14 CFR 61.53 you must not fly while on medication or treatment that makes you unable to meet your medical certificate's requirements 6. The FAA's Over-the-Counter Medications Reference Guide is the document to read before you take any medication and fly 7. Its table marks each common medication GO or NO GO. It sets three rules:

• a new medication: wait at least 48 hours after the first dose, with no side effects, before you fly
• a NO GO medication, or one that gave you side effects before: wait at least five dosage intervals after the last dose
• a sedating antihistamine such as diphenhydramine: wait at least 60 hours.

Five dosage intervals means:

• 30 hours for a medication taken at intervals of 4 to 6 hours
• 40 hours for a medication taken at intervals of 8 hours
• 60 hours for a medication taken at intervals of 12 hours.

If in doubt, ask an aviation medical examiner.

Stress. "Am I under psychological pressure from the job?" Stress from the pressures of everyday living impairs pilot performance, often in subtle ways 5. Stress and fatigue together are, in the AIM's words, "an extremely hazardous combination."

Alcohol. "Have I been drinking within 8 hours? Within 24 hours?" 14 CFR 91.17 sets three limits 8. A crewmember must not act:

• within 8 hours of drinking any alcohol
• while under the influence of alcohol
• with a blood or breath alcohol concentration of 0.04 or greater.

The 8 hours is a minimum. A hangover is impairment that remains after the 8 hours end, with a concentration below 0.04.

Fatigue. "Am I tired and not adequately rested?" The AIM calls fatigue "one of the most treacherous hazards to flight safety," because a pilot can fail to notice it until the errors start 5.

Emotion. "Am I emotionally upset?" An argument, a loss, or a recurring worry takes attention from the flight. The AIM's personal checklist lists all six: "I'm physically and mentally safe to fly; not being impaired by: Illness, Medication, Stress, Alcohol, Fatigue, Emotion" 5.

Hazard, risk, and the tools for judging them

A hazard is a condition or an object: fog on the pass, a soft grass runway, a party on the calendar. Risk is how likely and how severe the harm from that hazard is on this flight 9. The two are different.

You cannot remove most hazards. You decide how much risk each hazard adds to your flight. Fog on the pass is a fact about the mountains. Flying toward it without an instrument rating is a decision about risk.

Aeronautical decision making (ADM) is the FAA's term for a systematic approach to risk 10. The approach finds hazards, judges their risk, and chooses the safest course of action. Three tools apply.

A risk assessment matrix rates each risk on two axes, how likely the harm is and how severe it would be. The combination tells you whether to change or cancel the flight 11.

The DECIDE model works a problem in six steps: Detect, Estimate, Choose, Identify, Do, Evaluate 12.

The pilot runs the 3P loop continuously in flight: Perceive the hazard, Process its risk, Perform the mitigation, then perceive again 13. It does not end until the flight ends.

The 3P loop is why the pilot makes the go/no-go decision more than once. On the ground the decision is go/no-go. In the air the same question is called continue/divert, and the pilot asks it against the same PAVE categories for the whole flight. The pilot of N36402 answered it wrong about a dozen times in his last hour, and each time the divert option was open.

Personal minimums are limits you set on the ground, in calm conditions, stricter than the regulations, and never changed in the air 14. The regulations are the same for a 20,000-hour test pilot and for you. Personal minimums are your own honest numbers for wind, visibility, and ceiling. Under pressure, you compare the conditions to those numbers, not to your wish to go.

The five hazardous attitudes

The FAA names five thought patterns that lead to accidents 15. Each has an antidote: a short phrase you say to yourself, aloud if necessary, when you notice the attitude. The mnemonic RAIIM holds the five: Resignation, Anti-authority, Impulsivity, Invulnerability, Macho.

The method has three steps:

• notice the hazardous thought
• name it
• say the antidote.

The antidote does nothing while you still believe the thought is correct. Recognizing the thought is the intervention.

Three of the five attitudes appear in the accident. The wish to arrive for the party is invulnerability: it will not happen to me, not with my family aboard. Continuing into conditions beyond his training is macho. Accepting a clearance he could not fly, rather than asking for help, is resignation. He took the one option that did not require him to tell the controller his situation.

Cognitive biases

A cognitive bias is a repeatable error in how a person judges information. The FAA's Risk Management Handbook names two that affect a student pilot on the first solo cross-country 16.

Confirmation bias is searching only for information that supports the decision you already made. An example is reading the one good forecast twice and the AIRMET once. The counter takes deliberate effort. Search for the evidence against your decision, and give that evidence more weight.

Expectation bias is hearing or seeing what you expected instead of what happened. The classic case is reading back the clearance you expected rather than the one the controller issued. The counter is to treat each readback and each gauge check as a real question, not a formality.

These two biases are not the only ones. Wikipedia's list of cognitive biases names more than a hundred, and several apply to a pilot. The sunk cost fallacy is continuing because the rental money is already spent. The overconfidence effect is the attitude the FAA calls macho.

Fly the airplane first

When a problem occurs, the task priority is fixed: aviate, navigate, communicate, in that order 17. Fly the airplane first. Know where you are and where you are going second. Talk third. Many accidents happened because the pilot stopped flying the airplane to troubleshoot, navigate, or talk.

Situational awareness is an accurate understanding of what happens now and what happens next 18. Its two main threats are distraction and fixation. Distraction is attention on something other than the flight. Fixation is attention held on one thing while the rest of the flight changes. The pilot of N36402 showed both in his last minutes: head down in an unfamiliar procedure while the airplane rolled away from wings level.

The same priority applies to automation. An autopilot or a glass display is a resource to manage, not a substitute for flying. State what the automation does, and revert to hand flying as soon as it does something you did not expect 19.

Using everything you have

Single-pilot resource management (SRM) is the use of each resource available to a pilot flying alone 20. The resources are:

• the airplane's equipment
• ATC
• charts
• passengers who can hold a flashlight or watch for traffic
• the pilot's own planning. Crew resource management (CRM) is the same discipline when more than one crewmember shares the flight deck. The controller in the accident reported precipitation, relayed tops, and offered options. He was a resource for the whole flight.

The 5P check organizes SRM. Its decision points are:

• before takeoff
• at cruise checks
• before descent
• before the approach.

At each one, ask about the Plan, the Plane, the Pilot, the Passengers, and the Programming 21. Five questions take thirty seconds, and you make the continue/divert decision deliberately instead of by default.