The Three Strikes Rule: Risk Stacking and the Swiss Cheese Model

Ask experienced pilots how they make the fly or stay call and you'll hear some version of this rule. Night is a strike. IMC is a strike. Mountains are a strike. All three, and the airplane stays in the hangar. The rule works because of an idea accident investigators have used for decades: the Swiss cheese model.

What is the Swiss cheese model in aviation?

The Swiss cheese model says accidents rarely have one cause. Every flight has layers of defense, each with weaknesses, and an accident happens when weaknesses in several layers line up at once.

Psychologist James Reason pictured these defenses as slices of Swiss cheese whose holes keep opening, shutting and shifting. Trouble comes "when the holes in many layers momentarily line up to permit a trajectory of accident opportunity" (Reason, BMJ, 2000). The FAA uses the same picture in its Risk Management Handbook, where each slice is a defense against threats, errors and undesired aircraft states (FAA-H-8083-2A, p. 6-5, Figure 6-1).

What do the holes represent in the Swiss cheese model?

The holes are weaknesses in a defense. Reason sorted them into two kinds: active failures and latent conditions.

Active failures are unsafe acts by the people at the controls, such as slips, lapses and mistakes. Latent conditions sit in the system until they combine with an active failure. Reason wrote that nearly all adverse events involve both (Reason, BMJ, 2000).

What are the four layers of the Swiss cheese model?

The four layers usually named are organizational influences, unsafe supervision, preconditions for unsafe acts and unsafe acts. SKYbrary describes these as the four levels of failure in Reason's model (SKYbrary).

The Human Factors Analysis and Classification System (HFACS), developed by Scott Shappell and Doug Wiegmann, uses the same four levels (HFACS). Preconditions include weather, terrain and the pilot's own state, such as stress, fatigue or illness (SKYbrary, HFACS).

What is the three strikes rule for pilots?

The three strikes rule is a personal practice some pilots use: if three risk factors show up on the same flight, they cancel or change the plan.

A strike eats into your margin without breaking a hard limit. Below your written minimums isn't a strike, it's a stop.

How does risk stacking line up the holes?

Risk stacking is several manageable risks adding up on one flight. Each strike is a hole, so three strikes means three holes lined up before engine start. AOPA uses the Swiss cheese model to explain it (AOPA).

• Night. In AOPA ASI's 2017 to 2021 night accident review, 26 percent of night VMC accidents were fatal, versus more than 67 percent in night IMC (AOPA ASI).
• IMC. The FAA found 180 IMC-related GA accidents in NTSB data from 2014 to 2023, with a fatality rate above 82 percent (FAA Safety Briefing).
• Mountainous terrain. The Risk Management Handbook lists night and mountainous terrain among common contributors to controlled flight into terrain (FAA-H-8083-2A, p. 3-4).

In a 2001 Beech A36 accident near Jackson Hole, a non-instrument-rated pilot continued VFR into instrument conditions over mountains he told ATC he didn't know. ASI's summary: "This pilot had numerous factors stacked against him" (AOPA ASI). For a full case study, see our risk stacking article on ASI's Burley Caravan accident (AOPA ASI video).

Is the three strikes rule an FAA rule?

No. It's a personal practice, not an FAA regulation. The FAA's risk guidance for pilots is the Risk Management Handbook, which teaches the PAVE checklist and written personal minimums.

PAVE sorts hazards into Pilot, Aircraft, enVironment and External pressures, and the Pilot's Handbook of Aeronautical Knowledge pairs it with IMSAFE. It also warns that several less critical decisions, "when added together can create a critical outcome" (PHAK, Chapter 2). The Risk Management Handbook gives personal minimums a full chapter (FAA-H-8083-2A).

Where does a simple risk count fall short?

Counting has three blind spots: it misses what you don't notice, treats every strike as equal, and is easy to fudge.

It only counts what you notice. Night and mountains are easy to see. Fatigue, an unfamiliar airport or a dinner reservation at the destination are easy to miss. The FAA Safety Team agrees: "The mind has a tendency to isolate individual risks, which can lead to an underestimation of their collective impact" (FAASTeam FRAT).

It counts but doesn't weigh. A gusty wind and a night IMC layer over high terrain are each one strike, but not the same size. The FAA advises picking the more conservative rating when you're unsure (FAA-H-8083-2A, p. 4-2).

It's easy to fudge. The same page warns that pilots sometimes skew inputs toward a lower risk level "due to the desire to complete a flight."

How does a FRAT show stacked risk factors?

A flight risk assessment tool (FRAT) is the strikes rule written down. The FAA calls FRATs a way to "detect building risk before it becomes apparent in any one factor" (FAA Safety Briefing).

The PlaneWX FRAT is built on PAVE, with IMSAFE in the Pilot step. It opens within 4 hours of departure and pre-fills hints it already knows: day or night, the WX Score breakdown, airport complexity, night currency and whether you've flown into that destination before. Your own LOW, MEDIUM or HIGH ratings override every suggestion.

When three or more elevated factors stack on one flight, the FRAT shows a Risks are stacking banner with the count and the factors behind it. Take the classic three: night, weather rated MEDIUM and terrain rated MEDIUM. Add the hidden ones. You're fatigued, the destination is new to you, friends are waiting and you answered yes to get-there-itis. The banner reads seven, not three.

The banner doesn't change the WX Score or your FRAT levels, and it doesn't make the call. At MEDIUM or HIGH overall risk, the FRAT offers the FAA TEAM options (Transfer, Eliminate, Accept, Mitigate). Then you record GO, NO-GO, Postpone or Modify. PlaneWX never recommends GO or NO-GO. The pilot always decides.

It fits the PlaneWX loop: Brief, Assess, Decide, Debrief, starting with the WX Score briefing. On an obviously low-risk flight the FRAT is optional. When the score comes in low, the FRAT is where you name risks and mitigations, and a mentor can review it with you if concerns remain. The FRAT is on the free plan with no restrictions.

What else should a pilot weigh besides a risk count?

A risk count is one input, not the decision. Also read the NOTAMs, listen to the ATIS, check PIREPs, get a complete official weather briefing, and use your own judgment.

Federal rules require the PIC to "become familiar with all available information concerning that flight" before it begins (14 CFR 91.103). PlaneWX is not a substitute for a complete, independent preflight briefing, and no app or AI makes the fly or stay call for you.

How do you build your own strikes list?

• Write your hard limits first. Ceiling, visibility, crosswind and night rules go in personal minimums. They're stops, not strikes.
• List your strikes by PAVE. Pilot: IMSAFE and recency. Aircraft: squawks, fuel, runway fit. Environment: night, IMC, terrain, unfamiliar airports. External: passengers, deadlines, get-there-itis.
• Weigh the big ones. Decide in advance which items count double for you.
• Recount when things change. A new forecast or a missed approach adds to the count. It doesn't reset it.
• Debrief the count. Did the strikes you counted match what you felt?