The Checklist Manifesto (15 page)

The cockpit voice recorder caught the events from the moment the cargo door blew away:

The pilots notified flight control that something had gone wrong. Two seconds later, their cabin pressure and oxygen levels were gone.

The blast had torn out the oxygen supply lines, an investigation later found. Only by luck did the cockpit crew maintain enough control of the plane to descend to an altitude with sufficient oxygen levels. The pilots were then able to turn back to the Honolulu airport. All eighteen crew and 328 terrified remaining passengers survived.

The lesson for pilots is complicated. If you’re jetting along at thirty thousand feet and the DOOR FWD CARGO warning light goes on, yes, eliminating the pressure differential between inside and outside to stop the door from blowing out is a very good idea, but doing it by hitting the emergency depressurization switch and leaving everyone short of oxygen is not. Instead, Boorman said, the best thing to do is to make a rapid but controlled descent to eight thousand feet or as close to it as possible. At that height, you can safely release the plane’s inside pressure—the oxygen levels at eight thousand feet are adequate for people to breathe. (It is the altitude of Aspen, Colorado, after all.) And with that, the risk of a United Airlines–style door blowout will be safely eliminated.

The DOOR FWD CARGO checklist spelled out all these steps. And Boorman stressed how carefully it was designed for a crew to use in an emergency. All of Boeing’s aviation checklists—the company issues over one hundred per year, either new or revised—are put together meticulously. Boorman’s flight operations group is a checklist factory, and the experts in it have learned a thing or two over the years about how to make the lists work.

There are good checklists and bad, Boorman explained. Bad checklists are vague and imprecise. They are too long; they are hard to use; they are impractical. They are made by desk jockeys with no awareness of the situations in which they are to be deployed. They treat the people using the tools as dumb and try to spell out every single step. They turn people’s brains off rather than turn them on.

Good checklists, on the other hand, are precise. They are efficient, to the point, and easy to use even in the most difficult situations. They do not try to spell out everything—a checklist cannot fly a plane. Instead, they provide reminders of only the most critical and important steps—the ones that even the highly skilled professionals using them could miss. Good checklists are, above all, practical.

The power of checklists is limited, Boorman emphasized. They can help experts remember how to manage a complex process or configure a complex machine. They can make priorities clearer and prompt people to function better as a team. By themselves, however, checklists cannot make anyone follow them.

I could imagine, for instance, that when the DOOR FWD CARGO warning light goes on in a cockpit, a pilot’s first instinct
might not be to grab the checklist book. How many times, after all, does a flashing warning light end up being a false alarm? The flight would likely have been going smoothly. No noises. No explosion. No strange thud. Just this pesky light flipping on. The ground crew already inspected the doors at the preflight check and found no problem. Besides, only 1 in 500,000 flights ever suffers an accident of any kind. So a person could be tempted to troubleshoot—maybe have someone check the circuitry before deciding that something might really have gone wrong.

Pilots nonetheless turn to their checklists for two reasons. First, they are trained to do so. They learn from the beginning of flight school that their memory and judgment are unreliable and that lives depend on their recognizing that fact. Second, the checklists have proved their worth—they work. However much pilots are taught to trust their procedures more than their instincts, that doesn’t mean they will do so blindly. Aviation checklists are by no means perfect. Some have been found confusing or unclear or flawed. Nonetheless, they have earned pilots’ faith. Face-to-face with catastrophe, they are astonishingly willing to turn to their checklists.

In the cockpit voice recorder transcript of the United flight from Honolulu, for example, the pilots’ readiness to rely on procedure is striking. The circumstances were terrifying. Debris was flying. The noise was tremendous. Their hearts were probably racing. And they had a lot to focus on. Beyond the immediate oxygen problem, ejected sections of fuselage had flown into engine No. 3, on the right wing, and disabled it. Additional debris had hit engine No. 4 and set it on fire. The outer-edge wing flaps had been damaged. And sitting up front, trying to figure out what to do, the cockpit crew still had no idea what had really
happened. They thought a bomb had gone off. They didn’t know the full extent of the damage, or whether another blast might occur. They nonetheless needed to shut down the ruined engines, notify air traffic control of the emergency, descend to a safe altitude, determine how maneuverable the plane was, sort out which alarms on their instrument panel they could ignore and which ones they couldn’t, and decide whether to ditch the plane in the ocean or return to Honolulu. The greatest test of where crew members place their trust—in their instincts or in their procedures—is how they handle such a disaster.

So what did they do? They grabbed their checklist book:

There was a lot to go through, and they had to make good choices about what procedures to turn to first. Following their protocols, they reduced their altitude, got the two damaged engines shut down safely, tested the plane’s ability to land despite the wing damage, dumped fuel to lighten their load, and successfully returned to Honolulu.

To pilots, the checklists have proved worth trusting, and that is thanks to people like Boorman, who have learned how to make good checklists instead of bad. Clearly, our surgery checklist had a ways to go.

When you’re making a checklist, Boorman explained, you have a number of key decisions. You must define a clear pause point at
which the checklist is supposed to be used (unless the moment is obvious, like when a warning light goes on or an engine fails). You must decide whether you want a DO-CONFIRM checklist or a READ-DO checklist. With a DO-CONFIRM checklist, he said, team members perform their jobs from memory and experience, often separately. But then they stop. They pause to run the checklist and confirm that everything that was supposed to be done was done. With a READ-DO checklist, on the other hand, people carry out the tasks as they check them off—it’s more like a recipe. So for any new checklist created from scratch, you have to pick the type that makes the most sense for the situation.

The checklist cannot be lengthy. A rule of thumb some use is to keep it to between five and nine items, which is the limit of working memory. Boorman didn’t think one had to be religious on this point.

“It all depends on the context,” he said. “In some situations you have only twenty seconds. In others, you may have several minutes.”

But after about sixty to ninety seconds at a given pause point, the checklist often becomes a distraction from other things. People start “shortcutting.” Steps get missed. So you want to keep the list short by focusing on what he called “the killer items”—the steps that are most dangerous to skip and sometimes overlooked nonetheless. (Data establishing which steps are most critical and how frequently people miss them are highly coveted in aviation, though not always available.)

The wording should be simple and exact, Boorman went on, and use the familiar language of the profession. Even the look of the checklist matters. Ideally, it should fit on one page. It should be free of clutter and unnecessary colors. It should use both
uppercase and lowercase text for ease of reading. (He went so far as to recommend using a sans serif type like Helvetica.)

To some extent, we had covered this territory in drafting our surgery checklist. No question, it needed some trimming, and many items on the list could be sharper and less confusing. I figured we could fix it easily. But Boorman was adamant about one further point: no matter how careful we might be, no matter how much thought we might put in, a checklist has to be tested in the real world, which is inevitably more complicated than expected. First drafts always fall apart, he said, and one needs to study how, make changes, and keep testing until the checklist works consistently.

This is not easy to do in surgery, I pointed out. Not in aviation, either, he countered. You can’t unlatch a cargo door in midflight and observe how a crew handles the consequences. But that’s why they have flight simulators, and he offered to show me one.

I tried not to seem like a kid who’d just been offered a chance to go up to the front of the plane and see the cockpit. Sure, I said. That sounds neat.

A short stroll later, we entered an adjacent building, walked through an ordinary-looking metal door, and came upon a strange, boxlike space capsule. It was mounted on three massive hydraulic legs. We appeared to be on a platform of some kind, as the capsule was on our level and the legs went down to the floor below. Boorman led me into the thing and inside was a complete Boeing 777-200ER cockpit. He had me climb into the captain’s seat on the left while he took the one on the right. He showed me how to belt myself in. The windshield was three black plasma screens, until an assistant turned them on.

“What airport do you want?” Boorman asked. “We’ve got almost every airport in the world loaded into the database.”

I chose the Seattle-Tacoma airport, where I’d landed the day before, and suddenly the tarmac came up on the screens. It was amazing. We were parked at a gate. Guys with baggage carts whizzed back and forth in front of me. In the distance, I could see other airplanes taxiing in and out of their gates.

Boorman walked me through our checks. Built into the wall panel on my left was a slot for the checklist book, which I could grab at any time, but it was just a backup. Pilots usually use an electronic checklist that appears on the center console. He demonstrated how one goes through it, reading from the screen.

“Oxygen,” he said and pointed to where I could confirm the supply.

“Tested, 100 percent,” I was supposed to respond. “Flight instruments,” he said, and showed me where I could find the heading and altimeter readings.

On our initial cockpit check, we had just four preflight items to review. Before starting the engines, we had six more items, plus a prompt asking us to confirm that we’d completed our “taxi and takeoff briefing”—the discussion between pilot and copilot in which they talk through their taxi and takeoff plans and concerns. Boorman went through it with me.

His plan, as far as I could follow, was to do a “normal” takeoff on Runway 16L, lift off at a whole lot of knots per hour, “fly the standard departure” to the southeast, and climb to twenty thousand feet—I think. He also said something important sounding about the radio settings. Then he mentioned a bunch of crazy stuff—like if we had an engine failure during takeoff, we would power down if we were still on the ground, continue climbing if
we had one engine left, or look for a good landing site nearby if we didn’t. I nodded sagely.

“Do you have any concerns?” he asked.

“Nope,” I said.

He started the engines, and although there were no actual engines, you could hear them rev up, and we had to talk louder to be heard above them. Before taxiing out to the runway, we paused again for five more checks: whether anti-icing was necessary and completed, the autobrakes were set, the flight controls were checked, the ground equipment was cleared, and no warning lights were on.

The three checklists took no time at all—maybe thirty seconds each—plus maybe a minute for the briefing. The brevity was no accident, Boorman said. People had spent hours watching pilots try out early versions in simulators, timing them, refining them, paring them down to their most efficient essentials.