by Atul Gawande
First came what pilots call their "normal" checklists--the routine lists they use for everyday aircraft operations. There were the checks they do before starting the engines, before pulling away from the gate, before taxiing to the runway, and so on. In all, these took up just three pages. The rest of the handbook consisted of the "non-normal" checklists covering every conceivable emergency situation a pilot might run into: smoke in the cockpit, different warning lights turning on, a dead radio, a copilot becoming disabled, and engine failure, to name just a few. They addressed situations most pilots never encounter in their entire careers. But the checklists were there should they need them.
Boorman showed me the one for when the DOOR FWD CARGO warning light goes on in midflight. This signals that the forward cargo door is not closed and secure, which is extremely dangerous. He told me of a 1989 case he'd studied in which exactly this problem occurred. An electrical short had caused a Boeing 747 cargo door to become unlatched during a United Airlines flight out of Honolulu on its way to Auckland, New Zealand, with 337 passengers on board. The plane was climbing past twenty-two thousand feet and the cabin was pressurized to maintain oxygen levels for the passengers. At that altitude, a loose, unlatched cargo door is a serious hazard: if it opens enough to begin leaking air, the large pressure difference between inside and out causes a "ring-pull" effect--an explosive release like pulling the ring top on a shaken soda can. In the Honolulu flight, the explosion blew out the cargo door almost instantly and took with it several upper-deck windows and five rows of business class seats. Nine passengers were lost at sea. Passengers in adjacent seats were held in only by their seat belts. A flight attendant in the aisle was nearly sucked out, too, but an alert passenger managed to grab her ankle and pin her down, inches from the gaping hole.
The crew had had no time to prevent the catastrophe. From unlatching to blowout and the loss of nine lives took no more than 1.5 seconds. Boeing subsequently redesigned the electrical system for its cargo doors and--because no latch is foolproof--installed extra latches, as well. If one fails, the DOOR FWD CARGO light goes on and the crew has more time to respond. There is a window of opportunity to stop a blowout. That's where the checklist comes in.
When a latch gives way, Boorman explained, a crew should not tinker with the door or trust that the other latches will hold. Instead, the key is to equalize the difference between inside and outside pressures. The more you lower the cabin pressure, the less likely the door will explode away.
Airplanes have an easy way to lower the pressure, apparently: you hit an emergency override switch that vents the cabin air and releases the pressurization in about thirty seconds. This solution is problematic, however. First, the sudden loss of pressure can be extremely uncomfortable for passengers, particularly given the ear pain it causes. Infants fare the worst, as their eustachian tubes haven't developed sufficiently to adjust to the change. Second, depressurizing a plane at an altitude of twenty or thirty thousand feet is like dropping passengers onto the summit of Mount Everest. The air is too thin to supply enough oxygen for the body and brain.
The United Airlines flight offered a vivid lesson in what could happen, for the cargo door blowout instantly depressurized the plane, and once the initial, explosive decompression was over, lack of oxygen became the prime danger for the passengers and crew. Getting sucked into the void was no longer the issue. Everyone was able to stay well away from the ten-by-fifteen-foot hole. The temperature, however, plummeted to near freezing, and the oxygen levels fell so low that the crew became light-headed and feared losing consciousness. Sensors automatically dropped oxygen masks, but the oxygen supply on airplanes is expected to last only ten minutes. Moreover, the supply might not even work, which is exactly what happened on that flight.
The cockpit voice recorder caught the events from the moment the cargo door blew away:
CAPTAIN: What the [expletive] was that?
FIRST OFFICER: I don't know.
The pilots notified flight control that something had gone wrong. Two seconds later, their cabin pressure and oxygen levels were gone.
FIRST OFFICER: Put your mask on, Dave.
CAPTAIN: Yeah.
FIRST OFFICER: Honolulu Center Continental One Heavy, did you want us to turn left did you say?
RADIO: Continental One Heavy affirmative.
FIRST OFFICER: Turning now.
CAPTAIN: I can't get any oxygen.
FLIGHT ENGINEER: What do you want me to do now?
VOICE UNIDENTIFIED: [expletive]
FIRST OFFICER: You okay?
CAPTAIN: Yeah.
FIRST OFFICER: Are you getting oxygen? We're not getting any oxygen.
FLIGHT ENGINEER: No I'm not getting oxygen either.
The blast had torn out the oxygen supply lines, an investigation later found. Only by luck did the cockpit crew maintain enough control of the plane to descend to an altitude with sufficient oxygen levels. The pilots were then able to turn back to the Honolulu airport. All eighteen crew and 328 terrified remaining passengers survived.
The lesson for pilots is complicated. If you're jetting along at thirty thousand feet and the DOOR FWD CARGO warning light goes on, yes, eliminating the pressure differential between inside and outside to stop the door from blowing out is a very good idea, but doing it by hitting the emergency depressurization switch and leaving everyone short of oxygen is not. Instead, Boorman said, the best thing to do is to make a rapid but controlled descent to eight thousand feet or as close to it as possible. At that height, you can safely release the plane's inside pressure--the oxygen levels at eight thousand feet are adequate for people to breathe. (It is the altitude of Aspen, Colorado, after all.) And with that, the risk of a United Airlines-style door blowout will be safely eliminated.
The DOOR FWD CARGO checklist spelled out all these steps. And Boorman stressed how carefully it was designed for a crew to use in an emergency. All of Boeing's aviation checklists--the company issues over one hundred per year, either new or revised--are put together meticulously. Boorman's flight operations group is a checklist factory, and the experts in it have learned a thing or two over the years about how to make the lists work.
There are good checklists and bad, Boorman explained. Bad checklists are vague and imprecise. They are too long; they are hard to use; they are impractical. They are made by desk jockeys with no awareness of the situations in which they are to be deployed. They treat the people using the tools as dumb and try to spell out every single step. They turn people's brains off rather than turn them on.
Good checklists, on the other hand, are precise. They are efficient, to the point, and easy to use even in the most difficult situations. They do not try to spell out everything--a checklist cannot fly a plane. Instead, they provide reminders of only the most critical and important steps--the ones that even the highly skilled professionals using them could miss. Good checklists are, above all, practical.
The power of checklists is limited, Boorman emphasized. They can help experts remember how to manage a complex process or configure a complex machine. They can make priorities clearer and prompt people to function better as a team. By themselves, however, checklists cannot make anyone follow them.
I could imagine, for instance, that when the DOOR FWD CARGO warning light goes on in a cockpit, a pilot's first instinct might not be to grab the checklist book. How many times, after all, does a flashing warning light end up being a false alarm? The flight would likely have been going smoothly. No noises. No explosion. No strange thud. Just this pesky light flipping on. The ground crew already inspected the doors at the preflight check and found no problem. Besides, only 1 in 500,000 flights ever suffers an accident of any kind. So a person could be tempted to troubleshoot--maybe have someone check the circuitry before deciding that something might really have gone wrong.
Pilots nonetheless turn to their checklists for two reasons. First, they are trained to do so. They learn from the beginning of flight school that their memory and judg
ment are unreliable and that lives depend on their recognizing that fact. Second, the checklists have proved their worth--they work. However much pilots are taught to trust their procedures more than their instincts, that doesn't mean they will do so blindly. Aviation checklists are by no means perfect. Some have been found confusing or unclear or flawed. Nonetheless, they have earned pilots' faith. Face-to-face with catastrophe, they are astonishingly willing to turn to their checklists.
In the cockpit voice recorder transcript of the United flight from Honolulu, for example, the pilots' readiness to rely on procedure is striking. The circumstances were terrifying. Debris was flying. The noise was tremendous. Their hearts were probably racing. And they had a lot to focus on. Beyond the immediate oxygen problem, ejected sections of fuselage had flown into engine No. 3, on the right wing, and disabled it. Additional debris had hit engine No. 4 and set it on fire. The outer-edge wing flaps had been damaged. And sitting up front, trying to figure out what to do, the cockpit crew still had no idea what had really happened. They thought a bomb had gone off. They didn't know the full extent of the damage, or whether another blast might occur. They nonetheless needed to shut down the ruined engines, notify air traffic control of the emergency, descend to a safe altitude, determine how maneuverable the plane was, sort out which alarms on their instrument panel they could ignore and which ones they couldn't, and decide whether to ditch the plane in the ocean or return to Honolulu. The greatest test of where crew members place their trust--in their instincts or in their procedures--is how they handle such a disaster.
So what did they do? They grabbed their checklist book:
CAPTAIN: You want me to read a checklist?
FLIGHT ENGINEER: Yeah, I got it out. When you're ready.
CAPTAIN: Ready.
There was a lot to go through, and they had to make good choices about what procedures to turn to first. Following their protocols, they reduced their altitude, got the two damaged engines shut down safely, tested the plane's ability to land despite the wing damage, dumped fuel to lighten their load, and successfully returned to Honolulu.
To pilots, the checklists have proved worth trusting, and that is thanks to people like Boorman, who have learned how to make good checklists instead of bad. Clearly, our surgery checklist had a ways to go.
When you're making a checklist, Boorman explained, you have a number of key decisions. You must define a clear pause point at which the checklist is supposed to be used (unless the moment is obvious, like when a warning light goes on or an engine fails). You must decide whether you want a DO-CONFIRM checklist or a READ-DO checklist. With a DO-CONFIRM checklist, he said, team members perform their jobs from memory and experience, often separately. But then they stop. They pause to run the checklist and confirm that everything that was supposed to be done was done. With a READ-DO checklist, on the other hand, people carry out the tasks as they check them off--it's more like a recipe. So for any new checklist created from scratch, you have to pick the type that makes the most sense for the situation.
The checklist cannot be lengthy. A rule of thumb some use is to keep it to between five and nine items, which is the limit of working memory. Boorman didn't think one had to be religious on this point.
"It all depends on the context," he said. "In some situations you have only twenty seconds. In others, you may have several minutes."
But after about sixty to ninety seconds at a given pause point, the checklist often becomes a distraction from other things. People start "shortcutting." Steps get missed. So you want to keep the list short by focusing on what he called "the killer items"--the steps that are most dangerous to skip and sometimes overlooked nonetheless. (Data establishing which steps are most critical and how frequently people miss them are highly coveted in aviation, though not always available.)
The wording should be simple and exact, Boorman went on, and use the familiar language of the profession. Even the look of the checklist matters. Ideally, it should fit on one page. It should be free of clutter and unnecessary colors. It should use both uppercase and lowercase text for ease of reading. (He went so far as to recommend using a sans serif type like Helvetica.)
To some extent, we had covered this territory in drafting our surgery checklist. No question, it needed some trimming, and many items on the list could be sharper and less confusing. I figured we could fix it easily. But Boorman was adamant about one further point: no matter how careful we might be, no matter how much thought we might put in, a checklist has to be tested in the real world, which is inevitably more complicated than expected. First drafts always fall apart, he said, and one needs to study how, make changes, and keep testing until the checklist works consistently.
This is not easy to do in surgery, I pointed out. Not in aviation, either, he countered. You can't unlatch a cargo door in midflight and observe how a crew handles the consequences. But that's why they have flight simulators, and he offered to show me one.
I tried not to seem like a kid who'd just been offered a chance to go up to the front of the plane and see the cockpit. Sure, I said. That sounds neat.
A short stroll later, we entered an adjacent building, walked through an ordinary-looking metal door, and came upon a strange, boxlike space capsule. It was mounted on three massive hydraulic legs. We appeared to be on a platform of some kind, as the capsule was on our level and the legs went down to the floor below. Boorman led me into the thing and inside was a complete Boeing 777-200ER cockpit. He had me climb into the captain's seat on the left while he took the one on the right. He showed me how to belt myself in. The windshield was three black plasma screens, until an assistant turned them on.
"What airport do you want?" Boorman asked. "We've got almost every airport in the world loaded into the database."
I chose the Seattle-Tacoma airport, where I'd landed the day before, and suddenly the tarmac came up on the screens. It was amazing. We were parked at a gate. Guys with baggage carts whizzed back and forth in front of me. In the distance, I could see other airplanes taxiing in and out of their gates.
Boorman walked me through our checks. Built into the wall panel on my left was a slot for the checklist book, which I could grab at any time, but it was just a backup. Pilots usually use an electronic checklist that appears on the center console. He demonstrated how one goes through it, reading from the screen.
"Oxygen," he said and pointed to where I could confirm the supply.
"Tested, 100 percent," I was supposed to respond. "Flight instruments," he said, and showed me where I could find the heading and altimeter readings.
On our initial cockpit check, we had just four preflight items to review. Before starting the engines, we had six more items, plus a prompt asking us to confirm that we'd completed our "taxi and takeoff briefing"--the discussion between pilot and copilot in which they talk through their taxi and takeoff plans and concerns. Boorman went through it with me.
His plan, as far as I could follow, was to do a "normal" takeoff on Runway 16L, lift off at a whole lot of knots per hour, "fly the standard departure" to the southeast, and climb to twenty thousand feet--I think. He also said something important sounding about the radio settings. Then he mentioned a bunch of crazy stuff--like if we had an engine failure during takeoff, we would power down if we were still on the ground, continue climbing if we had one engine left, or look for a good landing site nearby if we didn't. I nodded sagely.
"Do you have any concerns?" he asked.
"Nope," I said.
He started the engines, and although there were no actual engines, you could hear them rev up, and we had to talk louder to be heard above them. Before taxiing out to the runway, we paused again for five more checks: whether anti-icing was necessary and completed, the autobrakes were set, the flight controls were checked, the ground equipment was cleared, and no warning lights were on.
The three checklists took no time at all--maybe thirty seconds each--plus maybe a minute for the briefing. The brevity was no accident, B
oorman said. People had spent hours watching pilots try out early versions in simulators, timing them, refining them, paring them down to their most efficient essentials.
When he was satisfied that we were ready, he had me pull out of the gate. I was supposed to be the pilot for this flight, believe it or not. He directed me to push the pedal brake down hard with two feet to release it. I felt a jolt as the plane lurched forward. I controlled the direction of the nose wheel with a tiller on my left--a spinning metal handle that I wound forward to turn right and backward to turn left--and the speed with the throttle controls, three levers in the center console. I weaved like a sot at first but got the hang of it by the time we reached the runway. I throttled back down to idle and locked the brake with both feet to wait our turn for takeoff. Boorman called up the Before Takeoff checklist.
"Flaps," he said.
"Set," I said.
This was getting to be fun. We got notification from the control tower that we were cleared. I unlocked the brakes, again. Boorman showed me how far to push the throttle. We began accelerating down the runway, slowly at first, and then it felt like we were rocketing. I pressed the right and left rudder pedals to try to keep us on the center line. Then, when he gave me the word, I pulled back on the yoke--what I'd thought of as the steering wheel--and felt the plane lift into the air. I don't know how the simulator does it, but it really did seem like we were airborne.