Checklist Philosophy

The Model 299 made its first flight on July 28, 1935, flown by Boeing’s chief test pilot Leslie R. Tower. Dubbed the “Flying Fortress” by Seattle reporter Richard L. Williams, the Model 299 was the prototype for 12,730 B-17s which followed. Then on Oct. 30, 1935, with the suddenness that characterizes experimental test flights, Boeing’s great gamble seemed to fail when the beautiful silver Model 299 crashed on takeoff from Wright Field. The tragic event seemed certain to lead to the cancellation of the program and an immediate change in Army Air Corps planning.

At about 9:30 a.m. on that October day, the Model 299 was manned by a very experienced crew, including Maj. Ployer P. Hill, Wright Field’s Flying Branch chief, and his copilot, 1st Lt. Donald L. Putt. Also on board were John B. Cutting, a flight-test observer; Mark H. Koogler, also from the Flying Branch; and Tower.

Observers described the initial run of the Model 299’s takeoff as normal, even though it broke ground at about 74 mph in a “tail low” attitude. As its speed increased, the bomber’s nose went up much higher than normal. Two men, 1st Lt. Robert K. Giovannoli and 1st Lt. Leonard F. Harman, sensed it was in trouble and ran forward as the airplane reached an altitude of about 300 feet.

The Model 299 stalled, turned 180 degrees, and fell back onto a field. It landed on its left wing, cushioning the impact, which probably saved the lives of several crew. Lying flat on the field, the bomber burst into flames. Amazingly, four crew members were able to crawl from the blazing wreckage.

Source: Boyne

A board of officers convened at Wright Field to investigate the crash. The presiding officer was Lt. Col. Frank D. Lackland, for whom Lackland AFB, Tex., was later named. The board determined the accident was “not caused by”: structural failure; malfunction of flight controls, engines, or propellers; the automatic pilot; or any faulty structural or aerodynamic design. Instead, it ascribed the direct cause to the elevator control being locked.

The tail section of the aircraft was virtually all that survived the fire, but it contained the cause of the accident: an internal control lock that controlled both the elevator and rudder.

The board stated that—due to the size of the airplane and the inherent design of the control system—it was improbable that any pilot, taking off under the same conditions, would discover the locked controls until it was too late to prevent a crash. Ordinarily, pilots make checks of their movement as a precaution, but apparently this did not occur.

To avoid another accident, Air Corps personnel developed checklists the crew would follow for takeoff, flight, before landing, and after landing. The idea was so simple, and so effective, that the checklist was to become the future norm for aircraft operations. The basic concept had already been around for decades, and was in scattered use in aviation worldwide, but it took the Model 299 crash to institutionalize its use.

The creation of the checklist was delayed by an unrealistic reliance on the memory of pilots. This dated all the way back to 1903, with the Wright brothers’ intimate knowledge of airplanes.

By 1918, with vastly expanded pilot training in the United States, a special handbook was created by Curtiss for the JN-4 “Jenny.” One section was titled “Hints on Flying” and provided a list of 18 items, each with considerable detail. Five items were devoted to actions to take before takeoff, nine covered in-flight procedures and safety precautions, two advised on landings, and two discussed ways to avoid stalls and spins.

As was the case with all of these checklist predecessors, pilots were expected to know the manual by rote. Sometimes this led to hubris, which led to accidents.

The nearest relative to a post-1935 checklist is found in “Hints on the Bristol Fighter,” dated March 30, 1918, and written by the officer commanding No. 39 Squadron. The section headings are similar to modern checklist, including specific sections designed to ensure pilots see that the pressure is holding, the ignition is fully advanced, the temperature is at least 65 degrees and not over 85 degrees, the oil pressure is OK, the blinds are open, and the tail lever is forward.

Source: Boyne

(a) The pilot in command of an airplane shall ensure that the following flying equipment and aeronautical charts and data, in current and appropriate form, are accessible for each flight at the pilot station of the airplane:

(1) A flashlight having at least two size “D” cells, or the equivalent, that is in good working order.

(2) A cockpit checklist containing the procedures required by paragraph (b) of this section.

(3) Pertinent aeronautical charts.

(4) For IFR, VFR over-the-top, or night operations, each pertinent navigational en route, terminal area, and approach and letdown chart.

(5) In the case of multiengine airplanes, one-engine inoperative climb performance data.

(b) Each cockpit checklist must contain the following procedures and shall be used by the flight crewmembers when operating the airplane:

(1) Before starting engines.

(2) Before takeoff.

(3) Cruise.

(4) Before landing.

(5) After landing.

(6) Stopping engines.

(7) Emergencies.

(c) Each emergency cockpit checklist procedure required by paragraph (b)(7) of this section must contain the following procedures, as appropriate:

(1) Emergency operation of fuel, hydraulic, electrical, and mechanical systems. (2) Emergency operation of instruments and controls.

(3) Engine inoperative procedures.

(4) Any other procedures necessary for safety.

(d) The equipment, charts, and data prescribed in this section shall be used by the pilot in command and other members of the flight crew, when pertinent.

Source: 14 CFR 91, §91.503

(a) Aircraft operations for the purpose of air navigation. No person may operate an aircraft in a careless or reckless manner so as to endanger the life or property of another.

(b) Aircraft operations other than for the purpose of air navigation. No person may operate an aircraft, other than for the purpose of air navigation, on any part of the surface of an airport used by aircraft for air commerce (including areas used by those aircraft for receiving or discharging persons or cargo), in a careless or reckless manner so as to endanger the life or property of another.

Source: 14 CFR 91, §91.13

3-3401 A. Definition. A checklist is a formal list used to identify, schedule, compare, or verify a group of elements or actions. A checklist is used as a visual or oral aid that enables the user to overcome the limitations of short-term human memory.

3-3402 B. Criticality of Checklist Items. Checklist items can be ranked in criticality according to the potential effect of the crewmember failing to perform the action. Critical items are those items which, if not correctly performed, have a direct, adverse effect on safety. Noncritical items are “housekeeping” items or systems management items, which for operating practices must be routinely accomplished during a specific phase of flight, but if omitted would have a minimal effect on safety.

3-3403 METHODS OF CHECKLIST DESIGN. Operators may choose from at least two accepted methods of checklist design: the “challenge-do-verify” (CDV) method and the “do-verify” (DV) method. Available evidence suggests that safety is enhanced when the operator adopts and applies a consistent checklist design policy. POIs should use the following informative guidance when reviewing the design of an operator’s aircraft checklists.

A. “Challenge-Do-Verify.” The CDV method consists of a crewmember making a challenge before an action is initiated, taking the action, and then verifying that the action item has been accomplished. The CDV method is most effective when one crewmember issues the challenge and the second crewmember takes the action and responds to the first crewmember, verifying that the action was taken. This method requires that the checklist be accomplished methodically, one item at a time, in an unvarying sequence. The primary advantage of the CDV method is the deliberate and systematic manner in which each action item must be accomplished. The CDV method keeps all crewmembers involved (in the loop), provides for concurrence from a second crewmember before an action is taken, and provides positive confirmation that the action was accomplished. The disadvantages of the CDV method are that it is rigid and inflexible and that crewmembers cannot accomplish different tasks at the same time.

B. “Do Verify.” The DV method (or “clean-up” method) consists of the checklist being accomplished in a variable sequence without a preliminary challenge. After all of the action items on the checklist have been completed, the checklist is then read again while each item is verified. The DV method allows the flightcrew to use flow patterns from memory to accomplish a series of actions quickly and efficiently. Each individual crewmember can work independently, which helps balance the workload between crewmembers. The DV method has a higher inherent risk of an item on the checklist being missed than does the CDV method.

C. Selection of Design Method. Both the CDV and the DV methods of checklist design are currently being successfully used for normal checklists. Traditionally, operators have preferred the DV method for normal checklists and the CDV method for non-normal and emergency checklists. Operators have, however, successfully used the CDV method for all checklists. POIs may approve either method for normal checklists. In most circumstances, non-normal and emergency checklists are more effective when the CDV method is used. The correct accomplishment of the actions and procedures incorporated in the non-normal and emergency checklist categories is critical and warrants a methodical approach. Since these checklists are seldom used, however, crewmembers are usually not as familiar with the procedures incorporated into these checklists as they are with the procedures in normal checklists. In addition, many non-normal and emergency checklists do not lend themselves to developing flow patterns that crewmembers can readily recall. The CDV method also enforces crew coordination, cross-checking, and verification, all of which aid the crewmember in overcoming the adverse effects of stress. POIs should not approve or accept the DV method for non-normal or emergency procedures unless the operator can provide substantial evidence that the method is effective for this application.

3-3404 B. 7) In the taxi and pretakeoff phases, aircraft configuration (such as flaps, trim, and speedbrakes) and flight guidance items (such as heading, flight director, altitude select panel settings, and airspeed bugs) have proven to be critical. All flightcrew members should confirm these items, and at least two crewmembers should respond to applicable checklist items.

8) On approach, flight guidance checklist items have proven to be critical items. At least two crewmembers should confirm and respond to these items. A response should be required from each pilot when the same setting is required on two separate devices (such as computers, flight instruments, or altimeters).

9) All checklist items that are critical in the before-landing phase vary with the type of airplane involved. In the operation of small airplanes, the landing gear has proven to be a critical checklist item, and both pilots should confirm and respond to this item. Although the landing gear and flaps are critical items for large, transport category airplanes, the multiple warning devices and systems that are associated with these systems make the need for a response and confirmation by both pilots less critical.

10) All checklists, except the after-takeoff and after-landing checklists, should be accomplished by one crewmember reading the checklist items and a second crewmember confirming and responding to each item. POIs shall ensure that critical items on the before-takeoff and before-landing checklists are confirmed and responded to by at least two crewmembers.

Source: FAA Order 8900.1, Volume 3, Chapter 32

13) Checklists should not be depended on to initiate changes in aircraft configuration. Operators should key aircraft configuration changes to specific operational events. For example, the operator may direct the landing gear to be extended at glideslope intercept. For any adjustment of thrust or configuration, a command from the PF and an acknowledgement from the crewmember taking the action are required.

Source: FAA Order 8900.1, Volume 3, Chapter 32