The first three decades of powered flight produced an explosive growth in the capabilities and complexities of aircraft. This became all too apparent on the afternoon of Oct. 30, 1935, when Maj. Ployer Hill, chief of the U.S. Army Air Corp’s flying branch, belted into the left seat of the Boeing Model 299 prototype at Wright Field. Known to the U.S. Army as the XB-17, the Model 299 was the most-sophisticated heavy bomber ever designed in the U.S., having four engines, adjustable fuel/air mixture, controllable pitch propellers, wing flaps, electric trim and retractable landing gear, among other advances. Some mainstream media pundits suggested that the airplane was just too complex to fly for average Army pilots.

Just after takeoff, the aircraft pitched up, stalled and crashed, killing Hill and Boeing chief test pilot Leslie Tower. The reason wasn’t failure of the engines, systems or structure. The crew simply had forgotten to release the control lock, thereby freezing the positions of the elevators and rudder.

The accident report attributed the mishap to “pilot error.” As a result, there was intense pressure for the Army to put pilots through longer, more comprehensive training to qualify to fly the XB-17. However, Hill was one of the Army Air Corp’s most experienced airmen, a highly skilled pilot who had thoroughly studied all aspects of the XB-17. So, the Army resisted and, as a result, developed a “checklist” of crew duties for each phase of flight that became standard in all its airplanes.

The step-by-step check was printed on a card small enough to be stuffed into the pocket of a flight jacket. It was as short as possible, but it included sufficient detail for all phases of flight from chock to chock.

Using the checklist made all the difference. U.S. Army pilots subsequently logged more than 100,000 fatal accident-free, non-combat flight hours in the aircraft and the U.S. government ultimately bought almost 13,000 B-17 Flying Fortresses for use in World War II. It was the mainstay of the Eighth Air Force’s strategic bombing campaign in the European Theatre of Operations.

During the next five or so decades, the aviation and space industries created substantially more complex and capable aircraft and spacecraft that could transport hundreds of people from continent to continent at 8 mi. per minute, exceed Mach 3 in level flight, fly to the moon and put a space station in orbit around the earth.

Checklists were developed for the flight crews of all of these vehicles. Disciplined use of checklists has prevented countless potential mishaps posed by weather, terrain, traffic and aircraft risks. Conversely, lax use of checklists has been linked to hundreds of aircraft accidents, many with fatal consequences.

But checklist creators developed ponderous litanies of procedures that could be distracting, if not ignored altogether. Flight crews began to omit or overlook certain checklist items that were critical to flight safety.

To paraphrase John Naisbitt, author of Megatrends, the 1982 best seller, “We are drowning in data, but we are starved for knowledge” while attempting to cope with the “chaos of information pollution.” That was an apt description for many checklists.

Boeing’s New Tack

About 10 years ago, Boeing fundamentally reformed its approach to checklist creation, explains Capt. Stephen Taylor, chief pilot of Boeing flight services, the organization tasked with training, along with simulator, navigation and air traffic management services.

“Checklists were too long and complex, too many items sometimes would be skipped,” he says. Boeing broadened the scope of its research to include non-aviation experts on checklists. Taylor says that Dr. Atul Gawande, author of The Checklist Manifesto: How to Get Things Right, was one of the outside resources who emphasized the importance of simple, effective checklists for use by the medical, as well as the legal, military intelligence, software development, meteorological forecasting and banking industries.

Somewhat ironically, Dr. Gawande’s inspiration for developing medical industry checklists originated with his research into aviation industry best practices. In The Checklist Manifesto, published in 2009, Dr. Gawande writes that today overcoming historic ignorance is less of a challenge in the field than ineptitude, the “instances the knowledge exists, yet we fail to apply it correctly.” While there is bountiful information available to medical professionals and most study for years to master their skills, the new challenge is to assure they “apply the knowledge . . . consistently and correctly.

“We have accumulated stupendous know-how. We have put it in the hands of some of the most highly trained, highly skilled and hardworking people in our society . . . . Nonetheless, that know-how is often unmanageable. Avoidable failures are common and persistent.” Disciplined use of checklists “provides protection against such failures.”

Dr. Gawande, for example, writes that use of a simple five-step sanitation checklist by ICU doctors at Johns Hopkins Hospital resulted in the 10-day IV line infection rate dropping from 11% to zero. Taking a lesson from aviation CRM, it’s worth noting that ICU nurses were empowered to prompt the physicians to follow the five-step checklist with the full support of hospital administrators.

When Boeing created its new checklists, though, it didn’t discard well-proven CRM concepts. Checklist responsibilities still were divided into captain and first officer roles, left and right seat roles, and pilot flying and pilot monitoring roles. Logical scan and flow patterns still are used for normal checklists that rely mostly on muscle memory of proper switch, knob and button positions, along with looking for proper instrument and annunciator light indications, rather than rote use of memorized checklists. After completing the normal flow, each item is checked on the list.

“It really starts with how you design the flight deck. Muscle memory makes the flow process very effective and reliable,” says Taylor. “The checklist is really a way to check completion of tasks in order to be ready for the next phase of flight.”

Non-normal checklists are designed for challenge and response use, says Barbara Holder, Ph.D., Boeing’s lead scientist for human factors. “Only immediate action, critical items are committed to memory, such as recall items for a rapid decompression event.” The pilot flying then calls for the appropriate non-normal checklist to complete less-time-critical reference items. The revised non-normal checklists also contain information required to plan for the remainder of the flight, thereby eliminating the need to alternate between normal and non-normal checklists. Non-normal maneuvers occasioned by malfunctions are contained in a separate AFM chapter, guiding the flight crew through non-normal configuration changes.

Boeing, along with FlightSafety International and CAE Flight Training, emphasize that the pilot flying only should call for the non-normal checklist when the flight path is under control, when the aircraft is not in a critical phase of flight (close to the ground) and when all memory recall items are complete.

Taylor said that rationalization of checklists between various Boeing models has led to as much as 97% commonality of checklists, helping flight crews to make the transition between different aircraft.

“The object is to let you climb into the cockpit with a total stranger and then work effectively as a team because you know where the boundaries are,” says Taylor.

“You set up a shared mental model. Working as a team, the flight crew uses briefings, callouts and procedures to set up expectations, to plan a course of action. The callouts are there to help them monitor execution of the plan,” adds Holder.

Elegantly Simple in Design

Ride jump seat in any U.S. airline cockpit and you’ll notice a distinct lack of checklist chatter. Scan and flow, then check protocols assure that the airplane is in satisfactory condition and that the configuration on the flight deck is correct for the phase of flight. The normal checklist assumes that all systems are operating normally and that cockpit automation will be used to the maximum extent practicable without causing distractions.

Specific preflight and postflight tasks typically are divided between captain and first officer, with each person being responsible for setting up the cockpit depending upon left- or right-seat position. Once in motion, most tasks are divvied up between the pilot flying and pilot monitoring, but Holder notes that both pilots need to monitor the overall situation.

The pilot flying typically is responsible for taxiing, flight path and airspeed control, aircraft configuration and navigation. The pilot flying also is responsible for flight guidance control panel, selecting heading, course, speed and altitude, along with modes while the aircraft is stationary or when the autopilot is engaged in flight.

The pilot flying calls out flight mode annunciations, such as heading, flight level change, LNAV, VNAV, approach and thrust mode to the pilot monitoring. Both pilots must verify changes made to the FMS and flight guidance by checking for the appropriate indications and annunciations on the PFD and ND or MFD.

The pilot monitoring runs the checklists, talks on the radios and PA system, and selects appropriate navigation charts for use by the crew, as well as monitoring taxi, flight path and airspeed control performance, aircraft configuration and navigation. The pilot monitoring also makes changes to the flight guidance panel at the command of the pilot flying while the aircraft is being hand flown. Quite clearly, the pilot monitoring has a considerably higher workload under normal conditions than the pilot flying.

Standard callouts are used to announce FMS or manual control of speeds, altitudes and modes. Some air carriers use color callouts to denote armed or active modes, FMS or manual control. The pilot flying might announce “Approach WHITE,” for instance, to advise the pilot monitoring that the approach mode has been armed and “Localizer GREEN” to announce that the localizer mode has become active. “MAGENTA speed,” for example, might be used to announce that the FMS speed mode is being used. In essence, cockpit automation is treated as a third crewmember, albeit one who communicates only by EFIS annunciations or flight guidance panel mode indications.

The FMS CDU, known as the “box” to most airline pilots, is the key to unlocking almost all the advanced automation capabilities in a modern cockpit. But it also has potential for being an egregious time and attention bandit.

In the chocks, either the captain or first officer can make entries, depending upon air carrier preference. But the other pilot must verify the entries before pushback. Most operators attempt to make entries into the box when the aircraft is stationary or when the autopilot is engaged in level cruise flight. If FMS modifications must be made during taxi, they must be programmed into the box by the pilot monitoring. If the pilot monitoring will be head down, reprogramming the box for a prolonged period, the pilot flying should be advised. The pilot flying must verify FMS changes made by the pilot monitoring but preferably only when the aircraft comes to a stop.

In flight with the autopilot engaged, the pilot monitoring typically makes changes to the box, such as when ATC issues an amended route or altitude clearance. The pilot flying also may make simple changes but remain wary of the temptation to be distracted from keeping flight path, airspeed and altitude under control. Changes to the plan only are executed when both pilots review the revision and verify the course of action. Some Airbus operators recommend that flight crews “plan, confirm, monitor and correct” what the box is doing, guarding against “automation complacency.”

During departure or arrival, or other periods of high workload, box entries should be limited to essentials. Boeing warns operators not to get sucked into the cockpit, heads down, preoccupied with programming a complex procedure into the box in congested terminal area airspace. Alternatively, the crew should consider taking the box out of the loop and using simple heading, speed and altitude flight guidance modes to achieve the desired flight path and speed. When time permits, the FMS may be reprogrammed and reconnected to the flight guidance system.

In the chocks, many air carriers use item by item, first officer challenge/captain response checklists to verify status of required documents, gear pins and duct covers, AHRS or IRS aligned, fuel on board and required, and altimeter settings. Before start, the same format is used to check windows and doors closed, beacon on, thrust level position, parking brake set, chocks out and transponder/TCAS set. Once one or both engines are started, that event, rather than a callout, initiates the post-start checklist by the pilot monitoring, a protocol that’s completed by one person using an audible challenge and response process. Similarly, the before-takeoff checklist, including settings and checks of c.g. and pitch trim, high-lift devices, verifications of V speeds, checking flight instruments and flight controls, anti-ice heaters on, proper EICAS annunciations and takeoff status checks, is completed by the pilot monitoring using an audible self-challenge and response protocol. On cue from the pilot monitoring, the pilot flying then conducts a short review of initial speed, heading and altitude targets, the runway to be used and departure procedure assigned. All of the detailed briefing regarding the departure is done in the chocks or at the FBO.

Once cleared to line up and wait, or cleared for takeoff, the pilot monitoring repeats the runway assignment, makes a final check of fuel on board and checks for left/right heading alignment, along with turning on the appropriate external lights. All the other typical general aviation lineup checks are done before taking the runway so that both flight crewmembers can be heads up, looking out for traffic conflicts as the aircraft rolls onto the runway centerline.

Once takeoff roll begins, typical standard callouts from the pilot monitoring include verification of takeoff power, initial airspeed indications, and a slow speed abort threshold, such as an 80-kt. crosscheck. Some air carriers allow either pilot to call “abort” below the threshold speed for any safety of flight reason. Above the threshold speed and below V1, the pilot monitoring typically calls out only critical malfunctions that would require a high-speed abort. Examples include “Right Engine Failure,” “Left Engine Fire” or “Traffic On Runway.” The pilot flying then initiates the abort and calls out “Abort” to the pilot monitoring.

Five knots before reaching the V1 takeoff decision speed, the pilot monitoring calls out “V1” to allow for pilot flying recognition time. At Vr, the typical call by the pilot monitoring is “Rotate,” followed by “Positive Rate” with two or more altitude gain indications. The pilot flying then says “Gear Up.”

Upon reaching the appropriate altitude, the pilot monitoring makes a callout and the pilot flying calls for retraction of high-lift devices and after-takeoff checks, along with setting climb thrust. The pilot monitoring typically completes the after-takeoff checklist silently and reports completion to the pilot flying.

Operators also typically have short checklists for crossing 10,000 ft. and 18,000 ft., along with level-off and periodic cruise checks.

Prior to descent, the pilot flying calls for the descent checklist and briefs the approach procedure to be flown. The pilot flying’s brief typically includes weather, communications and navigation frequencies, along with headings, courses and minimums, plus the missed approached procedure. A “build, bug and brief” or “build, book and brief” system often is used, providing a systematic approach to programming the procedure into the box, setting V speeds and checking landing distances and briefing the plan of action.

The pilot monitoring typically self-challenges and responds to each step on the remainder of the descent checklist, including items such as setting pressurization for landing, configuring anti-ice systems as required, cross checking that minimums are properly set and setting barometric pressure in the altimeters as the aircraft crosses below the transition altitude.

From there, it’s as though the aircraft is on virtual railroad tracks. Standardized normal maneuvers prescribe speeds, configurations and pilot selectable altitudes that may be used when specific procedure altitudes are not published. When the pilot flying, for instance, calls for the first notch of flaps at 10 mi. or when on downwind, the pilot monitoring expects that configuration change at that point because it’s spelled out in the SOPs. As the pilot flying calls for speed and configuration changes for each phase of the procedure, the pilot monitoring verifies both selection and correct status.

When the pilot flying calls for the before-landing checks, the pilot monitoring again self-challenges and responds verbally as each step is completed. Most operators also require both pilots to verify that all landing gear are down and locked, and that high-lift devices are properly set for landing.

The pilot flying doesn’t need nagging from the pilot monitoring to prompt corrections for minor deviations in lateral and vertical navigation, plus speed control. The trigger points typically are one-half to one-dot lateral and vertical deviations, plus 5- to 10-kt. speed deviations. Any speed deviation below Vref or altitude deviation below glideslope/glipepath inside the final approach fix triggers a reminder from the pilot monitoring. There also are hard check windows, such as 1,000 ft. above the airport, at which point the aircraft must be configured for landing, close to azimuth/localizer centerline, on or only slightly above glidepath/glideslope. At 500 ft., the aircraft must be fully stabilized and configured for landing, or the pilot monitoring must call for “go around.”

Once clear of the runway, the pilot flying calls for the after-landing checks. Those items are completed silently by the pilot monitoring, who then reports completion of the list.

Some airlines and business aircraft operators use considerably more detailed checklists and callouts, ones that are based upon the meticulous procedures used by military aviation organizations. But there’s a fine balance between being sufficiently thorough to assure safety of flight and drowning your flight crews in minutia.

“Less is more” appears to be the current checklist design theme at Boeing and Airbus. Scan and finger flows are predominant for routine procedures. Challenge and response normal checklists are few. Callouts are reserved for key checkpoints and events during the flight. Increasingly, civil aviation organizations seem to be modeling their flight crew SOPs after the quiet, dark, automated cockpits in which they fly.

But business aircraft flight crews often act as dispatchers, ground transportation providers, caterers, line service staffers, cabin attendants, A & Ps and baggage handlers, among other secondary responsibilities. As a result, each organization for which you might fly probably has its own SOPs, checklists and callouts, often incorporating checks for the additional duties. There’s enough differentiation between operators to make you think you’re earning a new type rating if you move to a new company. Additional responsibilities make it more difficult to keep checklists short and simple. But the payoff is a more relaxed working environment in which flight crews have the most time to devote to situational awareness and dealing with unexpected occurrences. B&CA