The Checklist Manifesto

by Atul Gawande

  Maybe our idea of heroism needs updating.

  On January 14, 2009, WHO's safe surgery checklist was made public. As it happened, the very next day, US Airways Flight 1549 took off from La Guardia Airport in New York City with 155 people on board, struck a large flock of Canadian geese over Manhattan, lost both engines, and famously crash-landed in the icy Hudson River. The fact that not a single life was lost led the press to christen the incident the "miracle on the Hudson." A National Transportation Safety Board official said the flight "has to go down as the most successful ditching in aviation history." Fifty-seven-year-old Captain Chesley B. "Sully" Sullenberger III, a former air force pilot with twenty thousand hours of flight experience, was hailed the world over.

  "Quiet Air Hero Is Captain America," shouted the New York Post headline. ABC News called him the "Hudson River hero." The German papers hailed "Der Held von New York," the French "Le Nouveau Heros de l'Amerique," the Spanish-language press "El Heroe de Nueva York." President George W. Bush phoned Sullenberger to thank him personally, and President-elect Barack Obama invited him and his family to attend his inauguration five days later. Photographers tore up the lawn of his Danville, California, home trying to get a glimpse of his wife and teenage children. He was greeted with a hometown parade and a $3 million book deal.

  But as the details trickled out about the procedures and checklists that were involved, the fly-by-wire computer system that helped control the glide down to the water, the copilot who shared flight responsibilities, the cabin crew who handled the remarkably swift evacuation, we the public started to become uncertain about exactly who the hero here was. As Sullenberger kept saying over and over from the first of his interviews afterward, "I want to correct the record right now. This was a crew effort." The outcome, he said, was the result of teamwork and adherence to procedure as much as of any individual skill he may have had.

  Aw, that's just the modesty of the quiet hero, we finally insisted. The next month, when the whole crew of five--not just Sullenberger--was brought out to receive the keys to New York City, for "exclusive" interviews on every network, and for a standing ovation by an audience of seventy thousand at the Super Bowl in Tampa Bay, you could see the press had already determined how to play this. They didn't want to talk about teamwork and procedure. They wanted to talk about Sully using his experience flying gliders as an Air Force Academy cadet.

  "That was so long ago," Sullenberger said, "and those gliders are so different from a modern jet airliner. I think the transfer of experience was not large."

  It was as if we simply could not process the full reality of what had been required to save the people on that plane.

  The aircraft was a European-built Airbus A320 with two jet engines, one on each wing. The plane took off at 3:25 p.m. on a cold but clear afternoon, headed for Charlotte, North Carolina, with First Officer Jeffrey Skiles at the controls and Sullenberger serving as the pilot not flying. The first thing to note is that the two had never flown together before that trip. Both were tremendously experienced. Skiles had nearly as many flight hours as Sullenberger and had been a longtime Boeing 737 captain until downsizing had forced him into the right-hand seat and retraining to fly A320s. This much experience may sound like a good thing, but it isn't necessarily. Imagine two experienced but unacquainted lawyers meeting to handle your case on your opening day in court. Or imagine two top basketball coaches who are complete strangers stepping onto the parquet to lead a team in a championship game. Things could go fine, but it is more likely that they will go badly.

  Before the pilots started the plane's engines at the gate, however, they adhered to a strict discipline--the kind most other professions avoid. They ran through their checklists. They made sure they'd introduced themselves to each other and the cabin crew. They did a short briefing, discussing the plan for the flight, potential concerns, and how they'd handle troubles if they ran into them. And by adhering to this discipline--by taking just those few short minutes--they not only made sure the plane was fit to travel but also transformed themselves from individuals into a team, one systematically prepared to handle what ever came their way.

  I don't think we recognize how easy it would have been for Sullenberger and Skiles to have blown off those preparations, to have cut corners that day. The crew had more than 150 total years of flight experience--150 years of running their checklists over and over and over, practicing them in simulators, studying the annual updates. The routine can seem pointless most of the time. Not once had any of them been in an airplane accident. They fully expected to complete their careers without experiencing one, either. They considered the odds of anything going wrong extremely low, far lower than we do in medicine or investment or legal practice or other fields. But they ran through their checks anyway.

  It need not have been this way. As recently as the 1970s, some airline pilots remained notoriously bluff about their preparations, however carefully designed. "I've never had a problem," they would say. Or "Let's get going. Everything's fine." Or "I'm the captain. This is my ship. And you're wasting my time." Consider, for example, the infamous 1977 Tenerife disaster. It was the deadliest accident in aviation history. Two Boeing 747 airliners collided at high speed in fog on a Canary Islands runway, killing 583 people on board. The captain on one of the planes, a KLM flight, had misunderstood air traffic control instructions conveying that he was not cleared for takeoff on the runway--and disregarded the second officer, who recognized that the instructions were unclear. There was in fact a Pan American flight taking off in the opposite direction on the same runway.

  "Is he not cleared, that Pan American?" the second officer said to the captain.

  "Oh yes," the captain insisted, and continued onto the runway.

  The captain was wrong. The second officer sensed it. But they were not prepared for this moment. They had not taken the steps to make themselves a team. As a result, the second officer never believed he had the permission, let alone the duty, to halt the captain and clear up the confusion. Instead the captain was allowed to plow ahead and kill them all.

  The fear people have about the idea of adherence to protocol is rigidity. They imagine mindless automatons, heads down in a checklist, incapable of looking out their windshield and coping with the real world in front of them. But what you find, when a checklist is well made, is exactly the opposite. The checklist gets the dumb stuff out of the way, the routines your brain shouldn't have to occupy itself with (Are the elevator controls set? Did the patient get her antibiotics on time? Did the managers sell all their shares? Is everyone on the same page here?), and lets it rise above to focus on the hard stuff (Where should we land?).

  Here are the details of one of the sharpest checklists I've seen, a checklist for engine failure during flight in a single-engine Cessna airplane--the US Airways situation, only with a solo pi -lot. It is slimmed down to six key steps not to miss for restarting the engine, steps like making sure the fuel shutoff valve is in the OPEN position and putting the backup fuel pump switch ON. But step one on the list is the most fascinating. It is simply: FLY THE AIRPLANE. Because pilots sometimes become so desperate trying to restart their engine, so crushed by the cognitive overload of thinking through what could have gone wrong, they forget this most basic task. FLY THE AIRPLANE. This isn't rigidity. This is making sure everyone has their best shot at survival.

  About ninety seconds after takeoff, US Airways Flight 1549 was climbing up through three thousand feet when it crossed the path of the geese. The plane came upon the geese so suddenly Sullenberger's immediate reaction was to duck. The sound of the birds hitting the windshield and the engines was loud enough to be heard on the cockpit voice recorder. As news reports later pointed out, planes have hit hundreds of thousands of birds without incident. But dual bird strikes are rare. And, in any case, jet engines are made to handle most birds, more or less liquefying them. Canadian geese, however, are larger than most birds, often ten pounds and up, and no engine can handle them. Jet engines ar
e designed instead to shut down after ingesting one, without exploding or sending metal shrapnel into the wings or the passengers on board. That's precisely what the A320's engines did when they were hit with the rarest of rare situations--at least three geese in the two engines. They immediately lost power.

  Once that happened, Sullenberger made two key decisions: first, to take over flying the airplane from his copilot, Skiles, and, second, to land in the Hudson. Both seemed clear choices at the time and were made almost instinctively. Within a minute it became apparent that the plane had too little speed to make it to La Guardia or to the runway in Teterboro, New Jersey, offered by air traffic control. As for taking over the piloting, both he and Skiles had decades of flight experience, but Sullenberger had logged far more hours flying the A320. All the key landmarks to avoid hitting--Manhattan's skyscrapers, the George Washington Bridge--were out his left-side window. And Skiles had also just completed A320 emergency training and was more recently familiar with the checklists they would need.

  "My aircraft," Sullenberger said, using the standard language as he put his hands on the controls.

  "Your aircraft," Skiles replied. There was no argument about what to do next, not even a discussion. And there was no need for one. The pilots' preparations had made them a team. Sullenberger would look for the nearest, safest possible landing site. Skiles would go to the engine failure checklists and see if he could relight the engines. But for the computerized voice of the ground proximity warning system saying "Pull up. Pull up. Pull up. Pull up," the cockpit was virtually silent as each pilot concentrated on his tasks and observed the other for cues that kept them coordinated.

  Both men played crucial roles here. We treat copilots as if they are superfluous--backups who are given a few tasks so that they have something to do. But given the complexity of modern airplanes, they are as integral to a successful flight as anesthesiologists are to a successful operation. pilot and copilot alternate taking the flight controls and managing the flight equipment and checklist responsibilities, and when things go wrong it's not at all clear which is the harder job. The plane had only three and a half minutes of glide in it. In that time, Skiles needed to make sure he'd done everything possible to relight the engines while also preparing the aircraft for ditching if it wasn't feasible. But the steps required just to restart one engine typically take more time than that. He had some choices to make.

  Plunging out of the sky, he judged that their best chance at survival would come from getting an engine restarted. So he decided to focus almost entirely on the engine failure checklist and running through it as fast as he could. The extent of damage to the engines was unknown, but regaining even partial power would have been sufficient to get the plane to an airport. In the end, Skiles managed to complete a restart attempt on both engines, something investigators later testified to be "very remarkable" in the time frame he had--and something they found difficult to replicate in simulation.

  Yet he did not ignore the ditching procedure, either. He did not have time to do everything on the checklist. But he got the distress signals sent, and he made sure the plane was properly configured for an emergency water landing.

  "Flaps out?" asked Sullenberger.

  "Got flaps out," responded Skiles.

  Sullenberger focused on the glide down to the water. But even in this, he was not on his own. For, as journalist and pilot William Langewiesche noted afterward, the plane's fly-by-wire control system was designed to assist pilots in accomplishing a perfect glide without demanding unusual skills. It eliminated drift and wobble. It automatically coordinated the rudder with the roll of the wings. It gave Sullenberger a green dot on his screen to target for optimal descent. And it maintained the ideal angle to achieve lift, while preventing the plane from accidentally reaching "radical angles" during flight that would have caused it to lose its gliding ability. The system freed him to focus on other critical tasks, like finding a landing site near ferries in order to give passengers their best chance of rescue and keeping the wings level as the plane hit the water's surface.

  Meanwhile, the three flight attendants in the cabin--Sheila Dail, Donna Dent, and Doreen Welsh--followed through on their protocols for such situations. They had the passengers put their heads down and grab their legs to brace for impact. Upon landing and seeing water through the windows, the flight attendants gave instructions to don life vests. They made sure the doors got open swiftly when the plane came to a halt, that passengers didn't waste time grabbing for their belongings, or trap themselves by inflating life vests inside the aircraft. Welsh, stationed in the very back, had to wade through ice cold, chest-high water leaking in through the torn fuselage to do her part. Just two of the four exits were safely accessible. Nonetheless, working together they got everyone out of a potentially sinking plane in just three minutes--exactly as designed.

  While the evacuation got under way, Sullenberger headed back to check on the passengers and the condition of the plane. Meanwhile, Skiles remained up in the cockpit to run the evacuation checklist--making sure potential fire hazards were dealt with, for instance. Only when it was completed did he emerge. The arriving flotilla of ferries and boats proved more than sufficient to get everyone out of the water. Air in the fuel tanks, which were only partly full, kept the plane stable and afloat. Sullenberger had time for one last check of the plane. He walked the aisle to make sure no one had been forgotten, and then he exited himself.

  The entire event had gone shockingly smoothly. After the plane landed, Sullenberger said, "First Officer Jeff Skiles and I turned to each other and, almost in unison, at the same time, with the same words, said to each other, 'Well, that wasn't as bad as I thought.' "

  So who was the hero here? No question, there was something miraculous about this flight. Luck played a huge role. The incident occurred in daylight, allowing the pilots to spot a safe landing site. Plenty of boats were nearby for quick rescue before hypothermia set in. The bird strike was sufficiently high to let the plane clear the George Washington Bridge. The plane was also headed downstream, with the current, instead of upstream or over the ocean, limiting damage on landing.

  Nonetheless, even with fortune on their side, there remained every possibility that 155 lives could have been lost that day. But what rescued them was something more exceptional, difficult, crucial, and, yes, heroic than flight ability. The crew of US Airways Flight 1549 showed an ability to adhere to vital procedures when it mattered most, to remain calm under pressure, to recognize where one needed to improvise and where one needed not to improvise. They understood how to function in a complex and dire situation. They recognized that it required teamwork and preparation and that it required them long before the situation became complex and dire.

  This was what was unusual. This is what it means to be a hero in the modern era. These are the rare qualities that we must understand are needed in the larger world.

  All learned occupations have a definition of professionalism, a code of conduct. It is where they spell out their ideals and duties. The codes are sometimes stated, sometimes just understood. But they all have at least three common elements.

  First is an expectation of selflessness: that we who accept responsibility for others--whether we are doctors, lawyers, teachers, public authorities, soldiers, or pilots--will place the needs and concerns of those who depend on us above our own. Second is an expectation of skill: that we will aim for excellence in our knowledge and expertise. Third is an expectation of trust-worthiness: that we will be responsible in our personal behavior toward our charges.

  Aviators, however, add a fourth expectation, discipline: discipline in following prudent procedure and in functioning with others. This is a concept almost entirely outside the lexicon of most professions, including my own. In medicine, we hold up "autonomy" as a professional lodestar, a principle that stands in direct opposition to discipline. But in a world in which success now requires large enterprises, teams of clinicians, high-risk technologies, and knowledg
e that outstrips any one person's abilities, individual autonomy hardly seems the ideal we should aim for. It has the ring more of protectionism than of excellence. The closest our professional codes come to articulating the goal is an occasional plea for "collegiality." What is needed, however, isn't just that people working together be nice to each other. It is discipline.

  Discipline is hard--harder than trustworthiness and skill and perhaps even than selflessness. We are by nature flawed and inconstant creatures. We can't even keep from snacking between meals. We are not built for discipline. We are built for novelty and excitement, not for careful attention to detail. Discipline is something we have to work at.

  That's perhaps why aviation has required institutions to make discipline a norm. The preflight checklist began as an invention of a handful of army pilots in the 1930s, but the power of their discovery gave birth to entire organizations. In the United States, we now have the National Transportation Safety Board to study accidents--to independently determine the underlying causes and recommend how to remedy them. And we have national regulations to ensure that those recommendations are incorporated into usable checklists and reliably adopted in ways that actually reduce harm.

  To be sure, checklists must not become ossified mandates that hinder rather than help. Even the simplest requires frequent revisitation and ongoing refinement. Airline manufacturers put a publication date on all their checklists, and there is a reason why--they are expected to change with time. In the end, a checklist is only an aid. If it doesn't aid, it's not right. But if it does, we must be ready to embrace the possibility.

  We have most readily turned to the computer as our aid. Computers hold out the prospect of automation as our bulwark against failure. Indeed, they can take huge numbers of tasks off our hands, and thankfully already have--tasks of calculation, processing, storage, transmission. Without question, technology can increase our capabilities. But there is much that technology cannot do: deal with the unpredictable, manage uncertainty, construct a soaring building, perform a lifesaving operation. In many ways, technology has complicated these matters. It has added yet another element of complexity to the systems we depend on and given us entirely new kinds of failure to contend with.