Skip to content
AFTER CERTAINTY
Skip to chapter text

No Time to ThinkPart II — Where the Constraint Went

Chapter 6 — The Checklist

About 11 mins
TextMedium

The Checklist

A small card lists a sequence of items to be called out and confirmed.

It is easy to underestimate. The card is short. The language is ordinary. Nothing about it looks like innovation. Yet in a cockpit before flight, the card does work that talent alone cannot guarantee: it externalizes memory, shares it between people, and makes a critical sequence interruptible without making it improvisable.

On the morning of October 30, 1935, at Wright Field in Dayton, Ohio, a Boeing aircraft designated Model 299 began its takeoff roll on a competitive evaluation for a large Army Air Corps bomber contract. The aircraft was Boeing's prototype for what would become the B-17 Flying Fortress—designed to carry a heavy bomb load over long range, equipped with four engines, and significantly more complex to operate than any bomber then in service. The Air Corps was watching closely, and Boeing believed it had built something exceptional.

The Model 299 lifted off, climbed briefly, then stalled and fell. It caught fire on impact. The Army Air Corps board of inquiry later determined that the aircraft's gust locks—devices that fix the control surfaces in place to prevent wind damage while the aircraft is parked—had not been released before takeoff. With the elevator controls still locked, the aircraft could not be controlled once it was airborne.1 Maj. Ployer P. Hill, the Army pilot flying the aircraft, and Leslie R. Tower, Boeing's chief test pilot, were fatally injured. Lt. Donald L. Putt, the copilot, and others aboard survived with injuries.2

The inquiry found that the gust locks had not been released, not that the aircraft had suffered a structural or engine failure. What the Air Corps and Boeing flight-test community drew from the accident was a broader institutional lesson: the aircraft had become complex enough that even experienced pilots could no longer rely on unaided memory to carry every critical step through the competing distractions of preflight preparation—especially under the pressure of a formal military evaluation. The gust locks were a step. The step was known. It was not performed because the sequence that should have ensured it was performed lived in memory rather than in a shared external record that two people could verify together.

The Air Corps did not abandon the Model 299. It ordered a small quantity for further testing and ultimately procured it as the B-17. Pilots from Boeing and the Air Corps flight-test community developed written preflight checklists—standardized sequences covering takeoff, flight, before-landing, and after-landing phases—and crews practiced using them as a discipline rather than a fallback.3 The aircraft later became associated with the phrase "too much airplane for one man to fly," a summary repeated in later accounts of the crash. With the checklist as a shared tool, the type became the backbone of American strategic bombing in the Second World War, eventually fielded in large numbers and flown by aircrews who came to it with far less experience than Maj. Hill or Leslie Tower had possessed.

The checklist did not teach new pilots the aircraft. It gave them a dependable structure for verifying that the steps they knew had actually been performed, in a sequence that could be interrupted, paused, confirmed by a second person, and resumed without loss of place.

What the Model 299 crash revealed was not a gap in skill. The pilots involved were experienced. What it revealed was a gap in the architecture of verification. As aircraft accumulated systems—fuel tanks, hydraulic lines, trim tabs, control locks, magneto switches, mixture controls, propeller pitch settings—the preflight sequence grew from a dozen steps to dozens, then to procedures for each phase of flight running into the hundreds of items across the full checklist set. No one questioned whether a trained pilot understood what each item meant. The question was whether unaided human memory was a reliable instrument for ensuring that every item was actually addressed, in the right sequence, under the conditions of normal distraction, time pressure, and the ordinary confidence that experienced people bring to familiar tasks.

The familiar error that checklists address is not ignorance. It is omission under confidence. A pilot who has completed hundreds of preflight walkarounds does not forget what the gust locks are. The risk is that the step feels so familiar that memory supplies the sense of completion before the action has been taken. The card does not add knowledge. It separates the feeling of knowing from the act of verifying. It makes a critical sequence objective, external, and resistant to the human tendency to fill in expected events as though they had occurred.

That separation is the checklist's structural contribution. It is also easy to confuse with a different function—recording procedure for its own sake, or satisfying an auditor that procedure was followed. When the card is used as theater, the separation collapses. The pilot calls out each item and confirms it whether or not the item was actually checked, because the card's function in that moment is not verification; it is documentation. A checklist used for documentation can be completed thoroughly while the equipment it covers is in exactly the state the preflight was supposed to prevent.

Aviation developed multiple methods for maintaining the distinction between real verification and procedural theater. FAA guidance describes both challenge-response checklist use and flows followed by checklist verification.4 In challenge-response use, one crew member calls the item and the other responds when the state has been verified. In a flow followed by verification, the crew completes a sequence from memory first, then runs through the checklist as a final confirmation that nothing was missed. Both methods are legitimate in the right context. The critical feature is the same in each: the checklist is not a substitute for knowing the aircraft or flying it. It is a structure that makes omission visible before consequence arrives.

Modern aviation checklists are also, by design, short enough to use under actual cockpit conditions. A preflight card that requires calm, unhurried concentration and a clean surface to spread it on is not a cockpit tool; it is a document that will be skipped when conditions are anything less than ideal. The length and format of a checklist is therefore a design question, not just a content question: every item added is a risk that attention will drift before the sequence is complete, and every item omitted is a risk that the forgotten step is exactly the one that mattered.5

The checklist belongs to a different family of tools than the stopwatch or the conveyor belt. Taylor's stopwatch and Ford's assembly line accelerated work by prescribing and mechanizing execution. The checklist does not primarily accelerate anything. It was invented because acceleration had already happened, and something else had been lost in the process of making flight faster and more capable.

As aircraft became faster, higher-flying, and more system-dense, the skill required to fly them did not decrease—it changed character. The raw physical skills of a First World War pilot, who managed a simple aircraft largely by feel, were supplemented by procedural knowledge: what sequence of actions, in what order, makes this particular type of aircraft ready to fly and safe to land. That procedural knowledge grew faster than memory's reliable capacity to carry it. The checklist was the mechanism that kept the procedural floor stable as the ceiling of aircraft capability rose.

This pattern—a tool that preserves a floor rather than raising the ceiling—appears often in systems where capability has outpaced the human capacity to manage it through expertise alone. Medicine, nuclear plant operation, and complex surgery have each arrived at some version of the same instrument. The Joint Commission's Universal Protocol for surgery, effective from 2004, requires a time-out immediately before incision in which the team actively verifies patient identity, procedure, and site—a structured pause designed to prevent a class of errors that training alone does not reliably prevent.6 The time-out functions like a preflight checklist: not a replacement for surgical skill, but a floor beneath it.

What these instruments have in common is that they are designed to operate in the presence of expertise, not in its absence. The checklist is not useful because pilots are inexperienced; it is useful because experienced pilots are subject to the same omission errors under confidence that inexperienced ones are. The time-out is not useful because surgeons are unskilled; it is useful because the conditions of a busy operating theater—distractions, familiar sequences, established teams—create exactly the kind of confidence that precedes wrong-site surgery. The tool does not substitute for judgment. It creates a moment in which judgment can engage before action forecloses it.

This distinction matters because the logic of efficiency can easily misidentify checklist pauses as waste to be eliminated. If the checklist adds no information to what the pilot already knows, the pause looks redundant. If the time-out is nearly always uneventful, it looks like ceremony. The reasoning that leads from "usually uneventful" to "unnecessary" is coherent only if the cases when the pause was not uneventful—the times when the gust lock was still engaged, when the side was marked wrong, when the briefing revealed a disagreement about the procedure—are invisible or treated as exceptions. They are not exceptions. They are the purpose.

Institutions that have stripped checklist friction in the name of speed have sometimes discovered this the hard way. The lesson they typically codify afterward is not "add more procedure." It is: understand what the procedure was doing before removing it. Some pauses exist because someone once paid for their absence. Removing them requires knowing which someone and which absence.

Aviation developed a parallel mechanism for learning across the fleet rather than within a single flight—a voluntary, confidential reporting system designed to surface the near-misses that individual memory would not otherwise preserve. That system, and the institutional logic behind protecting honest reporting, is the subject of a later chapter.

The present-day echo is easy to miss because it rarely looks like a laminated card. Review gates, sign-off rituals, deployment checklists, pre-procedure pauses, and merge-approval workflows all attempt a version of the same transfer: move some cognitive load out of unaided memory and into a shared, interruptible sequence. When generation becomes cheap and document creation becomes fast, the temptation is to treat those gates as obsolete—slowdowns from an earlier scarcity, friction that once made sense when work was harder to produce.

History's counterclaim is quieter. The constraint that the checklist was invented to address was not scarcity of production. It was the gap between knowing a procedure and reliably performing every step of it under operational conditions. That gap does not close when generation gets faster. If anything, it widens: more steps to verify, more systems interacting, more ways for a familiar sequence to proceed plausibly while one critical item is missed. The checklist's value is proportional not to how much content there is to generate but to how many ways there are for a completed-feeling sequence to have omitted something.

An institutional mechanism that preserves this value is not more procedure for its own sake. It is procedure that remains short enough to use under real conditions, owned and maintained by the people who must use it, revised when the system changes, and paired with permission to stop when the card and the world disagree. Without that permission, the checklist becomes theater. With it, the short card can carry part of the cognitive work so that attention remains available for what no card lists in advance.

As aircraft became more complex, the constraint moved from the physical ability to fly into memory, sequencing, and shared awareness. The short card carried some of that cognitive work so attention could remain available for surprise.

Footnotes

  1. Air Force Historical Foundation, October 30, 1935 Model 299 crash at Wright Field, https://afhistory.org/30-oct-1935/; National Museum of the U.S. Air Force fact sheet, https://www.nationalmuseum.af.mil/Visit/Museum-Exhibits/Fact-Sheets/Display/Article/610002/model-299-crash/. Official finding: failure to release control-surface gust locks before takeoff, not structural or engine failure. ↩

  2. Smithsonian National Air and Space Museum, "On. Set. Checked." (Air and Space Quarterly, Winter 2023), https://airandspace.si.edu/air-and-space-quarterly/winter-2023/set-checked. Identifies Maj. Ployer P. Hill, Boeing test pilot Leslie R. Tower (both fatally injured), and Lt. Donald L. Putt among the crew. Institutional accounts attribute standardized preflight checklists to the Air Corps and Boeing flight-test community after the investigation; authorship of the first lists is not clearly established. ↩

  3. Smithsonian National Air and Space Museum, "On. Set. Checked." ↩

  4. FAA Advisory Circular AC 120-71B, Standard Operating Procedures and Pilot Monitoring Duties for Flight Deck Crewmembers, https://www.faa.gov/documentlibrary/media/advisory_circular/ac_120-71b.pdf. Describes challenge-response checklist use and flows followed by checklist verification; emphasizes consistency of method in coordinating crew attention and verifying configuration. ↩

  5. A. Degani and E. L. Wiener, Human Factors of Flight-Deck Checklists: The Normal Checklist, NASA Contractor Report CR-177549, NASA Ames Research Center, 1990, https://www.faa.gov/sites/faa.gov/files/2022-11/NASA%20Ames%20Rpt%20CR%20177549%20.pdf. Analyzes checklist design principles including length, format, and the relationship between checklist structure and actual cockpit use under operational conditions. ↩

  6. Agency for Healthcare Research and Quality, Preventing Wrong-Site, Wrong-Procedure, and Wrong-Person Surgery (Chapter 36), NCBI Bookshelf, https://www.ncbi.nlm.nih.gov/books/NBK2678/. The Joint Commission Universal Protocol for preventing wrong-site surgery—including pre-procedure verification, site marking, and time-out immediately before incision—became effective July 1, 2004 for accredited organizations. ↩