The Checklist Manifesto (22 page)

Once that happened, Sullenberger made two key decisions: first, to take over flying the airplane from his copilot, Skiles, and, second, to land in the Hudson. Both seemed clear choices at the time and were made almost instinctively. Within a minute it became apparent that the plane had too little speed to make it to La Guardia or to the runway in Teterboro, New Jersey, offered by air traffic control. As for taking over the piloting, both he and Skiles had decades of flight experience, but Sullenberger had logged far more hours flying the A320. All the key landmarks to avoid hitting—Manhattan’s skyscrapers, the George Washington Bridge—were out his left-side window. And Skiles had also just completed A320 emergency training and was more recently familiar with the checklists they would need.

“My aircraft,” Sullenberger said, using the standard language as he put his hands on the controls.

“Your aircraft,” Skiles replied. There was no argument about
what to do next, not even a discussion. And there was no need for one. The pilots’ preparations had made them a team. Sullenberger would look for the nearest, safest possible landing site. Skiles would go to the engine failure checklists and see if he could relight the engines. But for the computerized voice of the ground proximity warning system saying “Pull up. Pull up. Pull up. Pull up,” the cockpit was virtually silent as each pilot concentrated on his tasks and observed the other for cues that kept them coordinated.

Both men played crucial roles here. We treat copilots as if they are superfluous—backups who are given a few tasks so that they have something to do. But given the complexity of modern airplanes, they are as integral to a successful flight as anesthesiologists are to a successful operation. pilot and copilot alternate taking the flight controls and managing the flight equipment and checklist responsibilities, and when things go wrong it’s not at all clear which is the harder job. The plane had only three and a half minutes of glide in it. In that time, Skiles needed to make sure he’d done everything possible to relight the engines while also preparing the aircraft for ditching if it wasn’t feasible. But the steps required just to restart one engine typically take more time than that. He had some choices to make.

Plunging out of the sky, he judged that their best chance at survival would come from getting an engine restarted. So he decided to focus almost entirely on the engine failure checklist and running through it as fast as he could. The extent of damage to the engines was unknown, but regaining even partial power would have been sufficient to get the plane to an airport. In the end, Skiles managed to complete a restart attempt on both engines, something investigators later testified to be “very remarkable” in
the time frame he had—and something they found difficult to replicate in simulation.

Yet he did not ignore the ditching procedure, either. He did not have time to do everything on the checklist. But he got the distress signals sent, and he made sure the plane was properly configured for an emergency water landing.

“Flaps out?” asked Sullenberger.

“Got flaps out,” responded Skiles.

Sullenberger focused on the glide down to the water. But even in this, he was not on his own. For, as journalist and pilot William Langewiesche noted afterward, the plane’s fly-by-wire control system was designed to assist pilots in accomplishing a perfect glide without demanding unusual skills. It eliminated drift and wobble. It automatically coordinated the rudder with the roll of the wings. It gave Sullenberger a green dot on his screen to target for optimal descent. And it maintained the ideal angle to achieve lift, while preventing the plane from accidentally reaching “radical angles” during flight that would have caused it to lose its gliding ability. The system freed him to focus on other critical tasks, like finding a landing site near ferries in order to give passengers their best chance of rescue and keeping the wings level as the plane hit the water’s surface.

Meanwhile, the three flight attendants in the cabin—Sheila Dail, Donna Dent, and Doreen Welsh—followed through on their protocols for such situations. They had the passengers put their heads down and grab their legs to brace for impact. Upon landing and seeing water through the windows, the flight attendants gave instructions to don life vests. They made sure the doors got open swiftly when the plane came to a halt, that passengers didn’t waste time grabbing for their belongings, or trap
themselves by inflating life vests inside the aircraft. Welsh, stationed in the very back, had to wade through ice cold, chest-high water leaking in through the torn fuselage to do her part. Just two of the four exits were safely accessible. Nonetheless, working together they got everyone out of a potentially sinking plane in just three minutes—exactly as designed.

While the evacuation got under way, Sullenberger headed back to check on the passengers and the condition of the plane. Meanwhile, Skiles remained up in the cockpit to run the evacuation checklist—making sure potential fire hazards were dealt with, for instance. Only when it was completed did he emerge. The arriving flotilla of ferries and boats proved more than sufficient to get everyone out of the water. Air in the fuel tanks, which were only partly full, kept the plane stable and afloat. Sullenberger had time for one last check of the plane. He walked the aisle to make sure no one had been forgotten, and then he exited himself.

The entire event had gone shockingly smoothly. After the plane landed, Sullenberger said, “First Officer Jeff Skiles and I turned to each other and, almost in unison, at the same time, with the same words, said to each other, ‘Well, that wasn’t as bad as I thought.’ ”

So who was the hero here? No question, there was something miraculous about this flight. Luck played a huge role. The incident occurred in daylight, allowing the pilots to spot a safe landing site. Plenty of boats were nearby for quick rescue before hypothermia set in. The bird strike was sufficiently high to let the plane clear the George Washington Bridge. The plane was also headed downstream, with the current, instead of upstream or over the ocean, limiting damage on landing.

Nonetheless, even with fortune on their side, there remained every possibility that 155 lives could have been lost that day. But what rescued them was something more exceptional, difficult, crucial, and, yes, heroic than flight ability. The crew of US Airways Flight 1549 showed an ability to adhere to vital procedures when it mattered most, to remain calm under pressure, to recognize where one needed to improvise and where one needed
not
to improvise. They understood how to function in a complex and dire situation. They recognized that it required teamwork and preparation and that it required them long before the situation became complex and dire.

This was what was unusual. This is what it means to be a hero in the modern era. These are the rare qualities that we must understand are needed in the larger world.

All learned occupations have a definition of professionalism, a code of conduct. It is where they spell out their ideals and duties. The codes are sometimes stated, sometimes just understood. But they all have at least three common elements.

First is an expectation of selflessness: that we who accept responsibility for others—whether we are doctors, lawyers, teachers, public authorities, soldiers, or pilots—will place the needs and concerns of those who depend on us above our own. Second is an expectation of skill: that we will aim for excellence in our knowledge and expertise. Third is an expectation of trust-worthiness: that we will be responsible in our personal behavior toward our charges.

Aviators, however, add a fourth expectation, discipline: discipline in following prudent procedure and in functioning with others.
This is a concept almost entirely outside the lexicon of most professions, including my own. In medicine, we hold up “autonomy” as a professional lodestar, a principle that stands in direct opposition to discipline. But in a world in which success now requires large enterprises, teams of clinicians, high-risk technologies, and knowledge that outstrips any one person’s abilities, individual autonomy hardly seems the ideal we should aim for. It has the ring more of protectionism than of excellence. The closest our professional codes come to articulating the goal is an occasional plea for “collegiality.” What is needed, however, isn’t just that people working together be nice to each other. It is discipline.

Discipline is hard—harder than trustworthiness and skill and perhaps even than selflessness. We are by nature flawed and inconstant creatures. We can’t even keep from snacking between meals. We are not built for discipline. We are built for novelty and excitement, not for careful attention to detail. Discipline is something we have to work at.

That’s perhaps why aviation has required institutions to make discipline a norm. The preflight checklist began as an invention of a handful of army pilots in the 1930s, but the power of their discovery gave birth to entire organizations. In the United States, we now have the National Transportation Safety Board to study accidents—to independently determine the underlying causes and recommend how to remedy them. And we have national regulations to ensure that those recommendations are incorporated into usable checklists and reliably adopted in ways that actually reduce harm.

To be sure, checklists must not become ossified mandates that hinder rather than help. Even the simplest requires frequent revisitation and ongoing refinement. Airline manufacturers put a
publication date on all their checklists, and there is a reason why—they are expected to change with time. In the end, a checklist is only an aid. If it doesn’t aid, it’s not right. But if it does, we must be ready to embrace the possibility.

We have most readily turned to the computer as our aid. Computers hold out the prospect of automation as our bulwark against failure. Indeed, they can take huge numbers of tasks off our hands, and thankfully already have—tasks of calculation, processing, storage, transmission. Without question, technology can increase our capabilities. But there is much that technology cannot do: deal with the unpredictable, manage uncertainty, construct a soaring building, perform a lifesaving operation. In many ways, technology has complicated these matters. It has added yet another element of complexity to the systems we depend on and given us entirely new kinds of failure to contend with.

One essential characteristic of modern life is that we all depend on systems—on assemblages of people or technologies or both—and among our most profound difficulties is making them work. In medicine, for instance, if I want my patients to receive the best care possible, not only must I do a good job but a whole collection of diverse components have to somehow mesh together effectively. Health care is like a car that way, points out Donald Berwick, president of the Institute for Healthcare Improvement in Boston and one of our deepest thinkers about systems in medicine. In both cases, having great components is not enough.

We’re obsessed in medicine with having great components—the best drugs, the best devices, the best specialists—but pay little attention to how to make them fit together well. Berwick notes how wrongheaded this approach is. “Anyone who understands
systems will know immediately that optimizing parts is not a good route to system excellence,” he says. He gives the example of a famous thought experiment of trying to build the world’s greatest car by assembling the world’s greatest car parts. We connect the engine of a Ferrari, the brakes of a Porsche, the suspension of a BMW, the body of a Volvo. “What we get, of course, is nothing close to a great car; we get a pile of very expensive junk.”

Nonetheless, in medicine that’s exactly what we have done. We have a thirty-billion-dollar-a-year National Institutes of Health, which has been a remarkable power house of medical discoveries. But we have no National Institute of Health Systems Innovation alongside it studying how best to incorporate these discoveries into daily practice—no NTSB equivalent swooping in to study failures the way crash investigators do, no Boeing mapping out the checklists, no agency tracking the month-to-month results.

The same can be said in numerous other fields. We don’t study routine failures in teaching, in law, in government programs, in the financial industry, or elsewhere. We don’t look for the patterns of our recurrent mistakes or devise and refine potential solutions for them.

But we could, and that is the ultimate point. We are all plagued by failures—by missed subtleties, overlooked knowledge, and outright errors. For the most part, we have imagined that little can be done beyond working harder and harder to catch the problems and clean up after them. We are not in the habit of thinking the way the army pilots did as they looked upon their shiny new Model 299 bomber—a machine so complex no one was sure human beings could fly it. They too could have decided just to “try harder” or to dismiss a crash as the failings of a “weak” pilot.
Instead they chose to accept their fallibilities. They recognized the simplicity and power of using a checklist.

And so can we. Indeed, against the complexity of the world, we must. There is no other choice. When we look closely, we recognize the same balls being dropped over and over, even by those of great ability and determination. We know the patterns. We see the costs. It’s time to try something else.

Try a checklist.

In the spring of 2007, as soon as our surgery checklist began taking form, I began using it in my own operations. I did so not because I thought it was needed but because I wanted to make sure it was really usable. Also, I did not want to be a hypocrite. We were about to trot this thing out in eight cities around the world. I had better be using it myself. But in my heart of hearts—if you strapped me down and threatened to take out my appendix without anesthesia unless I told the truth—did I think the checklist would make much of a difference in my cases? No. In
my
cases? Please.