“On. Set. Checked.”

How an accident gave us the checklist, and safer flying.

On October 30, 1935, the future of the U.S. Army Air Corps lay smoldering on the ground. That day, the promising prototype for a four-engine, long-range bomber had crashed shortly after takeoff at Wright Field in Dayton, Ohio. An inquiry discovered no problem with the sophisticated aircraft’s design. Rather, human error was at fault. The pilot, Major Ployer Peter Hill, had forgotten to release a safety lock.

What happened next would change aviation safety forever. The Army Air Corps implemented the preflight checklist, a revolutionary new protocol that became the standard for the entire aviation industry.

This major innovation in flight preparation has saved countless lives and averted untold crashes by circumventing mistakes. And the preflight checklist enabled the advancement of aviation technology by ensuring that, with proper protocols in place, pilots could safely fly the increasingly complex aircraft that sprang from the minds of engineers. NASA embraced checklists as well. Apollo astronaut Michael Collins even dubbed them a “fourth crew member.”  (Collins would become the director of the National Air and Space Museum in 1971.) The practice reverberated across other businesses and commerce sectors, inspiring a new safety culture based on the concept that standard operating procedures involving step-by-step checks were essential.

Today, the preflight checklist remains a must in the military. Just ask Lieutenant Colonel John “Karl” Marks of the U.S. Air Force Reserve, the only pilot with more than 7,000 hours flying the Fairchild Republic A-10C Thunderbolt II. He relies on a checklist each and every time he takes to the air with the 442nd Fighter Wing at Whiteman Air Force Base in Missouri. “We always say these lessons are written in blood,” says Marks. “Just about every single thing we do is based on something that has gone wrong in the past. You wonder why it took a crash to realize that a checklist was a good idea. That’s why safety is so important. It’s looking at what could happen and how to prevent it. You have to accept the fact that things can go wrong, so you have to take steps to make sure they won’t.”

The legacy of Model 299

The accident that changed it all occurred at a time when the world was readying for another war. In 1935, the Army Air Corps was evaluating three bomber prototypes submitted by Boeing, Martin, and Douglas. All three aircraft showed promise, but the Boeing design—known as Model 299—especially interested military brass.

Later dubbed the “Flying Fortress” by a journalist because of its bristling machine-gun defenses, the long-range bomber that would become the iconic B-17 during World War II featured four powerful engines and some of the most advanced technology seen on an aircraft of that era.

On October 30, Model 299 took off from Wright Field, the large, shiny airplane roaring impressively down the runway. But when the bomber ascended to 300 feet, it stalled and then crashed in a fiery blast before a stunned crowd of top-ranking military leaders.

The accident would claim the lives of two of the country’s top test pilots: the Army Air Corps’ Hill, who was at the controls, and Leslie Tower of Boeing, who looked on from the cockpit. (Three air crew survived the crash.)

At first, an inquiry board could find no reason for the accident. Everything seemed to check out. However, testimony by Air Corps copilot Lieutenant Donald L. Putt and the mortally injured Tower revealed that Hill had forgotten to release the gust lock, a mechanism that secured the aircraft’s tail control surfaces from excessive wind while the airplane was parked on the ground. Hill had tried to unlock it in flight, but it was too late.

The Army Air Corps desperately wanted to make Model 299 the lead bomber of a new air force. However, the organization came under intense pressure from critics who thought Model 299 was too complex to be flown since it required at least 30 steps to prepare it for takeoff. Something had to change if the sophisticated aircraft was to fly again.

According to Atul Gawande, author of The Checklist Manifesto, Air Corps senior staff turned to their own test pilots for a solution. “[They] came up with an ingeniously simple approach: They created a pilot’s checklist,” he wrote. “Its mere existence indicated how far aeronautics had advanced. In the early years of flight, getting an aircraft into the air might have been nerve-racking but it was hardly complex. Using a checklist for takeoff would no more have occurred to a pilot than to a driver backing a car out of the garage. But flying this new plane was too complicated to be left to the memory of any one person, however expert.”

By creating a checklist, pilots and crew could be on the same page—literally—during preparations for takeoff. The plan called for them to check each critical system listed on a piece of paper as part of a step-by-step process to ensure nothing was overlooked. By utilizing a challenge-and-response protocol, the air crew could be certain that fuel switches were open, gyroscopes uncaged, hydraulics were working, and that any other systems were functioning as required.

The new procedure worked amazingly well and was soon implemented for use on all Army Air Corps airplanes. Other militaries quickly took notice and began using preflight checklists. Soon, the entire aviation industry had adopted the new safety protocol.

The basic standard operating procedure devised 87 years ago is still in use today, though it has been updated to reflect modern technology. In some cases, computers and iPads have taken the place of clipboards and paper forms. Pilots can even download smartphone apps of checklists for different aircraft, including the ATR 42-500, a regional turboprop airliner. “It’s very sophisticated,” says Joe Klun, a pilot and first officer with Delta Air Lines, who flies an Airbus A220 out of Seattle-Tacoma International Airport. “We use a touchscreen to check each system, which is cool. But the process is still the same. The captain calls for the checklist and the first officer reads it. He challenges the captain, who must respond. If something is wrong, then you have caught it—and you correct it.”

Pilots use checklists for more than preparing for takeoff. There are separate checks for all kinds of flight situations. Before any change is made in an aircraft’s status, the crew makes sure every mechanical and computer system is properly set. That includes ascents, descents, speed changes, directional corrections, headings, and more—essentially, any action that will affect the performance of the aircraft must be checked. One study conducted by the NASA Ames Research Center in northern California stressed that checklists during takeoff, approach, and landing phases are especially important. Although these three phases constitute only 27 percent of an average flight, more than 75 percent of major accidents occur during takeoff, approach, and landing.

A culture of safety

When steps are skipped or the checklist is not given the attention it is due, accidents are likely to happen. In 2014, a Gulfstream IV crashed in Bedford, Massachusetts, killing seven people, including millionaire philanthropist Lewis Katz. An investigation by the National Transportation Safety Board (NTSB) determined the crew had failed to conduct a preflight checklist. Had it done so, it would have discovered the gust lock had not been released—just like on Model 299.

As recently as 2021, former U.S. Navy aviator Dale Snodgrass was killed when his SIAI-Marchetti SM.1019 crashed at the Lewiston Nez Perce County Airport in Idaho. Again, the NTSB attributed the accident to Snodgrass’ failure to disengage the flight control lock before departure.

One of the deadliest U.S. crashes on record occurred in 1987, when Northwest Airlines Flight 255 went down shortly after departing Detroit Metropolitan Airport, killing all but one of the 149 people onboard the McDonnell Douglas MD-82. Investigators determined that the pilots had failed to follow the taxi checklist; therefore, they did not know the flaps had not been extended. Compounding the error was a power failure that prevented a warning signal from sounding as the airplane stalled in midair due to the undeployed flaps.

The Northwest crash was one of a series of incidents in the late 1980s that prompted air safety experts to conduct investigations into how checklists were—and weren’t—being utilized. The NTSB found that between 1983 and 1986 there had been 21 accidents involving improper use of checklists. In five of the incidents, checklists hadn’t been used at all.

A closer look at pilot reports provided further insight into the underlying problems. Some checklists were poorly designed and difficult to read. (Investigators noted that in one accident—where a checklist hadn’t been properly followed—the type size was 57 percent smaller than normal.) Distractions and interruptions were the most commonly cited issue. Multitasking crew members briefly stopped conducting their checks while attending to other matters, and then when they resumed the process, they were uncertain where they had left off. And some airplane crews had become so familiar with the procedure they didn’t even notice their own errors.

Safety experts suggested some common-sense fixes. Airlines should pay more attention to checklist designs, they said, and minimize confusion by using standardized terms. (Nomenclature sometimes varied across airlines and different types of aircraft—whereas one airline might use “power levers,” another might say “throttles.”) Checklists should be initiated by designated crew members at specific times, safety experts recommended, adding that they should also be completed during times of minimal workloads, when there would be fewer distractions. The taxi checklist, for instance, should be undertaken as close to the gate and as far from the runway as possible.

Carole Hopson—an author and speaker on aviation history who flies Boeing 737s for United Airlines as a captain—says that when system checks are called out, she ensures the corresponding controls are set in the correct positions. “If the first officer says, for example, ‘engine bleeds and packs are ON and AUTO,’  I stop what I’m doing and look,” she says. “Are they ON or OFF? AUTO or manual? I have to touch every button and switch called to make sure.”

“The checklists are made so we can follow standard operating procedures,” adds Hopson. “It really does make our lives easier. To not follow them is so foolish. It eliminates the guesswork. That’s why you have to follow them relentlessly and religiously.”

Sometimes, however, accidents happen even when pilots follow the checklists. Chesley “Sully” Sullenberger knows this all too well. In 2009, he had just taken off from LaGuardia Airport in Queens, New York, when his Airbus A320 hit a flock of birds, causing both engines to fail. Sullenberger and copilot Jeffrey Skiles successfully glided U.S. Airways Flight 1549 to a belly landing on the Hudson River. All 155 people onboard were rescued. “I spent my life preparing for a challenge I never knew I would face,” says Sullenberger. “I was always trying to be more knowledgeable, more skillful, and more experienced so I would have the judgment needed to handle the unexpected.”

Sullenberger recalls how he actually had a checklist for a twin-engine flameout. Unfortunately, it was for an airplane losing power at 30,000 feet. Both engines on his jet stopped working at about 3,000 feet. Sullenberger and Skiles did not have time to initiate the checklist designed for the higher-altitude restart. For years, Sullenberger lobbied the industry to change that particular checklist so it would include instructions on restarting engines at lower altitudes. He finally succeeded, 10 years after ditching his jet in the Hudson.

Now retired, Sullenberger gives lectures on the importance of maintaining a culture of safety. He talks about checklists and being prepared for any eventuality with groups from a variety of industries, including the medical profession—one of many industries that now uses checklists to improve safety. “It’s not just reading the words on a piece of paper,” says Sully. “It’s a safety culture based on institutional core values, leadership, team building, and communication skills that makes the checklist so effective. It’s a way of literally getting the team on the same page and coordinating individual efforts toward common goals and best practices. Just good enough isn’t.”

 

Houston, we have a checklist

Prior to the launch of a rocket, the NASA flight controller runs down a list of systems to determine operational readiness, with each section head responding “Go” or “No go.” The creation of that launch-approval sequence is credited to the late Christopher C. Kraft, NASA’s very first flight director, who was responsible for inventing mission control and creating its organization and culture.

Many in the space program came from the military, including Milton L. Windler, one of the flight directors of the troubled Apollo 13 mission. Before working for NASA, he learned about the importance of following the preflight checklist as a pilot with the U.S. Air Force. “I flew F-86Ds back in the late ’50s,” he says. “Obviously, we had checklists. I missed a couple of preflight checks that I should have picked up. Both of them bit me later.”

One of the incidents involved the hatch to a drag chute on the back of his North American F-86 jet. Before each flight, Windler needed to make sure the door was set correctly so the chute would deploy on landing. It was cold on the evening that Windler skipped the chute-door check before flying into Geiger Field in Spokane, Washington. As his jet slid down the icy runway, he realized he was going to need more than brakes to stop. “As luck usually happens, I needed the drag chute,” he recalls. “I pulled the handle and there was no drag chute. I slid off the end of the runway, but it turned out to not be too big a deal. That’s the way accidents usually are. It’s not one thing that happens—it’s two or three that compound themselves and get you in trouble.”

 

The experience would serve Windler well during Apollo 13 in 1970, when an oxygen tank exploded as the spacecraft was on its way to the moon. Mission control in Houston scrambled to save the lives of astronauts Jim Lovell, Jack Swigert, and Fred Haise. (Read an interview with Haise about his book, Never Panic Early, on p. 46.) Power was shut off in the command module to save energy while systems in the lunar module powered the space capsule.

With time and oxygen running out, mission control had to invent procedures for restarting the crippled craft’s computers. Staff worked feverishly to develop a new 500-step checklist that would enable the command module to power up and safely return the crew to Earth.

“It was time critical,” says Windler. “Lovell was starting to get antsy about getting the checklist in his hands so he could start working on it, but everything had to be verified.”

“I think when this is over, this checklist will be the story of the flight,” NASA flight director Gerald Griffin predicted while talking to the press in 1970. “Hundreds of people worked on it for three days, 24 hours a day.” 

Family business

On the night of February 16, 2022, a dozen dark gray jets rolled out of their hangar and prepared for takeoff in Utah. With preflight checks completed, pilots of the Lockheed Martin F-35A Lightning IIs of the 388th Fighter Wing got the “go” sign from the tower and began rolling down the runway.

As the sleek and sophisticated fifth-generation jets rose smoothly into the air, all that was visible were their flying lights and the bright fiery blasts from their powerful Pratt & Whitney F-135 afterburning turbofan engines. The U.S. Air Force’s newest combat aircraft were being deployed to Germany in the wake of Russia’s military buildup on the border with Ukraine. If tensions spilled over, the aircraft would be on the frontlines ready to take on any threat to American allies in Europe.

As the F-35s disappeared into the night sky at Hill Air Force Base, the pilots probably didn’t realize the debt owed to the man for whom the base is named. Today, hardly anyone remembers Ployer Peter Hill, the test pilot who made sure nearly 60 different pre-World War II fighters and bombers were safe to fly. Hill’s sacrifice at the helm of Model 299 changed the world forever and saved hundreds, perhaps thousands, of lives.

“He sought to ensure those flying into harm’s way could do so with confidence,” says Mark Millam, director of technical programs and events at the nonprofit Flight Safety Foundation in Alexandria, Virginia. “It’s entirely appropriate that checklists came from such a distinguished pilot who spent his life improving the safety and operability of the aircraft of his era.”

Doug Hill couldn’t agree more. The veteran Air Force pilot and retired United Airlines captain is the grandson of the famous test pilot. He now works as an aviation safety inspector with the Federal Aviation Administration. In 2019, he told Aero Crew News how he thinks of his forebear frequently: “I just know he would have been really proud of what came after his death.” 

---

David Kindy is a journalist, freelance writer, and book reviewer who writes about aviation, space, military history, and other topics.