Boeing Checklist Philosophy
Boeing Checklist Philosophy
Boeing Checklist Philosophy
Date: 09-01-1990
Subject: Boeing Checklist Philosophy
Introduction
This paper compares the current Boeing checklist philosophy with FAA guidance as
described in the “Air Transportation Operations Inspector’s Handbook,” Chapter 15, and
the NASA contractor report “Human Factors of Flight Deck Checklists: The Normal
Checklist.” It also includes a discussion on future options and developments for normal
checklists.
The Boeing Company currently produces aircraft of both “new” and “old” technology
with “monitored” and “not monitored” systems. Therefore the layout, composition, and
text are different between the “older” 737 series checklists and the “newer” 757, 767, and
747-400 series airplane checklists. Despite this necessary difference, the basic
methodology of checklist usage is the same for all currently produced Boeing airplanes.
Specifically, the normal checklists are do-verify (DV), and the non-normal checklists are
recall (memory) items and challenge-do-verify (CDV). These methods of checklist
design are generally accepted by most airlines and are the methods considered most
effective by the FAA (as discussed in the FAA’s Air Transportation Operations
Inspector’s Handbook, Chapter 15, and Section 5).
The most apparent difference between the “old” and “new” checklist design is that the
newer “system-monitored” airplane checklists are shorter. The 757 normal checklist
philosophy states:
“Normal checklists are used to verify that certain critical procedural steps
have been accomplished. Only procedural steps which, if omitted, would have a
direct and adverse impact on normal operations are included. Items annunciated
by the crew alerting system (EICAS) are not included.”
The Air Transport Association (ATA) has also stated its recommended checklist
philosophy:
PP-1
steps which, if omitted have direct and adverse impact on normal operations, are
included. Items annunciated by crew alerting systems are not included.”
Note that the industry accepted standard of not including items annunciated by crew
alerting systems is identical to the Boeing philosophy. As discussed later, this agreement
may be critical should The Boeing Company decide to further modify its checklist
philosophy.
The POI’s Handbook, Chapter 15, Section 5, PP 3-2113 under “Development and
Sequencing of Checklist Items” states:
In the NASA contractor report “Human Factors of Flight-Deck Checklists: “The Normal
Checklists,” the authors address how “old” style lengthy and detailed checklists link with
cockpit interruptions, distractions, and the limits of human short term memory. During
critical periods of a flight this “linkage” has led to accidents or incidents, sometimes with
disastrous results.
Looking at these factors, it appears the present Boeing checklist philosophy, namely,
keeping the checklists short and including only the “killer” or safety of flight items, is
correct by all present industry and regulatory standards.
This is an area of the Boeing checklist philosophy which may not be in agreement with
FAA guidance. After accomplishing the approach procedure for example, we then
instruct the pilot flying to call for the approach checklist. However, Boeing training does
not recommend precisely how or when to initiate the approach procedure. It is left to the
individual pilot to initiate the procedure through whatever means he or she sees fit.
Not every Boeing procedure has a corresponding checklist. An example is the Boeing
takeoff procedure. After being cleared on the runway for takeoff, the pilot flying (PF)
and the pilot not flying (PNF) each have specific tasks, but, there is no corresponding
takeoff checklist. Crews are in the habit of accomplishing a procedure, then calling for
PP-2
the corresponding checklist. Many of the airlines recognize and promote this pattern and
have added a takeoff checklist in an attempt to “round out” this phase of flight.
All other Boeing procedures relating to phases of flight have a corresponding checklist to
verify the “critical” or “regulatory required” procedural steps have been accomplished.
Boeing training may not sufficiently address the related concepts of initiating procedural
tasks and accomplishing the associated checklist. The Boeing Company should
investigate whether it would be wise to add specific verbiage and timing
recommendations to our training documents. For example:
“After engine start, call for and accomplish the ‘after start’ procedure.
When the procedure is completed, call for the ‘after start’ checklist.”
Or:
“Prior to transition altitude, and if possible prior to ten thousand feet, call
for and accomplish the ‘approach’ procedure. When the procedure is completed,
call for the ‘approach’ checklist.”
The Boeing Company generally specifies in the Operations Manual which crew member
will accomplish each normal procedural step. The Boeing developed quick reference
checklist, however, does not display which crew member is to respond to a particular
item. During student training, many Boeing instructor pilots have seen confusion
between the students as to which pilot is to accomplish or respond to items in both
normal and non-normal checklists.
Within their published checklists, many of the operators have interpreted this FAA
guidance to mean that individual crew members must be designated to respond to and
accomplish specific items. These operators denote on the normal checklists which pilot
must accomplish or respond to an item.
PP-3
Customer Paradigms
The primary conflicts between operator checklists and Boeing developed checklists
center on which “normal” actions are to be considered and listed for each phase of flight.
What arises is sometimes a dilemma for The Boeing Company. We are dedicated to
quality improvement concepts and therefore, wish to serve our customers the product
they need. If their operations (or industry-wide operation) are in direct conflict with the
Boeing recommended philosophy, where does Boeing draw the line? For example,
Boeing includes auto brakes in the 747-400 approach and landing procedure, but we do
not include it in the Boeing developed approach checklist. In contract, most operators
include the auto brakes in their approach checklist considering it a “killer” or safety of
flight item if not accomplished. If the majority of operators want it included, should
Boeing also include it in the Boeing developed approach checklist?
Another example of this “disagreement” is the flight control check in the 747-400. The
Boeing Company recommends it be accomplished prior to engine start. When a poll was
taken asking the operators when they actually perform the flight control check, it was
found that 91% of the 21 responding operators were accomplishing the check after engine
start and/or while taxing out. The Boeing philosophy is very clear on this issue and is
driven by the desire to keep taxi time completely clear of tasks that would draw crew
attention to inside the cockpit.
The fact that most of the airlines are not following The Boeing Company
recommendation may be a product of their cultural, traditional, philosophical, and
regulatory development. Because of these factors and influences, it may be difficult for
them to break with the past. If it has been shown through industry, NASA, and Boeing
studies, that there is a safer method to accomplish a particular task, should The Boeing
Company mount a campaign to change customer philosophy and viewpoint? We have
done this in the past with other issues of safety education such as wind shear, rejected
takeoff, tail strikes, etc. At what point does Boeing draw a line in the sand and attempt to
change customer paradigms?
The answer to this question may lie in our ability to integrate monitoring and alerting
systems into the checklist philosophy. It is possible to establish correct and consistent
standards that must be followed because of the design of the airplane. For the future,
Boeing must decide to what extent the combined advantages of display technology,
computer logic and monitoring technologies are to be exploited in an effort to enhance
the simplicity of normal procedures and checklists.
Display Technology
If technological advances can decrease the potential for human error on the flight deck
then, whenever possible, The Boeing Company should incorporate this technology into
PP-4
our checklist philosophy. The 777 will utilize an electronic checklist. We must not fail
to capitalize on this technological potential by limiting our thinking. The Boeing
Company should not limit development of this flight deck aid to mimic existing checklist
patterns and models. Totally linking the electronic checklist to the appearance of “paper”
checklists of the past negates the advantages of display technology capabilities. For
example, using the display technology capability not only to change the color of the
current active checklist item, but also to enhance its size relative to other checklist items.
The electronic checklist also has the capacity to be integrated into the “monitored”
normal procedural tasks as discussed in the next section.
Monitored systems and computer logic have the potential to revolutionize the current
Boeing checklist philosophy. In order to minimize the risk of crews not performing
certain tasks at critical phases of flight, the capability exists to integrate sensed airplane
functions, FMC functions and the EICAS into the pilot’s procedural routine. In other
words, the normal checklists would be supplemented and backed up by EICAS messages
to be displayed by exception. Some Boeing airplanes already incorporated such
integration for limited functions; however, the concept can be taken beyond existing
logic.
For example, consider the after start, before takeoff and takeoff phases of flight. The
Boeing Company has maintained that the before takeoff phase (the taxi phase) is to be
“quiet.” For this reason, Boeing has no taxi checklist for the “newer” airplanes, and the
before takeoff checklist contains only one item. Yet many operators have added a
separate taxi checklist and numerous items to the before takeoff checklist. Adding
checklists and inserting additional items to checklists effectively negates the “silent, dark
flight deck” concept. If monitored systems, FMC functions, and the EICAS were
integrated into the checklist philosophy, and the after start procedure included selecting
takeoff flaps before taxi (instead of selecting flaps during taxi), then taxi and before
takeoff procedures and checklists could be eliminated. This would enhance the “quiet,
dark, flight deck” concept.
Here is a brief explanation of how it would work: after engine start, when commencing
the taxi phase, if the aircraft ground speed went above a nominal figure of 2 to 5 knots, an
automatic comparison would be made between actual flap position and the FMC entered
flap setting. If not in agreement, an EICAS message such as “flaps FMC disagree” and
an aural warning would be generated. The crew would be required to correct the
condition before takeoff as they would not be able to cancel the message. The backup to
this concept would be the normal configuration warning system if takeoff were attempted
with flaps up.
Incorporating this type of checklist or procedural task monitoring into Boeing airplanes
could eliminate accidents such as the Northwest DC-9 in Detroit (1988) and the Delta
727 in Dallas (1989). In both of these accidents, the crews were distracted during taxi
and failed to perform the required procedural tasks and checklists prior to takeoff.
PP-5
Integrating monitored systems, FMC, and EICAS logic into the checklist philosophy
would, in some cases, drive operators to change their procedures to match the Boeing
philosophy; the monitoring system would require tasks to be accomplished in a defined
order or time relative to specific phases of flight.
If the inputs from monitored components and systems were integrated into FMC/EICAS
logic, more procedural tasks and existing checklist items could be included. For
example, during climb, if the landing lights were not turned off by 11,000 feet, an EICAS
message “landing lights” would be displayed. During descent, when passing 9,500 feet if
the landing lights were not on, the same EICAS message would display. Another
example might be a comparison between the FMC landing flap input and the actual flap
position selected. If not in agreement, an EICAS message would be generated.
Taken to the extreme, the monitored procedural task concept could lead to the elimination
of all normal checklists. In such a philosophy, EICAS messages would be displayed by
exception when required procedural tasks were not accomplished within preset
parameters. The advantage of this concept would be less “chatter” and “heads down”
time on the flight deck, giving more time to concentrate on flying the airplane and
looking outside. The pilots would not be taken out of the “loop” but in fact, a reliable
electronic memory would become an integral part of the “loop.”
For example, after passing the FMC entered flap acceleration altitude plus a nominal
altitude of 3,000 feet, if the flaps were not up, an EICAS message “flaps” would be
displayed. Approaching the gear raising limit speed if the landing gear were not up, and
the handle off (if required), an EICAS message “landing gear” would be displayed.
Monitoring these particular items would eliminate the need for an after takeoff checklist.
The procedural tasks would be accomplished (and monitored for completeness by the
system); however, no checklist would be required.
In the NASA contractor report “Human Factors of Flight-Deck Checklists: The Normal
Checklist,” the authors state that one checklist function is “mutual supervision” (cross
checking among crew members). In the strictest sense, this objective may not appear to
be met by an EICAS “exceptional notification” concept. However, if the computer
memory and logic is looked upon as a “trusted” third crew member, then the cross
checking objective would be unnecessary.
The authors also list sixteen checklist “proposed guidelines” (see attachment). Nearly all
of these objectives could be met by an EICAS “exceptional notification” system such as
described above. Many of the author’s “checklist” objectives would be better classified
as “procedural” objectives.
Procedural Considerations
Some existing routine procedural tasks could be tied together to reduce crew workload.
For example, for takeoff, an automatic flight attendant warning (cabin notification) could
PP-6
be tied to turning on the strobe light (after receiving clearance on the runway). For
landing, the notification could be tied to some other routine task, such as selecting flaps
ten in the 747-400. Connecting or automating as many routine tasks as possible would
reduce cockpit workloads thereby decreasing distractions. Experience has proven these
are tasks that are often forgotten. Many operators have added routine procedural tasks to
their normal checklists on “newer” airplanes. Tying some of the tasks together and
coupling them to normal checklist items (where possible) would reduce this tendency to
make these additions to the Boeing recommended checklists.
Summary
Overall, the existing Boeing Company normal checklist philosophy is in step with the
latest FAA guidance and NASA studies. However, some clarification of tasks may be
required. For the future, display technology capabilities, monitored systems and
computer logic have the potential to revolutionize Boeing checklist philosophies.
Through enhanced presentation and expansions of the role played by the electronic “third
pilot” in the procedural and checklist process, it may be possible to eliminate some (if not
all) normal checklists. Additionally, some existing routine procedural tasks have the
potential to be coupled to further reduce crew workloads. For all new philosophies, the
objective should be to utilize airplane systems to reduce crew workloads.
PP-7
Attachment
Appendix A
Proposed Guidelines
In this appendix the authors propose several guidelines for designing and using flight-
deck checklists. These considerations are not specifications and some when applied
individually, may conflict. Therefore, each should be carefully evaluated for its
relevance to operational constraints and the checklist philosophy-of-use in any specific
airline operation. The section in the report which explains the rationale for each
guideline is given in parenthesis.
(1) Every effort should be made to avoid using the checklist as a “site” for resolving
discipline problems. (3.2.3.)
(2) Standardization of checklists between fleets has many advantages, but this should
be done carefully to prevent inappropriately imposing a checklist sequence and
concept of one aircraft type on another. (3.3.)
(3) Airlines should attempt to standardize the names assigned to controls and displays
between different fleets. (6.2.4.)
(4) Checklist responses should portray the desired status or the value of the item
being considered (not just “checked” or “set”). (6.2.3.)
(5) The use of hands and fingers to touch appropriate controls, switches, and displays
while conducting the checklist is recommended. (7.2.2.)
(6) The completion call of a task-checklist should be written as the last item on the
checklist, allowing all crew members to move mentally from the checklist to other
activities with the assurance of all pilots that the task-checklist has been
completed. (5.3.)
PP-8
(9) Checklist items should be sequenced in parallel to internal and external activities
that require input from out-of-cockpit agents such as cabin crew, ground crew,
fuelers, and gate agents. (7.2., 5.4., and 8.2.2.)
(10) The most critical items on the task-checklist should be listed as close as possible
to the beginning of the task-checklist, in order to increase the likelihood of
completing the task before interruptions may occur. We note that this guideline
could be in conflict with numbers (8) and (9) above. In most cases where this
occurs, this guideline (10) should take precedence. (7.2., and 8.2.2.)
(11) Critical checklist items such as flaps/slats, trim, etc., that might be reset prior to
takeoff due to new information should be duplicated between task-checklists.
(7.2.)
(12) Checklists should be designated in such a way that they will not be tightly
coupled with other tasks. Every effort should be made to provide buffers for
recovery from failure and a way to “take up the slack” if checklist completion
does not keep pace with the external operation. (8.2.)
(13) The TAXI checklist should be completed as close as possible to the gate and as
far away as possible from the active runway(s) and adjacent taxiways. (8.2.)
(14) Flight crews should be made aware that the checklist procedure is highly
susceptible to production pressures. These pressures “set the stage” for errors by
encouraging substandard performance and later may lead some to relegate
checklist procedures to second level of importance, or not use them at all in order
to save time. (8.2.3.)
(16) Likewise when a merger occurs, checklists of the acquired airline should be
carefully examined for their differences. Knowledge gained by the acquired
airline in operating a specific model should not be ignored. Differences in
concepts and operating procedures should be resolved in a manner that enhances
safe checklist behavior of all crew members. (4.)
PP-9
PP-10
Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.
Alternative Proxies: