The Debrief · No. 05
A checklist is not a clock
The airliner that worked calmly through the correct procedure for an ambiguous warning, on a problem that would not wait for the procedure to finish.
Case File
What happened
On 2 September 1998, Swissair Flight 111, a McDonnell Douglas MD-11 registered HB-IWF, was on a scheduled service from New York to Geneva carrying 215 passengers and 14 crew. Around 53 minutes after departure, the crew noticed an unusual odour in the cockpit, initially attributed to the air conditioning system. A short time later the odour returned with a small amount of visible smoke, and the crew made a "pan pan" urgency call, not yet a full emergency declaration, to air traffic control over Nova Scotia.
The crew began working through the airline's checklist for smoke or fumes of unknown origin. They requested a diversion, first to Boston, then accepted a closer vector to Halifax offered by air traffic control. Following the checklist, they shut off power to non-essential cabin systems, which also disabled the cabin's recirculation fans, dumped fuel to reduce landing weight, and began preparing the cabin for landing. Landing itself was one of the last steps in a checklist sequence that, worked through in full, would have taken longer to complete than the aircraft had left in the air.
The fire, burning above the cockpit ceiling and sustained by flammable insulation material, was already advancing faster than the crew's actions could contain it. Cutting cabin power caused a reverse airflow in the ventilation ducts that increased the amount of smoke reaching the flight deck rather than clearing it. Roughly thirteen minutes after the odour was first detected, aircraft systems began failing in rapid succession. At 22:24 Atlantic time the crew reported they now had to fly the aircraft manually, then moments later declared a full emergency. Their last transmission to air traffic control followed about twenty seconds after that. The flight and cockpit voice recorders stopped shortly afterwards. The aircraft struck the Atlantic Ocean near Peggy's Cove, Nova Scotia, at approximately 22:31, roughly 21 minutes after the odour was first noticed. All 229 people on board were killed. The Transportation Safety Board of Canada released its investigation report, A98H0003, in March 2003.
The Lesson
The lesson aviation took
The TSB found that the checklist itself was built on an assumption that no longer held once this particular fire was under way: that smoke or odour of unknown origin is usually minor, and that there is time to methodically work out the source before committing to land. That assumption set the pace of everything the crew did. In response, the TSB recommended a philosophy shift across the industry: when odour or smoke of unknown origin appears, the appropriate course of action is to prepare to land immediately, and emergency checklists for that condition should be redesigned to be completed in a timeframe that minimises the chance of a fire being sustained, not to be worked through in full before landing is even considered. The lesson was not about this particular fire's cause. It was that a normal, methodical pace is the wrong response to a signal whose severity nobody yet knows, because by the time the severity is confirmed, the time budget may already be gone.
Translation
On your site
A strange smell in a control room. A bearing running hot but not yet alarming. A warning light nobody recognises. Every one of these looks, in the moment, like something that probably has a simple explanation, and the natural response is to work it through calmly: notify, assess, gather more information, then decide. That sequence is the right one for a problem you can already size up. It is the wrong one for a problem you cannot yet size up, because the not knowing is itself the signal that this may be moving faster than the normal process assumes. The crew that waits for certainty before escalating a genuinely unknown risk is running the same checklist, at the same pace, on a problem that will not wait for it.
Ask the Crew
Three questions for pre-start
- 01
Where does our response to a strange or ambiguous warning assume it is probably minor, because that is what it usually turns out to be?
- 02
If we do not yet know how serious something is, does our process treat that uncertainty as a reason to escalate immediately, or as a reason to gather more information first?
- 03
Pick one warning or alarm this week: if it turned out to be the fast-moving version of the problem, would our first response still be fast enough?
A checklist is not a clock.
Free Download
Run better pre-starts
The free Pre-Start Briefing Pack includes the THREAT Brief format, a Challenge and Response card, and three read-aloud talks like this one.