The Checklist Manifesto_ How to Get Things Right - Atul Gawande [47]
Boorman showed me the one for when the DOOR FWD CARGO warning light goes on in midflight. This signals that the forward cargo door is not closed and secure, which is extremely dangerous. He told me of a 1989 case he’d studied in which exactly this problem occurred. An electrical short had caused a Boeing 747 cargo door to become unlatched during a United Airlines flight out of Honolulu on its way to Auckland, New Zealand, with 337 passengers on board. The plane was climbing past twenty-two thousand feet and the cabin was pressurized to maintain oxygen levels for the passengers. At that altitude, a loose, unlatched cargo door is a serious hazard: if it opens enough to begin leaking air, the large pressure difference between inside and out causes a “ring-pull” effect—an explosive release like pulling the ring top on a shaken soda can. In the Honolulu flight, the explosion blew out the cargo door almost instantly and took with it several upper-deck windows and five rows of business class seats. Nine passengers were lost at sea. Passengers in adjacent seats were held in only by their seat belts. A flight attendant in the aisle was nearly sucked out, too, but an alert passenger managed to grab her ankle and pin her down, inches from the gaping hole.
The crew had had no time to prevent the catastrophe. From unlatching to blowout and the loss of nine lives took no more than 1.5 seconds. Boeing subsequently redesigned the electrical system for its cargo doors and—because no latch is foolproof—installed extra latches, as well. If one fails, the DOOR FWD CARGO light goes on and the crew has more time to respond. There is a window of opportunity to stop a blowout. That’s where the checklist comes in.
When a latch gives way, Boorman explained, a crew should not tinker with the door or trust that the other latches will hold. Instead, the key is to equalize the difference between inside and outside pressures. The more you lower the cabin pressure, the less likely the door will explode away.
Airplanes have an easy way to lower the pressure, apparently: you hit an emergency override switch that vents the cabin air and releases the pressurization in about thirty seconds. This solution is problematic, however. First, the sudden loss of pressure can be extremely uncomfortable for passengers, particularly given the ear pain it causes. Infants fare the worst, as their eustachian tubes haven’t developed sufficiently to adjust to the change. Second, depressurizing a plane at an altitude of twenty or thirty thousand feet is like dropping passengers onto the summit of Mount Everest. The air is too thin to supply enough oxygen for the body and brain.
The United Airlines flight offered a vivid lesson in what could happen, for the cargo door blowout instantly depressurized the plane, and once the initial, explosive decompression was over, lack of oxygen became the prime danger for the passengers and crew. Getting sucked into the void was no longer the issue. Everyone was able to stay well away from the ten-by-fifteen-foot hole. The temperature, however, plummeted to near freezing, and the oxygen levels fell so low that the crew became light-headed and feared losing consciousness. Sensors automatically dropped oxygen masks, but the oxygen supply on airplanes is expected to last only ten minutes. Moreover, the supply might not even work, which is exactly what happened on that flight.
The cockpit voice recorder caught the events