Gimli Glider

On July 23, 1983, Flight 143 was cruising at 41,000 feet (12,000 m) over Red Lake, Ontario. The aircraft's cockpit warning system sounded, indicating a fuel pressure problem on the aircraft's left side. Assuming a fuel pump had failed, the pilots turned it off,[6] since gravity should feed fuel to the aircraft's two engines (at least in near-level flight) even without the fuel pumps operating.

The aircraft's fuel gauges were inoperative because of an electronic fault indicated on the instrument panel and airplane logs; this fault was known before takeoff to the pilots, who took steps to work around it. During the flight, the management computer indicated that there was still sufficient fuel for the flight, but only because the initial fuel load had been incorrectly entered: the fuel had been calculated in pounds instead of kilograms by the ground crew, and the erroneous calculation had been approved by the flight crew.[7] This error meant that less than half the amount of intended fuel had been loaded. Because the incorrect fuel weight data had been entered into the system, it was providing incorrect readings.

A few moments after the crew silenced the left-side fuel pressure alarm, a second fuel pressure alarm sounded for the right engine. This prompted the pilots to divert to Winnipeg. Then, within seconds, the left engine failed and the pilots began preparing for a single-engine landing. As they communicated their intentions to controllers in Winnipeg and tried to restart the left engine, the cockpit warning system sounded again with the "all engines out" sound, a long "bong" that no one in the cockpit could recall having heard before.[6] Flying with all engines out was something that was never expected to occur and that therefore had not been covered in training, either on a flight simulator or otherwise.[8] Seconds later, with the right-side engine also stopped, the 767 lost all power, and most of the instrument displays in the cockpit went blank.

The 767 was one of the first airliners to include an electronic flight instrument system, which operated on the electricity generated by the aircraft's jet engines. With both engines stopped, the system went dead, leaving only a few basic battery-powered emergency flight instruments. While these provided sufficient information with which to land the aircraft, a vertical speed indicator—that would indicate the rate at which the aircraft was descending, information which could be used to predict how long it could glide unpowered—was not among them.

On airliners the size of the 767, the engines also supply power for the hydraulic systems, without which the aircraft cannot be controlled. Such aircraft are therefore required to be equipped with a means to compensate for this kind of power failure. With the 767, that compensation is usually achieved through the automated deployment of a ram air turbine, a backup generator that generates power from air movement, like a wind turbine.[9] As the Gimli pilots reduced speed for landing, the resultant reduced airflow meant a decrease in the hydraulic power, power that was critically needed for control during landing.

In line with their planned diversion to Winnipeg, the pilots were already descending through 35,000 feet (11,000 m)[4] when the second engine shut down. They immediately searched their emergency checklist for the section on flying the aircraft with both engines out, only to find that no such section existed.[6] Captain Pearson was an experienced glider pilot, so he was familiar with flying techniques almost never used in commercial flight. To have the maximum range and therefore the largest choice of possible landing sites, he needed to fly the 767 at the optimum glide speed. Making his best guess as to this speed for the 767, he flew the aircraft at 220 knots (410 km/h; 250 mph). First Officer Maurice Quintal began to calculate whether they could reach Winnipeg. He used the altitude from one of the mechanical backup instruments, while the distance travelled was supplied by the air traffic controllers in Winnipeg, measured by the aircraft's radar echo observed at Winnipeg. In 10 nautical miles (19 km; 12 mi) the aircraft lost 5,000 feet (1,500 m), giving a glide ratio of approximately 12:1 (dedicated glider planes reach ratios of 50:1 to 70:1).[10]

At this point, Quintal proposed landing at the former RCAF Station Gimli, a closed air force base where he had once served as a pilot for the Royal Canadian Air Force. Unbeknownst to Quintal or to the air traffic controller, a part of the facility had been converted to a race track complex, now known as Gimli Motorsports Park.[11] It included a road race course, a go-kart track, and a dragstrip. A Canadian Automobile Sport Clubs-sanctioned sports car race hosted by the Winnipeg Sports Car Club was underway at the time of the incident and the area around the decommissioned runway was full of cars and campers. Part of the decommissioned runway was being used to stage the race.[12]

Without main power, the pilots used a gravity drop, which allows gravity to lower the landing gear and lock it into place. The main gear locked into position, but the nose wheel did not; this later turned out to be advantageous. As the aircraft slowed on approach to landing, the reduced power generated by the ram air turbine rendered the aircraft increasingly difficult to control.

As the plane drew near the runway, it became apparent that the aircraft was coming in too high and fast, raising the danger of the 767 running off the runway before it could be stopped. The lack of hydraulic pressure prevented flap/slat extension that would have, under normal landing conditions, reduced the stall speed of the aircraft and increased the lift coefficient of the wings to allow the airliner to be slowed for a safe landing. The pilots briefly considered a 360-degree turn to reduce speed and altitude, but they decided that they did not have enough altitude for the manoeuvre. Pearson decided to execute a forward slip to increase drag and lose altitude. This manoeuvre is commonly used in gliders and light aircraft to descend more quickly without increasing forward speed, but it is practically never executed in large jet airliners outside of rare circumstances like those of this flight.

Complicating matters yet further was the fact that with both of its engines out, the plane made virtually no noise during its approach. People on the ground thus had no advance warning of the impromptu landing and little time to flee. As the gliding plane closed in on the decommissioned runway, the pilots noticed that there were two boys riding bicycles within 1,000 feet (300 m) of the projected point of impact. Captain Pearson would later remark that the boys were so close that he could see the looks of sheer terror on their faces as they realized that a commercial airliner was bearing down on them.

Two factors helped avert disaster: the failure of the front landing gear to lock into position during the gravity drop, and the presence of a guardrail that had been installed along the centre of the repurposed runway to facilitate its use as a drag race track. As soon as the wheels touched down on the runway, Pearson braked hard, skidding and promptly blowing out two of the aircraft's tires. The unlocked nose wheel collapsed and was forced back into its well, causing the aircraft's nose to slam into, bounce off, and then scrape along the ground. This additional friction helped to slow the airplane and kept it from crashing into the crowds surrounding the runway. After the airliner had touched down, the nose began to scrape along the guardrail in the centre of the race track, creating additional frictional drag that helped to decelerate the plane; Pearson applied extra right brake, which caused the main landing gear to straddle the guardrail. Air Canada Flight 143 came to a final stop on the ground 17 minutes after running out of fuel.[13]

There were no serious injuries among the 61 passengers or the people on the ground. As the aircraft's nose had collapsed onto the ground, its tail was elevated and there were some minor injuries when passengers exited the aircraft via the rear slides, which were not long enough to sufficiently accommodate the increased height. A minor fire in the nose area was extinguished by racers and course workers equipped with portable fire extinguishers.[14]

The amount of fuel in the tanks of a Boeing 767 is computed by the Fuel Quantity Indicator System (FQIS) and displayed in the cockpit. The FQIS on the aircraft was a dual-processor channel, each independently calculating the fuel load and cross-checking with the other. In the event of one failing, the other could still operate alone, but in that case, the indicated quantity was required to be cross-checked against a floatstick measurement before departure. In the event of both channels failing, there would be no fuel display in the cockpit, and the aircraft would be considered non-serviceable and not authorized to fly.

Because inconsistencies had been found with the FQIS in other 767s, Boeing had issued a service bulletin for the routine checking of this system. An engineer in Edmonton duly did so when the aircraft arrived from Toronto following a trouble-free flight the day before the incident. While conducting this check, the FQIS failed and the cockpit fuel gauges went blank. The engineer had encountered the same problem earlier in the month when this same aircraft had arrived from Toronto with an FQIS fault. He found then that disabling the second channel by pulling the circuit breaker in the cockpit restored the fuel gauges to working order albeit with only the single FQIS channel operative. In the absence of any spares he simply repeated this temporary fix by pulling and tagging the circuit breaker.

A record of all actions and findings was made in the maintenance log, including the entry; "SERVICE CHK – FOUND FUEL QTY IND BLANK – FUEL QTY #2 C/B PULLED & TAGGED...".[16] This reports that the fuel gauges were blank and that the second FQIS channel was disabled, but does not make clear that the latter fixed the former.

On the day of the incident, the aircraft flew from Edmonton to Montreal. Before departure the engineer informed the pilot of the problem and confirmed that the tanks would have to be verified with a floatstick. In a misunderstanding, the pilot believed that the aircraft had been flown with the fault from Toronto the previous afternoon. The flight to Montreal proceeded uneventfully with fuel gauges operating correctly on the single channel.

On arrival at Montreal, there was a crew change for the return flight back to Edmonton. The outgoing pilot informed Captain Pearson and First Officer Quintal of the problem with the FQIS and passed along his mistaken belief that the aircraft had flown the previous day with this problem. In a further misunderstanding, Captain Pearson believed that he was also being told that the FQIS had been completely unserviceable since then.

While the aircraft was being prepared for its return to Edmonton, a maintenance worker decided to investigate the problem with the faulty FQIS. To test the system he re-enabled the second channel, at which point the fuel gauges in the cockpit went blank. Before he could disable the second channel again, however, he was called away to perform a floatstick measurement of fuel remaining in the tanks, leaving the circuit breaker tagged (which masked the fact that it was no longer pulled). The FQIS was now completely unserviceable and the fuel gauges were blank.

On entering the cockpit, Captain Pearson saw what he was expecting to see: blank fuel gauges and a tagged circuit breaker. Pearson consulted the master minimum equipment list (MMEL), which indicated that the aircraft was not legal to fly with blank fuel gauges but due to a misunderstanding, Pearson believed that it was safe to fly if the amount of fuel was confirmed with measuring sticks.[17]

The 767 was still a very new aircraft, having flown its maiden flight in September 1981. C-GAUN was the 47th Boeing 767 off the production line, and had been delivered to Air Canada less than four months previously.[18] In that time period there had been 55 changes to the MMEL, and some pages were blank pending development of procedures.

Because of this unreliability, it had become practice for flights to be authorized by maintenance personnel. To add to his own misconceptions about the condition in which the aircraft had been flying since the previous day, reinforced by what he saw in the cockpit, Pearson now had a signed-off maintenance log that it had become custom to prefer over the MMEL.

At the time of the incident, Canada's aviation sector was in the process of converting to the metric system. As part of this process, the new 767s being acquired by Air Canada were the first to be calibrated for metric units (litres and kilograms) instead of Imperial units (gallons and pounds). All other aircraft of the company were still operating with Imperial units. For the trip to Edmonton, the pilot calculated a fuel requirement of 22,300 kilograms (49,200 lb). A floatstick check indicated that there were 7,682 litres (1,690 imp gal; 2,029 US gal) already in the tanks. To calculate how much more fuel had to be added, the crew needed to convert the volume (litres) in the tanks to a mass (kilograms), subtract that figure from 22,300 kg and convert the result back into a volume. In previous times, this task would have been completed by a flight engineer, but the 767 was the first of a new generation of airliners that flew with only a pilot and co-pilot.

The volume of jet fuel varies with temperature. In this case, the mass of a litre of fuel was 0.803 kg, so the correct calculation was:

7,682 litres × 0.803 kg/L = 6,169 kg = mass of fuel already on board

22,300 kg − 6,169 kg = 16,131 kg = mass of additional fuel required, or

16,131 kg ÷ (0.803 kg/L) = 20,088 litres = volume of additional fuel required

The ground crew, however, used the incorrect conversion factor of 1.77, the mass of a litre of fuel in pounds, and this error was not noticed by the flight crew. The conversion factor provided on the refueller's paperwork was one that had always been used in the past, when Air Canada's fleet had been imperial-calibrated. The calculation that they actually performed was:

7,682 litres × 1.77 lb/L = 13,597 lb (because of the incorrect conversion factor, this quantity was interpreted incorrectly as 13,597 kg already on board)

22,300 kg − 13,597 kg = 8,703 kg = mass of additional fuel required

8,703 kg ÷ (1.77 lb/L) = 4,917 litres = volume of additional fuel required (because of the incorrect conversion factor, this quantity was interpreted incorrectly as 4,917 L)

Instead of taking on the 20,088 litres of additional fuel that they required, they instead loaded only 4,917 litres. The use of the incorrect conversion factor led to a total fuel load of only 22,300 pounds (10,100 kilograms) rather than the 22,300 kilograms that was needed. This was approximately half the amount required to reach their destination.[19] Knowing the problems with the FQIS, Captain Pearson double-checked their calculations but was given the same incorrect conversion factor and came up with the same erroneous figures.

The flight management computer (FMC) measures fuel consumption, allowing the crew to keep track of fuel burned as the flight progresses. It is normally updated automatically by the FQIS, but in the absence of this facility it can be updated manually. Believing he had 22,300 kg of fuel on board, this is the figure the captain entered.

Because the FMC would reset during the stopover in Ottawa, the captain had the fuel tanks measured again with the floatstick while there. In converting the quantity to kilograms, the same incorrect conversion factor was used, leading him to believe he now had 20,400 kg of fuel; in reality, he had less than half that amount.