Gimli Glider

On July 22, 1983, Air Canada Boeing 767 C-GAUN,[10] underwent routine checks in Edmonton. The technician found a defective FQIS, so he disabled the defective channel and made an entry in the logbook. The next morning, Captain John Weir and co-pilot Captain Donald Johnson were told about the problem. Since the FQIS operated on a single channel, a dripstick reading was taken to obtain a second fuel quantity measurement. Weir converted the dripstick reading from centimetres to litres to kilograms, finding that it agreed with the FQIS. The plane flew to Toronto and then Montreal without incident.[9]

At Montreal, Captain Robert "Bob" Pearson and First Officer Maurice Quintal took over the airplane for Flight 143 to Ottawa and Edmonton. During the handover, Weir told Pearson that a problem existed with the FQIS, and Pearson decided to take on enough fuel to fly to Edmonton without refueling in Ottawa. Meanwhile, an avionics technician had entered the cockpit and read the logbook. While waiting for the fuel truck, he enabled the defective channel and performed an FQIS self-test. Distracted by the arrival of the fuel truck, he left the channel enabled after the FQIS failed the test. Pearson entered the cockpit to find the FQIS blank, as he expected.[9]

After taking a dripstick measurement, Pearson converted the reading from centimetres to litres to kilograms. However, he did his calculation with the density figure for jet fuel in pounds/litre from the Air Canada refueler's slip, used for all other aircraft in the fleet, instead of kilograms/litre for the all-metric 767 aircraft, which was new to the fleet.[11] Since the FQIS was not operational, he entered the reading into the flight management computer, which tracked the amount of fuel remaining in kilograms. The airplane flew to Ottawa without incident, where another dripstick measurement was taken and converted using the density in pounds/litre. Since the aircraft appeared to have enough fuel to reach Edmonton, no fuel was loaded at Ottawa.[9][12]

While Flight 143 was cruising over Red Lake, Ontario, at 41,000 feet (12,500 m) shortly after 8 pm CDT,[2] the aircraft's cockpit warning system sounded, indicating a fuel-pressure problem on the aircraft's left side. Assuming that a fuel pump had failed, the pilots turned off the alarm,[13] knowing that the engine could be gravity-fed in level flight. A few seconds later, the fuel pressure alarm also sounded for the right engine. This prompted the pilots to divert to Winnipeg.

The left engine failed within seconds, and the pilots began preparing for a single-engine landing. As they communicated their intentions to controllers in Winnipeg and tried to restart the left engine, the cockpit warning system sounded again with the "all engines out" sound, a sharp "bong" that no one in the cockpit could recall having heard before.[13] The right-side engine stopped seconds later, and the 767 lost all power. Flying with all engines out was never expected to occur, so it had never been covered in training.[14] Adding to both the crew's and the controllers' problems, the plane's transponder failed, stopping the altitude reporting function and forcing the controllers to revert to primary radar to track the plane.

The 767 was one of the first airliners to include an electronic flight instrument system, which operated on the electricity generated by the aircraft's jet engines. With both engines stopped, the system went dead, and most screens went blank, leaving only a few basic battery-powered emergency flight instruments. While these provided sufficient information to land the aircraft, the backup instruments did not include a vertical speed indicator that could be used to determine how far the aircraft could glide.

On the Boeing 767, the control surfaces are so large that the pilots cannot move them with muscle power alone. Instead, hydraulic systems are used to multiply the forces applied by the pilots. Since the engines supply power for the hydraulic systems, in the case of a complete power outage, the aircraft was designed with a ram air turbine that swings out from a compartment and drives a hydraulic pump to supply power to hydraulic systems.

In line with their planned diversion to Winnipeg, the pilots had been descending through 35,000 feet (10,700 m)[11] when the second engine shut down. They had searched their emergency checklist for the section on flying the aircraft with both engines out, only to find that no such section existed.[13] Captain Pearson was an experienced glider pilot, so he was familiar with flying techniques rarely used in commercial flight. Pearson needed to fly the 767 at the optimum glide speed to have the maximum range and, therefore, the largest choice of possible landing sites. Making his best guess as to this speed for the 767, he flew the aircraft at 220 knots (410 km/h; 250 mph). First Officer Quintal began to calculate whether they could reach Winnipeg. Quintal used the altitude from one of the mechanical backup instruments, while the distance travelled was supplied by the air traffic controllers in Winnipeg, measured by the aircraft's radar echo observed at Winnipeg. In 10 nautical miles (19 km; 12 mi), the aircraft lost 5,000 feet (1,500 m), giving a glide ratio of roughly 12:1 (dedicated glider planes reach ratios of 50:1 to 70:1).[15]

At this point, Quintal proposed landing at the former RCAF Station Gimli, a closed air force base where he had once served as a pilot for the Royal Canadian Air Force. Unbeknownst to Quintal or the air traffic controller, a part of the facility had been converted to a race track complex, now known as Gimli Motorsports Park.[16] It included a road-race course, a go-kart track, and a dragstrip. A Canadian Automobile Sport Clubs-sanctioned sports-car race hosted by the Winnipeg Sports Car Club was underway at the time of the incident. The area around the decommissioned runway was full of cars and campers. Part of the decommissioned runway was being used to stage the race.[17]

Without main power, the pilots used a gravity drop to lower the landing gear and lock it into place. The main gear locked into position, but the nose wheel did not. The failure of the nose wheel to lock fortuitously turned out to be advantageous after touchdown. As the aircraft slowed on approach to landing, the reduced power generated by the ram air turbine rendered the aircraft increasingly difficult to control.[18]

As the plane approached the runway, the pilots realized it was coming in too high and fast, increasing the likelihood that the 767 would run off the runway. The lack of hydraulic pressure prevented flap/slat extension that would have, under normal conditions, reduced the aircraft's stall speed and increased the lift coefficient of the wings, to slow the airliner for a safe landing. The pilots briefly considered a 360° turn to reduce speed and altitude, but they decided they did not have enough altitude for the manoeuvre. Pearson decided to execute a forward slip to increase drag and reduce altitude. This manoeuvre, performed by "crossing the controls" (applying the rudder in one direction and ailerons in the other direction), is commonly used in gliders and light aircraft to descend more quickly without increasing forward speed; it is rarely used in large jet airliners outside of rare circumstances like those of this flight.[18] The forward slip disrupted airflow past the ram air turbine, which decreased the hydraulic power available; the pilots were surprised to find the aircraft slow to respond when straightening after the forward slip.

With both engines dead, the plane made hardly any noise during its approach. This gave people on the ground no warning of the impromptu landing and little time to flee. As the gliding plane closed in on the decommissioned runway, the pilots noticed two boys were riding bicycles within 1,000 feet (300 m) of the projected point of impact. Captain Pearson later said that the boys were so close that he could see the sheer terror on their faces as they realized a large aircraft was bearing down on them.[18]

Two factors helped avert disaster; the failure of the front landing gear to lock into position during the gravity drop and a guardrail installed along the centre of the repurposed runway to facilitate its use as a drag race track. Pearson braked hard as soon as the wheels touched down on the runway, skidding and promptly blowing out two of the aircraft's tires. The unlocked nose wheel collapsed and was forced back into its well, causing the aircraft's nose to slam into, bounce off, and then scrape along the ground. This additional friction helped to slow the airplane and kept it from crashing into the crowds surrounding the runway. Pearson applied extra right brake, which caused the main landing gear to straddle the guardrail. Air Canada Flight 143 came to a final stop on the ground 17 minutes after running out of fuel.[18]

No serious injuries occurred among the 61 passengers or the people on the ground. As the aircraft's nose had collapsed onto the ground, its tail was elevated, so some minor injuries occurred when passengers exited the aircraft via the rear slides, which were not sufficiently long to accommodate the increased height. Racers and course workers with portable fire extinguishers extinguished a minor fire in the nose area.[19]

The amount of fuel in the tanks of a Boeing 767 is computed by the FQIS and displayed in the cockpit. The FQIS on the aircraft was a dual-processor channel, each independently calculating the fuel load and cross-checking with the other. In the event of one failing, the other could still operate alone, but in that case, the indicated quantity was required to be cross-checked against a floatstick measurement before departure. If both channels fail, no fuel display was seen in the cockpit, and the aircraft would be considered unserviceable and not authorized to fly.

Because inconsistencies had been found with the FQIS in other 767s, Boeing issued a service bulletin for the routine checking of this system. An engineer in Edmonton duly did so when the aircraft arrived from Toronto following a trouble-free flight the day before the incident. While conducting this check, the FQIS failed, and the cockpit fuel gauges went blank. The engineer had encountered the same problem earlier in the month when this same aircraft had arrived from Toronto with an FQIS fault. He found then that disabling the second channel by pulling the circuit breaker in the cockpit restored the fuel gauges to working order, albeit with only the single FQIS channel operative. Without any spares, he repeated this temporary fix by pulling and tagging the circuit breaker.

A record of all actions and findings was made in the maintenance log, including the entry: "SERVICE CHK – FOUND FUEL QTY IND BLANK – FUEL QTY #2 C/B PULLED & TAGGED...".[20] This reports that the fuel gauges were blank and that the second FQIS channel was disabled, but does not make clear that the latter fixed the former.

The aircraft flew from Edmonton to Montreal on the day of the incident. Before departure, the engineer informed the pilot of the problem and confirmed that the tanks must be verified with a floatstick. In a misunderstanding, the pilot believed the aircraft had been flown with the fault from Toronto the previous afternoon. The flight to Montreal proceeded uneventfully, with fuel gauges operating correctly on the single channel.

On arrival in Montreal, the crew changed for the return flight to Edmonton. The outgoing pilot informed Captain Pearson and First Officer Quintal of the problem with the FQIS and passed along his mistaken belief that the aircraft had flown the previous day with this problem. In a further misunderstanding, Captain Pearson believed he was also being told that the FQIS had been completely unserviceable since then.

While the aircraft was being prepared to return to Edmonton, a maintenance worker decided to investigate the problem with the faulty FQIS. To test the system, he re-enabled the second channel, at which point the fuel gauges in the cockpit went blank. However, before he could disable the second channel again, he was called away to perform a floatstick measurement of fuel remaining in the tanks, leaving the circuit breaker tagged (which masked the fact that it was no longer pulled). The FQIS was now completely unserviceable, and the fuel gauges were blank.

On entering the cockpit, Captain Pearson saw what he was expecting to see - blank fuel gauges and a tagged circuit breaker. Pearson consulted the master minimum equipment list (MMEL), which indicated that the aircraft was not legal to fly with blank fuel gauges. Still, due to a misunderstanding, Pearson believed it was safe to fly if the amount of fuel was confirmed with measuring sticks.[21]

The 767 was still a very new aircraft, having flown its maiden flight in September 1981. C-GAUN was the 47th Boeing 767 off the production line and had been delivered to Air Canada less than four months previously.[22] In that time, 55 changes had been made to the MMEL, and some pages were blank pending development of procedures.

Because of this unreliability, maintenance personnel authorizing flights had become standard practice. To add to his misconceptions about the aircraft's flying condition since the previous day, reinforced by what he saw in the cockpit, Pearson now had a signed-off maintenance log, which had become customarily preferred over the MMEL.

In older aircraft with a three-person crew, the flight engineer kept a fuel log and supervised the fueling. The Boeing 767 belonged to a new generation of aircraft that flew with only a pilot and co-pilot, but Air Canada had not clearly assigned responsibility for supervising the fueling.[9]^: 64–65 On the day of the accident, two technicians and two pilots worked on the calculation in Montreal. One technician stopped after he found that he was not making any progress. Another technician was using a piece of paper in his pocket, and he stopped when he ran out of space. First Officer Quintal did the calculation by hand, and Captain Pearson checked the arithmetic with his Jeppesen slide rule.[9]^: 40–41

Since the FQIS was not working, Captain Pearson decided to take on enough fuel to reach Edmonton without refueling at Ottawa.[9]^: 26 The flight plan showed that 22,300 kilograms (49,200 lb) of fuel were required for the flight from Montreal to Ottawa to Edmonton. A dripstick check found that 7,682 litres (1,690 imp gal; 2,029 US gal) of fuel was already in the tanks. To calculate how much fuel the airplane had to take on, he needed to convert the 7,682 litres of fuel already in the tanks to their equivalent mass in kilograms, subtract that figure from the 22,300 kg total fuel that would be needed, and convert that result back into its equivalent volume.[9]^: 41 The density in metric units was 0.803 kg/L, so the correct calculation would have been:

7,682 L × 0.803 kg/L = 6,169 kg = mass of fuel already on board

22,300 kg − 6,169 kg = 16,131 kg = mass of additional fuel required, or

16,131 kg ÷ (0.803 kg/L) = 20,088 L = volume of additional fuel required

At the time of the incident, Canada's aviation sector was converting from Imperial to metric units. As part of this process, the new 767s acquired by Air Canada were the first to be calibrated for metric units.[9]^: 63–64 The fueler reported that the density of jet fuel at the time was 1.77, which was in lb/L, since other Air Canada aircraft used lb. Pearson and Quintal both used the density of jet fuel in lb/L without converting to kg/L:[9]^: 40–41

7,682 L × 1.77 lb/L = 13,597 lb = misinterpreted as kilograms of fuel already on board

22,300 kg − 13,597 kg = 8,703 kg = incorrect mass of additional fuel required

8,703 kg ÷ (1.77 lb/L) = 4,917 L·kg/lb = misinterpreted as litres of additional fuel required

Instead of taking on the 20,088 L of additional fuel that they required, they took on only 4,917 L. The use of the incorrect conversion factor led to a total fuel load of only 22,300 lb (10,100 kg) rather than the 49,170 lb (22,300 kg) that were needed. This was less than half of the amount required to reach their destination.[23]

The flight management computer (FMC) measures fuel consumption, allowing the crew to keep track of fuel burned as the flight progresses. It is normally updated automatically by the FQIS, but the fuel quantity can also be entered manually. Because the FMC would reset during the stopover in Ottawa, the captain had the fuel tanks measured again with the dripstick. With 11,430 litres of fuel in the tanks, the fueler gave a density of 1.78. Repeating the same error, Captain Pearson determined that he had 20,400 kg (45,000 lb) of fuel and entered this number into the FMC. However, he actually had just 9,250 kg (20,400 lb) of fuel.[9]^: 42–43

The previous flight from Edmonton to Montreal had avoided the error. The fueler at Edmonton knew the density of jet fuel in kg/L, and he calculated the correct number of litres to pump into the tanks. He testified that it was a "regular practice of his" to do such calculations. When fueling was complete, Captains Weir and Johnson checked the figures. The captain knew "from previous experience" the density of jet fuel in kg/L. He also had a working FQIS, which agreed with his calculations.[9]^: 43–44