Air Safety

An official investigation was called by Transport Canada. Its findings brought several deficiencies in the airline and system manufacturing industry to light.

The Flight

To give you a brief background, the 767 aircraft was to operate from Montreal to Edmonton on 24 July 1983. The aircraft was refuelled in Montreal to have sufficient fuel on board to reach Edmonton; with station stop in Ottawa. Approximately one hour out of Ottawa, or 80 miles from Winnipeg Airport, one engine then the other began to fail at an altitude of 41,000 feet. A restart of the engines was not attempted, as fuel tank booster pumps did not provide fuel pressure. The APU was started but only ran for 40 seconds. Aircraft flight controls kept working fine, thanks to a Ram Air Turbine driven hydraulic pumps and the aircraft battery provided power for the standby horizon and VHF radios. The flight controls felt almost normal, the Captain stated. Cabin pressure was slowly leaking off, but not fast enough for the oxygen masks to deploy. This indicates that the 767 is a real tight ship. The Captain and his First Officer intended to land at Winnipeg. As the aircraft descended, it became clear to them however, that they would not be able to reach Winnipeg Airport, hence they began looking for alternatives.

The Captain navigated the aircraft through a layer of clouds with the help of the standby magnetic compass, the standby horizon, air speed indicator and the altimeter. The 767 has a ‘glass cockpit’ and all other indications were lost due to the electrical power failure. At about 9,000 feet, the First Officer discovered that the cabin pressure had become equal to the outside pressure and was now able to use the cabin pressure rate of descent indicator to calculate a descent profile. To this point, the biggest problem for the crew had been the lack of aircraft vertical speed indication. The cabin crew prepared the passengers for an emergency landing. No one in the cabin was aware of the engine failures. This helped to keep the passengers calm. There was no panic. The cabin noise level was not much different than during a normal descent.

In the meantime, ATC could not offer any alternative landing fields, other than a former air force training base with little information to give to the flight in trouble. The First Officer once trained there and remembered the location. The distance to this base seemed to fit the calculated descent profile. Without hesitation, the Captain went for it. The airport had no tower or emergency services.

They soon were able to spot a runway in the now weakening daylight. They flew an almost normal approach profile. On short final the Captain felt he was somewhat high on the approach and adjusted the descent by flying a side slip manoeuvre and reduced the altitude by approximately 300 feet. The gear was lowered in the normal fashion, which resulted in the nose gear not extending properly. (Should have used alternate procedure. )

A perfect touchdown was made in the runway touchdown zone. The nose gear did not hold up and the nose lowered itself onto the runway. In the distance, the Captain saw some activity on the runway people and cars. He applied full braking and the aircraft slowed down well. The aircraft came to a halt approximately 150 feet from a gathering of people. An evacuation was initiated and passengers and crew evacuated. Due to the nose down attitude of the aircraft, problems sliding down the chute were experienced. At the front doors, the angle of the slide was shallow, but at the rear doors, they were very steep. Other than an elderly lady, who went backwards down the slide, there were no serious injuries to anyone.

Smoke was filling the cockpit and forward cabin. It originated in the electronic compartment area. The contact with the fuselage skin to concrete during the landing rollout created friction and heat. The aircraft skin was worn down. Smoke from scorched paint rose inside the aircraft and gave the impression that the aircraft was on fire. The Captain realised that this airport had no Fire Rescue Services. He also noticed that the runway he landed the aircraft on was a closed runway used for drag racing. A racing car driver offered the Captain a fire extinguisher and he used it. No fire developed.

The aircraft is next to a small town called Gimli. A serviceable runway is actually located parallel to the closed runway. But it was not visible to the flight crew, due to the darker colour of its pavement.

The town’s Fire Department came out to assist the passengers and crew. Passengers soon realised that this was not Winnipeg. Nevertheless, they were satisfied with the crew and applauded their skills.

The Problem

So, all ended well; but why did this aircraft run out of fuel? Let me go through the main events that led to this situation.

Event 1

Approximately a month before the incident, the fuel quantity indication system operated intermittently. The problem disappeared after the Fuel Quantity Processor was reseated in its rack. This processor converts volumetric fuel quantity signals from the tanks to a digital fuel quantity indication in the cockpit (in kilograms). It consists of two channels, both identical, but one of them is a back-up channel that will automatically take over should a fault occur in the first one. ‘·

Event 2 . .

The day before the incident, the unit failed to qjsplay fuel quantity again in Edmonton. An avionics technician found a faulty channel in the fuel quantity processor and further noticed that the switch-over from the faulty channel to the serviceable channel only took place when the circuit breaker for the faulty channel was deactivated. There were no spare units available. It was legal to dispatch the aircraft in this condition, provided the fuel in tanks was physically measured with dip sticks and that one channel of the processor was serviceable. The aircraft was dispatched with the faulty channel deactivated by the circuit breaker.

Event 3

The same day, the aircraft was dispatched from Montreal with still the same unit installed, only now another avionics technician dispatched the aircraft with both circuit breakers set, resulting in no fuel quantity indication available in the cockpit. The circuit breaker was left set by the technician, after performing some extra troubleshooting.

Event 4

When the flight crew arrived in the cockpit to take the aircraft to Edmonton, they had a conversation with the Avionics Technician. The Captain understood that special permission for dispatch of the aircraft had been obtained from Engineering. The aircraft did not meet the Minimum Equipment List requirements, and there was no indication of the quantity of cockpit fuel. This was a misunderstanding.

Events 5

The technician in Montreal correctly determined the amount of fuel in the tanks (litres). For dispatch of the aircraft, this amount of fuel needed to be converted to kilos. The technician and flight crew used a conversion factor that was used by all companies in Canada, to convert litres to pounds (1. 78). This factor is supplied at all airports by the fuel companies as a standard procedure. The 767 at that time was the only aircraft having metric indications. Using this multiplication for the 767 (metric, the resulting figure needed to be divided by 2. 2, to obtain kilos. This was not done.

The procedure used in Montreal was repeated in Ottawa. There, the fuel plan called for 19,600kg of total fuel weight. Fuel measure in tanks with sticks/tables was correctly established to be 11,430 litres by the technician in Ottawa.

The flight crew who converted the litres to kilos arrived at ‘20,345kg’ by multiplying 11,430 litres with 1. 78. A further step of dividing by 2. 2 was again omitted. Another way to convert litres to kilos would have been to multiply by the specific gravity of fuel, namely 0. 8. At departure time the actual amount of fuel in tanks was only 9,144 kg not 20,345kg. About 10,456kg short.

Interviews after the incident indicated that neither the ground crews nor the flight crew were sure of the conversion procedures. Nor did company manuals provide easy to find guidance.

Event 6

Event 6 took place somewhere in South Dakota and represents the beginning of the previously mentioned chain of events. This event will not qualify to be named ‘ The Probable Cause’, but nevertheless, if it had not occurred, this chain would not have had a beginning. The official investigation into the failure of the Fuel Quantity Processor revealed that during production of a circuit board at an electronics company on South Dakota, one of the wires to an inductor coil had not been properly joined. This coil was mounted on a circuit board which was part of the power supply and channel cross monitoring circuits in the faulty channel. The wires had a cold solder joint and were not properly intertwined. Initially, electrical contact was there, but in San Francisco the weak connection showed up as an intermittent indication failure in the cockpit and later in Edmonton, the wires completely separated.

Epilogue

These events as they occurred, were created entirely by humans and could have been stopped by humans; including the circuit board failure. It failed because quality control by humans failed at several levels.

All events I have described show a trace of human complacency. There is a saying: “When not sure, stop and ask. ” The chain of complacency was stopped when the engines began to fail. From there on, these two pilots did a super job and used their superior skills to land the aircraft safely.