22-27

22 FLIGHT SAFETY AUSTRALIA JULY-AUGUST 2003 COVER STORY Merran Williams O N THE WESTERN side of Manitoba’s idyllic Lake Winnipeg lies an old Royal Canadian Air Force station. As a town of just 2,000 people, Gimli is a tiny dot on the map, eclipsed by its larger neigh- bour, Winnipeg. But thanks to a 20-year- old accident, Gimli is probably the most famous landing ground in Canada. On July 23, 1983, Captain Bob Pearson and First Officer Maurice Quintal were piloting Flight 143 on a routine flight from Montreal to Edmonton, via Ottawa. The Boeing 767 was lightly loaded, with 61 passengers and five crew. Flight 143 climbed to its cruising alti- tude of 41,000 feet and the first hour of flight was straightforward for the experi- enced flight crew. However, just after 2000 local time, Pearson and Quintal were shocked to see cockpit instruments warning of low fuel pressure in the left fuel pump. At first they thought it was a fuel pump failure. Seconds later, warning lights indicated loss of pressure in the right main fuel tank. Realising the situation was becom- ing serious, Pearson quickly ordered a diversion to Winnipeg Airport, 120 miles away. It became clear they were running out of fuel. The left engine was the first to flame out. At 2021, when their altitude was 28,500 feet and they were 65 miles from Winnipeg, the right engine stopped. Flight 143 was gliding. Most of the instrument panels went blank as they had been relying on power generated by the engines, and suddenly Pearson was The 156-tonne GIMLI GLIDER It’s the 20th anniversary of aviation’s most famous deadstick landing. P H O T O : C O U R T E SY A R C H IV E S O F M A N IT O B A Grounded: Inspecting the damage after Flight 143’s unorthodox landing. FLIGHT SAFETY AUSTRALIA JULY-AUGUST 2003 23 COVER STORY flying blind. A magnetic compass, an artificial horizon, an airspeed indicator and an altimeter were the only instru- ments still working. The ram air turbine dropped from near the right wheel well and used wind power to turn a four-foot propeller, pro- viding enough hydraulic power to manipulate the ailerons, elevators and rudder. However, the pilots were unable to operate speed brakes, flaps or the undercarriage or carry out reverse thrust on landing. At 2031, realising Flight 143 did not have enough height to reach Winnipeg, the pilots called Winnipeg Air Traffic Control to request a change in heading to Gimli, a decommissioned airforce base 12 miles away. Gimli wasn’t listed in Air Canada’s manuals but, fortuitous- ly, Quintal had been stationed there when serving in the airforce. As far as anyone knew, both of its 6,800-foot run- ways would be deserted. As the aircraft descended without power, Pearson needed all his flying skills to keep it on track. He had only one chance to land – there could be no missed approach. Unfortunately the air- craft was coming in too fast and was going to overrun the runway at its cur- rent speed, as there was no way of apply- ing reverse thrust. Pearson took a gamble that the 767 would respond in the same way as a smaller aircraft and executed a sideslip by turning the yoke to the right at the same time as he jammed his foot against the left rudder pedal. The aircraft responded and descended enough to bring it in on target. The manoeuvre required exceptional piloting skills as the indicated airspeed wasn’t correct during the sideslip because the angle of the air- craft was different from its direction of travel. It came down to Pearson’s judge- ment and experience as a glider pilot. During the nerve-wracking descent, Quintal tried using a back-up system to lower and lock the landing-gear. The gear on each wing was deployed but the nosewheel stuck part way. As it turned out, the absence of a nose wheel saved lives. The pilots were shocked to see peo- ple on the runway as they descended. Unknown to Air Traffic Control, Gimli airbase had become a two-lane dragstrip. The rally spectators were startled to see a huge aircraft bearing down on them, silent except for the rushing of wind against its body. People scattered as quickly as they could, but only the fric- tion between the aircraft nose and the ground as the partly extended nosewheel collapsed, brought the aeroplane to rest in front of them. The time was 2038 hours. Just 17 min- utes had elapsed since Pearson had start- ed flying a powerless 767 from 28,500 feet to a safe landing. Pearson and Quintal became overnight celebrities and Gimli a house- hold name across the world. An accident that came so close to tragedy ended as a triumph of human ingenuity. But while the crew of Flight 143 were praised for their skill and bravery under pressure, a vital question remained. How did an aircraft as advanced as a Boeing 767, with all its cutting edge avionic technology, run out of fuel? A federal government public inquiry carried out a comprehensive investiga- tion into the accident, using reports compiled by Air Canada and the Transportation Safety Board of Canada (TSB). Pearson himself was on the wit- ness stand for five days and remembers seeing seven television cameras trained on him amid the media frenzy on the first day. The reason for the accident turned out to be all too familiar. Systemic problems with Air Canada training and proce- dures, had led to a series of uncorrected errors by ground and flight crew. The TSB’s final report, a tome of almost 200 pages, criticised Air Canada’s upper management for serious communication failures. The TSB concluded that pro- ducing manuals and procedures for per- sonnel was a “corporate responsibility” not being adequately fulfilled by Air Canada management. Aircraft too high. Speed slowed to 180 knots Pilot initiates slideslip. Left rudder pedal pushed while he turns the yoke to the right. Aircraft manoeuvred into a steep angle, Aircraft rapidly loses altitude. Aircraft straightened up at altitude 40 feet. Aircraft touches down. Aircraft comes to rest Sideslipping a 767 ILLU ST R A T IO N : P E T E R M A R K M A N N 24 FLIGHT SAFETY AUSTRALIA JULY-AUGUST 2003 The flight and cabin crews were praised for averting a major disaster through their “professionalism and skill” which helped them overcome the prob- lems caused by “corporate and equip- ment deficiencies”. The trouble started almost three weeks before the accident when the fuel quanti- ty indicating system on aircraft No. 604 (later Flight 143) was examined follow- ing a directive from Boeing. As each fuel gauge was checked, it mysteriously went blank. However, a later check found the gauges apparently working normally, so the aircraft was given clearance to fly. On the night of 22-23 July, the prob- lem resurfaced and the same mechanic, Conrad Yaremko, investigated, unaware it was the same aircraft. He discovered a malfunction in the digital fuel gauge processor but was told no replacement processors were available. The processor was a dual-channel sys- tem that provided fuel quantity meas- urement, calculation and indication, and was located under the aircraft’s floor, behind the cockpit. It was considered the “heart” of the fuel quantity indication system on the Boeing 767 and was built by Honeywell to Boeing specifications. Its benefits included an ability to operate on a second channel if one failed, and a self-testing mechanism enabling it to recognise faults within the system. These built-in redundancies did not prevent the processor from failing, how- ever. Tests performed after the accident found the failure was caused by a “cold solder” joint on the inductor between one coil wire and its terminal post. While the terminal post was pretinned and had enough solder sticking to it, the coil wire end was not pretinned and had poor adhesion. Still, the failure of one inductor coil should not have disabled the fuel gauges. Another inductor coil in the second processor should have taken over if the processor had performed according to its specifications. Investigations revealed a design error was to blame. The processor failed to switch from the defective chan- nel to a working channel because there had been a drop in the power supply. Although he couldn’t diagnose the exact problem, Yaremko found that if he disabled the faulty circuit breaker, the backup circuit breaker got the gauges working again and provided the required fuel readings. The mechanic labelled the pulled circuit breaker with yellow main- tenance tape to prevent it being turned back on. But he did not clearly record in the logbook his reasons for doing this. The 767 flew from Edmonton to Montreal via Ottawa without incident after the pilot in command satisfied him- self that it was legal to operate the air- craft under provisions of the Minimum Equipment List (MEL) despite the devia- tion reported in the fuel processor. Because of the unreliable electronic fuel monitoring system, when the air- craft reached Dorval Airport in Montreal, maintenance worker Jean Ouellet was assigned to conduct a manu- al drip check of the aircraft’s fuel levels before its dispatch to Edmonton. He was intrigued by the problem with the fuel processor and despite not having the authority or training, took it upon him- self to tinker with the electronics while waiting for the fuel truck. As he later told investigators: “I thought I would do a BITE [built-in test equipment] test on the processor, so I pushed in the breaker MONTREAL OTTAWA WINNIPEG GIMLI RED LAKE Cut short Travelling from Montreal to Edmonton via Ottowa, Flight 143 was forced to divert to Winnipeg because of a fuel shortage that led to the loss of both engines. When it became apparent the aircraft would not reach Winnipeg, the pilots changed course and headed to Gimli. “The failure of one inductor coil should not have disabled the fuel gauges.” OUT OF FUEL AT 28,500 FEET: A NIGHTMARE SCENARIO FLIGHT SAFETY AUSTRALIA JULY-AUGUST 2003 25 COVER STORY YOU’RE FLYING a Boeing 767. Both engines fail and you’re left to glide at 28,500 feet. What do you do? For Air Canada captain Bob Pearson, there was only one answer: keep flying the aircraft using all the techniques you’ve ever learnt. On July 23, 1983, Pearson and his first officer Maurice Quintal faced a nightmare scenario when a fueling mishap left them powerless on what was expected to be a routine flight from Montreal to Edmonton. Twenty years later, Pearson, now 68, is matter-of-fact about the incident that made him a household name in aviation. He notes that all pilots should know how to glide. “The pilot closes the throttle so they end up at flight idle setting rather than ground idle which is slower. At that power setting, the power coming out of the back of the engine offsets the drag of the front so it’s as if the engine isn’t there. Every pilot is actually gliding on normal descent [if the power levers are closed].” The difference with the “Gimli Glider”, as the incident came to be known, is that no one had ever successfully landed a 767 without power. Pearson’s Canadian pilot’s licence required him to demonstrate the ability to perform a deadstick landing in a single-engine aeroplane, but he and Quintal had no way of knowing whether the techniques would work in a 767. “I don’t think anyone anticipated this sort of thing happening,” Pearson says. “On a twin- engine aeroplane, you’re trained ad nauseum to fly on one and on a four-engine aeroplane you’re trained to land on two. But at Air Canada, we had no training on what to do if both engines fail.” Pearson sees this as a failing in pilot training. “Year after year, pilots attend training and learn the same stuff. My feeling is that pilots should get more of these unusual situations. If we had practised in the simulator, even once, it prob- ably would have made it easier for us.” A few months after the incident, Pearson learnt that Scandinavian Airlines had made it mandatory for pilots to perform a successful deadstick landing through the simulator before they were endorsed to operate any new type of aircraft. While Pearson is modest about the piloting skills he used to bring Flight 143 to a safe landing, his experience as a gliding and aero- batic instructor was essential when it became apparent that the aircraft was travelling too fast to land on the runway at Gimli airbase near Winnipeg. Pearson needed to lose altitude fast. The only way was to sideslip the giant aircraft on the final approach so it would touch down close enough to the beginning of the runway that it wouldn’t run out of tarmac. This manoeuvre was unprece- dented. Fortunately, it worked, and Flight 143 touched down safely. But Pearson is relieved that he wasn’t flying an Airbus. “You can’t sideslip an Airbus aircraft, the computers won’t let you,” he says. “Boeing aircraft are capable because they’re a hydraulic- controlled aircraft and you can cross control.” The Gimli accident led to a huge investigation by both the Canadian Transport Safety Board and the Federal Government Public Board of Inquiry. Air Canada’s own investigation blamed the pilots and mechanics for the accident. The official investigations cast the net wider and concluded that Air Canada’s procedures were at fault. Pearson spoke out against the Air Canada verdict at the time and says he hasn’t stopped talking to the media. “I don’t think any other employee of Air Canada has ever done that,” he laughs. “I was not afraid for my job even though I was working for them – I think they were a little bit afraid of me!” Pearson flew for Air Canada for the next 10 years, retiring at 58. He then flew for Asiana Airlines until retiring eight years ago, aged 60. The Gimli Glider incident received worldwide attention and became the subject of a best selling book and a TV movie. Pearson had a bit part in the movie, Falling from the Sky: Flight 174: you can see him holding a clipboard when the pilots come out of the simulator. However, he was unimpressed by the movie’s accuracy and was frustrated to see mistakes in aviation terminology. He preferred the book Freefall, by Marilyn and William Hoffer. Pearson now travels extensively as a public speaker, and is in high demand as an expert aviation witness in legal proceedings. in the cockpit that was deactivated.” This made the fuel gauges blank again. The fuel truck arrived and Ouellet left the aircraft without deactivating the faulty circuit breaker. As the investigation later reported, “the well-intentioned but misguided curiosity of Mr Ouellet result- ed in blank fuel gauges in the cockpit, and contributed significantly to the sub- sequent accident.” With the fuel gauges inoperative, mainte- nance workers performed a drip test and estimated that 7,682 litres of fuel remained in the tanks. The flight from Montreal to Edmonton, including a brief stop in Ottawa, required 22,300kg of fuel, an amount expressed as mass because of the importance of knowing an aircraft’s weight. The mechanics needed to work out how many litres made up 22,300kg. They could then subtract the 7,682 litres already in the tanks, and use the fuel gauge on the refuel- ing truck to tell when they had reached the right number of litres to make up 22,300kg. But the 767 was the first aircraft in Air Canada’s fleet to use metric units (kilo- grams) rather than imperial (pounds). Metric units were being phased in across Canada, and the conversions were still causing confusion. With the help of First Officer Quintal, the ground crew used the correct proce- dure to calculate the weight in kilos. P H O T O : C O U R T E SY B O B P E A R SO N Bob Pearson at the time of the Gimli accident 26 FLIGHT SAFETY AUSTRALIA JULY-AUGUST 2003 However, they had not been trained in cor- rect conversion, so the figure of 1.76 pro- vided by the refueling company on their refueling document, was taken to be the required multiplier. It was typical of the numbers seen on previous slips and they assumed that the numbers provided over the previous few months had indicated specific gravity in the new metric system. They decided to multiply 7,682 by 1.76. This would mean 13,597kg remained in the tanks, requiring an infu- sion of 8,703kg to bring the fuel level up to 22,300kg. They then divided 8,703kg by 1.76, assuming that this conversion would give them the correct volume in litres. Through this calculation, the crew determined that 4,916 litres needed to be added from the fuel truck. The problem was that 1.77 is the multiplier that con- verts litres into pounds, not kilograms: to convert litres into kilograms you need to multiply by 0.8. Flight 143 did not have 22,300kg on board, it had about 10,000kg, less than half the amount of A- 1 kerosene jet fuel needed to get the air- craft to Edmonton. The refueller didn't know where the flight was headed, so no alarm bells rang for him as he poured fuel into the tanks. Using a computer to calculate fuel also caused confusion over responsibilities. In the past, when fuel was calculated manu- ally, a flight engineer’s duties included checking the fuel load. Flight engineers were a thing of the past on this 767, as a Presidential task force, under Ronald Reagan, had determined that aircraft could be built to be operated by two pilots instead of three, if the tasks previ- ously given to the second officer (flight engineer) were either fully automated or handled by ground staff. Responsibility for ensuring adequate fuelling had passed to the maintenance branch. But Gimli slider The only injuries that came out of Flight 143’s powerless landing occurred when passengers used the emergency slides to evacuate the aircraft after it came to rest at Gimli Airbase. FLIGHT SAFETY AUSTRALIA JULY-AUGUST 2003 27 COVER STORY because these men were not trained to calculate fuel, they assumed the pilots would make sure it was done properly. The problem was neither of the pilots was trained in this technical task. Safety procedures had failed to keep pace with new technology. As the investigation later concluded: “Air Canada ... neglected to assign clearly and specifically the respon- sibility for calculating the fuel load in an abnormal situation.” The investigation attacked Air Canada’s training procedures, noting “both flight crew and maintenance per- sonnel seemed to be somewhat mes- merised by the complex, computerised characteristics of the 767. They did not appear to have sufficient background knowledge of these aspects of the air- craft. They did not appear to have received sufficient training about some of the critical aircraft systems, in particu- lar, the fueling system.” The investigation also revealed an organisational shortcoming at the Air Canada maintenance base. The crew held morning meetings at which senior techni- cal experts gathered to discuss the major maintenance issues for each aircraft in the fleet. However, the meetings took place only five mornings a week: from Monday to Friday. July 23, 1983 was a Saturday. Despite being unaware of the inade- quate fuel load, Pearson took the absence of computerised fuel monitoring seri- ously and carefully consulted the 767 minimum equipment list (MEL). The MEL stated that one main fuel tank gauge could be inoperative when the air- craft was dispatched. However, Air Canada maintenance told the pilots that it was legal to operate with both the main tank gauges unserviceable, as indicated by the master MEL (provided by Boeing) as long as a full drip was conducted on the aircraft’s fuel tanks. This was backed up by a page in the Boeing operating manual, which was removed shortly after the accident, and by prompts on the pro- gramable management computer. At no time did the pilots believe they were not operating legally. Pearson also had to consider that if he grounded too many flights, it would reflect on his professional abilities. He had to be absolutely sur