Air Canada Flight 143 — The Gimli Glider and the Unit Conversion Nobody Checked

The Gimli Glider is aviation’s most famous arithmetic error. On 23 July 1983, a brand-new Boeing 767 — Air Canada’s flagship aircraft — ran out of fuel at 41,000 feet over the Canadian prairies because its fuel load had been calculated in pounds when the calculation required kilograms. The actual fuel aboard was approximately half the required quantity.

The aircraft became the world’s heaviest glider over Manitoba. Its engines flamed out in sequence. Its crew — including a captain who was a licensed glider pilot in his leisure time — improvised a dead-stick approach to a former air force base at Gimli that was serving as a car racing track on that particular Saturday afternoon. Everyone survived.

What makes this accident remarkable is not the error itself — though it is extraordinary — but the fact that it required the simultaneous failure of at least four independent verification processes, each of which should have caught the discrepancy before the aircraft departed. The system had been designed with redundancy. Every layer of that redundancy failed together.

The Gimli Glider is not a story about one person making one mistake. It is a story about a verification system in which every check shared the same incorrect assumption — and therefore every check produced the same wrong answer.

Date	23 July 1983
Flight	AC 143
Aircraft	Boeing 767-233
Operator	Air Canada
Fatalities	0 — all 69 on board survived
Category	Fuel Calculation Error / Maintenance / Human Factors / Metric Conversion
Location	Gimli Industrial Park Airport, Manitoba, Canada

The Event

767 introduced to Air Canada service; Canada is transitioning from imperial to metric units
The aircraft’s fuel quantity indicating system (FQIS) is unserviceable — fuel must be calculated manually using a drip stick
Ground crew calculate the fuel density using the value for pounds per litre (1.77) rather than kilograms per litre (0.803)
The aircraft is loaded with 22,300 pounds of fuel — it requires 22,300 kilograms
The captain, first officer, and dispatcher all review and accept the fuel calculation
At FL410 over Red Lake, Ontario, both engines flame out from fuel exhaustion
The crew execute an emergency unpowered descent toward Winnipeg — then reassess
Captain Pearson diverts to Gimli, a former RCAF base now used as a motor racing circuit
The aircraft executes a sideslip approach to manage excess speed on final
The aircraft touches down on the drag strip; two front wheels collapse; car racing is briefly interrupted; all 69 survive

Captain Robert Pearson’s glider pilot licence proved directly relevant — his familiarity with unpowered approaches and the sideslip technique as a speed-management tool was not standard airline training.

Systems Engineering Perspective

From a systems engineering perspective, the Gimli Glider exposes a specific and dangerous failure mode in verification systems: the same-source-of-error problem. When multiple checks all draw on the same underlying data, assumption, or procedure, a systematic error in that common source invalidates all checks simultaneously. The redundancy is apparent but not real.

A verification system in which every check uses the same source data has exactly the same reliability as a single check. It provides the appearance of redundancy without its substance.

The Metric Transition — An Unmanaged Change

Canada was in the process of converting from imperial to metric units in 1983. Air Canada’s 767 was among the first aircraft in the fleet to use metric units — kilograms — for fuel measurement. Previous aircraft had used pounds. The conversion was operationally real but not accompanied by adequate training, documentation, or verification procedures specifically designed for the change.

The drip stick fuel measurement process required a calculation using the specific gravity of jet fuel to convert a volume measurement to a mass measurement. The correct conversion factor for kilograms was 0.803 kg/litre. The factor routinely used for pounds was 1.77 lb/litre. The ground crew used the pound factor. No step in the process required them to verify which unit system they were applying.

An operationally significant change to units of measurement — particularly one affecting safety-critical calculations — requires explicit procedural redesign, not just the assumption that trained staff will adapt.

Four Checks, One Error

The fuel calculation error passed through at minimum four independent verification points: the initial calculation by the ground fuelling supervisor, a check by the first officer, a review by the captain, and a check by the dispatcher. All four accepted the same figures.

This happened because all four checks were performed using the same understanding of the conversion factor. The error was not detectable by any of them because the error was in their shared knowledge, not in their individual procedures. When the systematic error is at the level of a shared assumption, no number of checks based on that assumption will detect it.

Independence in verification requires independence of knowledge and method, not just independence of personnel. Four checks sharing one incorrect assumption is one check.

FQIS Unserviceable — The MEL and the Manual Alternative

The 767’s fuel quantity indicating system was deferred as an MEL item — legally permitted under the minimum equipment list. The MEL required manual fuel measurement using the drip stick. This manual process introduced a calculation step that had never previously been required in Air Canada operations and for which the transition to metric units had not been explicitly procedurised.

The MEL procedure created the vulnerability. The unmanaged unit conversion populated it with an error.

Human Factors Perspective

The human factors analysis of the Gimli Glider centres on confirmation bias — the tendency to accept information that is consistent with expectations, without subjecting it to deeper scrutiny — and on the challenge of skill transfer between systems that appear similar but have a critical difference.

Confirmation Bias in Multi-Party Verification

The calculated fuel figure was internally consistent. It was consistent with what an experienced crew might expect for the route. It was consistent with what the ground crew expected to load. No one had an independent source of information that would have given them reason to question it.

Confirmation bias operates most powerfully when an incorrect answer falls within the range of plausible answers. A calculation that produced a fuel load of zero, or one that was ten times the correct value, would have been immediately questioned. A calculation that produced a figure in the plausible range — achieved by applying the wrong unit but still generating a reasonable-looking number — passed without challenge.

Confirmation bias is most dangerous when the incorrect answer is plausible. The Gimli fuel load looked right. It was catastrophically wrong.

The Transfer of a Practised Skill to a Changed Context

Every person in the verification chain was experienced and competent in fuel calculations. They had performed this calculation many times — but in pounds, not kilograms. The conversion factor was so deeply practised that it was applied automatically, without conscious attention to whether it was appropriate for the new unit system.

This is the skill transfer failure: applying a well-practised procedure to a context where it does not belong, without the cognitive step of verifying that the context has not changed. The metric transition changed the context. The practised habit did not adapt.

The Glider Pilot Captain

Captain Pearson’s leisure-time qualification as a glider pilot directly contributed to the survival of all 69 people. His familiarity with unpowered approaches, energy management, and the sideslip technique — which functions as a speed brake by introducing aerodynamic drag — was not part of any airline training programme. It was personal knowledge that proved, in the most direct way possible, that diverse skill sets in a crew create resilience in novel emergencies.

The sideslip that saved 69 lives was not in the airline training manual. It was in the captain’s personal knowledge from a separate aviation discipline. Diverse expertise creates safety margins that procedures cannot.

System Interaction Breakdown

1. Systematic Error in Shared Assumption

The unit conversion error was a systematic error embedded in the shared knowledge of everyone in the verification chain. No independent reference existed to challenge the shared assumption. The result was a verification system with apparent redundancy and actual single-point failure.

2. MEL Creating Novel Procedure Without Novel Training

The MEL deferral of the FQIS created a situation requiring a manual calculation that had not previously been part of the normal operational process. The training for this procedure — including the critical unit conversion step — had not been redesigned for the metric environment.

3. Fuel Onboard Consistent With Plausible Range

The incorrect fuel load fell within the plausible range for the flight. No alarm condition existed. No system threshold was breached. The error was invisible to every technical and procedural safeguard because no safeguard was calibrated to detect a systematic unit conversion error producing a plausible-looking result.

A safety system cannot detect what it is not designed to detect. Unit conversion errors in safety-critical calculations require independent, methodologically separate verification — not just additional personnel using the same method.

Significance in Aviation Risk

1. Dual-Method Verification for Safety-Critical Calculations

Fuel loading calculations now require verification by independent methods — not just by independent personnel using the same method. The ‘same source of error’ vulnerability is addressed by requiring that at least one verification uses a different computational approach.

2. Metric Transition Procedural Design

The Gimli Glider established that unit system transitions in safety-critical operational parameters require complete procedural redesign — not just awareness training — including explicit statement of the unit in every step of the calculation.

3. MEL Procedure Completeness

MEL alternate procedures for critical system deferrals must be complete, tested, and specifically designed for the operational context in which they will be used — including unit systems, personnel training, and verification requirements.

Closing Perspective

The Gimli Glider is a case study in the gap between apparent redundancy and actual redundancy. Four checks reviewed the fuel calculation. Four checks drew on the same incorrect assumption. The verification architecture provided the appearance of independent confirmation while providing none of its safety value.

The accident survived — remarkably, completely — because a glider pilot happened to be flying the aircraft, and because a former air force base with an available runway existed within glide range. These were not engineered safety margins. They were luck.

The systemic lesson is that verification systems must be designed around the independence of method, not just the independence of personnel. A second person checking a first person’s arithmetic using the same formula is not a safety check — it is social confirmation. Real verification requires a different method, a different source, or a different foundation.

The Gimli Glider is the definitive demonstration that redundancy without independence is not safety — it is the multiplication of a single point of failure.