The Event
On 23 July 1983, Air Canada Flight 143, a Boeing 767, departed Montreal for Edmonton.
Mid-flight, at cruising altitude, both engines shut down.
The aircraft became a glider at 41,000 feet.
There was no structural failure.
No fire.
No explosion.
Just a sudden loss of thrust in a fully functioning aircraft.
What Happened (Surface Explanation)
The aircraft ran out of fuel.
But not because fuel was unavailable.
Because fuel quantity had been miscalculated during metric conversion.
A chain of measurement assumptions led to:
- Incorrect fuel loading
- Incorrect fuel gauge interpretation
- Incorrect operational validation
The aircraft departed with far less fuel than required.
The System’s Perspective
From the aircraft’s point of view:
- Fuel quantity = valid input data
- Fuel gauges = consistent with expected readings
- Flight plan = fully executable
Nothing indicated a problem at departure.
The system did not “know” it was under-fuelled.
It only knew what it was told.
Where the Situation Became Dangerous
This was not a mechanical failure.
It was a system-of-systems translation error.
1. Unit conversion breakdown
- Fuel was partially calculated in pounds and kilograms
- Conversion was incorrectly applied or omitted
2. Validation gap
- No independent system verified fuel sufficiency
- Assumptions were treated as confirmed data
3. Silent propagation
- Error entered at ground level
- Propagated into flight planning without correction
The system carried forward an incorrect state as if it were correct.
Why the Crew Didn’t Detect It Earlier
From the cockpit:
- Fuel readings appeared normal relative to expectations
- No alert indicated critical discrepancy
- The error existed outside the operational feedback loop
The system did not expose its own inconsistency.
It behaved consistently — just with the wrong baseline.
The Critical Transition
At cruise altitude:
- Engines flamed out due to fuel starvation
- Electrical and hydraulic systems degraded rapidly
At that moment:
- The aircraft transitioned from powered flight to glide
- Crew had seconds to reframe the situation entirely
The system had shifted from:
“Managing flight”
to
“Managing descent without propulsion”
The Deeper Pattern
This was not a fuel failure.
It was a representation failure inside the system:
- Quantities were correct in isolation
- But incorrect in translation
- And never reconciled before becoming operational truth
The system did not fail at altitude.
It failed on the ground — invisibly.
What This Case Actually Shows
Air Canada 143 demonstrates that:
1. Small unit errors can propagate into total system failure
2. Validation gaps are more dangerous than calculation errors
3. Systems can operate normally on incorrect assumptions
4. Errors at the input layer become invisible at the output layer
The Core Insight
The aircraft did not suddenly lose fuel.
It was never correctly fuelled in the system’s understanding of reality.
From departure to engine shutdown:
- Everything was consistent
- Everything was “correct” according to the system
- Nothing signalled urgency until failure was complete
Final Framing
This was not a failure in flight.
It was a failure in system translation and validation:
- The aircraft departed with a hidden discrepancy
- The discrepancy was never surfaced by any subsystem
- And when the truth emerged, it did so as total engine failure
The system did not misbehave.
It confidently executed a false reality until it could no longer do so.
Related Posts
