July 23, 1983. Air Canada Flight 143, a Boeing 767 four months old, climbs out of Ottawa bound for Edmonton. At 41,000 feet over the Manitoba lakes, both engines quit within minutes of each other — not from mechanical failure, but from fuel starvation.
The aircraft was carrying exactly what the paperwork said: 22,300. The paperwork said kilograms. The tanks held pounds.
Sixty-nine people were now riding the largest glider ever flown, with seventeen minutes to find somewhere to put it down. The place they found was a decommissioned air base that had been turned into a drag-racing strip, packed with families on a summer afternoon.
Most unit-conversion disasters are easy to summarize. Mars Climate Orbiter: pounds-force where newtons were expected. Korean Air 6316: meters read as feet. The Gimli Glider is different, and it is different in a way that makes it the purest unit error of them all.
Nobody mistranslated anything. The arithmetic was checked twice and came out clean. The aircraft left the ground with a number on the fuel slip that matched the flight plan exactly — 22,300. The disaster was that the plan wanted 22,300 kilograms, and the slip meant 22,300 pounds. The number was identical. Only the unit was wrong, and a unit is not a small thing. It is the whole meaning of the number.
This is the accident that turns the abstract phrase "metric conversion" into a physical event. To understand what happened you have to understand three things: the coincidence that hid the error, the density number that carried it, and the country-sized transition that made the whole fleet unsafe.
The 22,300 Coincidence That Hid the Error
Here is the detail that turns this from a routine fuel miscalculation into something almost elegant: The flight plan for the Montreal–Ottawa–Edmonton run required 22,300 kilograms of fuel. Because of the conversion error, the aircraft was loaded with 22,300 pounds.
When the captain and first officer cross-checked the arithmetic on the ground, the figure on their scratchpad matched the target perfectly. The number was right. The unit was wrong. And because the number looked right, no alarm went off.
That coincidence is why the error survived two independent checks by the flight crew, and why it survived a second fuel measurement at the Ottawa stopover. A number that agrees with the plan is the most dangerous kind of error there is — it does not announce itself.
The scale of that damage snaps into focus when you convert it:
- $1\text{ kg} \approx 2.2046\text{ lb}$
- $22,300\text{ kg} \approx 49,160\text{ lb}$
- Tanks actually held: $22,300\text{ lb} \approx 10,100\text{ kg}$
The aircraft departed carrying less than half the fuel required to reach Edmonton.
A Metric Aircraft in an Imperial Fleet
The real cause of the Gimli Glider was not one careless person. It was a country in the middle of switching measurement systems, and an airline that had put a metric aircraft into a fleet that was still thinking in pounds.
In the early 1980s Canada was several years into a politically fraught conversion to metric:
- Weather: Celsius in 1975
- Road signs: Kilometres in 1977
- Petrol pumps: Litres in 1979
Aviation was caught in the gap. Fuel was sold by suppliers in metric litres. But nearly every aircraft Air Canada flew — the DC-9s, the 727s, the 747s, the L-1011s — measured fuel weight in imperial pounds.
The new Boeing 767s were the exception. They were the first aircraft in the fleet calibrated entirely for metric: computers, gauges, load sheets, and manuals all required fuel in kilograms. Air Canada had introduced a metric machine into a non-metric operation without retraining the people who fed it numbers.
Compounding it was a structural change: the 767 eliminated the flight engineer. Historically, the flight engineer was the person who monitored systems and ran fuel-burn numbers. When the role disappeared, Air Canada never clearly reassigned those fuel-checking duties to the remaining two pilots.
0.803 and 1.77: The Same Fuel in Two Numbers
The error lived inside a single conversion factor: the density of jet fuel.
The tanks were measured with mechanical dripsticks and read 7,682 litres. Jet fuel density varies with temperature; on that afternoon the correct figure was 0.803 kg/L.
The Correct Calculation:
- $7,682\text{ L} \times 0.803\text{ kg/L} = 6,169\text{ kg}$ on board
- $22,300\text{ kg} - 6,169\text{ kg} = 16,131\text{ kg}$ to add
- $16,131\text{ kg} \div 0.803\text{ kg/L} = \mathbf{20,088\text{ litres}}$ to load
What Actually Happened:
The ground crew used 1.77 pounds per litre (the imperial specific weight standard for the rest of the fleet):
- $7,682\text{ L} \times 1.77 = 13,597\text{ "kg" (actually pounds)}$
- $22,300\text{ kg} - 13,597 = 8,703\text{ to add}$
- $8,703 \div 1.77 = \mathbf{4,917\text{ litres}}$ loaded
Instead of taking on 20,088 litres, the aircraft took on 4,917. The density number 1.77 was not wrong — it was simply imperial. Skipping the unit carried a silent factor of 2.2 through the entire system.
Why the Gauges Were Blank: The FQIS Failure
The 767's Fuel Quantity Indication System (FQIS) was a dual-channel processor. On aircraft C-GAUN, it had been malfunctioning.
A technician previously found that pulling the circuit breaker on faulty Channel 2 allowed Channel 1 to take over and restore the gauges. Later, in Montreal, another technician pushed the breaker back in for a self-test, got distracted by the refuelling truck, and forgot to pull it back out. Both fuel gauges went completely blank.
The aircraft was dispatched under a Minimum Equipment List (MEL) provision allowing manual dripstick measurements before departure. The one automated instrument designed to alert the crew was dark, and the manual procedure substituted in its place introduced the unit error.
41,000 Feet: The Dead-Stick Landing
Shortly after 8:00 p.m. at 41,000 feet, both engines flamed out. Generator power died, glass displays went dark, and the 132-ton airliner became a massive glider.
A ram-air turbine (RAT) deployed from the belly to power basic hydraulics. First Officer Maurice Quintal remembered an abandoned RCAF base at Gimli, Manitoba.
What they didn't know: Gimli had become a drag strip, hosting a motorsport event packed with families.
Coming in too high and fast, Captain Robert Pearson — an experienced glider pilot — executed a forward slip (crossing controls with opposite rudder and aileron to fly sideways through the air, steepening descent without gaining airspeed). No commercial airliner had ever attempted this manoeuvre.
The 767 crossed the threshold, touched down, collapsed its nose gear, and slid to a halt. All 69 people survived.
What Software & Systems Engineers Should Take Away
This failure belongs to every engineer who has ever consumed an untyped variable or trusted raw arithmetic.
-
A number and its unit are a single type. Correct arithmetic on the wrong unit is still complete failure. Never pass raw floats or integers across module or service boundaries without explicit units (
fuel_kgvsfuel_lb, or strongly typed wrappers). - Coincidences hide catastrophic states. A value matching an expected target is the hardest bug to detect because sanity checks pass silently.
- Transitions breed downtime and failure. Systemic migrations (metric vs. imperial, monolith to microservices, schema changes) create boundary mismatches. If humans or machines must bridge two incompatible conventions, the bridge must explicitly validate input types.
