History of Flight

On July 22, 1983, an Air Canada Boeing 767, aircraft number 604 and registered as C-GAUN, underwent a routine preflight check in Edmonton, Ontario. Maintenance personnel observed that all three fuel quantity gauges on the flight deck’s overhead panel were blank and inoperative. This maintenance issue with the inoperative fuel gauges had also occurred about two weeks prior on the same aircraft.

These fuel gauges are responsible for displaying the designated fuel amount in each tank; the center auxiliary tank, left main tank, and right main tank. During this time, the center tank was not used on domestic routes in Canada.

In accordance with the MEL, Air Canada had an authorized and approved alternate solution to allow for aircraft dispatch. The alternate solution required deactivating the channel 2 processor by pulling the associated circuit breaker, resulting in channel 1 powering the gauges and providing the necessary fuel indications. The mechanic tagged the channel 2 circuit breaker with yellow tape, marking it as "inoperative." The fuel quantity gauges were also labeled with yellow tape, including the notation of see "logbook," directing the flight crew to review the alternate MEL procedure. The mechanic documented the discrepancy with the channel 2 processor in the aircraft logbook. As a result of one of the processors being inoperative, an additional MEL requirement now necessitated verifying the fuel load through use of fuel quantity measuring sticks located under the aircraft's wings.

On July 23, 1983, prior to the accident flight, the aircraft was dispatched from Edmonton to Montreal via Ottawa in adherence to standard operating procedures. During an early morning flight on the day of the accident, the aircraft was authorized for dispatch from Edmonton to Montreal via Ottawa in compliance with its MEL. The flight proceeded without incident, with all three fuel gauges functioning on fuel processor channel 1, as expected, due to the deactivated system channel 2 circuit breaker.

The aircraft underwent a crew change in Montreal and was dispatched from Montreal to Edmonton with an intermediate stop in Ottawa. In Montreal, a mechanic identified the inoperable channel 2 and reset the circuit breaker to diagnose the system. Consequently, all the fuel gauges in the flight deck displayed blank readings. The mechanic proceeded to perform a Built-in Test Equipment (BITE) test on the processor to detect any faults in the system. However, due to distractions with the fueler, he forgot to deactivate channel 2 by pulling the circuit breaker after the BITE test. Therefore, all the fuel gauges appeared blank during the subsequent flight crew change in Montreal. According to the MEL, the aircraft was required to have a minimum of two functioning fuel gauges and at least one operative channel.

Dispatching the airplane in this configuration prevented the flight management computer (FMC) from receiving fuel quantity data from the FQIS, which was a required condition in the MEL for dispatch with either a fuel quantity gauge or processor channel inoperative. The lack of fuel quantity data to the FMC prevented the FMC from comparing the FQIS fuel quantity to the FMC-calculated fuel remaining based on initial fuel load and integration of the engine fuel flow rates. This prevented the FMC from providing a "FUEL DISAGREE" indication to the flight crew, which would draw the crew's attention to the discrepancy between the calculated fuel remaining and the required mission fuel. The MEL dispatch allowances and the requirement that the FMC receive and display fuel quantity data from the FQIS were specifically intended to preclude dispatch with the FMC unable to compare FQIS fuel quantity to calculated fuel remaining.

Based on testimony given during the investigation, the captain "knew that the aircraft was not legal to go with blank fuel gauges. He testified that he had raised the question of legality with one of the attending technicians who assured him that the aircraft was legal to go and that a higher authority, Maintenance Central...had authorized the operation of the aircraft in that condition." Although it violated the MEL requirements, the captain now believed he could safely fly the aircraft, provided the fuel quantity on board the aircraft was confirmed by use of the fuel quantity measuring sticks in the wing fuel tanks.

Initially intending to refuel the aircraft in Ottawa, the captain opted to load additional fuel to fly from Montreal to Edmonton without refueling in Ottawa. This new aircraft in Air Canada’s fleet, manufactured with metric value indications, lacked procedures for any flight crew to convert fuel quantity from centimeters, read on the drip sticks to liters, and from liters to kilograms for total fuel quantity indications in the FMC. In the process of attempting to verify the fuel load through use of the fuel quantity measuring sticks, the flight crew inaccurately converted the fuel quantity to a lower than required amount. Despite not realizing this error in calculation, the flight crew departed Montreal with just half of the required fuel instead of the expected fuel load.

As a result, during the flight from Ottawa to Edmonton, the aircraft experienced complete fuel exhaustion and the flight crew was forced into an emergency landing over Red Lake, Ontario. While the flight was in cruise at 41,000 feet, the flight crew noticed first signs of fuel exhaustion due to low fuel pressure on the left engine. During the descent, the left engine, followed by the right engine, flamed out as the aircraft descended through 35,000 feet. The flight crew started but could not maintain operation of the Auxiliary Power Unit (APU), an additional electric and pneumatic generator, because its fuel source was the same as the engines. With the inability of normally extending the landing gear, speed brakes, flaps, or slats, which were needed to control their rate of descent and land, the flight crew decided to divert to the nearest operational airport which was Winnipeg. After realizing that they could not reach Winnipeg, they selected Gimli, Manitoba, a closed and decommissioned military airbase which was closer. This required executing a landing on a runway that was shorter than the recommended length for the Boeing 767.

The flight crew used a sideslip maneuver to lose altitude without gaining airspeed by pushing the right rudder and using left aileron to increase the descent rate needed for landing. Although this maneuver is not normally used in transport aircraft, it allowed them to better position the aircraft for landing on the short Gimli runway.

During the descent, the flight crew activated the alternate gear extension switch, releasing the landing gear uplocks that allowed gravity to extend the gear. However, the nose gear only partially extended, did not lock down, and collapsed upon touch down. They were able to land by applying wheel brakes, landing the aircraft 800 feet from the threshold and stopping within 2,900 feet. Although there were a few passengers with minor injuries exiting via emergency slides, no one was seriously hurt either on the ground or onboard the aircraft.

Swiss Cheese Model

The Swiss cheese model is a safety framework used in aviation to understand how accidents can happen. Imagine slices of Swiss cheese with each slice representing a layer of defense that prevents an accident from occurring. Each layer has holes, which represent potential failures that, if aligned with the holes in the other layers, can create a pathway for an accident to happen.

The idea is that no layer is perfect and every layer has holes. If multiple layers are in place, they represent the organization’s defense against risk and may, in aviation safety, prevent an accident. However, if the holes in these layers align, a clear pathway for an accident may occur. As for the case in this accident, the three aligned holes that led to this accident involved design, organizational, and human errors.

1. Design Error

The Boeing 767 included a low-fuel system warning at 2,000 pounds total fuel. That warning did not occur in this accident due to a design error that resulted in the warning system not being independent from the basic fuel quantity calculation in the FQIS.

As designed, the FQIS had two independent channels, each with its own power supply and contained in an aluminum box. If one channel failed, the processor would automatically switch to the other channel and continue to provide fuel quantity data on the flight deck gauges.

The system was designed with the intent that no single fault would cause the loss of both channels, and this was ensured by design features that included automatic channel switchover when a bad channel was detected or power loss occurred.

However, an investigation into the accident revealed a manufacturing flaw in the power supply of channel 2. This flaw resulted in a drop in current and a failure to provide fuel quantity indication in any tank from that channel and prevented switchover to the operative channel, despite the circuit breaker being closed. As a result, with no redundancy available, and a lack of fuel system isolation that would have provided a signal to the tank gauges, there was no fuel quantity indication.

Redesign

At the time of the accident, despite 14 CFR 25.903 requiring fuel system isolation as a protection for the engines, the fuel processors on the Boeing 767 were not isolated tank-to-tank since all fuel tank quantity gauges were impacted. As the switchover was attempted, due to the closed circuit breaker for channel 2, the power loss in channel 2 resulted in a blank reading and channel 1 was unavailable. Together, this prevented any quantity indication from being displayed for any tank. Because each channel failed to provide tank-to-tank display isolation, the fuel gauges did not provide any indication following channel failure. As a result, with all fuel gauges blank, the flight crew was unable to observe any fuel remaining in any tank or receive a low fuel alert.

Following the accident, Boeing revised the design of the 767 fuel system to ensure system isolation in accordance with 14 CFR Part 25. The revised rule requires that any propulsion system failure only impacts one engine to ensure the safe continued operation of the remaining engine.

This system isolation, informally referred to as "brick wall design," would have safeguarded each processor on the accident aircraft to be operationally independent when providing fuel gauge readings for each fuel tank. With this redesign, any faults related to one tank would not have propagated, neither impacting nor disabling the fuel gauge of any other tank.

2. Organizational Errors

Improper Dispatch

The aircraft was dispatched from Edmonton to Montreal via Ottawa under the provisions of Minimum Equipment List (MEL) item 28-41-2 because only one fuel processor channel was working properly, and the mechanic restored fuel indications in the flight deck by pulling and securing the circuit breaker in the open position.

However, the aircraft was then improperly dispatched from Montreal to Edmonton via Ottawa due to all the required provisions of MEL 28-41-2 not being met. In this case, because the required processor channel circuit breaker was not left open, there were no indications of fuel quantity in any of the three tank gauges. Operating the aircraft with more than one inoperative fuel gauge is not permitted under the MEL.

The MEL is a document created by air carriers from the manufacturer’s Master Minimum Equipment List (MMEL), approved by the FAA and, in the case of the Air Canada Boeing 767, validated by Transport Canada. The Air Canada MEL is part of the Air Canada Boeing 767 Aircraft Operating Manual, which is required to be carried onboard, is found in the Limitations section. It outlines situations when an aircraft can be safely dispatched, even if some equipment is inoperable. Critical systems are often duplicated to allow for redundancy in the event of a failure, and the MEL specifies certain conditions that must be met for safe operation.

MEL item 28-41-2 refers to Fuel Tank Quantity Processor Channels, which are digital channels that process fuel quantity gauge data for each tank. The qualifying conditions for this item state that one tank display may be inoperative provided fuel loading is confirmed in the tank with the inoperative display by use of a fuel measuring stick or by measuring fuel pumped into the tank. Additionally, it is required that the flight deck FMC fuel quantity information remains available.

Fuel measuring sticks, also known as drip sticks, are used to measure the amount of fuel in each tank in an aircraft and are only used when an aircraft is being dispatched under qualifying conditions. The drip sticks are installed vertically in the bottoms of the fuel tanks. These sticks feature a graduated rod with a magnet at the upper end that slides downwards within an outer tube when unlocked from the stowed position. A float with a matching integral magnet is located on the tube and moves up and down to follow the fuel surface. The level of fuel is determined during ground operations by unlocking the associated drip sticks and allowing the graduated rods to slowly fall until the rod magnet is attracted by the float magnet, exposing the graduations. To determine the fuel quantity within a tank, the pitch and roll of the aircraft are noted using the attitude indicator(s), and the fuel level(s) from the drip sticks are measured by the fueler or crew. The fuel density is determined from the supplier/fuel depot. Using the attitude, density and level data, the quantity of fuel is determined from the aircraft quantity conversion table handbook.

Diagram of fuel quantity measuring stick check, The Boeing Company

Boeing 767 Minimum Equipment List - Operating Manual, The Boeing Company

Manufacturer

At the request of Air Canada, Boeing provided manufacturing technical documents using the metric system (kilograms, liters, kilometers). However, some of the original documentation used the imperial numbering system (pounds, gallons, miles, etc.). This difference in documentation later led to the use of 1.77 pounds/liter, not the all-metric 0.8 kilogram/liter required for the new 767.

Using a table of figures provided to the maintenance personnel, this value could then be converted into a volume in liters, the unit used by the fuelers. A further conversion from liters to kilograms would be needed to provide the fuel quantity to the flight crew for use in the FMC. This system was unique in that every other airplane in Air Canada’s fleet used different units. All aircraft except the 767 had fuel gauges which read in pounds, and the drip sticks on other Air Canada planes read in inches, U.S. gallons, and imperial gallons, depending on aircraft type.

The 767 was the first new model to enter service with Air Canada when Canada officially began its transition from imperial to metric measurements in the late 1970s. The Canadian government, through Transport Canada, owned and regulated Air Canada, and insisted that the 767 be ordered with metric gauges for use in Canada and wherever international standards called for them. The only systems on the accident aircraft that utilized the metric system were the fuel quantity gauges and the fuel drip sticks. At that time, only China and the Soviet Union used metric units for these measurements. However, industry practice in most of the Western world, where the use of early standards developed in Britain and the United States led to the near-universal acceptance of feet, nautical miles, and knots as the default measurements of altitude, distance, and speed in aviation, led the industry to accept imperial notation as the international standard.

3. Human Error

Fuel load planning is a crucial part of every flight. The process involves the flight crew, maintenance staff, and the airline dispatcher(s) working together to determine the appropriate fuel load required for the journey. This is particularly important for long-range flights over the ocean where weather and wind forecasting are critical in establishing the minimum fuel load needed. The regulations mandate that the fuel load must cover the following:

• The distance from the point of departure to the destination
• Enough fuel to allow diversion to an alternate airport from 1,000 feet above the planned destination airfield to 1,000 feet above the planned alternate airfield
• Additional fuel to allow for 30 minutes of flying time after reaching the alternate airfield

In Montreal, while conducting the pre-flight checks, the flight crew decided to load enough fuel to fly from Montreal to Edmonton via Ottawa. It was determined by the fuel plan that the minimum required fuel was 22,300kg. The crew and maintenance staff, in accordance with the MEL, conducted a manual fuel check.

The manual fuel check revealed a total quantity of 7,682 liters (L) on board. The crew knew that this fuel quantity was not enough to complete the upcoming flight. To ensure an adequate amount of fuel was boarded, the crew used the specific gravity provided by the maintenance staff of 1.77 pounds per liter, but inadvertently interpreted the result as kilograms.

This led to a misinterpretation of the fuel already on board and the crew then reached the incorrect number of liters of additional fuel required. Had the crew properly calculated the fuel required using the correct conversion factors for kilograms, the amount of additional fuel required would have been 20,088L, a difference of 15,171L.

Investigators determined if the crew and the fuel loader had performed the proper calculation, the required amount of fuel that should have been loaded was 20,088L.

Loss of FMC Fuel Disagree Alert

An MEL-required condition for dispatch is that FMC fuel quantity information is available when there is an inoperative fuel gauge or an inoperative FQIS processor channel. The intent of that requirement is that the FMC must be receiving a valid signal of the total fuel on board from the FQIS. Without that signal, the FMC monitoring and alerting function that compares the FMC-calculated fuel remaining to the FQIS indicated total tank quantity is defeated.

On a three-crew airplane, mathematical integration of the fuel used by the engines and comparison of the flight engineer-calculated fuel remaining to the FQIS indications and to the mission and reserve fuel required were the core functions of the flight engineer. These flight engineer and related crew activities were critical to early identification of fuel leaks or other potential fuel exhaustion scenarios so that timely corrective actions could be taken by the flight crew. The automation of this function and simplification of fuel system operation was fundamental to FAA acceptance of two-crew flightdecks for large, long-range transport airplanes. The MEL requirement for the FMC to be receiving fuel quantity for all tanks when dispatching with a gauge or processor channel inoperative was intended to preserve this critical monitoring and alerting function on all flights.

Conclusion

A combination of factors led to the Air Canada accident, including the design error, dispatching the aircraft in violation of the MEL, and the incorrect fuel load. This accident highlights two critical safety objectives:

1. Fuel System Isolation – If one fuel tank quantity indicator is blank or erroneous, the remaining display can still detect declining fuel levels before complete fuel exhaustion occurs. However, if all indicators are blank or in error, it becomes impossible to identify a hazardous fuel quantity condition. If the fuel system isolation had been properly designed to isolate fuel tank quantity indications, the aircraft would not have experienced fuel exhaustion.

2. MEL Compliance – It is essential for operators to strictly comply with the MEL. If the MEL had been properly followed, the aircraft would not have been dispatched for flight, thereby avoiding the accident.

Back to top

Aviation Safety Bureau of Transport Canada Board of Inquiry determined the factual circumstances and contributory causes of the accident in Part II and Part III of the Final Report of the Board of Inquiry. The complete text is available at the following link: (Part II and Part III)

Back to top

Aviation Safety Bureau of Transport Canada Board of Inquiry provided recommendations in Part V of the Final Report of the Board of Inquiry. The complete text is available at the following link: (Part V)

Back to top

In 1983, Air Canada introduced the Boeing 767 to its fleet. The aircraft featured avionics that enhanced pilot workload management, enabling a two-pilot operation instead of the previous requirement for two pilots and a flight engineer.

The 767 aircraft marked Air Canada’s first implementation of the metric system.

Consistent with Canadian government policy, Air Canada ordered the 767s with fuel gauges calibrated in kilograms and drip sticks calibrated in centimeters, both metric measurements. Other instruments within the aircraft remained in imperial units, resulting in a mixture of measurement systems.

Back to top

• Lack of propulsion system isolation – Propulsion system isolation that provides independence of any propulsion system failure or condition does not affect safe operation of the remaining engines or does not require immediate crew action. Fuel system malfunctions are included in the prescribed propulsion system malfunctions. In this accident, designed redundancy was provided yet failed to protect the aircraft due to a lack of tank isolation. System isolation is required so that no single failure or condition jeopardizes the safe operation of the remaining engines. Total fuel exhaustion is an example of a condition that jeopardizes safe operations of multiple engines.

• Compliance with MEL requirements – As a condition of certification, a manufacturer creates a Master Minimum Equipment List to provide for times of operating the aircraft with inoperative components. That MMEL is approved by the FAA and allows the operator to develo, with FAA approval an even more restrictive MEL for their specific use. Adherence by operators, dispatchers, maintenance, and flight crews to the MEL is required for safe flight and operation.

Back to top

Back to top

United Airlines, Flight 173, N8082U, Portland, Oregon, December 28, 1978

A McDonnell Douglas DC-8-61 operated by United Airlines crashed into a wooded area during approach to Portland International Airport, Oregon on December 28, 1978. The crash occurred after the aircraft ran out of fuel due to a landing gear malfunction that caused the flight crew to hold at 5,000 feet to troubleshoot the problem. There was little discussion about fuel onboard during the hold, and the aircraft crashed approximately one hour after the hold began. Ten people were fatally injured and 23 were seriously injured among the 189 people onboard.

Library module: United Airlines Flight 173

 

Back to top

Advisory Circular 120-42A – (Cancelled and revised as AC 120-42B) Extended Operations (ETOPS)

Low fuel warning requirements. The complete text of Appendix K to 14 CFR part 25 is available at the following link: Appendix K.

Back to top

The FAA issued AD 83-15-05 R2, effective January 6, 1986, requiring the replacement of the FQIS to prevent loss of engine power due to fuel exhaustion resulting from erroneous fuel quantity indications for Boeing Models 757 and 767 aircraft.

Back to top

Airplane Life Cycle

• Design / Manufacturing
• Operational

Accident Threats

• Fuel Exhaustion
• Lack of System Isolation / Segregation

Groupings

• Approach and landing

Accident Common Themes

• Organizational Lapses
• Human Error
• Flawed Assumptions
• Pre-existing Failures

Back to top

Organizational Lapses

• One of the factors that contributed to the accident, which falls under corporate responsibility, was the lack of clear understanding of the Minimum Equipment List (MEL) within Air Canada.
• Training necessitated by the introduction of new aircraft requires appropriate manuals and training devices. With the industry determination during the time of this accident of whether to incorporate two- or three-pilot transport aircraft, Air Canada and other operators who were conducting pilot training of two pilot aircraft in three pilot simulators were faced with building new training programs and procedures for pilots, mechanics, and flight attendants.

Human Error

• During a stopover in Montreal, a mechanic reset the circuit breaker to diagnose a fuel gauge issue on channel 2. As a result, all fuel gauges displayed blank readings. While performing a Built-in Test Equipment (BITE) test, the mechanic forgot to deactivate channel 2 by pulling, thereby opening, the circuit breaker. As a result, all fuel gauges displayed blank readings during a subsequent flight crew change in Montreal.
• The fuel quantity information to the FMC was rendered inoperative by the fuel processor circuit breaker remaining closed. Fuel quantity information available to the FMC is a required condition for MEL dispatch with an inoperative fuel quantity gauge or processor channel. Lack of that required signal rendered the FMC fuel disagree alert inoperative.
• Fuel load planning is critical for every flight and involves determining the minimum fuel required to cover the distance, allow diversion to an alternate airport, and provide for 30 minutes of flying time after reaching the alternate airfield. In this case, the flight crew conducted a manual fuel check and miscalculated the amount of additional fuel required using the wrong units of measurement.

Flawed Assumptions

• The aircraft was dispatched improperly from Montreal to Edmonton via Ottawa. Air Canada, maintenance staff, and the flight crew assumed the redundancy in the FQIS would provide correct indications of fuel quantity. However, no tank-to-tank isolation was provided by either channel.

Pre-existing Failures

• Previous issues with the FQIS had been discovered, including a fault in the FQIS processor unit that would cause erroneous readings of the fuel quantity with a fault indication.

Back to top

The following accidents are related to fuel exhaustion:

Boeing 707-321B, Avianca Airlines Flight 052, AVA052 Long Island, New York, January 25,1990

A Boeing 707-321B operated by Avianca Airlines crashed in Long Island, New York after running out of fuel during a third holding period caused by poor weather conditions at John F. Kennedy (JFK) International Airport. The flight crew reported being low on fuel and unable to reach their alternate airport, and subsequently executed a missed approach to JFK. The crash was attributed to poor flight crew planning and communication. There were 158 passengers and crew on board, with 73 fatalities.

Library module: Avianca Airlines Flight 052

Airbus A330-243, Air Transat Flight TSC236, C-GITS Lajes, Azores, Portugal, August 24, 2001

An Airbus A330 operated by Air Transat experienced a fuel leak in the right engine, which went undetected by the flight crew. When the fuel shortage became critical, the crew diverted to Lajes Airport on Terceira Island in the Azores, but both engines eventually flamed out, forcing the crew to carry out an emergency landing with no power. The cause of the fuel leak was the fuel line chafing against an adjacent hydraulic line. The chafing was caused by a combination of old and new configurations due to incomplete incorporation of service bulletin changes due to a shortage of parts. The aircraft suffered structural damage and there were 16 injuries during the emergency evacuation.

Library module: Air Transat Flight TSC236

ATR 72-202, Flight TUI 1153, TS-LBB, Palermo, Sicily, August 6, 2005

The flight crew of an ATR 72 experienced a flameout of both engines during flight. The flight crew attempted to restart the engines, but without success. After gliding for approximately 16 minutes, they executed a ditching off the coast of Capo Gallo. The aircraft broke into three pieces, fatally injuring 16 of the 39 people onboard. Investigators determined that the cause of the accident was fuel exhaustion. A fuel quantity indicator (FQI) had been replaced the day prior to the accident, following an inefficiency of the FQI reported by the captain. Technicians replaced the FQI, installing a version designed to be used on the ATR 42, not the ATR 72, due to insufficient part numbers within the spare management system database. Thus, an erroneous fuel quantity was provided, indicating 900kg of fuel remained in each of the left and right tanks. The FQI replacement procedure at the time of the accident, did not require a manual check using drip sticks to determine the effective fuel quantity present in each tank and compare the relevant value shown by the FQI.

Final accident report: ATR 72

The following accident is related to adherence to the MEL:

Boeing 727-22C, United Airlines Flight 266, N7434U, Los Angeles, California, January 18, 1969

On January 18, 1969, United Airlines Flight 266 crashed into Santa Monica Bay shortly after takeoff from Los Angeles International Airport (LAX). The airplane was dispatched with the No. 3 generator inoperative per the MEL. The flight crew shut down the No. 1 engine due to a fire warning and subsequently lost all generated electrical power, resulting in the airplane crashing due to flight crew disorientation during a night, instrument departure in which the instrument displays were disabled. The cause of the loss of all generator power and the failure of the standby electrical system was undetermined.

Library module: United Airlines Flight 266

Back to top

Technical Related Lessons

System isolation and redundancy of the FQIS for all propulsion systems is necessary to protect the engines from failures that can impact more than one engine. (Threat Category: Lack of System Isolation/Segregation; Fuel Exhaustion)

• 14 CFR 25.903 requires propulsion system isolation. The FQIS and its processors are now interpreted to be a "propulsion system" and can affect the operation of the aircraft and its engines. The continued safe operation of any large transport aircraft is predicated on only one engine being impacted by any failure. 14 CFR 25.903 requires propulsion system to be isolated in a manner that prevents single or likely combinations of failures or malfunctions (including blanking of gauges) from affecting more than one fuel tank quantity gauge. The regulation requires isolation such that a single failure does not jeopardize safe operation.
• In this accident, the fault condition that resulted in erroneous or blanking display of more than one fuel tank quantity display resulted in a catastrophic fuel exhaustion condition.
• Both system isolation and redundancy work to achieve operational safety objectives. In this case of fuel quantity indication, the dual-channel processor provided redundancy, but did not achieve system isolation.

Common Theme Lessons

Strict adherence to procedures in the MEL is critical for safe dispatch and operation. (Common Theme: Organizational Lapse)

• The Master Minimum Equipment List (MMEL) is an FAA-approved document. It is provided to operators by aircraft manufacturers and contains a listing of specific components and features of the aircraft that can be allowed to be inoperative for a limited period, with specific required conditions for these components to be unavailable. Operators use the MMEL to develop operator-specific MEL.
• In this accident, investigators determined that Air Canada’s operations and maintenance organization approved the aircraft for dispatch in a configuration not in accordance with the MMEL nor the MEL. The MEL required one operative fuel tank quantity indication and dipping of the fuel quantity measuring sticks; however, the flight was dispatched with no fuel tank quantity indication.

Back to top