The Debrief · No. 01
Duplication is not verification
The airliner that ran out of fuel at 41,000 feet because two professional teams did the same arithmetic, the same way, with the same wrong number.
Case File
What happened
On 23 July 1983, Air Canada Flight 143 was a brand-new Boeing 767, one of the airline's first aircraft delivered with metric fuel gauges while Canada was mid-transition from imperial units. On that day the fuel quantity indication system was unserviceable, so the fuel load was worked out manually: ground staff measured the tanks with dripsticks, converted the reading, and the flight crew checked the numbers.
The aircraft needed 22,300 kilograms of fuel. The conversion used the figure for pounds. The refuellers calculated it, the crew checked it, and every check agreed, because every check used the same wrong factor. The jet departed with roughly half the fuel it required.
At 41,000 feet over Red Lake, Ontario, one engine flamed out, then the other. A widebody airliner with 69 people on board became a glider, and most of the cockpit instruments went dark with it. Winnipeg was out of reach. The first officer, a former air force pilot, knew of a decommissioned strip at Gimli, Manitoba. The captain, an experienced glider pilot, flew a manoeuvre no airline trains: he sideslipped the 767 to bleed off height, then put it down dead-stick on a runway that was hosting a family motorsport day. The nose gear collapsed, the aircraft ground to a stop, and everybody walked away. The jet was repaired and flew for another 25 years, known for the rest of its life as the Gimli Glider.
The Lesson
The lesson aviation took
The uncomfortable finding was that everyone involved had checked the fuel figure. Nothing about the checking was independent. Same source number, same conversion factor, same blind spot, passed from hand to hand and agreed at every step. A check is only a defence if it can fail differently from the thing it is checking: a different person, using a different method, drawing on a different source. Aviation also learned to distrust moments of change. The error lived in a transition, imperial to metric, old fleet to new. Change is exactly when checks matter most, and exactly when they quietly assume nothing has changed.
Translation
On your site
The lifting plan reviewed by two engineers using the same spreadsheet. The isolation list verified by reading the printed list back, instead of walking the field with the drawing. Tonnes and kilograms on a load cell after a system change. Two signatures on one assumption is still one assumption; it just has better paperwork. Independence looks different: the second person walks the isolation against the drawing rather than the list, recalculates with a different method, sources their own number before comparing. It is slower by minutes and safer by orders of magnitude.
Ask the Crew
Three questions for pre-start
- 01
Where do our double-checks share a single source, one spreadsheet, one list, one person's figure?
- 02
What has changed recently here (a system, a unit, a supplier, a roster), and which of our checks quietly assume nothing changed?
- 03
Pick one critical check this week: what would make it independent instead of duplicated?
Duplication is not verification.
Free Download
Run better pre-starts
The free Pre-Start Briefing Pack includes the THREAT Brief format, a Challenge and Response card, and three read-aloud talks like this one.