The Plane You Are Flying Was Broken This Morning

On July 23, 1983, a remarkable aviation incident occurred. A Boeing 767 operated by Air Canada departed Montreal with non-functioning fuel gauges. All three screens in the cockpit were dark, visible to both the crew and technicians. Despite this, the aircraft was cleared for departure.

An hour and a half into the flight, at flight level 410, the fuel ran out and both engines went silent. Captain Bob Pearson, who had glider piloting experience, glided the aircraft to a former military base in Gimli. That day, go-kart races were being held there, but the crew landed successfully with no fatalities.

The MEL Document (Minimum Equipment List)

The key to understanding this incident is a special document called the MEL, which formalizes acceptable malfunctions.

Aviation developed rapidly in the 1960s. Aircraft became more complex, the number of flights increased. Requiring one hundred percent equipment functionality before every departure proved unrealistic.

Regulators and manufacturers jointly developed the MMEL (Master Minimum Equipment List) — a document listing equipment that may be inoperative when releasing an aircraft for flight, along with corresponding restrictions. Each airline then creates its own MEL based on the MMEL, which can be more restrictive but never less so.

Defect Categories

Each defect permitted under the MEL belongs to one of four categories:

• Category A: The timeframe is specified in the MEL item, usually a matter of hours or a specific number of cycles
• Category B: Three days (excluding the day of discovery)
• Category C: Ten days
• Category D: 124 days — the aircraft can fly for four months with such a defect

Examples of Acceptable Malfunctions

Thrust reverser: One of two reversers can be locked out. The reverser is not part of the certified landing performance characteristics; the aircraft must be able to land on wheel brakes alone. So flying with one reverser deactivated is perfectly safe — it just means the crew needs to ensure the runway is long enough for braking without it.

One of two air conditioning packs: You can fly, but the ceiling is reduced to 25,000 feet, and payload may be restricted. The remaining pack handles all pressurization and temperature control.

APU (Auxiliary Power Unit): Without it, the aircraft flies normally, but cannot start independently and cannot be dispatched on transoceanic routes. The APU provides backup electrical power and bleed air, which is critical over water where diversion options are limited.

Weather radar: You can fly without it only if there is no forecast of thunderstorm activity along the route. In clear weather, it's simply not needed.

One of two generators: The APU takes the load, but transoceanic routes are closed. The system has built-in redundancy for exactly this reason.

Practical Application

A technician during pre-flight inspection finds a malfunction. He opens the MEL on his tablet, checks the conditions and restrictions. If they fit, he installs a lockout pin, marks the lever in the cockpit, and makes an entry in the aircraft log.

The crew checks the log, opens the MEL, and decides: destination, runway length, weather — does everything meet the restrictions? The captain has the final say. The airline recalculates flight performance.

In the evening, the aircraft arrives at the maintenance base, and the night shift calmly performs the repair. This system keeps aircraft flying safely while ensuring repairs happen in a timely and organized manner.

The Real Cause of the Gimli Incident

The story is often retold incorrectly. Here is what actually happened:

July 21, Edmonton: Technician Conrad Yaremko discovered a malfunction in the second channel of the FQIS system (which displays fuel quantity). He disconnected the faulty channel, hung a tag, and noted the MEL reference — item 28-41-2: one of two channels inoperative, flight permitted with dipstick fuel checks.

In Montreal: Another technician, Ouellet, decided to investigate the cause of the failure. For diagnostics, he returned the switch to its normal position. Both channels dropped, the screens went completely dark. The technician left to measure fuel with dipsticks and forgot to return the switch to the pulled position.

Captain Pearson saw the dark screens and the tag. From the previous captain, he learned about the sensor problem and assumed the aircraft had already been flying with this defect. The MEL stated: one channel inoperative — permitted; both channels inoperative — not permitted. But Pearson missed this crucial distinction.

Simultaneously, a unit conversion error occurred. Canada was transitioning to the metric system. The crew converted liters to weight using the coefficient 1.77 (for pounds), not knowing that the computer expected the coefficient 0.8 (for kilograms). The aircraft departed with half the required fuel.

The Spanair Flight 5022 Incident (2008)

An opposite example — a catastrophe related to improper MEL usage.

August 20, 2008 in Madrid, a McDonnell Douglas MD-82 was preparing for takeoff in +35°C heat. The instruments showed a reading of 99 degrees. The captain aborted the takeoff.

The technician opened the MEL: the outside air temperature sensor heater can be deactivated if there is no forecast of icing conditions. August, Madrid, scorching heat — what ice? The technician pulled the circuit breaker, documented the procedure.

On the second takeoff attempt, the crew forgot to deploy the flaps and slats. The TOWS system (Takeoff Warning System) did not activate.

The investigation revealed: during installation, the TOWS system wiring had been bundled together with the temperature sensor wiring. A degraded relay R2-5, connected to the RAT sensor, prevented the warning system from functioning. 154 people died.

The technician followed the MEL correctly, but nobody knew about the hidden connection between the systems. This tragedy illustrates that even perfect procedures can fail when undocumented dependencies exist between aircraft systems.

Why Do We Need MEL?

Without MEL, airlines have only two options:

1. Cancel the flight for any defect whatsoever
2. Fly at the discretion of the technician and captain without unified rules — as was done in the 1950s-1960s, when this approach led to regular disasters

MEL is the third way: formalized boundaries of what is acceptable. Modern aircraft are designed with enormous redundancy reserves. Every critical system has backups, and MEL defines exactly which backup systems can be temporarily unavailable.

Additionally, there are:

• CDL (Configuration Deviation List) — describes external structural elements whose loss does not affect performance characteristics (small fairings, access panels, etc.)
• NEF (Non-Essential Furnishings) — cabin breakdowns (tray tables, armrests, reading lights), often documented by the crew themselves

Conclusion

The story of the Gimli Glider shows that the MEL actually prohibited departure with two non-functioning channels. The blame lies with a chain of human errors, not the system itself. The Spanair story points to a real danger: undocumented connections between systems.

MEL remains an essential tool of modern aviation, balancing safety with operational reality. The next time you board an aircraft, know that something on it might be broken — and that's not only normal, it's carefully managed by one of aviation's most important safety documents.