The Three-Day-Old Fuel Slip
The Story of Air Tindi Flight 223
On November 1st, 2021, an Air Tindi Twin Otter was forced to make an emergency landing about 14 kilometres away from Fort Providence Aerodrome in the Northwest Territories (NWT) of Canada. The flight was about 40 minutes into a flight from Yellowknife to Fort Simpson when they realized that they had insufficient fuel to reach either airport. While diverting to Fort Providence, they ran out of fuel, out of reach of the aerodrome. Fortunately, the pilots managed a landing onto partially frozen muskeg. After four hours of waiting, all five people on board were rescued with only minor injuries relating to the post-landing hypothermia.
How did this plane run out of fuel? What’s a Twin Otter? Or indeed, what’s Air Tindi?
Air Tindi is an airline based out of Yellowknife. Tindi is actually the word for “the big lake”, referring to the Great Slave Lake, in Tłı̨chǫ Yatıì [here’s the IPA pronunciation guide for that, because I cannot describe it myself: tɬʼĩ-tʃʰõ ja-tʰìː], also known as the Dogrib language, one of the official Indigenous languages of NWT. Founded on November 1st, 1988 by the Arychuk family, it was sold to Discovery Air in December 2006. When Discovery Air went bankrupt in March 2018, the Clairvest Group bought the company, and are the current owners.
Its fleet consists of rugged planes that can handle the conditions of Northern Canada, including a few Dash 7 Combis and DHC-6 Twin Otters. These are small planes that can carry a small number of passengers and/or cargo from Yellowknife to other communities surrounding the Great Slave Lake, as well as other locations whenever chartered to do so. The Twin Otters in particular could be fitted with wheels, floats, or skis, which gives the plane amazing flexibility in locations it has access to.
The accident plane was a de Havilland DHC-6–300 Twin Otter, with registration C-GNPS. The date of manufacture, according to the TSB, is 1977, though other sources have the roll out date on February 1978. Its first flight was on March 6th, 1978, and was acquired by Air Tindi when Latham Island Airways, which bought the plane in 1988, merged with the company in 1991.
The plane was actually involved in an incident on July 2nd, 2001, when, while landing on an esker in Exeter Lake, NWT, a crosswind pushed the plane off to the side and went down an embankment. Fortunately, no one was injured, and the plane was repaired.
On this day, the regular landing gear was fitted onto the aircraft, and was scheduled to do seven flights under Visual Flight Rules (VFR), all within NWT, starting at 10:30am MDT (UTC -6). The itinerary consisted of:
- Yellowknife Airport (CYZF/YZF) to Whatì Airport (CEM3/YLE) as TIN218, and the return trip as TIN219 (mistakenly noted as TIN220 in the report);
- CYZF to Wekweètì Airport (CYWE/YWE) as TIN212, and the return trip as TIN213;
- CYZF to CEM3 as TIN220, and the return trip as TIN221;
- CYZF to Fort Simpson Airport (CYFS/YFS) as TIN223, the accident flight.
Note that TIN212 was the only flight with more than nine passengers, as it had to operate under Commuter Operations regulations. The rest, including the accident flight, operated under Air Taxi Operations regulations. The flight crew was expected to fly all of seven flights before overnighting in Fort Simpson.
The flight crew consisted of a captain and first officer, who would be working together for the first time.
The captain joined the company in August 2008 as a ramp assistant, and climbed the ranks to be a flight coordinator in November 2009, a first officer for the Twin Otter in June 2011, a first officer for the Dash 7 in August 2013, promoted to captain of the single-pilot Cessna 208 in November 2017, before finally being captain of the Twin Otter in April 2019. In June 2021, he also became a training pilot for the Twin Otter. At the start of the day, he had 6396 hours of experience, with 2945 hours on type, 1644 hours of which he was pilot-in-command. He held an airline transport pilot licence (ATPL), and had over 63 hours of rest before starting work.
The first officer was very new to the company, only being hired in April 2021. He was approved to work as a first officer of the Twin Otter by August 31st, 2021, just two months before the accident flight. At the start of the day, he held 434 hours of experience, with almost 85 hours on type. He held a commercial pilot licence (CPL), and had 15 hours of rest before starting work.
An important part of this accident is how fuel is usually requested. This is usually done during the previous flight. In the accident flight’s case, fuel should’ve been requested on TIN221, which involves informing the flight coordinator of the amount needed, who then places an order for the fuel from the fuel company. Unfortunately, the cockpit voice recorder (CVR) on this plane only records the last 30 minutes of flight, so TIN221 was never recorded, and thus, the investigation was unable to determine if the request was made. Whatever happened, the flight coordinator did not order fuel for TIN223. TIN221 landed in Yellowknife at 5:25pm, where the passengers and crew deplaned and went into the passenger boarding lounge.
The first officer returned to the plane at 5:38pm and began the external pre-flight inspection, with the captain returning one minute later. The captain entered the cockpit from the front left door. While getting into his seat, he saw a fuel receipt in the door map pocket. The captain thought it was a fuel slip for the fuel he thought he requested for TIN223, and did not read it. Unfortunately, he was severely mistaken. The fuel slip was three days old, and no fuel had been added. This left the plane with 533 pounds of fuel, when 2500 pounds was required for the flight to Fort Simpson, according to the flight plan.
Of course, as fuel is critical for a flight, checking the fuel quantity should be a part of the checklists, and it is. It’s on the Before Start checklist, the Taxi checklist, and the Cruise checklist. So how did the crew do these checklists?
Since the CVR only records the last 30 minutes, and these checklists were done more than 30 minutes before signs of trouble, it wasn’t recorded, but according to the crew, this is the chain of events.
The captain did the Before Start checklist using a “geographic flow,” where he did the checks in a consistent order, but without reference to the checklist. Doing this checklist by memory was allowed. However, in the middle of this checklist, he was distracted by a conversation with one of the passengers, who was a former coworker. Instead of restarting the checklist, he continued the checklist, missing the fuel quantity check.
After the first officer briefed the passengers, probably doing safety demonstrations, he went into the cockpit and asked if he would like to do the Before Start checks. The captain declined, and the engines were started at 5:43.
Now here is the critical part. According to Air Tindi’s Flight Operations Manual (FOM), checklists that are “most critical for safety of flight” require both crew members to participate in the “verbal challenge and response” method, where one crew member does an item, says that they’ve done it, and the other crew member confirms that they’ve done. These checklists cannot be done from memory, and among those checklists is the Taxi checklist. This is the only checklist in this category that checks the fuel quantity.
Unfortunately, this was not followed. The captain did the After Start, Taxi, and Line Up checklists, all in this critical category, silently by himself, from memory alone. He, along with a few other experienced captains, “had developed the practice of performing some of the challenge and response checks silently, by memory only, and by themselves.” Had this been done as the FOM stated, like it had been in the six previous legs, the crew would’ve noticed the insufficient fuel quantity in this check.
At 5:47, the plane took off from Yellowknife and climbed towards their cruising altitude of 6500 feet above sea level (this Twin Otter was unpressurized). The first officer did the After Takeoff and Cruise checklists by himself without reference to the checklist, which was allowed. However, this left room for the fuel quantity to be unchecked by mistake, and it was.
Just three minutes later, the fuel company called the Air Tindi flight coordinator and asked if this aircraft needed fuel. They responded that the plane already took off. In my opinion, had the flight coordinator informed the crew of this weird call, the crew would’ve noticed their mistake and returned for a safe landing at Yellowknife. However, the flight coordinator probably assumed that the crew had enough for the flight to Fort Simpson without a refuelling.
The investigation estimated that the low-fuel-level caution light for the aft fuel tank would’ve illuminated 26 minutes after take-off, around 6:13. At this point, the plane had about 40 minutes of flying time at cruise power before running dry, pinning the time of fuel exhaustion at 6:43, assuming all of the fuel is used at cruise power.
At 6:26, when TIN223 was about halfway between Yellowknife and Fort Simpson, the flight crew first noticed the low-fuel-level light for the aft fuel tank, and immediately figured out that they took off without enough fuel. They looked at their diversion options, and found that Fort Providence Aerodrome (CYJP), NWT, was the closest runway, and at 6:29, they turned towards the aerodrome. The captain also decided to climb to 7000 feet above sea level. They had about 14 minutes of fuel left to make the diversion from their turn if they used cruised power.
The captain, via the plane’s satellite radio, told the flight coordinator of the situation, and they relayed a suggestion from the chief pilot: shut down one engine to conserve fuel. In my years of being an avgeek, I have never heard of this option of shutting down an engine to save fuel, but apparently, it is a valid suggestion, at least for these types of small planes. According to the TSB, “a specific range of 0.325 NM per pound of fuel at a true airspeed of 136 knots is calculated” when using the optimal two-engine configuration, while “a specific range of 0.394 NM per pound of fuel at a true airspeed of 143 knots is calculated” when using a one-engine configuration with the engine at maximum continuous power, and the shut off engine’s propellers feathered (the edge is facing into the wind, reducing drag).
The captain followed this suggestion, shut down the left engine, making sure to feather the left propellers, all while drawing fuel from the auxiliary fuel tanks on the outboard sections of the wings. During this, the first officer briefed the passengers on the diversion. All of this was done with the timespan from 6:34 to 6:38. Power was then reduced on the right engine to conserve fuel, and they descended slowly.
Now for some information on the Twin Otter’s fuel system. Asides from the auxiliary wing fuel tanks (which were optional), it has two main fuel tanks under the passenger cabin. The forward fuel tank fuels the right engine, and the aft fuel tank fuels the left engine. Each tank has its own gauge, and both were working on this plane. The optional wing fuel tanks are to be used in cruise flight only. One way of refuelling these tanks is by using the fuel pumps in the plane, where they pump fuel from the main tanks to the wing tanks. However, this is prohibited from being done in flight by the aircraft flight manual. Despite this, there is nothing stopping a crew member from doing this, and it’s easy to do so accidentally, as the switch to refuel the wing tank is the same switch that controls when the wing tank provides fuel to the engines. This switch, from up to down, is ENGINE, OFF, REFUEL.
At 6:43, the PUMP FAIL R TANK light lit up, which it does when there is insufficient pressure from that wing tank. In this situation, it means almost no fuel in that tank. When the captain attempted to turn the switch on the right fuel tank from ENGINE to OFF, he accidentally went through OFF and into REFUEL. There are no cockpit indications that REFUEL has been selected, and allowed valuable fuel to be redirected into the right wing without being used. 7 US gallons of fuel would end up in that fuel tank when the plane crash landed.
Also, 5 US gallons of fuel from the left-wing tank was left when they crash landed. The fuel in the left wing tank was not used, as when the left engine was shut off, the fuel pump to the left engine was shut off, resulting in the fuel in the left wing being unavailable for the right engine “unless the flight crew reconfigured the fuel system.” The report did not go into detail as to how the crew failed to do this, and I was unable to figure out the correct procedures.
Getting ahead of myself, at 6:47, at 11 nautical miles from Fort Providence, descending through 3300 feet above sea level (2800 feet above ground), the right engine began to surge from the lack of available fuel. Both main tanks were empty, and 12 US gallons of fuel of valuable fuel were locked away in the wings. Unfortunately, that amount of fuel would’ve allowed them 8 more minutes of flying time, which would’ve put them well within range of Fort Providence.
The crew shut off the right engine and had the propellers feathered, and the captain aimed for the optimal glide speed of 86 knots. At 2800 feet, he did not have much time. With the optimal speed, the Twin Otter can glide about 2 nautical miles for every 1000 feet of descent. With 86 knots at 2800 feet, they could go another 5.6 nautical miles before hitting the ground in about 3 minutes and 54 seconds. They were not going to make it to the aerodrome.
With that inevitability, the first officer “briefed the passengers for a forced approach to an off-airport landing”, which I believe is code for “BRACE FOR IMPACT”. Meanwhile, the captain had to look for a place to land, which is difficult in the mid-autumn night of northern Canada. Thankfully, the captain had a good eye, and managed to tell the difference between an area of muskeg and an area of trees. Muskeg is a bog or peatland in Arctic or boreal areas. With that eye, the captain lined up for a landing on the partially frozen muskeg. Just before touchdown, he requested flaps, which were selected, and seconds before touchdown, the stall horn activated. The plane landed at 6:51, 6.7 nautical miles northwest of Fort Providence Aerodrome and stayed upright. Everyone on board was uninjured in the landing.
The rescue was not easy. It was about −2.7 °C at night. The muskeg was partially frozen, so the ice was thin, and underneath was cold water. The crew set the satellite phone they use to communicate to the company to “emergency mode” during the diversion, which broadcasts position data but disables outgoing calls, which the crew attempted to do after landing. Luckily, the crew was able to use a passenger’s cell phone to call them and tell them the good news. The company was also able to tell them to switch the satellite phone to “normal mode” to be able to make calls again.
Two passengers tried to walk away from the aircraft, but the conditions compelled them to follow the first officer’s advice to get back into the plane. The plane had a survival kit, and they used the space blankets in it to provide warmth. Meanwhile, the crew was turning the lights of the plane on and off every 30 minutes to help the search team find them, which they did by 8:00. Unfortunately, the closest road was about a kilometre away, and the all-terrain vehicles could not handle the partially frozen muskeg. They had to resort to walking, which was not easy, considering that the ice was thin, and they often fell through into knee-deep and waist-deep water, which, according to reports, was two feet deep.
By 9:20, the search and rescue team reached the plane, and made the decision to have the passengers and crew walk back to the road. Over an hour later, at 10:25, everyone made it back and were driven to Fort Providence, rewarded with coffee and warmth according to reports. At 11:00, they were given health assessments and treated for mild hypothermia, thus ending the ordeal for everyone.
While hearing that everyone made it out alive with only mild hypothermia must have been a great thing to hear, the fact that a plane ran out of fuel and had to land off airport was worrying. When the events were established, they must have been even more dumbfounded. How could a properly trained crew miss the fact that they never refuelled? How could a properly trained crew botch three separate checklists? How could they not notice a low fuel level light for 13 minutes? Finally, how could a plane allow a crew to easily set a switch into a mode that should have been prohibited from happening in flight?
The investigation found out that the captain and a few other experienced pilots were making safety critical checklists silently, by memory only, and by themselves because “the adaptation was perceived as more efficient.” Since nothing went wrong, it became normalized in this captain’s routine.
How about the first officer? Well, this was the first officer’s first day with the captain, and he was expecting to fly by the book. However, throughout the day, he recognized the captain’s adaptations. While “the captain did not prohibit the first officer from performing any checklist activity, the first officer became progressively more passive.” Since the first officer was new, he was influenced by the culture of the company, where “other first officers were aware of such adaptations and that they tolerated them,” and that “other captains with whom the first officer flew also did not routinely use checklists.” The company approved of the captain after all, why not follow his lead? What the first officer (and similar first officers in his position) did not know is that the captain and these other captains did follow the standard operating procedures during their check flights, so of course the company would approve of them.
Reading these findings, it just puts into perspective how critical a good culture is to safety. Of course no one sets out to crash a plane, but a culture that tolerates deviations from the standard is a culture just waiting for an accident. It’s even more important for newcomers, as sticking to the standard would give them good, quality experience to further their flying career, and molding them into being wishy-washy with checklists is not good for the future of flying.
It was even more worrying that first officers who experienced these deviations from the norm were not reporting this via the safety management system (SMS) Air Tindi had, but only informally to training captains. This allowed for the company management to not be fully aware of these deviations, particularly the culture that had developed with these experienced captains, and thus not “pursue a corrective action plan through the SMS.” A culture that prioritizes “not being a snitch” over the safe operation of the plane is in danger of being toxic, and hopefully the safety actions taken by the airline have gone on to change this culture.
The passive role the first officer had on the accident flight caused him to not perform a mental checklist of the state of the plane during the taxi. The crew did not effectively scan the instruments while in flight, causing them to miss the low fuel light for 13 minutes. While the report said that there was nothing to indicate that the crew’s performance was degraded by fatigue, I would say that the timing of this accident flight in relation to the timing of everything else was a factor. They started their working day over 7 hours before takeoff of this flight, the sun had just set, and it was the last flight of the day. While that is not outside of the fatigue limits, it could have induced a sort of either “rush” or “laziness” to finish the day as soon as possible, allowing room for the crew to make basic errors, like not calling in for a refuelling, or missing basic checks.
When the crew finally realized their situation, they followed the advice of shutting down an engine to save fuel. However, due to the limited time, they did not check the performance charts for the best configuration to save on fuel. They also descended after they shut down the engine. Therefore, the investigation could not determine if shutting down the engine actually had any effect on the range of the flight. It did not help when the crew accidentally set the right wing fuel tank switch to REFUEL instead of OFF. However, considering the possible high stress of the situation at hand, this was understandable, especially when there is no indication in the cockpit on whether that switch is in the REFUEL position.
The descent essentially sealed their fate into landing in the muskeg. Had they held their altitude of 6500 feet above ground (7000 feet above sea level), the altitude when they shut down the left engine, they would’ve had 6.5 nautical miles of extra gliding range to their original 5.6 nautical miles gliding range, making about 12.1 nautical miles, possibly putting them just barely within range of Fort Providence Aerodrome when the right engine failed, which was 11.8 nautical miles away.
Numerous changes were made in Air Tindi after this crash. The company de-briefed with everyone that flew the Twin Otter individually. Numerous memos were sent to flight crews which achieved the following:
- “emphasize the requirement to follow all procedures and checklists”;
- “require the captain to verify fuel uplift and sign an acknowledgement on every fuel slip before engine start”; and
- “inform them of the requirement to communicate fuel on board to the Operations Control Centre before each departure.”
The first memo seems more like a reminder, but useful nonetheless. The second memo is a crucial change, as it makes sure that the captain looks at any fuel slip that supposedly seems like the fuel slip for the following flight, and actually verifies that it is indeed for the following flight.
Missing fuel slips have led to aviation accidents before. Tuninter Flight 1153 ran out of fuel over the Mediterranean due to the wrong fuel gauge being installed, and the captain not verifying the supposed “refuelled” status of the plane with a fuel slip that didn’t exist. I was surprised that in 2021, a captain of an airline did not have to sign a fuel slip to verify the new fuel quantity.
The third memo not only allows for the Operations Control Centre to be in the loop for every fuel situation, but it also forces the crew to look at their fuel gauges before departure, as they couldn’t otherwise report it.
Finally, Air Tindi modified how they did their “safety critical” checklists. Rather than use a “challenge-response” method, they now use a “challenge-response-verification” method. The report does not go into detail into what this means, but I would guess that it means after a crew member confirms the other crew member did an action, they both verify that the action was indeed done.
After the ordeal, the plane was recovered from the muskeg with a helicopter, and taken to Fort Providence Aerodrome. According to the Aviation Safety Network, the plane has been repaired. However, as of writing, the plane hasn’t flown in the past 7 days, and probably hasn’t flown since being recovered.
Ever since I found out about this flight, I became more and more fascinated by the chain of events that caused this accident. What started off as a simple browsing of the TSB’s latest reports turned into a slightly in-depth look into how pilot culture can really affect safety. How a seemingly simple mistake is actually the final straw in a system that was not safe. How a three-day-old fuel slip was not the cause, but merely a weird domino in a line of them that started when a captain decided to do a safety critical checklist silently by memory.
This article was inspired by Admiral Cloudberg’s amazing articles on plane crashes. If you enjoyed mine, you would enjoy her articles a lot more.
