Detailed Analysis, Maps and Photos: Two Behemoths Fall: The Costa Concordia Cruise Ship and The Air Canada 767 "Gimli Glider"

The Costa Concordia. Photograph: Andrea Sinibaldi/AP

[See updates at end of article, and a new, detailed video showing exact track of the Costa Concordia]
 
As an engineer, I'm fascinated by giant machines. In particular, I love to understand how they work, and at time, why they don't work. This post is a story of two major accidents. One is currently unfolding in the Mediterranean near Corsica - the sinking of the cruise ship Costa Concordia, and the other happened almost 30 years ago when an Air Canada 767 ran out of fuel half way to its destination.

Air Canada Flight 143, July 23, 1983 ran out of fuel at 41,000 feet but the pilots managed to glide with no power to a safe landing at a former Canadian Air Force base that was in use for car racing. No one was killed, and the plane was put back into service. (photo by Wayne Glowacki, Winnipeg Free Press) 

Illustration: Dailymail.co.uk [Editors Note: This path turned out to be in error. The actual path is shown in the Jan 16 update below]
 
About two hours into the trip, the ship took a detour from its "usual" route to give passengers an up-close view of Giglio's port town by night, according to officials there. Upon approaching the port, the ship hit a rock that wasn't marked on nautical maps, Mr. Schettino, the captain, would later tell reporters. Instead, the ship struck Le Scole, a well-known rock formation, that skirts the coast of Giglio, according to the coast guard.
 
A detailed article in the Daily Mail in the UK provides a map that seems to echo the WSJ article. That article noted from townspeople that ships usually pass to the west of the Isola del Giglio, not the east.

 
This Google Map overlay showing the track of the Costa Concordia also clearly shows that the normal shipping routes are to the west of the island. Note the blue track from the Costa Concordia, showing it to the east of the island.

 
Air Canada Flight 143

Meanwhile back in 1983, the Air Canada 767 took off from Ottawa for a flight to Edmonton. The 767 aircraft was brand new, and only a few had been delivered. Significantly, it measured fuel in the "modern" way ... in liters, instead of in Imperial Gallons, as earlier Air Candada aircraft had done. On this day, due to what should have been a minor problem, a technician had disabled one channel of a fuel monitoring system, not knowing that there was a problem with the other channel as well. 
 
As a result, the system did not show actual fuel levels during the flight. Next, the technicians on the ground used the wrong conversion factor from liters to Imperial Gallons to figure out how much fuel to load on the aircraft.  It was a huge error. Instead of 20,000 liters, they only added 5,000 liters. (See if you can follow the whole story...here's the full report in Wikipedia)
 
Since the fuel monitoring system had been partially inoperative, the pilot manually loaded the 20,000 liter figure into the system, (after double checking ground crew's math...but still with the wrong conversion factor.)
 
Half way to Edmonton, the 767 lost one engine, and very shortly, the other. A warning sound that they had never heard sound. They soon came to realize it meant all engines out. The captain, who was also a glider pilot put the plane into its best glide angle. The pilots calculated whether they could make it to Winnepeg, but decided they were too far away. The co-pilot, it turns out, had been stationed at Gimli before it closed, and even though it was not on their charts, he knew it was big enough and close enough to handle the 767. What he didn't know was that it had been converted to a drag strip and it was in use on this day.

 
So what caused the Air Canada accident? Simple human error. One wrong conversion that never got caught. One circuit breaker removed (and properly tagged) that shouldn't have mattered. The equipment worked as it was supposed to. When both engines failed, a ram air turbine dropped from the belly of the 767 to provide enough power to fly the aircraft. The pilot's great skill allowed them to make a safe (if precarious) landing.

As for the Costa Concordia, it looks like the cause of the disaster was simple as well. (I'm assuming the WSJ article is correct). The captain of the Costa Concordia wanted to give his passengers a lovely view of a small Italian town on a calm night. One bad decision that led to a calamity.

Costa Concordia's Voyage Data Recorder (VDR) being offloaded by Italian Coast Guard Source: Reuters

Will we know what happened on the Costa Concordia? Absolutely. Since 1999, international rules require most ships to have "black box" recorders much like airplanes. So, it's likely that the answers are all in the black box (which is actually orange, and appears to be a VDR 4350 from SAM Electronics) 

Cover photo from VDR 4350 Voyage Data Recorder from SAM Electronics (an L3 Communications Company)
Here's what the system records:
  • Speed log – Speed through water or speed over ground.
  • Gyro compass – Heading.
  • Radar – As displayed or AIS data if no off-the-shelf converter available for the Radar video.
  • Audio from the bridge, including bridge wings.  (Editor's note: This will be very important)
  • VHF radio communications.
  • Echo sounder – Depth under keel.
  • Main alarms – All IMO mandatory alarms.
  • Hull openings – Status of hull doors as indicated on the bridge.
  • Watertight & fire doors status as indicated on the bridge.
  • Hull stress – Accelerations and hull stresses.
  • Rudder – Order and feedback response.
  • Engine/Propeller – Order and feedback response.
  • Thrusters* – Status, direction, amount of thrust % or RPM.
  • Anemometer and weather vane – Wind speed and direction
    • Conclusion
    It seems to me that technology can be made to work remarkably well if we have the will to design our machines correctly. At the same time, it seems that human error can so easily slip in and overturn (literally) our best designs. Luckily, in both of these cases, large loss of life was prevented. In the case of the Air Canada flight this was due to the combined skill of the pilots, a well designed aircraft, and no small dose of luck. In the case of the Costa Concordia, the relatively small loss of life (compared to what it could have been) might be attributed to the good weather and the location of the incident so close to land.
     
    By the way, this article in the Telegraph pointed out that  the Costa Concordia did not fall over due to taking on water from one side. Rather, it is so tall that it it is not stable in water shallower than 26 feet, and that it is lying on its side because that's what it must do in shallow water. Note that the gash with the rock in it is facing up in all the photos. You would expect a gash to flood its own side and end up under water. The article is worth reading.
     
    Update January 16, 2011, 11:30 PM
     
    The basic elements of the article above are still correct, but there is now more clarity on certain items. For example, it appears that the Costa Concordia set out for the island from the beginning, and that the first time it hit a rock was when it reached the island. In addition, a savvy reader spotted markings on the Voyage Data Recorder to show that it's from another manufacturer.
     
    This animation shows the reports of the Costa Concordia's Automatic Identification System (AIS). This clearly shows that the Concordia set a course to Isola del Giglio soon after leaving its starting port. Note that this video is available in 720 HD. Select that and view in full screen. You can even see the ship turn around at the :36 mark in the video.

    This screen shot from the AIS video seems to show to course changes. The first seems to change the course from passing the island to the west, and instead passing to the east. The second course correction seems to take the Concordia directly towards the Isola del Giglio.

    Illustration: Guadian UK View Flash Animation
    This illustration seems to be the most accurate that I can find, and the easiest to understand. It looks like the Concordia came colse to Giglio, struck rocks near Le Scole, then continued north, only to turn south towards the port of Giglio, where it eventually became stuck on an an underwater outcropping and tipped over with the previously damaged side of the ship facing upward.

    Lastly, an eagle-eyed reader named Oliver Brandmueller wrote to me and pointed out that the Voyage Data Recorder on the Costa Concordia is actually an Avecs Bergen MER VDR. He also sent me a PDF brochure of the unit. (The website at www.avecs-bergen.de does not seem to work.) 
    The brochure shows how the data that is being replayed is displayed.
    Update Thursday, January 26, 2012
     
     
    This video, from the Costa Concorida News Page of John Konrad's blog, shows very detailed, AIS data recorded from a receiver on the island of Giglio, and narrated by John with tremendous insight from a ship captain. Watch and listen to the replay, and you'll feel like you finally have a clear idea of what happened. Data for the recording was provided by Quality Positioning Services BV (QPS), headquartered in Zeist, The Netherlands.
     
    This video shows, without a doubt, that the Costa Concordia slammed into known rocks because it approached the island too fast, and failed to turn soon enough given the momentum it had already built up. The ship turned, but still had motion (slipping sideways) towards the island and the rear of the ship slammed into well known rocks. For the captain to say he hit unmarked rocks is an unfathomable statement.
     
    It is truly hard to believe that after such a monumental collision, that the Captain of the Concordia would still insist that their only problem was a power blackout, even after getting immediate inquiries from the port of Giglio by radio. This fascinating recording of the radio exchange shows just how clearly Giglio interrogated the Concordia, and also how vigorously the crew insisted that there was no problem. It's only 30 seconds and its worth listening to.
     
    Recording of Captain Schettino Speaks With Gregorio De Falco of Italian Coast Guard

    This recording of Captain Schettino talking to the Coast Guard is one of the central elements of the drama that unfolded after the grounding. The captain had left the ship, along with his 2nd in command, and had landed on a nearby reef and was awaiting rescue. 
     
    Earlier Recording Where Captain Schettino Promises to Stay on the Ship
     
    The Italian Magistrate's Report
    There was a hearing to determine whether Captain Schettino would be jailed or otherwise held. The Magistrate's Report (PDF) is in English and contains some fascinating details, including this one: 
     
    ...it appears evident that, once having abandoned the ship, albeit in untimely fashion, he remained in place on the reef of Isola del Giglio where he had landed aboard a launch, and watched the ship sink at the mercy of the tragic event that was occurring (see the service report of Capt. Roberto Galli, Head of Area Security of the Municipality of Isola del Giglio, declarations made by Dimitros Christidis and by Stefano Iannelli and eyewitnesses, unambiguous on the point). 
     
    Voyage Data Recorder Was Inoperative
     
    Separately, this report from Thomas Gunn Navigation Services says that the Voyage Data Recorder Module removed from the ship was scheduled for repair the day AFTER the accident. But the key data was probably also available on hard drives: 
     
    A FAULT in Costa Concordia’s VDR was due to be repaired on 14 January, the day after it capsized, the company has confirmed. However, the problem only affected the 12-hour recording in the capsule itself, a spokesman assured Fairplay, not the two hard disks on the bridge, which held details of its last 24 hours and the previous 30 days. 
     
    Costa Concordia Links:
     
     
     
    4. http://www.es.northropgrumman.com/solutions/voyagemaster2/assets/VDR_S-VDRGuide.pdf  Detailed background about Voyage Data Recorder by Northrop Grumman.
     
    5. http://webstore.iec.ch/preview/info_iec61996-1%7Bed1.0%7Den.pdf  Specification for Voyage Data Recorders
     
    6. http://www.guardian.co.uk/world/interactive/2012/jan/15/costa-concordia-italian-cruise-ship-interactive  Interactive maps showing Guardian's view the Concordia's path. This does not match the illustration provided by the Daily Mail.
     
    7. http://marinetraffic.com/ais/default.aspx?oldmmsi=247158500&zoom=10&olddate=1/13/2012%209:02:00%20PM This site provides some recorded data of the Costa Concordia's path. This partial path matches what the Guardian is showing in the link above.
     
    8. http://www.seanews.com.tr/article/ACCIDENTS/74284/Costa-Concordia-accident-navigational-error/  This site claims to have the full course of the Costa Concordia, including a harrowing navigation between two small islands where they claim the Concordia hit the rocks. The MarineTraffic.com site data does not show the Costa Concordia passing through the two islands. A quick measurement on Google maps shows the gap in the islands to be about 200 feet. The Costa Concordia is about 120 feet wide.
     
    This video appears to be a playback from the MarineTraffic.com site. This seems to match the Guardian's (#6 above) very nice interactive illustration above.
     
    Gimli Glider (Air Canada 143) Links:
     
     
     
    3.   Gimli Glider fly-by on way to retirement
     
    4.  Gimli Glider three months before retirement
    Upvote Upvoted 9
    22 responses
    What a great geeky post on the complexity of modern transport and the simplicity of human failure. And amazing what data & media you can research and assemble in our connected world - love the 767 retirement fly-by video. Thanks, Bill!
    — reedsturtevant
    Reed - thanks for the comment. It really is amazing what you can piece together. No one that I've found has a clear an explanation as that WSJ piece -- from Europe, by the way. I was very proud to find out exactly which model of VDR the ship has...I'm pretty confident I have the right ID on that. But how cool is that? Not only can we confirm through a European site that the black box was found, but we have a photo of it being off-loaded that is detailed enough to find the the manufacturer.

    Separately, it is truly amazing how fragile our decision making can be compared to the relative robustness of our machines. After all, the Shuttle Challenger crashed simply because it was launched when it was too cold, and they were in a rush to satisfy Reagan when he went on national TV. If someone had simply put a spec somewhere that stated "Launch temperature range 50 to 95 degrees", then all would have been fine.

    The Costa Concordia seems to to have crashed due to a desire to please the passengers, and the Gimli Glider crashed due to a math error (Math errors deserves their own hall of fame that would include the Hubble, the Mars Climate Orbiter, and the ESA Cluster...among others)

    — Bill Warner
    i know i always think a new vessel - plane, train, automobile - is safer than an old one. likewise i know we all prefer a seasoned veteran (old) pilot, captain at the helm. bill this is a really interesting because it seems that both these machines of which you write, are new, shiny and filled with technology. yet it is simple human error that causes the problem.
    — John B
    Hi Bill! Thanks for this. As a non-engineer, this was educational for me, and posed in layman's terms for us non-engineering types to understand.
    — Bruce Mendelsohn
    The reason for the Concordia fiasco is one: EGO. We are the biggest, we have the best spa, we are the safest, we are unsincable, we are god, we know the best, and so on. It was bound to happen to any cruise line.
    Perhaps they will learn the lesson.
    Captain (navy) Mike Eldar
    — mike eldar
    First I was also very confident about the model of the VDR being an 4350 from SAM, but now I'm pretty sure it's actully an Avecs Bergen MER VDR. If you google the specs (there's a nice PDF around), you'll find a nice pic showing handles on the side (which the SAM one is missing) and the handle (on the pic of of Costa Concordia's VDR on the downside) for mechanical retrieval (by robots or similar). If you have a sharp look you could even compare the manufacturer's sticker on the side.
    — Oliver
    Bill, thanks for that great posting! Interesting that some incidents involve a rather lengthy chain of events where things went wrong (and either no one questioned things -- or didn't get any traction when doing so). Now I am going to read the Hoffer's book, Freefall, about the Gimli incident (for free -- local library has it, and it doesn't seem to be available in a Kindle edition). On one trip to Las Vegas for a major video show (NAB), I asked the captain of the 757 if he liked having CRT-based instrumentation. He replied that it's great [except maybe on the Gimli trip], since you no longer had to constantly scan a giant array of indicator dials and such]. Then, he mentioned how it was critical to know what version of the autopilot software was installed on the plane, because the method of entering course data could differ, and there were constant course corrections needed when flying across the country. That's the kind of thing that makes me a little nervous; I should have asked at the end of the flight [which was a rough one]! Also, on the marine wreck front, having been a fan of BMW cars, I remember this accident from a number of years back:, since a huge number of custom-ordered BMW cars were lost: http://www.marineinsight.com/marine/life-at-sea/maritime-history/worst-mariti... . The salvage company ended up having to cut the ship into manageable chunks, something they hopefully won't have to do with the Concordia.
    — Paul
    Thanks. Your Blog reads well, I like it, keep at it, love it.
    — Crane Repair
    >> the website at www.avecs-bergen.de does not seem to work

    Bill, thanks for your great Blog. Just trying to help a bit with the puzzle:

    The AVECS Corporation (a group of companies that AVECS Bergen belonged to as well) was bought by Interschalt maritime systems AG (www.interschalt.de) in the mean time. Back in the days, AVECS Bergen was selling the VDR (product name: MER-VDR) on their own, but also supplying to OEM partners like Raytheon (Raytheon MER) and SAM (Debeg 4300), maybe that's where the confusion comes from.

    The pictures definitely show an AVECS capsule (FRM - Final Recording Medium), developed and made by a sub-supplier from southern Germany (Novega).

    In the mean time Costa confirmed that the FRM wasn't properly working, but likely (as on most of the 'high end' passenger ships) this VDR is also equipped with long term recording where the data are stored on a separate 'standard' PC on a separate hard disk for 24 hours in detail / 30 days without radar pics.

    — Tom Bombadil
    Forgot to mention the link on Novega/Noah: http://www.noah-strongroom.com/index.php?id=111&L=1. Capsule is showing up in slides.
    — Tom Bombadil
    Tom - Are you serious that the VDR black box wasn't working? Do I understand properly that there is another recording on a PC that might not have been damaged and would have been recovered from the ship. It would have 24 hours of detailed data (hence covering the event) and 30 days of data without radar images?
    — Bill Warner
    Bill, I am referring to http://kreuzfahrt-zeitung.de/costa-concordia-tragoedie-gegendarstellung-defek..., along with the official statement of the Costa CEO that a VDR service was planned but could not be done in the last port of call before the accident.

    Also, e.g. look here (just google to find more sources): http://sg.news.yahoo.com/costa-ceo-blames-captain-error-grounding-110430721.html. Somewhere in the middle is stated:

    "Coast Guard Cmdr. Filippo Marini said divers had recovered the so-called "black box," with the recording of the navigational details, from a compartment now under water, though no details were released." --> There is enough pictures in the internet showing coast guard members dismounting the FRM from a boat alongside to the so called 'monkey island', the highest deck position on board, which is still above waterline. FYI the FRM is a 'quick-dismount' device.

    How does a black box work? --> Imagine you have a PC at home that is recording whenever you switch on/off lights, TV, radio, recording voice of your door opener, and in addition it is recording surveillance cameras outside your house (the radars). As you are a careful person, this PC is storing the information in a shoot- and fireproof capsule hidden at the roof (the 'FRM'). But in addition, this PC is storing all information in parallel on a built-in hard disc for 24 hours. Videos and door-opener-recordings take a lot of space, so you can only save 'major' information (eg lights on/off) for a longer time (30 days).

    So if your FRM is unusuable - what would you do?

    — Tom Bombadil
    Bill –

    Thanks for a great job. The media did even worse than usual on the Costa Concordia. You have assembled what was frustratingly absent from their breathless reports.

    Some have attributed both incidents to simple “human error”. It’s usually more complicated than that. Working as an engineer at Grumman in my first job out of school, I avidly read many FAA reports on investigations of airplane accidents. They all read like Greek tragedies: error piled upon error, leading inevitably to a tragic end result. Exactly what happened with the “Gimli Glider”. (Even the simple apparent piloting error on the Costa Concordia, a skid on to the rocks, isn’t the full explanation. The ship was where it was due to a series of procedural errors.)

    As an engineer, I naturally began thinking about what might have prevented these accidents. Each could have been avoided with a small addition of electronic equipment.

    Erroneous paperwork showed Flight 143 taking off with 20,000 pounds more fuel than it had aboard. Airline pilots know the takeoff weight on every flight they make – as determined by adding up a bunch of calculated numbers. Suppose the 767 had a strain gauge on each landing gear strut, feeding a cockpit instrument showing total weight. A measured value showing ten tons less than the paperwork number would have been noticed. They would never have taken off without resolving the difference.

    Procedural changes will follow the Costa Concordia disaster. No more will captains be allowed to skim close to shore for sightseeing. But an electronic display might have prevented the piloting error itself from happening. It seems the captain was going too fast, turned to starboard too late to avoid the rocks, so the stern skidded into them. In short, keeping out of trouble depended on his judgment as to where the ship could be a few minutes from now, and his judgment proved faulty. But suppose a simulator calculated that for him, and displayed an area around the ship that was the “envelope” of places it can’t possibly avoid, including effects of turning, skidding, etc. The piloting exercise would simply consist of keeping that area in deep water, off the rocks. Once it moves over the rocks, there is no way to avoid them. But much less judgment is called for. Something like a stall warning on an airplane. Even the captain of Costa Concordia might have evaded the rocks he hit because, it seems, he misjudged how fast he could turn his ship as he approached the island.

    Tom Hagan

    — Tom Hagan
    9 visitors upvoted this post.
    Add Website URL »