The inoperative items on the 14.6 year old plane, due to the loss of hydraulic system “C”‘s pressure, were the centre autopilot, a part of the right autopilot, a few wing spoilers, normal flaps, normal landing gear extension and retraction, and the automatic speed brake. The left autopilot can independently handle the flight with no issues, and the flaps and landing gear can be deployed with the alternate systems on board. There was no foreseen need for concern whatsoever.

The North Atlantic Track (NAT) followed by LOT 016 on the 1st of November, 2011, was track “V”, which was comprised of waypoints RAFIN-VODOR-N45W50-N46W40-N48W30-N50W20-SOMAX-ATSUR. LOT 016 reached its initial cruise altitude of FL310 about 15 minutes after departure. 30 minutes later the aircraft climbed to FL330. After an hour of cruise at 330, the crew step climbed to FL 340. Two hours forty minutes later, they step climbed to FL370 in accordance with ICAO eastbound levels when leaving the NAT.

As the crew approached Warsaw Chopin Airport, they attempted to extend the landing gear through the alternate mechanism. The alternate gear mechanism uses an electric motor to trip the locking mechanism for each gear. This releases all gear and door uplocks. The landing gear free falls to the down and locked position. But this did not happen.

The crew initiated a go-around, and entered a hold. While in the hold, the crew declared an emergency. Twenty minutes thereafter, combat aircraft were scrambled to visually check the status of the landing gear. Fuel was running low and 72 minutes after the go around, the crew prepared to perform a belly landing on Runway 33 of Warsaw Chopin Airport. The 767 FCTM states wisely that “A gear up or partial gear landing is preferable to running out of fuel while attempting to solve a gear problem“.

The 767 FCTM is the only document that describes the technique for an all gear up landing:

“Land in the centre of the runway. the engines contact the ground first. There is adequate rudder available to maintain directional control during the initial portion of the ground slide. Attempt to maintain the centreline while rudder control is available“

The 767 was configured with land with flaps at 30 degrees. The runway was sprayed with foam, despite the FCTM stating that spraying is not necessary as it provides minimal benefit. To minimize the chances of a fire, runway lights were turned off when the aircraft was on short finals and the crew had the runway in sight. Winds were from 120 degrees at 5 knots.

The typical dry operating weight of the 767 is 86,100kg. 231 souls on board would contribute to approximately 102kg X 231 = 23562 kg. Not considering fuel and extra cargo, with this total weight of 109,662kg (241,763lbs), the approach reference speed (VREF) with flaps 30 is 124kts. At 117,934kg (260,000lbs), the VREF is 130kts, which is a difference of 6kts for 8,272kgs. With this near 8000kg uncertainty to account for remaining fuel and any extra cargo, the 767 may have touched down at around 124-130kts IAS. The tailwind would have added the 5kts, making the aircraft’s ground speed on touchdown between 129 and 135kts.

Based on videos of the incident, the tail struck the runway first, with the engines contacting the runway almost a second later. Sparks and intermittent flames were seen only from engine #2. In fact, Engine #1 seems to have had sufficient foam under it, while Engine #2 had little, if any, most probably due to an asymmetric spraying of foam on either side of the runway centreline, and the aircraft itself having been slightly to the right of the centreline: This especially happens when the captain is the one who is landing the airplane. Photos of the airplane after it having come to a rest show the aircraft having veered slightly to the right of the centreline, possibly from asymmetric friction between the engines and the runway. Spoilers were manually deployed after landing, though not all extended due to the absence of pressure in hydraulic  system “C”. Fuel flow to the engines seem to have been cut off on landing, but it is not yet known at exactly which point down the runway the action was performed. Thrust reversers were not available due to the absence of signals from the weight on wheels sensors on the main landing gear.

Almost 9 hrs and 18 minutes after leaving Newark Liberty International Airport,the Boeing 767 registered SP-LPC came to a stop on the 12106 feet long runway 33, almost 7000 feet from the runway threshold. This left the aircraft right at the intersection of Runway 29-11 and Runway 33-15, closing the airport for any operations, till the next day.

Evacuation of the 220 passengers and 11 crew members was completed in 90 seconds, through all doors except the right hand overwing exit.

On the 7th of November, 2011, Polish President Bronisław Komorowski awarded Captain Tadeusz Wrona with the Officer’s Cross of the Order of Polonia Restituta, one of Poland’s highest orders.

The cause

What prevented the landing gear from being extended normally was a damaged hydraulic hose of the right main landing gear. This damage drained out the centre “C” hydraulic system’s fluid. But even without this hydraulic system, the airplane was designed to function normally and land safely.

When members of the Państwowa Komisja Badania Wypadków Lotniczych (PKBWL, State Commission on Aircraft Accidents Investigation) entered the cockpit about 20 minutes after the aircraft was evacuated, they found a circuit breaker (CB) “popped”: that is, in a position that doesn’t complete the electrical circuit. This particular circuit breaker, referred to as C829 BAT BUS DISTR, is located on a vertical panel behind the captain’s seat. This CB, when connected, supplies power, via another CB, to the landing gear alternate extension motor. Since this CB was out, the motor could not run, and the motor’s running is important to release the locks that keep the landing gear and door retracted.

When there is an electrical overload or short in a system, a CB pops out, or trips. By popping out, it opens the circuit and prevents a high current from starting a fire. This may lead to an early conclusion that the CB tripped in flight. However, the other CBs down the electrical line, were not found popped out. Also, when the aircraft was hoisted up with cranes, the aircraft powered up, and the CB inserted into its normal position that ensures electrical connectivity, the landing gear alternate extension system worked, and the landing gear dropped down.

The mystery shrouding this incident is how the particular CB tripped. That should be explained in the final report from the PKBWL.

Learning:

To have brought down a heavy airliner on the runway centreline, in the absence of any landing gear, is quite a feat. Lateral stability doe to uneven friction from the engines is an issue, yet the captain was able to keep the aircraft almost on the centreline throughout the entire slide down the runway. Experience does come into the picture: the captain had a total of 15,980 hours of experience on the day of the incident, and the first officer had 9431 hours of experience. Excellent CRM would have definitely played a role in the timely evacuation of all 231 souls on board, resulting in the safe end to LOT flight 016. A mix of good technical understanding, CRM, and experience are surely responsible for saving the day.

While the entire crew of that flight is being applauded for their heroic actions on the 1st of November, focus must be shifted to the design of decision support systems and training. If the report proves that it was only a simple circuit breaker that came between the aircraft and its landing gear, certain simple modifications may need to be effected in cockpit design, flight crew manuals, and crew training, listed and discussed below in the descending order of ease.

Crew Training:

In case of abnormal flight scenarios involving malfunctioning systems, a simple check of the Circuit breaker panels, noting those that have tripped, and relaying the same to the operations centre is a short procedure that can have a great impact on flight safety in such situations. In the 72 minutes that the crew had on their hands between the go around and their decision to land with gear up, it would have taken ten seconds per a circuit breaker panel scan, (totally 30 seconds), thirty seconds to get out of the seat, and another thirty seconds to note the designation of the CB that had tripped. In a matter of tens of minutes, the relevance of the CB in system malfunction could have been determined by the operations centre. Training can focus and work on this issue.

Flight Crew Manuals

The QRH in all aircraft can be updated to include one additional check item when dealing with system malfunctions: the circuit breaker panels. This will ensure that crew have a better situation awareness of the systems that they are dealing with.

Flight Deck System Design

Today’s processing ability does not prevent having a system that relays the status of individual circuit breaker breakers to the flight crew. A system of displaying on the Engine Indicating and Crew Alerting System (EICAS) a particular CB that has tripped will play an important role in system troubleshooting when in flight. If however that is perceived as too much, a simple, non specific indication on the EICAS that a CB has tripped is easy to implement, and may play an important role in flight safety. Such a system exists on the Bombardier Global Express. The Global Express has an Electrical Management System (EMS), whereby the status of all circuit breakers is monitored (trips are automatically displayed) and can be acknowledged and reset via this EMS. EMS Control Display Units (CDU) are installed on the pilot’s and copilot’s side panel. A “CB TRIP” message appears on the EICAS anytime a circuit breaker trips.

Addendum: Just for those interested: the route followed by LOT 16 on November 1st is as under:

KEWR04L MERIT HFD PUT BOS VITOL N27A NANSO N27A RAFIN NATV SOMAX NATV ATSUR EVRIN UL607 INLAK UL179 CPT UQ295 BPK UM185 CLN UL620 ARNEM UP147 RKN UL980 CZE UP150 BIMPA EPWA33