Automation logic withheld braking for nine seconds as Lufthansa Flight 2904 overran the runway at Warsaw

On 14 September 1993 an Airbus A320-211 operating Lufthansa Flight 2904 from Frankfurt touched down at Warsaw Okecie in heavy rain on a runway covered with standing water, and then rolled for about nine seconds with essentially no braking. The jet's air-to-ground logic, which decides when the aircraft is on the ground, had not been satisfied: the spoilers, thrust reversers and wheel brakes all stayed locked out while the crew called for them. The aircraft ran off the end of the runway at roughly 72 knots, struck an earth embankment, caught fire and was destroyed. Two of the 70 people on board died and 56 were injured. The Polish investigation named crew decisions in windshear conditions as the cause, but recorded that the aircraft's own design had limited what braking the pilots could apply, and the US Federal Aviation Administration went on to order a landing-gear modification on US-registered A320s.

What happened on runway 11

The crew were warned of windshear on final approach to runway 11, both by the tower and by an aircraft that had just landed, and followed their airline's adverse weather guidance by adding speed. According to the official accident report published by Poland's Main Commission Aircraft Accident Investigation, the A320 crossed 50 feet at about 158.8 knots calibrated airspeed, nearly 30 knots above the 130-knot reference speed for its weight and well beyond the 20-knot increase the crew had intended, with a ground speed of 172 knots. The right main gear made first contact 770 metres past the threshold; the left main gear did not touch until nine seconds later, 1,525 metres down a runway with 2,800 metres available (Main Commission Aircraft Accident Investigation report).

Only at that second touchdown did the aircraft's automatic systems accept that it had landed. The ground spoilers then extended fully, the reversers began to operate at 71 percent N1, and the wheel brakes became effective roughly four seconds after that. Aquaplaning on the flooded surface had already cut braking effectiveness, and the report records that deceleration fell by about 30 percent over the last 180 metres of runway. The pilot flying steered right in an attempt to miss the obstacle ahead. The aircraft crossed the runway end at 72 knots ground speed, travelled a further 90 metres and hit an embankment carrying a localiser aerial with its left wing.

The logic that kept the brakes off

The report sets out the ground-sensing conditions in detail. Ground spoilers would extend only if the shock absorbers were compressed at both main landing gears, with at least 6,300 kilograms of load needed to compress one strut, or if wheel speed exceeded 72 knots at both main gears. Thrust reversers depended on the stricter of those two tests alone: compression at both main gears. A fast, lightly loaded touchdown on one wheel, with the tyres that were on the runway aquaplaning rather than spinning up, satisfied neither test. Among the commission's findings is the blunt observation that the crew had no way around this:

In emergency, the crew is unable to override the lock-out and to operate ground spoilers and engine thrust reversers.

Main Commission Aircraft Accident Investigation, Report on the Accident to Airbus A320-211 Aircraft in Warsaw

An independent engineering reconstruction of the landing by Clive Leyman, a former British Aerospace A320 landing-gear engineer, modelled the same sequence and reached a similar mechanical picture: the excess airspeed kept lift high and ground reaction on the gear low, the flooded runway then provoked aquaplaning so the tyres never reached the required rotational speed, and the aircraft slid on for nine seconds until drag had bled off enough speed to compress both main gears. Leyman's stopping-distance table estimates that removing the brake and spoiler delay alone would have shortened the calculated stopping distance by hundreds of metres (Engineering Analysis of the Landing Sequence, RVS group, University of Bielefeld).

Casualties, fire and evacuation

The captain-instructor occupying the right seat, who was checking the pilot flying, was killed on impact; the autopsy attributed his death to collision with cockpit structure. One passenger did not get out and died of carbon monoxide poisoning in the burning cabin. Sixty-three of the 64 passengers got out, largely by their own efforts, directed by the two cabin crew who were still able to act; a stewardess fainted after opening a door and the chief steward was knocked unconscious. The injury tally in the report is 51 serious and 5 minor, 56 injured in total, with spinal injuries the largest single category. Ruptured tanks spilled fuel onto the left side of the fuselage, which ignited, most probably on hot parts of the wrecked left engine or on the destroyed aerial's wiring, and the fire spread into the cabin. The aircraft, registration D-AIPN, was written off (Aviation Safety Network database entry).

What the investigators concluded

The commission's stated cause was the flight crew's decisions and actions after being told of windshear on approach, in weather produced by a front crossing the aerodrome with heavy rain and rapidly shifting wind. The tower had reported a light wind from 160 degrees at 25 kilometres per hour, but the flight recorder showed a tailwind of 25 knots at the outer marker and 18 knots at touchdown, well above the aircraft's 10-knot limit; the commission found the tower lacked certified current wind data, that the crew did not react to the tailwind shown on their own displays, and that a go-around was still justified and feasible. It also noted the embankment was not described in Poland's aeronautical publication. It added, in the same finding, that the crew's actions were also affected by design features that limited their ability to use the available braking systems, and by insufficient operations manual information about the increase in landing distance. The commission recommended that the manufacturer examine allowing emergency use of ground spoilers and thrust reversers independently of the aircraft's logic, and that Lufthansa's manuals be supplemented with landing-distance corrections for approaches flown fast because of windshear.

Leyman's independent analysis declined to single out one factor, applying a definition under which crew decisions, system design and airfield conditions all qualify:

the crew decisions, aircraft system design and airfield/environmental conditions are all potential `causes' in this accident, and it is not profitable to try to isolate a single item.

Clive Leyman, Engineering Analysis of the Landing Sequence

The regulatory response

The FAA proposed a fix in December 1993 and published it as airworthiness directive 94-23-06 on 21 November 1994, effective 21 December 1994. The directive does not name the Warsaw accident, and the Airbus service bulletin it mandates is dated June 1993, three months before the crash. The directive required operators of certain A320-111, -211 and -231 aircraft to replace the one-stage main landing gear shock absorbers with two-stage units, precisely so that the air-to-ground logic would register a landing sooner and release the braking devices earlier. One commenter argued the change was unnecessary and that two-stage struts existed only for passenger comfort. The agency disagreed:

The FAA has re-evaluated the air-to-ground sensing logic, has reviewed all other available data, and has determined that an unsafe condition exists with regard to the airplane failing to achieve the landing distances specified in the FAA-approved AFM.

Federal Aviation Administration, AD 94-23-06, Federal Register

The agency acknowledged that the full combination of factors that can lead to such an overrun was unlikely to recur, but refused to stretch the compliance deadline to five years, settling on 18 months instead, noting that aircraft with dual-stage struts would be able to activate ground spoilers, wheel brakes and thrust reversers earlier in the landing roll. It estimated 35 US-registered aircraft were affected, at about 19,190 dollars each and roughly 671,650 dollars in total. The FAA also rejected the argument that it should wait for France's civil aviation authority to act first, saying bilateral agreements do not stop it issuing directives on its own finding of an unsafe condition (Federal Register, 21 November 1994).

Why it moves the needle

Warsaw is one of the earliest well documented cases in which an automated system, working exactly as specified, denied two experienced pilots the controls they were urgently asking for. Nothing broke: the sensing logic applied its rules, and the rules did not describe the landing that was actually happening. The crew could see the runway end approaching and could not force the spoilers or reversers open, a lockout the investigation recorded as a finding of fact rather than a malfunction. That failure mode, where the operator's authority is bounded by a machine's model of the world and the model is wrong, is the same shape as failures that recur across later automation-heavy systems, from flight control protection laws to driver assistance and autonomous vehicles. The fix ordered by the FAA is instructive too: rather than change the software's decision rule, the regulator changed the hardware that fed it, so the logic would see the ground sooner (Federal Aviation Administration, AD 94-23-06, Federal Register).