An Airbus A330 of that weight should touch down at about 135 knots. On 13 April 2010, Cathay Pacific 780 arrived at Hong Kong at 231 knots — with both thrust levers at idle, one engine stuck at seventy percent power, the other stuck below idle, and no checklist anywhere in the world for what was happening.

Three hundred and twenty-two people were on board. Everyone survived. The reason is two pilots who improvised a landing nobody had ever been trained for, and the cause was something that had never been seen in an aircraft fuel system before.

It started with rain and a hacksaw

The chain begins on the ground at Surabaya, nowhere near an aeroplane. In 2009 the airport’s hydrant refuelling circuit was extended. The pipes were cut open by hand during heavy rain, at an airport beside the sea with saline regulating ponds nearby. Salt water got into the system, and the flushing that followed did not clear it.

What happened next is the genuinely novel part. The refuelling dispenser’s filter monitors work using a superabsorbent polymer that swells when it meets free water and shuts off the flow. Salt water defeats it. Instead of swelling and stopping the fuel, the polymer gelled — and under refuelling pressure the gel was extruded straight through the filter media.

It emerged on the far side as microscopic spheres, five to thirty microns across, with sodium chloride crystals on their surfaces. The filter designed to protect the aircraft had become the contaminant.

Twenty-five microns

Inside each engine’s fuel metering unit sits a main metering valve: a piston sliding inside a sleeve, with a working clearance of roughly twenty-five microns. The spheres were the right size to agglomerate and wedge into exactly that gap.

First it produced stiction — the small engine pressure ratio fluctuations the crew noticed in the climb. Then it produced seizure. And here is the cruel detail: each valve locked at whatever position it happened to be in at the moment it jammed.

Number two engine had misbehaved from the start, and the crew, following the electronic checklist, had brought its thrust lever to idle. So it seized at idle — about 17 percent N1, effectively useless. Number one seized later, while set to maximum continuous thrust. It locked at around 74 percent, and stayed there.

They now had one engine they could not throttle up and one they could not throttle down.

The approach

The first warning at altitude came at 01:58 UTC: an engine two control system fault. It cleared. It came back. The crew consulted maintenance control, everything else looked normal, and they continued — which was the correct decision on the information available.

At 05:19, a hundred and ten miles from Hong Kong, engine one threw the same fault and engine two stalled. A PAN call went out. Eleven minutes later engine one stalled too, and the call was upgraded to MAYDAY.

On final approach they had both levers at idle and an engine that would not come below about seventy percent. They used full speedbrake. They put the gear down early. They could only get limited flap, because they were already past the placard speed for anything more. The aircraft exceeded its flap limits and its tyre speed rating on the way down, and the ground proximity warning system called terrain and pull-up repeatedly.

Captain Malcolm Waters, 35, had 2,601 hours on type. Hayhoe, 37, had 1,171. What the cockpit voice recorder captures is not drama.

They touched down at 231 knots, 680 metres beyond the threshold. The aircraft bounced, rolled seven degrees left and scraped the number one engine cowling on the runway. Only one thrust reverser deployed. They braked manually and fully, and stopped 2,630 metres later.

One correction worth making

The story is usually told with the tyres bursting. They did not. The braking energy was so extreme that the thermal fuse plugs in the wheels melted, which is precisely what they are designed to do — they deflated five of the eight main tyres deliberately, and in doing so prevented a burst.

The fire crews then reported smoke and flame at the wheels, which is what prompted the captain to order an evacuation. Every injury on the flight happened on the slides. Nobody was hurt by the landing.

A line pilot’s breakdown of the flight and what the crew were dealing with.

There was no procedure, so they wrote one afterwards

The Hong Kong Civil Aviation Department’s final report, published in July 2013, is unusually direct about the fact that the crew were operating without a map. Superabsorbent polymer spheres in an aircraft fuel system were, in the report’s own phrase, unheard of before this accident. There was no checklist for a dual thrust-control failure of this kind because nobody had imagined it.

The report also notes something easy to skip past: landing distance data for that configuration and that speed was not provided by either Airbus or Cathay — and was not required to be.

What followed was substantial. Airbus issued a service information letter within seven months and, in September 2011, created a new quick reference handbook procedure — Suspected Engine Fuel System Contamination — which exists solely because of this flight. The filter monitor was redesigned. ICAO published a manual on civil aviation jet fuel supply in June 2012, and the report recommended that refuelling equipment carry a device that automatically halts refuelling when filter differential pressure goes out of range.

Waters and Hayhoe received the Polaris Award from the International Federation of Air Line Pilots’ Associations in 2014, the profession’s highest honour for airmanship.

Documentary reconstruction of the approach and landing.

A second reconstruction, with the flight-data and cockpit-voice timeline laid out.

Pourquoi c'est important

Most celebrated airmanship cases involve a failure the crew had at least heard of. Sullenberger had practised engine-out drills. The Gimli Glider crew were gliding an aeroplane, which is a thing aeroplanes do badly but predictably.

CX780 was different. The failure mode did not exist in any manual, the aircraft would not slow down, and there was no time to work out why. What the report credits them with is not heroics but process — they concentrated, as it puts it, on flying the aircraft for a safe landing, and left the diagnosis for later.

The checklist that would have helped them was written eighteen months after they landed. It is named after their problem.

Sources: Hong Kong Civil Aviation Department Final Report 2/2013 and CVR transcript, Aviation Safety Network, IFALPA, ICAO Doc 9977, Airbus SIL 28-094