An Exercise in Self-Deception: The crash of KLM Cityhopper flight 433
On the 4th of April 1994, a Dutch commuter plane bound for Wales turned around and returned to Amsterdam after the pilots reported a problem with one of the engines. But just seconds before landing, the pilots suddenly lost control of the plane, which rolled uncontrollably to the right before plowing sideways into a muddy field. The twin turboprop cartwheeled and came to rest on its side, killing three and seriously injuring nine of the 24 people on board. But what had caused this sequence of apparently escalating mechanical failures? To the surprise of Dutch investigators, an exhaustive examination turned up nothing wrong with the airplane, except for a single faulty warning light. It was this tiny glitch that set in motion a cascading series of errors in which the pilots failed to recognize the consequences of their own inputs, convincing themselves that something was seriously wrong with their perfectly operational airplane — and they never considered the simple, obvious course of action that would have solved all their problems.
KLM Cityhopper is a wholly owned subsidiary of Dutch flag carrier KLM, which carries out mostly regional flights to complement KLM’s primarily long haul international services. With a large fleet of small twin-engine turboprops, KLM Cityhopper offers flights to cities all over Central and Western Europe on routes popular with business travelers and commuters. One of these was flight 433, a regular service between Amsterdam and Cardiff, Wales. For this route on the 4th of April 1994, KLM Cityhopper provided a Saab 340B, a Swedish-built twin turboprop with room for 34 passengers. In command of the flight were Captain Gerrit Lievaart and First Officer Paul Stassen, who had 1,200 and 1,300 hours respectively on the Saab 340B. Joining them were a flight attendant and 21 passengers, totaling 24 people on board.
At 2:20 p.m. local time, KLM Cityhopper flight 433 lifted off the runway at Schiphol Airport and began to climb toward its cruising altitude of 20,000 feet. For about ten minutes, all was normal as the plane climbed out over the Dutch countryside.
Then, at an altitude of 16,500 feet, the pilots were suddenly jolted from their routine by the sound of the master caution warning, the generic alarm which alerts the crew to the presence of a mechanical failure. Lievaart and Stassen immediately looked at the warning panel, where they observed that the right engine oil pressure light had illuminated.
“Right engine oil pressure,” Stassen announced.
“Check. Take action.”
Stassen pulled out the quick reference handbook (QRH), which contained procedures for how to react to all the various warnings which they could experience in flight. What neither pilot knew was that the warning was actually false — a short circuit in the switchboard attached to the right engine oil pressure warning light had caused it to illuminate even though oil pressure was normal. But the checklist was designed with this possibility in mind, and it would help them to quickly determine whether the warning was real.
“Take action… Emergency checklist… Engine and propeller oil pressure low, 15B,” said First Officer Stassen, flipping through the QRH. “15B… engine oil pressure low, engine oil and prop oil pressure… checked.”
Before Stassen had even found the checklist, Captain Lievaart began to pull back power on the right engine, even though this wasn’t part of the prescribed procedure. Most likely, Lievaart was worried that leaving the engine at high power without sufficient oil could lead to a catastrophic engine failure, but he was supposed to wait until a problem was actually verified before doing this.
Unaware of Lievaart’s actions, Stassen glanced at the right engine oil pressure gauge to verify that there was a problem. “Well, engine oil pressure, uh… that is this one, this one is slightly lower than the other one, but… it is decreasing,” he said. Because Lievaart had reduced power to the right engine, the oil pressure reading for that engine began to decrease. But neither pilot apparently made the connection.
“Yes,” said Lievaart.
“Yes, it is decreasing.” Continuing through the checklist, Stassen said, “Then next… engine oil pressure warning panel light on, or engine oil pressure below 30psi.”
The gauge clearly showed that oil pressure on the right engine, although lower than that of the left engine due to the lower power setting, was above 30psi and well within the normal range. The warning light and the gauge derived their readings from independent sources to ensure that a failure of the warning system doesn’t lead to an incorrect reading.
“That is not the case,” Lievaart said. “But it is still normally in the green, that is what is so strange.”
“That’s funny, isn’t it?” said Stassen. According to the checklist, there was no problem if the oil pressure gauge showed a normal pressure reading, but the fact that the pressure was nevertheless decreasing had both pilots spooked.
Now they needed to decide whether or not they should return to the airport. “Yes, but we are not going to continue with this,” said Captain Lievaart.
“No no no no no,” said Stassen. “Engine oil pressure… well, light or below 30psi, that is not the case. So one of two things… if so, then you may continue, but if they are both on, so if the light is on and the pressure is below 30psi, then it must be shut down,” he announced, paraphrasing the checklist.
“Okay,” said Lievaart, “Well, what do we have? Is it above fifty?”
“Yes.”
“And we… the warning pressure is…”
“Yes, the light is on. So the light is on, or below thirty, or…”
“Continue normal operation,” said Lievaart.
“Yes.”
Having worked through the checklist, they had correctly come to the conclusion that the presence of the warning light in combination with a pressure reading above 30psi meant that the flight could continue as normal. But Captain Lievaart failed to restore the right engine to climb power, either because he forgot, or because he had lingering doubts about the condition of the engine. Either way, leaving the engine at idle was inconsistent with the decision to continue the flight.
However, with one engine at idle (where it generates little to no thrust), the plane was not able to climb as quickly as before. With one engine bearing the bulk of the load, flight 433’s rate of climb began to deteriorate, which quickly caught Captain Lievaart’s attention. But instead of restoring the right engine to climb power, he saw their inability to climb as confirmation that something was actually wrong with the engine. Just a few seconds after saying they could “continue normal operation,” Lievaart changed his mind and announced that they would return to Amsterdam.
At Lievaart’s urging, First Officer Stassen called the tower and issued a “PAN-call,” one level short of a mayday call, to inform air traffic control that they had an abnormal situation which was not an emergency. Flight 433 turned around and began to head back to Schiphol Airport.
The crew did not discuss how one engine being at idle would affect the landing until 2:42, well into the descent toward the airport. At this point, Stassen commented, “I also think that, because you are flying in flight idle, that because of that you have less problems than you might have had otherwise.”
“Yes,” said Captain Lievaart. Both pilots apparently believed that the plane would be easier to land with the right engine at idle than it would be if they shut it down entirely. However, this was not actually true. By this point Lievaart had announced that they would use the normal procedures for landing with all engines operative, and he presumably believed that leaving the right engine at idle instead of shutting it down would allow him to use this procedure. But in reality, an idle engine actually causes more difficulties than an engine which has been shut down. While the engine does not produce thrust in either state, it causes more drag when idling, which makes the plane more difficult to control. To avoid this the crew should have either restored the right engine to normal thrust or shut it down entirely and used the one-engine-inoperative landing procedure. Instead, they were effectively trying to land with one engine out while using the procedure for a normal landing — a combination which would have deadly consequences.
Captain Lievaart soon requested a landing on runway 06, which the controller swiftly granted. First Officer Stassen pointed out that this would force them to land with a 10-knot tailwind, the maximum allowed by regulations, but Lievaart decided to proceed anyway. In order to lose enough altitude in time to land on runway 06, Lievaart now put the left engine at idle as well, and for most of the rest of the descent the engines would remain at this power setting. The crew completed the landing checklist on time, and shortly thereafter they intercepted the glide path to the runway. Now Lievaart needed to adjust their power and pitch to maintain the glide path and the target approach speed of 125 knots. But with one engine at idle and a strong tailwind, he found it difficult to do both of these things at once. It seemed that every time he accelerated to regain 125 knots, he ended up above the glide path, and whenever he throttled back to return to the glide path, his speed would drop below 125 knots.
Meanwhile, First Officer Stassen observed that the autopilot had been applying rudder trim to counteract the asymmetric thrust of the engines. With the left engine producing power and the right engine at idle, the plane tended to want to yaw to the right, which could be countered using the rudder; until now, the autopilot had been doing this by “trimming” the rudder to a position where it perfectly offset the thrust imbalance. But standard procedures called for the pilots to remove any rudder trim applied by the autopilot prior to landing, in order to make the plane easier to control while on the ground. At a height of 230 feet, Stassen removed the rudder trim — it was now Captain Lievaart’s responsibility to step on the rudder to compensate for the thrust imbalance. Meanwhile, their airspeed dropped to 119 knots, prompting Stassen to call out, “Watch your speed!”
When a plane yaws or “drifts” sharply, the upwind wing generates more lift than the downwind wing, which causes the plane to bank. In order to keep this bank under control, Captain Lievaart steered left using the ailerons, which kept the plane level but didn’t address the underlying yaw. Then, when Stassen called out “watch your speed,” he sharply accelerated the left engine to try to regain the proper approach speed. This caused the yaw to increase more, and the plane began to bank to the right more vigorously than could be counteracted with the ailerons alone. Flight 433 veered to the right of the runway even as Captain Lievaart applied full left aileron, and it immediately became clear that they would be unable to land. Lievaart called for a go-around and accelerated the left engine to max power, abandoning the approach.
With the left engine at max power and the right engine at idle, Lievaart needed to use the rudder to counteract the yaw and prevent the plane from turning right; the ailerons alone would not do the job. But he did not do so. Instead, still applying full left aileron, he pulled back on the controls to climb, achieving a pitch angle of twelve degrees nose up. This was too steep an angle with only one engine generating power. Consequently, the plane rapidly began to lose speed. Within moments, the stick shaker stall warning activated, alerting the crew to an impending stall. Lievaart pushed the pitch back down to six degrees, but then increased it up to nine degrees, causing the stall warning to activate again.
At this point, airspeed dropped below 103 knots — the plane’s so-called “minimum control speed.” The minimum control speed, or Vmca, is the slowest speed at which the plane can be controlled with one engine inoperative. Because the effectiveness of the flight controls decreases proportionally with decreasing airspeed, below a certain speed the ailerons and rudder together will not have enough control authority to overcome the yaw and bank caused by the inoperative engine. When flight 433 dropped below this speed, the plane snapped hard to the right. Captain Lievaart finally planted his foot on the rudder, but it was too late; the only way to recover was to accelerate the right engine and get back above Vmca. Seconds later, banking through 80 degrees, the right wingtip struck a field some 500 meters to the right of the runway. The wing dug into the muddy soil and the plane cartwheeled into the ground, tearing off the wing and sending the fuselage sliding sideways across the ground. After sliding for over 100 meters, the plane rolled over onto its left side and lurched to a halt, badly damaged but with the cabin largely intact.
The crash instantly killed two passengers seated in the right front part of the aircraft, where the fuselage first struck the ground; Captain Gerrit Lievaart also perished because he was not wearing his seat belt, causing him to be thrown against the glare shield on impact. However, the left wing fuel tank miraculously was not breached during the crash, preventing the ignition of a serious fire. The passengers, most of them suffering various degrees of injury, found themselves hanging by their seat belts in the sideways airplane, shaken, but alive. The left side exits were pinned against the ground and could not be opened, while the right overwing exit was straight above their heads, making it difficult to reach. Three passengers managed to climb out through it, but most remained trapped inside the plane — had there been a fire, they would have burned alive. After struggling through the muddy farmer’s field surrounding the plane, rescuers managed to free the trapped survivors by slicing through the roof with specialized power tools. Nine people suffered serious injuries, including First Officer Stassen, but aside from the three who died on impact, everyone made a full recovery.
Investigators from the Dutch Safety Board soon arrived on the scene and removed the plane’s black boxes for analysis. Their next priority was to interview First Officer Stassen, but it turned out that Stassen had suffered a brain injury during the crash which left him unable to recall anything about the flight. They would get no first-hand insight into the reasoning behind the actions of the crew.
A technical analysis of all the plane’s systems revealed that the only thing wrong with the aircraft was a short circuit in a switchboard which erroneously triggered the right engine oil pressure warning light. Everything else from that point on lay with the actions of the pilots. From the flight recorder data, it was apparent that while First Officer Stassen ran through the checklist correctly, Captain Lievaart pre-emptively rolled the right engine back to idle power and left it there for the rest of the flight. This was the instigating error that spawned all the other errors which followed. What confused investigators was the question of whether Lievaart knew the right engine was still at idle when he decided to continue the flight. The evidence suggested that he did. Later in the flight, the pilots agreed that the plane would be easier to land with the engine at idle rather than shut down, and they also reported to ATC that the engine was at idle when asked for the nature of their problem. Considering the above, it was likely that Lievaart knew the idle engine was the reason they weren’t climbing, and decided to return to the airport because of this fact. What he didn’t understand was that the decrease in the right engine oil pressure was because he had reduced power on that engine, not because there was something wrong with it. However, having become convinced that something was wrong with the engine, he completely blocked out the possibility of restoring it to full power. Not even at the last moment, when accelerating the right engine was his only hope of saving the plane, did it occur to him to try.
Obviously, had the crew returned the engine to climb power, they could have continued to Cardiff without incident. But it was also entirely possible to return safely to Schiphol with one engine inoperative. The problems only escalated because the pilots falsely believed that they could use the normal landing procedure with the engine at idle. In reality, they needed to fly as though the engine was inoperative. Pilots are trained to steer against a failed engine using the rudder, and the single-engine landing procedure reminds them of the minimum control speed (Vmca), but Lievaart and Stassen clearly failed to appreciate that these items were equally important when the engine was turned on but not generating thrust. The period during the descent when both engines were at the same power setting might have further lulled them into a false sense of security. When First Officer Stassen removed the rudder trim applied by the autopilot, Captain Lievaart was not mentally prepared to use the rudder to keep the plane straight. He instead used the ailerons to counter the roll, which allowed the yaw to keep getting worse until the plane veered off the runway heading.
Lievaart correctly determined that this situation required a go-around. But the procedures for a go-around are different with one engine. Namely, with one engine inoperative, the pilot cannot pitch up as steeply as normal. Maintaining airspeed at the pitch attitude used in a normal go-around requires more thrust than a single engine can provide, meaning that a shallower angle of climb must be used. By pitching up too steeply, Lievaart caused the plane’s airspeed to drop below Vmca, resulting in an uncontrollable roll to the right. Had he followed the single-engine go-around procedure, the airspeed would have stayed above Vmca and the crash would not have occurred.
Captain Lievaart’s treatment of the situation betrayed a lack of technical understanding. Although he isn’t alive to confirm this, the evidence suggested that he did not know how thrust settings affected oil pressure or that an engine at idle was aerodynamically similar to an engine that has been shut off entirely. His determination that it was not necessary to use the single-engine landing and go-around procedures resulted from an overly literalist interpretation of the instructions, and showed that he did not understand some of the basic principles behind flying a multi-engine airplane. Even though in both cases the engine is “on,” an engine at idle obviously behaves differently from an engine providing normal thrust!
The Dutch Safety Board found that Lievaart had twice failed simulator checks on one-engine-out operations, and only passed after receiving additional training. On his most recent single-engine check, he scored a “standard minus,” the lowest possible passing grade. This again suggested that Lievaart understood the what but not the why of single-engine operating procedures. Like a student who knows how to punch two times two into a calculator but doesn’t know why the answer is four, he was unprepared for a situation in which he needed to derive the answer on his own.
This is actually a surprisingly common problem among young pilots who have transitioned relatively recently from single-engine to multi-engine operations. Some student pilots who can fly single-engine airplanes without issues sometimes struggle to wrap their heads around how a multi-engine plane will react to differential thrust, and although these pilots often memorize enough procedures to pass their check rides, they lack the ability to respond to a real emergency. A recent example occurred in 2019 in Addison, Texas, where a privately chartered twin-engine Beechcraft King Air suffered failure of the left engine during liftoff. The pilots did not adequately counter the yaw induced by the failed engine and did not maintain sufficient airspeed. When their airspeed dropped below Vmca, the pilots lost control of the plane, and the King Air rolled inverted and dived into a hangar, killing all 10 people on board. This video (below) of the Addison accident provides a vivid illustration of the aerodynamic principle which also led to the crash of KLM Cityhopper flight 433.
The Safety Board also noted that a lack of proper communication between the crewmembers was a contributing factor in the accident. There was no discussion of the possible effects of flying with one engine at idle. The pilots did not discuss how the 10-knot tailwind might affect their approach. They also did not try to work out why they were getting contradictory messages about the oil pressure. Throughout the flight, First Officer Stassen offered helpful bits of information and generally gave off the impression that he wanted to fly by the book, but Captain Lievaart frequently misinterpreted or outright ignored his statements, issuing contradictory orders without explanation. Stassen also failed to challenge him when this occurred. Unfortunately, crew resource management training (CRM), which could have helped the pilots communicate more effectively, was still being rolled out at KLM Cityhopper at the time, and while Lievaart had begun to receive the training, Stassen had not.
In its final report, the Dutch Safety Board recommended that Saab update its operations manual to either prohibit or provide procedures for flying with one engine at idle, and for neutralizing rudder trim while flying with one engine inoperative. It also recommended that KLM Cityhopper improve the way it assesses pilot abilities and expedite its introduction of crew resource management training.
But the best safety improvements sometimes don’t come from formal recommendations. Given the widespread problem of mistakes during single-engine operations on multi-engine propeller planes, the most important thing pilots can do is study previous accidents, like KLM Cityhopper flight 433, the Addison King Air crash, or Midwest Express flight 105. Captain Lievaart went to his grave believing something was terribly wrong with his plane, but the problem was really his own lack of knowledge about the fundamentals of flight. Just knowing what the procedures are is only half the battle — knowing why the procedures are the way they are is equally important, and it should be the responsibility of every pilot to know both, lest they meet the same fate as the crew of flight 433.
______________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read over 160 similar articles.
You can also support me on Patreon!
