Reckless Faith: The crash of Crossair flight 3597
On the 24th of November 2001, a regional jet flying for Swiss carrier Crossair slammed into a hillside near Zürich, Switzerland while on final approach. Twenty-four people were killed, while nine managed to escape with their lives. The crash was the second for Crossair in less than two years, and the people of Switzerland were beginning to ask questions. The investigation into the accident would reveal an all-too-familiar story: an assertive captain, an inexperienced first officer, a last-minute runway change, a navigational error. They would discover a pilot with a history of outlandish misadventures that defied common sense. In a fog of overconfidence and bravado, determined to get his plane on the ground as quickly as possible, he made the oldest mistake in the book — an error that no pilot in the 21st century ought to have made. But the system which allowed him to make such a confounding decision was rotten to the core: if there was one thing the accident revealed, it was that flying in Switzerland wasn’t safe.
Crossair was a Swiss regional airline specializing in short flights within Switzerland as well as to and from neighboring countries. Prior to its takeover of Swissair to form Swiss International Airlines in 2002, it operated a large and sometimes eclectic fleet of small to midsized airliners, including the Saab 340, the Avro RJ85 and RJ100, two types of Embraer E-jets, and the McDonnell-Douglas MD-83 (some of which it painted in garish McDonald’s livery to advertise the restaurant chain, probably because the airline was perpetually short of cash). Of particular note in this case was the Avro RJ100, a distinctive four-engine, high-wing regional jet produced by Avro International Aerospace, a wholly owned subsidiary of British Aerospace. The RJ100 was merely an updated version of the otherwise identical British Aerospace BAe 146, which was designed for short takeoffs and landings and was marketed as being exceptionally quiet. In 2001, Crossair operated 16 Avro RJ100s, making it the largest single operator of the type at the time.
It was one of these RJ100s that was scheduled to carry out Crossair flight 3597, a regular flight from Berlin, Germany to Zürich, Switzerland on the 24th of November 2001. In command of the flight was 57-year-old Captain Hans Ulrich Lutz, a veteran pilot with nearly 20,000 flight hours and a 22-year career at Crossair. His first officer was 25-year-old Stefan Löhrer, a new hire fresh out of training who had less than 500 total hours. (Curiously, however, Lutz had switched to the RJ100 so recently that Löhrer actually had more hours on type than he did.) Joining them that night were three flight attendants and 28 passengers, well short of what they were expecting: a group of 21 tourists who had been booked on the flight never showed up, leaving the 97-seat plane more than two thirds empty.
With Lutz at the controls, flight 3597 lifted off from Berlin Tegel Airport at 9:01 p.m., 21 minutes late. The cockpit voice recording begins some 35 minutes later, just in time to catch Captain Lutz giving First Officer Löhrer a long (and totally unnecessary) lecture about how to interpret a runway report. A couple minutes later, Löhrer provided proof of his competence when he pointed out that Lutz had let their speed get too high, forcing the captain to rein in the throttles.
The runway they planned to land on that night was runway 14, which was fully equipped with an instrument landing system. It was only as they were descending toward 13,000 feet at 9:47, having already conducted a full approach briefing, that air traffic control informed them they would be landing on runway 28 instead. About a month previously, authorities in Switzerland and Germany had signed an agreement to address the concerns of residents in southern Germany who had complained about the noise of airliners landing in Zürich late at night. The approaches to runways 14 and 16 — the two main runways at Zürich Airport — both passed over German villages at relatively low altitude, so the two countries agreed that between 10:00 p.m. and 6:00 a.m., all airplanes landing in Zürich would use runway 28, which would route them over Swiss territory. (How Swiss residents felt about this must not have been given as much thought.) Prior to this change, runway 28 was only used by airliners when there was a significant westerly wind, and it was not equipped with an instrument landing system — pilots had to use a VOR/DME approach instead. Because flight 3597 was on track to land shortly after 10:00, they just missed the cutoff to avoid having to use runway 28. Upon hearing of the change, Captain Lutz clearly became frustrated. “Oh scheisse,” he muttered, “that as well, fine. Okay.”
While briefly circling in a holding pattern, the pilots went over the approach to runway 28. This was a VOR/DME approach, meaning that the navigational aids would help them align with the runway, but they would be personally responsible for ensuring that they were at certain altitudes at certain distances from the airport. This could be accomplished by referring to their distance measuring equipment, or DME, which indicated their distance from the VOR radio beacon at the airport. After passing a point 6 nautical miles (11 kilometers) from the VOR, they would descend to their minimum descent altitude (MDA) of 2,390 feet, which they were required to maintain until they spotted the runway. That would be no easy task: the weather that night was poor, with a low cloud ceiling and visibility of 3,500 meters in mixed snow and rain.
At 9:58, flight 3597 received clearance to approach runway 28, and the pilots began to turn in toward the runway. As they descended, the lights of a village briefly became visible through the clouds, prompting Captain Lutz to comment that he had “ground contact.” Shortly afterward, at 10:04, another Crossair flight ahead of them reported that they had landed successfully, but that the weather conditions were near the minimums and they only saw the runway from 2.2 nm (4km) out. This report would play a critical role in the events to follow.
At around this time, Captain Lutz selected a descent rate of 1,200 feet per minute, the rate he estimated was necessary to hold to the appropriate glide trajectory given their airspeed of 160 knots. But over the next couple minutes, as the crew configured the airplane for landing, their speed began to decrease. This meant that they needed to descend more slowly in order to drop the same amount over the same distance. However, Lutz’s mind was apparently elsewhere: at no point did he change their descent rate away from 1,200 feet per minute. Consequently, flight 3597 began to descend below the glide path to the runway.
At 10:05, Captain Lutz noted that they were nearing the minimum descent altitude (MDA). The lights of another village were just visible through the fog, so he again said, “We have ground contact.”
“Yes,” said First Officer Löhrer.
Peering through the fog, Captain Lutz said, “Someone said he saw the runway late here… approaching minimum descent altitude… here we’ve got some ground contact.” Ten seconds later, they reached the MDA of 2,390 feet. “Two four, the minimum,” said Lutz. “I have ground contact, we’re continuing at the moment… we have ground contact, we’re continuing on.” Instead of leveling off at the MDA, he kept right on descending. This was a violation of the most basic rule of flying any approach: don’t descend below the MDA if you can’t see the runway. Lutz was able to see the lights of villages below the plane, but he was much too far from the airport to see the runway lights, given the conditions. Nevertheless, he believed that the lights of the airport would come into view at any moment. Tragically, he was wrong.
The problem with Lutz’s assumption was that he was actually much farther from the airport than he thought he was. Based on his statements, he believed he had reached the point where the previous flight said they saw the runway — that is, 2.2nm (4km) out. But at that moment they were actually 4.8nm (9km) from the runway. Because of their excessive rate of descent they had reached the MDA earlier in the approach than Lutz had anticipated, and he did not check his DME to confirm how far out they actually were.
As the runway failed to come into view, Captain Lutz became increasingly frustrated. Ten seconds after deciding to continue past the MDA, he said, “Scheisse, two miles he said, he sees the runway!” He apparently had no idea that they were still more than three nautical miles from the airport.
“Two thousand,” First Officer Löhrer said, calling out their altitude.
“MINIMUMS,” said the ground proximity warning system, informing them that they had reached their pre-set minimum radio height of 300 feet above the ground.
“Make a go around?” Lutz said quietly, as though weighing whether to act. Two seconds later, he made his decision. “Go around,” both pilots said in unison. Lutz immediately pushed the throttles to go-around power and pulled up to abandon the approach. Little did he know it was already too late.
Two seconds after applying go-around power, just as the plane began to level off, flight 3597 crashed headlong into a tree-covered ridge that stuck up into the clouds. Tree trunks ripped through the right wing, causing the engines to fail; the fuel tank burst and a stream of fuel erupted into a great jet of fire as the plane surged out the other side of the forest. Hopelessly crippled, the RJ100 struggled on for a further 200 meters, plunging down the back side of the ridge before slamming into the valley below. In just a few seconds, it was all over: the plane crashed to earth in a forest and ground to an abrupt halt, sending a wall of fire tearing through the mangled wreckage.
Incredibly, the tail section remained largely intact, and several people seated there managed to survive the crash. As flames threatened to consume what remained of the cabin, nine people — seven passengers and two flight attendants — fled out into the frigid night.
In the control tower, the sole controller on duty initially didn’t notice that flight 3597 had disappeared from her radar screen. Four minutes after the crash, she suddenly realized that the plane had not landed and raised the alarm. Directed by witnesses in a nearby village, local emergency services quickly reached the site, where they were stunned to find survivors running from the forest, backlit by towering flames. All nine survivors were quickly taken to area hospitals, while a search and rescue operation was launched to find any others who had wandered away into the woods. Unfortunately, there was no one else to find: all 24 remaining passengers and crew were dead. Among the victims were both Captain Lutz and First Officer Löhrer, along with American pop singer Melanie Thornton and two of the three members of the Eurodance group Passion Fruit, who had been on their way to a gig in Zürich. Several of those who survived also suffered serious injuries, including Passion Fruit singer Debby St. Maarten, who still required weekly medical care more than a decade after the crash — effectively ending her music career.
Meanwhile, investigators from Switzerland’s Aircraft Accident Investigation Bureau (AAIB) arrived at the scene to uncover the cause of the crash. The accident came as a shock for Switzerland: this was the third major tragedy to befall the small country in the past several months, coming shortly after 15 people were killed in a terrorist shooting and 11 died in a major accident inside the Gotthard road tunnel. This was also the second accident for Crossair in as many years: on the 10th of January 2000, Crossair flight 498, a Saab 340, crashed shortly after takeoff from Zürich, killing all 10 passengers and crew. In that accident, the AAIB found that the pilots — both hired from countries in Eastern Europe — had not been adequately trained or assessed after coming to Switzerland, and while taking off in low visibility conditions they lost control of the plane. Was this latest accident another case of poor-performing pilots slipping under the radar?
The basic sequence of events which led to the crash began when the pilots of flight 3597 were asked to approach runway 28 instead of runway 14. They were tired, it was near the end of the working day, and they were now asked to perform a much more difficult approach for no operational reason. A little bit of sloppiness was probably to be expected. What actually happened was much worse than that. Instead of configuring the plane prior to beginning the final approach, the pilots delayed these steps until after they were already beginning their final descent to the MDA, which meant they would need to constantly modify their descent rate in order to stay on the glide path. But as their speed dropped from 160 knots to 116 knots due to the extension of the flaps and landing gear, Captain Lutz kept their descent rate at 1,200 feet per minute, causing them to reach the MDA too far from the airport. Evidently, both pilots were more focused on their altitude and the search for the runway than on their DME, which would have told them that they were still more than four nautical miles from the runway.
This mistake was not in itself consequential, except in that it led Lutz to underestimate the remaining distance to the runway. Believing that he had already reached the point where the previous crew spotted the runway lights, he decided to deliberately descend below the MDA in an attempt to break through what he thought must be a thin layer of cloud preventing him from copying his colleague’s successful landing. Consequently, he continued through the MDA and crashed into a hill. It was the oldest mistake in the book: descending below the MDA without visual reference to the runway, blinded by a reckless faith that nothing would stand in the way. This is the story of countless plane crashes, not just Crossair flight 3597. What possessed Captain Hans Ulrich Lutz when he decided that he could get away with it when so many pilots before him died trying?
To understand this decision, the AAIB began looking through records and conducting interviews to piece together Lutz’s flying history. It turned out that he had a rocky training history stretching back decades. In 1961, at the age of 17, he failed his very first entry exam to begin flight training. Between 1963 and 1965, he was rejected three times from flight training due to insufficient education. In the late 1960s, he needed three years to get his instrument flight certification because he kept failing the exam. After being hired by Crossair in 1979, his performance was negatively assessed by an inspector from what was then the Federal Aviation Office; however, later that year responsibility for evaluating pilots was devolved to the airlines, and for 17 years Crossair never once criticized his aptitude. That changed in 1996 when he attempted to upgrade to the McDonnell Douglas MD-83, only to fail out of conversion training twice because of difficulty with the autoflight systems.
But all of these difficulties by themselves weren’t sufficient to say much about Lutz, except that he was maybe a little bit slow to learn. It was the specific incidents during his career that truly raised eyebrows at the AAIB. In 1990, he was instructing a trainee on the Saab 340 while parked on the ground when he overrode a series of safety measures and accidentally retracted the landing gear. The plane crashed to the ground and was damaged beyond repair. Following this incident, he was removed from his position as flight instructor for the Saab 340 but continued flying for Crossair. Then in 1991, while undergoing a route check, he failed to comply with an ATC instruction, flew into the wake of a Boeing 747, and forgot to tell the flight attendants to be seated for landing. The check airman decided to abort the route check due to inadequate performance and made him try again later.
These were the only major incidents that were known to Crossair, but interviews with other Crossair pilots revealed several more. For example, in 1999, while conducting a privately chartered sightseeing flight to Sion, Lutz accidentally overshot the destination by more than 50 kilometers and ended up in Italy. Upon realizing that something was wrong, Lutz attempted to land at the first airport he saw without conducting any preparation or even contacting air traffic control. This airport was not Sion, but Aosta, across the border in Italy. During final approach, passengers noticed road signs in Italian outside the plane, at which point the pilots performed a go-around and proceeded to the correct airport. Remarkably, Crossair was never informed of the incident.
In another case in 1995, a Crossair first officer reported that while on approach to Lugano in nighttime instrument conditions, Lutz initiated a blistering descent of 4,000 feet per minute, which he maintained clear through the MDA before leveling off when he caught sight of Lake Lugano at a height of 300 feet above the ground. He then proceeded in visual conditions for a successful landing. In order to accomplish this maneuver, Lutz had gone so far as to deactivate the ground proximity warning system and the overspeed warning to prevent them from going off during his insane plunge toward the lake. Other Crossair crews confirmed that while approaching Lugano, it was common practice to descend below the MDA if they were able to see the lake but not the runway. They managed to get away with this because the final approach ran over Lake Lugano, which (being perfectly flat) did not present any obstacles that would pose a hazard to low-flying planes.
All of these incidents showed that Captain Lutz was prone to careless mistakes and did not shy away from risky maneuvers. But it was the revelation about how Crossair pilots flew the approach to Lugano which did the most to explain the crash of flight 3597. Could Captain Lutz have decided to descend below the MDA on approach to Zürich in an attempt to emulate his technique from the approach to Lugano? It was quite probable that he did. He could see villages on the ground and likely thought that he could get away with descending below the MDA like he did at Lugano, and that he would break out of the clouds well above any terrain. The problem was that unlike a lake, the terrain underneath the approach to runway 28 was not flat. Lutz might not have realized that: in fact, the hill with which the airplane collided was not marked on his approach chart. And even if he did know it was there, his misunderstanding about their distance from the runway might have caused him to believe that they had already passed it.
Investigators felt that as pilot monitoring, First Officer Löhrer should have raised some objection to this ill-informed plan. But a number of obstacles prevented him from doing so, not least among them Lutz’s vastly superior experience. Lutz had almost 40 times as many flight hours as Löhrer, and his lectures earlier in the flight had established a teacher-student relationship between them rather than a partnership of equals. Before the approach they did not agree on a set of circumstances which would trigger a go-around, making it harder for Löhrer to judge whether Lutz was pushing things too far. Lutz was also known for being extremely quiet and calm at all times, giving off an air of competence and certainty that totally belied the danger of what he was doing. Furthermore, other pilots who had flown with Lutz confirmed that he tended to run a one-man operation and rarely took input from his first officers. Considering these factors, it was unlikely that Löhrer would have raised any objection to Lutz’s decision-making, or if he had, that Lutz would have listened to it.
The AAIB noted that despite his immense experience, Lutz made several fairly basic mistakes during the approach that raised questions about his mental state at the time of the crash. Could he have struggled to keep track his speed, descent rate, and distance from the runway due to fatigue? Investigators concluded that the answer was yes. As it turned out, Captain Lutz had a second job as an instructor for a flight school, and he frequently conducted training flights early in the morning before reporting for work at Crossair. He was required to inform Crossair of this second job so that company dispatchers could ensure he complied with flight duty time limits, but while airline management knew of Lutz’s activities on an informal basis, no attempt was made to ensure that he adhered to regulatory limits.
At the time of the accident, Lutz had been flying for 13 hours, only part of which was with Crossair, and his rest breaks were almost always too short because he would invariably spend part of his designated rest time working at the flight school. This would have led to chronic fatigue — especially on the night of the accident, considering that he had been awake for 15 hours and had significantly exceeded the number of flight hours allowed in one day. First Officer Löhrer might not have been doing much better: his wife told investigators that he had felt exhausted and stressed the previous evening, after coming home from a long work day in which he spent 10 hours in the air. With both pilots suffering from fatigue and looking forward to getting on the ground, monitoring tasks started to slip away from them, beginning with their descent rate, then their distance from the airport. Fixated on finding the runway, they lost track of what their plane was doing until just seconds before the crash.
Lutz was probably moonlighting as a flight instructor not because he loved teaching, but because Crossair didn’t pay him enough to get by. Crossair was expanding rapidly and always had a tight budget; its salaries were poor and it struggled to find enough qualified pilots. Those pilots it did manage to retain, like Captain Lutz, were subject to insufficient scrutiny. Examinations were often purely subjective and lacked any effective means to detect systemic problems. Crossair also had no anonymous incident reporting system until shortly before the accident, preventing the airline from discovering pilots’ unsafe habit of violating the MDA on approach to Lugano. Crossair had no full-time flight safety officer; this position was held part-time by one of its pilots. This officer had the right to conduct internal investigations, but since his appointment he had never actually done so, and he knew nothing about the problems with crew performance, which were typically dealt with by the respective fleet managers. The result of this lack of enforcement was that pilots started making up their own informal procedures rather than following the published guidelines. The AAIB identified more than 40 such cases in the past five years alone, of which none were reported to airline management.
This environment at Crossair went undetected by the Federal Office of Civil Aviation (FOCA), the Swiss equivalent of the FAA, because the agency was critically understaffed. Just days before the crash, a report by the International Civil Aviation Organization sharply criticized the FOCA, noting that it employed only six full-time inspectors and took part in so little oversight activity that it was effectively useless. “Without a substantial increase in the number of adequately trained inspectors,” ICAO wrote, “the industry may become essentially self-regulating.” The behavior of employees at all levels of Crossair, from pilots all the way to management, showed that this was already occurring. Indeed, the FOCA had never once audited Crossair to ensure it was complying with regulations!
Even after everything came together to send flight 3597 on a collision course with the hill, the accident could have been prevented had the latest technology been available. The aircraft involved in the accident had a ground proximity warning system derived from the original model that entered service in the 1970s, and it was unable to predict the impending crash. This GPWS worked by measuring the closure rate with the ground directly below the aircraft; it therefore could not warn of high terrain further along the flight path, and it never sounded a warning. However, by 2001 the next generation of ground proximity warning technology — known as the Terrain Awareness and Warning System, or TAWS — was already available. TAWS relies on a pre-programmed terrain database to predict collisions well in advance, a capability which could have prevented the accident. European regulations mandated that passenger airliners install TAWS by 2005, but this deadline was far enough away that at the time of the accident Avro hadn’t even published a procedure for installing the system on older versions of the RJ100.
The crash also could have been prevented with a Minimum Safe Altitude Warning System, or MSAW. An MSAW system detects when an airplane is too low on approach and sounds an alarm in the control tower, allowing controllers to actively intervene to prevent controlled flight into terrain. After an Italian airliner flew into a mountain while on approach to Zürich Airport in 1990, Switzerland installed MSAW systems on runways 16 and 14, but declined to do so on runway 28 as it was rarely used at the time.
This brought the AAIB back to the decision to use runway 28 in the first place. The agreement to bring planes in via runway 28 after 10:00 p.m. was intended solely to reduce noise over German villages, and little thought seemed to have been given to the question of whether this approach was suitable for frequent use by large aircraft. It lacked the margin of safety provided by an ILS and an MSAW system, both of which could have prevented the accident, and the approach itself was riddled with flaws. And while the agreement did allow controllers to route planes onto runways 16 and 14 after hours if the weather prevented a VOR/DME approach to runway 28, there was considerable pressure on them to avoid doing this. The weather on the night of the accident was too poor for aircraft to land safely on runway 28, despite the fact that some planes managed to do so anyway. In fact, if flight 3597 had maintained the MDA up to the point where the runway became visible, they would have had to perform their final descent at an angle greater than 6 degrees, much steeper than is considered safe. In hindsight, controllers should have allowed incoming planes to land on runways 14 and 16 — but in doing so, they would have had to explain to local authorities why the Germans were complaining about airplane noise again.
The crash of flight 3597, while directly caused by the captain’s decision to violate one of the cardinal rules of aviation, was therefore made possible by the collapse of Switzerland’s aviation safety system at every level. When Captain Lutz decided to deliberately fly below the MDA, he did so in an environment where that type of behavior had been normalized. Lack of discipline within Crossair resulted in an absence of consequences of risky behavior. A lack of oversight from the federal government allowed Crossair to develop this unsafe culture. Then came the purely political runway assignment, the lack of safety equipment, the fatigue, the lousy weather, the slowly escalating series of missteps and errors. Was it really one man’s bad decision, or was it a perfect storm of adverse circumstances?
As a result of the accident, Swiss authorities took numerous measures to try to improve aviation safety in Switzerland. Runway 28 at Zürich airport was fitted with an instrument landing system and an MSAW system. The FOCA doubled the number of inspectors in 2002. Under close supervision, Crossair (which by then had changed its name to Swiss International Airlines after the merger with Swissair) implemented a 13-step plan to overhaul its safety culture and institutionalize informal processes, based on a list of 81 points of action drawn up in the wake of the crash. The AAIB also issued nearly 30 safety recommendations intended to fix problems in areas ranging from pilot performance to approach chart design to weather observation. Since the overhaul, Swiss International Airlines hasn’t had another major accident.
All of that having been said, the mentality of pilots like Hans Ulrich Lutz continues to mystify. Some rules get bent and hardly anything ever happens. But the minimum descent altitude, especially on a non-precision approach, is not one of those rules. One can only conclude that Lutz didn’t know about the countless fatal crashes that had occurred because pilots made the exact same decision that he did. And if he did know, then what was he thinking? Don’t ever descend below the MDA if you can’t see the runway. Just don’t do it! Really, how hard can it be?
_________________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read over 180 similar articles.
You can also support me on Patreon!
