Running on Empty: The crash of Hapag-Lloyd flight 3378
On the 12th of July 2000, a German airliner carrying holidaymakers home from Crete crash-landed short of the runway in Vienna, Austria, sending the Airbus A310 sliding across a field before coming to rest next to an airport taxiway, leaning crazily to one side with its nose in the air. Despite the harrowing forced landing, all 151 people on board escaped with their lives. But how did the plane end up in a field in Austria in the first place? After all, Vienna was not its intended destination — the flight was actually bound for Hanover. It had been forced to divert to Vienna after running low on fuel, and both engines gave out due to fuel starvation moments before landing. The sequence of events which led to Hapag-Lloyd flight 3378 running out of fuel on a relatively short flight from Greece to Germany started with a failure of the landing gear. This minor issue escalated into an emergency due to faulty assumptions by the crew during their interactions with an automated system which they did not fully understand. The actions of the pilots during the hours they spent in the air would be pored over both by investigators and by the courts, and would ultimately stand as an important lesson about what not to do when faced with a problem in flight — and a lesson for systems designers about the way humans understand documentation.
The German shipping conglomerate Hapag-Lloyd is most famous for running one of the world’s largest container ship lines, but between 1972 and 2007, the massive logistics company also operated a rather different enterprise on the side: a passenger airline. Known as Hapag-Lloyd Flug, the airline initially offered connecting flights between German cities and the launching points of Hapag-Lloyd cruises, but over the subsequent decades it expanded to become one of Germany’s largest charter airlines, offering both scheduled and on-demand services to holiday destinations throughout Europe. (Many Germans might have flown with Hapag-Lloyd Flug without even realizing it: after a 2007 merger, the airline was rebranded as TUIfly Deutschland.)
One of the destinations served by Hapag-Lloyd was the city of Chania on the scenic Greek island of Crete. The airline’s direct scheduled service between Chania and Hanover, designated flight 3378, was popular with German tourists, and on the 12th of July 2000, 143 of them boarded a Hapag-Lloyd Airbus A310 at Chania International Airport for the flight home. In command of the wide body jet were two pilots: 56-year-old Captain Wolfgang Arminger, and a young first officer identified only as Thorsten R. Although the first officer was new to the company and had only a few hundred hours on the Airbus A310, Captain Arminger was a veritable flying legend: he had been a pilot since the age of 17, and during his 30 years as an airline captain, he had logged over 23,000 flight hours, the most of any pilot at Hapag-Lloyd.
With 143 passengers and eight crew on board, flight 3378 departed Chania at around 9:00 a.m. UTC, with Captain Arminger at the controls. However, within seconds after liftoff, the crew encountered a problem: when they attempted to retract the landing gear, the main gear remained extended, and several “gear unsafe” warning lights illuminated in the cockpit. The crew tried cycling the gear several times, but their efforts were unsuccessful; it was evident that the landing gear could not be stowed.
This was not in any way an emergency situation, however. Like all airliners, the Airbus A310 is capable of flying normally with the landing gear extended, and provided they kept below the gear-extended speed limit, they could continue to their destination. There was just one caveat: fuel. When the main landing gear is extended, it causes significant drag, which negatively impacts fuel economy. The pilots would need to determine how much more fuel than normal was being consumed, calculate whether they could make it to Hanover, and decide where they would land if they couldn’t.
Captain Arminger instructed the first officer to contact the company dispatcher, apprise them of the situation, and ask for advice on the best course of action. However, the first officer soon discovered that the long-distance radio at Hapag-Lloyd’s dispatch office was not working, and radio communication could not be established. Instead, he began a painstaking back-and-forth conversation using the Aircraft Communications Addressing and Reporting System, or ACARS, which allowed him to exchange text messages with the dispatcher via the plane’s flight management system (FMS) interface. This cumbersome endeavor consumed most of the first officer’s attention for the better part of an hour.
Meanwhile, Captain Arminger set about determining their fuel situation. Normally, pilots keep tabs on their fuel using the FMS, which combines several data sources to tell the crew how much fuel is on board and how much fuel they will have remaining when they reach their destination. By cross-checking the actual amount of fuel on board against the expected amount of fuel as indicated on the flight plan, a pilot can determine whether they are burning fuel at the expected rate. He or she can then use the FMS to determine whether their rate of fuel burn will leave them with a sufficient amount left over after arrival. Captain Arminger observed right away that according to the FMS, they would not have enough fuel to reach Hanover. Therefore, the first officer and the dispatcher set about determining a suitable alternate airport to use as a refueling stop. The dispatcher suggested Stuttgart, which was rejected. Instead, the crew agreed to stop in Munich, which was closer than Stuttgart. Via ACARS message, the dispatcher later added that if their fuel situation got worse and they couldn’t reach Munich, they should go to Vienna instead.
In order to determine how far they could get, the first officer broke out the manual and opened it to the section on extended flight with the landing gear down. This section contained a chart which provided fuel consumption figures for both climb and cruise with the gear extended at various altitudes. However, the table only included figures up to a height of 27,000 feet. By that point they had already reached their cruising altitude of 31,000 feet, for which no fuel burn figures were provided. Arminger believed that this was because the chart was only meant to be used for flight planning and not for in-flight calculations, and he made the first officer put it away. The uselessness of the chart was no big deal, he thought; after all, the FMS could calculate all of this for them anyway.
Here he made a critical assumption: that the flight management system was capable of taking the extended landing gear into consideration when calculating their expected fuel upon arrival (referenced hereinafter as “expected fuel on board,” or EFOB). It was not unreasonable to believe that the FMS calculated EFOB by extrapolating the present fuel burn rate into the future, but this was not how the system actually worked. Instead of basing the EFOB off the instantaneous rate of fuel consumption, which could vary significantly from one moment to the next, it calculated this value using an algorithm which incorporated numerous factors that might affect the long-term burn rate, including altitude, wind speed, and several other parameters. This produced a rather accurate figure which was immune to ephemeral variations in fuel consumption due to changes in flight level, gusts of wind, or other phenomena. However, one thing it did not take into account was the position of the landing gear, which is virtually always retracted except for the last minute or two of each flight. Therefore, the EFOB indicated by the FMS upon arrival in Munich was based on their present fuel quantity fed through an algorithm that did not include the extra drag induced by the landing gear. Little did either pilot know that at their present rate of consumption, they would not make it to Munich.
During the conversation with the dispatcher, both pilots used their own flight management systems to independently confirm that they would have 3.3 metric tons of fuel left over after arriving in Munich — well above the legal minimum. However, when the first officer performed their first routine fuel burn check at 9:57, he observed that they had used 60% more fuel than expected by this point in the flight. This rather extraordinary burn rate did not seemingly conflict with the notion that they could reach Munich, even though this city was more than 60% of the way between Chania and Hanover, because the pilots expected efficiency to suffer more during climb than during the cruise and descent, resulting in greater inefficiency early in the flight and an increase in efficiency later. This expectation obscured the discrepancy between the observed inefficiency and the optimistic EFOB.
Over time, the EFOB for Munich slowly decreased from 3.3 tons to about 2.0. This was an artefact of the elevated fuel consumption causing progressively lower-than-expected real fuel quantities to be fed into the EFOB algorithm. Since the minimum EFOB allowed by regulations was 1.9 tons — enough for 30 minutes of holding prior to landing — Captain Arminger decided that an EFOB of 2.0 was cutting it too close and that they should go to Vienna instead. After entering the new destination into the FMS, the system stated that they could expect to have 2.6 tons of fuel left over after arriving in Vienna.
In order to increase their margin of safety, Arminger began requesting clearances from air traffic control to fly more direct routes between each of the waypoints on the way to Vienna. Each time they were cleared direct, the total distance remaining decreased, causing a corresponding increase in the EFOB which reversed its steady downward creep. The result was an EFOB which appeared to remain roughly stable at 2.6 tons. In reality, however, their fuel consumption was so high that safely reaching Vienna was already almost impossible.
At this point, flight 3378 passed abeam Zagreb, only 10 minutes out from Zagreb Airport. A diversion to Zagreb would have brought the situation to a swift and uneventful end. But Captain Arminger believed they could still reach Vienna, where Hapag-Lloyd had a company presence; by contrast, Zagreb was not a destination normally served by the airline.
The indicated EFOB soon began to drop again, and by 10:34, it fell below 1.9 tons, the minimum allowed on landing. The urgency of the situation was now somewhat more apparent. Captain Arminger apprised the Vienna air traffic controller of their situation and requested a direct approach into runway 34 from the south, which was granted. He followed this up with a request for a priority landing, and flight 3378 began its descent from 31,000 feet at a distance of 267 kilometers from the airport. The first officer noted that according to proper procedures, they were supposed to declare a fuel emergency, because they expected to land with less fuel than the legal minimum. But Captain Arminger refused to do so, apparently unwilling to rock the proverbial boat. He seemed to be in denial about the seriousness of their predicament.
At 11:01, the low fuel light came on, warning the pilots that they needed to land immediately. It was not until 11:07 that Arminger finally declared a fuel emergency. In his radio call, he emphasized to air traffic control that they would reach Vienna safely, and he did not request that emergency vehicles be deployed. Despite the fact that they were in a real emergency, he treated the declaration like a formality.
At that moment, Vienna was not the closest runway: in fact, the airport in Graz was 55 kilometers closer. The first officer brought this up at 11:09, suggesting that they change their plan and fly to Graz instead. Captain Arminger quickly shot this down, noting that they were already lined up with runway 34 at Vienna, and changing course to line up with the runway at Graz could end up adding distance to their journey. As they assessed the possibility of diverting there, the crew discovered that the approach charts for Graz were missing. Hesitant to make a blind rush for an airport with which he was not familiar, Captain Arminger made the fateful decision to continue towards Vienna, and given the circumstances, the first officer reluctantly assented.
Because flight 3378 had now lined up with the runway, the crew were no longer able to request shortcuts on their route; as a result, the indicated EFOB was no longer periodically adjusted upward, and its true rate of decline became apparent. As the EFOB rapidly dropped toward zero, Captain Arminger became alarmed and confused, wondering aloud how and whether the FMS was actually factoring air resistance into its calculations. The first officer correctly asserted that, in fact, it must not take into account the air resistance caused by the landing gear — an explanation which Captain Arminger rejected out of hand. The EFOB had seemed stable up until the descent, so he felt something must have changed in the past few minutes. The first officer was unconvinced, but the matter soon fell by the wayside: they were about to have a much bigger problem on their hands.
At 11:26, the right engine ran out of fuel, triggering a cascade of flashing warnings lights and blaring alarms. Seconds later, the left engine also sputtered and died, leaving the plane completely powerless — and they still had 22 kilometers to go until the runway. While the first officer issued a frantic mayday call, the captain deployed the ram air turbine, a small propeller which extends from the bottom of the fuselage and generates enough power to run the hydraulic pumps. The first officer immediately began to run through the engine relight process, hoping to squeeze just a few more moments of powered flight out of the dregs of fuel left in the tanks. His initial attempts were met with success, but at 11:29 the engines flamed out again, this time for good.
Gliding toward the airport without any engine power, it seemed for a moment like the A310 might yet make it to the runway in one piece. But their sink rate was just slightly too high, the distance slightly too long. Flight 3378 touched down hard in a field 660 meters short of the runway, impacting the grass with its left wingtip and landing gear. The left main landing gear dug into the dirt and sheared off, sending the plane sliding across the grass with its left engine dragging along the ground. The plane veered left, plowed through a row of approach lights and an ILS antenna, skidded across a taxiway, and ground to a halt in a field on the far side, leaning crazily askew with its nose high in the air. Hapag-Lloyd flight 3378 had made it to Vienna — but only just.
As soon as the plane came to a stop, Captain Arminger ordered the passengers to evacuate, and the flight attendants hurried to open the emergency exits. However, the angle of the plane prevented flight attendants from pulling the left front exit door out of its frame, and the right front escape slide was useless because it was too steep. The left center slide struck a mangled piece of the wing and deflated, while wind blew the right center escape slide up against the fuselage, rendering it unusable as well. All 151 people on board ultimately evacuated via the two rearmost exits, although the urgency proved unwarranted, as the lack of fuel prevented the ignition of a fire. In the end, everyone survived mostly unscathed, with only 26 minor injuries incurred during the evacuation. The plane itself was not so lucky — the damage was so extensive that it had to be written off.
At first, Captain Arminger was hailed by the media as a hero for getting his powerless plane to the airport and crash-landing without any casualties. No one at that point understood what had happened to the fuel. But as Austrian investigators examined the contents of the plane’s black boxes, they found the sequence of events was rather different from what anyone had expected. There was no sudden loss of fuel on final approach, as the captain had reported — rather, the fuel dropped steadily downward throughout the flight until it ran out. At their rate of consumption, they simply didn’t have enough fuel on board to reach Vienna. The pilots thought they could make it because the FMS showed them with plenty of fuel remaining after arrival, and they did not understand that the FMS does not include the extra drag induced by the landing gear in its fuel projections. As for what started it all — investigators found that a nut on the right main landing gear actuator had been installed incorrectly. The nut would periodically catch on a nearby piece of the structure, causing it to slowly unscrew over thousands of flight hours. This extended the length of the actuator arm until it eventually became geometrically impossible for the landing gear to retract.
The investigation now turned to the pilots’ thought processes during the flight. They noted that the captain was incredibly experienced and had always been graded satisfactory or good on his proficiency checks. The first officer, although relatively new to A310, had always been graded good or excellent and was considered an exemplary pilot. How could this crew have simply run out of fuel?
The first thing to consider was why the crew believed that they could use the FMS to calculate their expected fuel on arrival. Investigators discovered that while Airbus’s official checklist for flight with the landing gear extended included a step to determine fuel consumption manually, this step was missing from the version of the checklist provided by the airline. There was also no documentation available to the pilots which would explain the algorithm used by the FMS to determine an EFOB figure, and the pilots could not have determined with certainty which factors affecting fuel consumption were included and which were not. In fact, the pilots were not even aware that it used an algorithm rather than a direct projection based on current fuel consumption. They were merely taught to use the FMS like a black box, performing “procedure X to get result Y,” as investigators put it, without any knowledge of how the system actually worked. In explaining this to the press, Captain Arminger said, “I assumed that the FMS works like an on-board computer in a car, which also shows the range correctly, even if you have a roof rack with you.”
Without any indications that this assumption was false, it cemented itself in Captain Arminger’s mind early in the flight. The results of the fuel burn checks did not shake this belief because it was possible to mentally reconcile the high burn rate with the erroneous EFOB provided by the FMS. Pilots were also not trained on any special procedures for using the FMS with the landing gear extended. They had been provided training scenarios where they had to reprogram the FMS to correctly calculate fuel burn after an engine failure, but not for a landing gear failure. The fact that the FMS immediately told them they could not reach Hanover also reinforced the pilots’ mistaken belief that it was projecting their fuel burn rate into the future; in reality, however, this was because they had already burned enough fuel that Hanover was unreachable even at the erroneous burn rate used by the FMS. And finally, the table of fuel burn rates in the manual was not obviously intended for in-flight rather than pre-flight use and did not indicate that the figures provided should be used in lieu of the FMS. It was now apparent how the pilots managed to maintain their mistaken interpretation for so long.
As the flight proceeded toward Vienna, the EFOB value produced by the FMS did not decrease at a rate perceptible to the pilots because they kept taking shortcuts which added fuel back into the calculation. This convinced them that they could continue to Vienna for most of the middle portion of the flight. However, by the time they were roughly abeam Zagreb, the EFOB had begun to decrease noticeably. In fact, the EFOB for Vienna dropped below the legal minimum of 1.9 tons just moments before the plane passed by the city. Why didn’t they decide to divert there instead? Why continue to Vienna, knowing they would be obligated to declare a fuel emergency?
To rationalize the captain’s decision not to divert, investigators noted that Arminger was known to be very loyal to the airline and certainly feared creating a headache for management by landing in Zagreb, an airport at which Hapag-Lloyd had no company presence. Investigators described this decision in terms of “subjectively expected utility.” This is the product of the perceived probability of success and the perceived benefits of achieving the goal, vis-à-vis an alternate, less desirable course of action. It was evident that at this point the captain considered the probability of success (reaching Vienna) to be nearly 100%, which weighed the unconscious equation in favor of continuing the flight. If he was certain he could reach either airport, it made sense to pick the one where Hapag-Lloyd could more easily make another plane ready to pick up the passengers and continue to Hanover. An objective analysis of the situation would have shown that the danger of continuing to Vienna was considerable, but none was conducted.
After passing Zagreb, the crew were again presented with an opportunity to divert, this time to Graz. The first officer argued in favor of diverting to Graz, but Captain Arminger shot down his suggestion without taking the time to properly analyze it. By this point, the workload on the captain was high and he was under considerable stress, which can lead to fixation on a known goal (in this case reaching Vienna). The large number of tasks occupying his brain influenced him to stick with his existing plan rather than switch to a new one with all the uncertainties that would entail (a well-known psychological phenomenon known as plan continuation bias). Even though they lacked approach charts for Graz, the weather was clear and it would have been easy to spot the runway visually; had they chosen to fly there, they would have been able to land with fuel still in the tanks. The fact that he did not come to this conclusion on his own shows that Captain Arminger had lost his situational awareness and did not understand the true level of danger. Further evidence for this assertion came when the first officer speculated that the FMS does not account for the extended landing gear in its EFOB calculations. Again, the captain rejected this idea because he was locked into a narrow, fixated mental state, unable to process the possibility that his entire conception of the situation was wrong.
Investigators also found that there were three separate actions the pilots could have taken which would have allowed them to reach the runway. First, they did not fly at the optimum speed with the gear extended. Fuel efficiency with the gear down is actually greatest at low speeds, but none of the documentation available to the crew mentioned this. As a result, they cruised at a higher speed that caused them to burn more fuel. Second, flying at lower altitudes burns more fuel due to increased air resistance. When low on fuel, the optimum descent procedure is to stay as high as possible for as long as possible and then descend rapidly to the airport. The flight operations manual should have had a table of fuel burn rates during descent with the gear extended (corresponding to the tables for cruise and climb mentioned earlier) which also stated that the optimum point to begin their descent from 31,000 feet would have been at a distance of 93 kilometers from the airport. But this page was missing from their documentation, and the pilots actually began their descent at a distance of 267 kilometers. And finally, the crew did not follow the dual engine flameout checklist after they ran out of fuel. The penultimate item on the checklist instructed them to flip the “land recovery” switch, which would have supplied emergency power to the flaps, slats, and other electrically-driven flight control systems. Had the pilots been able to deploy the flaps and slats, which increase lift, they might have been able to extend their glide long enough to reach the pavement. In fact, if the pilots had taken any of these steps, the crash most likely wouldn’t have happened — although poor documentation meant that only one of the three aforementioned courses of action was actually available to them.
Six months after the crash, the captain resigned from Hapag-Lloyd Flug, never to fly again. But his ordeal was not over. As the details of the flight were made public, prosecutors in Germany charged Wolfgang Arminger with negligently operating an aircraft, an accusation which could result in consequences ranging from a fine to prison time. Arminger forcibly maintained his innocence, hiring a lawyer who had successfully defended the pilots involved in a 1974 Lufthansa crash against similar charges. The trial was controversial from the start. Experts in both law and aviation safety are extremely wary of pursuing criminal charges against pilots who make errors resulting in accidents, both because the threat of prison time prevents pilots from admitting mistakes to investigators, and because the practice is ethically questionable. A nuanced review of the events of the flight reveals how inadequate documentation, missing charts, and insufficient knowledge of complex systems led Captain Arminger to fly to a destination that was beyond the reach of his airplane. So where was the crime? Most experts agree that there was none. Nevertheless, in 2004, a judge sentenced Arminger to a six-month suspended prison sentence, in the process publicly excoriating him for being “arrogant” and unwilling to admit his mistakes. The sentence was handed down despite the fact that the final report on the accident had not yet been released. In an article for Der Spiegel, Gisela Friedrichsen sharply criticized the judge’s decision, writing, “A pilot flies to a destination even though he has too little fuel in the tank. A judge sentences, although evidence is still pending. One acts negligently and grossly in breach of duty. And the other one?”
After numerous delays, the final report on the crash of Hapag Lloyd flight 3378 was finally released in March 2006. It painted the captain in a far more sympathetic light than the judge who sentenced him to prison, spending several pages describing the known psychological phenomena that could have led to each and every one of his errors. (It also noted that the first officer made no errors at all; in fact he went above and beyond the call of duty, performing critical tasks without any prompting from the captain. Furthermore, he figured out the real cause of the problem on his own, and the captain didn’t believe him.) Despite his evident mistakes, no one who reads the report could possibly walk away believing that Arminger deserved to go to prison.
Tacked onto the end of the report was a 30-page response by Airbus Industries which challenged some of the stances taken by the investigators. Airbus complained that the report “erroneously suggests that the FMS failed to provide accurate fuel predictions with the gear down,” noting that the FMS was never designed to do this in the first place. “Attributing design deficiencies to automation system [sic] for objectives that were not assigned to such automation must be made with extreme care,” the company added. This statement seems to miss the point entirely. Are the objectives for which the automation was designed not themselves valid subjects of criticism? In hindsight, it seems like the FMS easily could have (and should have) taken into account the position of the landing gear in its calculations.
Airbus also argued that the airline was at fault due to its failure to include important information about fuel consumption and the FMS in its documentation. Here the manufacturer had a point, as the absence of the line “FUEL CONSUMPTION … DETERMINE” from the checklist for flight with the landing gear extended might have set the whole sequence in motion. Airbus added that its version of the checklist also referred pilots to a section of the flight operations manual which stated the FMS should not be used “in the vertical mode” with the gear extended. According to Airbus, the “vertical mode” includes EFOB calculations. But investigators wrote that the phrase “vertical mode of the FMS” was not defined anywhere and it was not obvious that this included the fuel burn functions. It was therefore unclear how this caution could have prevented a pilot from assuming he or she could use the FMS to calculate EFOB with the gear down.
Alongside their report, Austrian investigators issued 14 safety recommendations, including that Airbus and the airline overhaul the documentation of the FMS and the procedures for flight with the gear extended in order to ensure that there was no ambiguity about the capabilities of the FMS under circumstances involving increased fuel consumption. They also recommended that the ability of the escape slides to stand up to wind be examined; that pilots be trained on the limits of the FMS in unusual fuel scenarios; and that Hapag-Lloyd fix its landing gear checklist and ensure its documentation is complete.
The crash of Hapag-Lloyd flight 3378 contains crucial lessons for both pilots and manufacturers. Throughout most of the flight, Captain Arminger felt a sense of invulnerability — that everything was going to be fine, that negative outcomes only happen to other people. This assumption is false; the worst can happen to anyone, at any time. A pilot must always remain cognizant of the presence of danger, and retain enough self-awareness to take it seriously even if the chances of a negative outcome seem slim. You never know when you’ve done the math wrong.
Designers of systems both in aviation and elsewhere can also learn something from this accident. There was a critical disconnect between the objectives for which the FMS was designed and the objectives for which pilots used it, due to a pervasive lack of information about how the system worked. It is too easy to assume that the end user will intuitively understand the system’s limitations. In this case, Airbus’s official documentation did include a series of leads which would bring a reader to the conclusion that the FMS could not be used for this particular objective. But the existence of such a series of instructions is not enough by itself. A holistic system design must consider cues which compete with the intended use case, steering the user onto a different course of action. Nevertheless, sometimes scenarios do arise which systems designers are unable to predict in advance — but the response should be to improve the system, not to sentence a pilot in court for being misled by a computer.
________________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read over 150 similar articles.
You can also support me on Patreon.
