Überlingen 2002: DHL 757 and Tu-154 Mid-Air Collision

OVERBURDENED CONTROLLER | DEADLY MID-AIR COLLISION

At 21:35:32 UTC on July 1, 2002, two airliners were descending toward the same piece of sky over southern Germany. One was a Boeing 757 cargo aircraft operated by DHL. The other was a Tupolev Tu-154M carrying passengers from Moscow to Barcelona.

Both crews had functioning TCAS systems. Both aircraft were under air traffic control. The weather was good.

And yet, within seconds, the two aircraft would collide in mid-air over Überlingen near Lake Constance, killing all 71 people aboard.

The accident became one of aviation's most important lessons in controller workload, human factors, TCAS authority and the dangers of operating a safety-critical system without adequate redundancy.

The official investigation was conducted by Germany's Federal Bureau of Aircraft Accident Investigation, the BFU, under investigation report AX001-1-2/02. Because this was a German accident involving aircraft operating under Swiss air traffic control, the NTSB was not the lead investigating authority and did not issue the primary probable-cause report. The BFU's final report is the authoritative accident-investigation source for the event. (doczz.net)

Two Aircraft, One Flight Level

Bashkirian Airlines Flight 2937 was a Tupolev Tu-154M traveling from Moscow to Barcelona. It carried 69 people: 60 passengers and nine crew members.

Among the passengers were many children traveling on a holiday trip to Spain.

DHL Flight 611 was a Boeing 757-200 freighter flying from Bergamo, Italy, to Brussels, Belgium. Only two people were aboard: the captain and first officer.

The aircraft were flying through the airspace controlled by the Zurich Area Control Centre, operated by Swiss air navigation service provider Skyguide. Both aircraft were cruising at Flight Level 360, approximately 36,000 feet, when their routes brought them toward the same area.

The Aviation Safety Network records the Tupolev as RA-85816 and the DHL Boeing 757 as A9C-DHL. Both aircraft were destroyed and every person aboard both aircraft died. (dokument.pub)

The danger was developing inside a relatively small portion of controlled airspace. Under normal circumstances, the controller would have been expected to identify the developing conflict and issue an instruction early enough to preserve separation.

But the controller responsible for the sector was working under unusual conditions.

One Controller Handling Multiple Tasks

That night, only one controller was working the relevant Zurich airspace position.

According to the BFU investigation, the controller was simultaneously responsible for two radar working positions and two radio frequencies. He was handling traffic on one frequency while also managing other aircraft on the second frequency.

At the same time, technical maintenance was being performed at the Zurich facility.

The telephone system that controllers normally used to coordinate with other facilities was unavailable. The Short Term Conflict Alert, or STCA, which could provide an automated warning of potentially conflicting traffic, was also unavailable at the relevant position.

Radar processing was operating in a degraded configuration as maintenance work continued. The controller therefore had fewer technological and organizational safeguards than would normally be expected in a busy control environment. An ICAO safety presentation later used the accident as an example of how degraded equipment, staffing arrangements and workload can combine into a serious operational threat. (ICAO)

The situation became even more difficult because the controller was attempting to coordinate traffic involving Friedrichshafen Airport. He made repeated attempts to establish telephone communication with the airport but could not get through.

The result was a classic human-factors problem: several tasks were competing for the same person's attention at exactly the moment when the traffic picture demanded continuous monitoring.

The controller was not simply "too busy" in an everyday sense. He was working in an environment where several layers of protection had been degraded simultaneously.

The Conflict Develops

The crews were operating normally and were communicating with ATC. Neither aircraft had suffered an engine failure or other mechanical emergency. The aircraft themselves were capable of continuing their flights safely.

The critical threat was traffic separation.

The TCAS systems aboard both aircraft detected the developing conflict before the collision.

The systems first generated Traffic Advisories, telling the crews that another aircraft was nearby. The warnings were followed by Resolution Advisories, or RAs, which are specific vertical maneuver commands designed to prevent a collision.

The TCAS aboard the DHL Boeing 757 instructed its crew to descend.

The TCAS aboard the Tupolev instructed its crew to climb.

Had both crews followed their respective TCAS commands, the aircraft would have moved vertically away from one another.

But the Tupolev crew received a different instruction from the ground.

The Controller Issues a Descent Instruction

The controller eventually recognized the conflict and instructed Flight 2937 to descend to Flight Level 350.

The instruction came only shortly before the predicted loss of separation.

The Tupolev crew acknowledged the controller's command and began descending.

At almost the same time, however, the aircraft's TCAS was generating an opposite instruction: climb.

The Boeing 757 crew followed its TCAS Resolution Advisory and began descending.

Now both aircraft were moving downward.

The system designed to prevent the collision was telling the two crews to perform complementary maneuvers, but one cockpit was following an ATC instruction that conflicted with its TCAS command.

The BFU later identified this conflict between the controller's instruction and the aircraft's collision-avoidance system as one of the central elements of the accident. (ResearchGate)

The tragedy was developing in seconds.

The Tupolev's crew continued the descent ordered by ATC even after the TCAS system instructed them to climb. The Boeing crew, meanwhile, continued following its own TCAS descent command.

The aircraft converged vertically and horizontally.

At approximately 21:35:32 UTC, they collided.

The Collision

The Boeing 757's vertical stabilizer and horizontal stabilizer struck the Tupolev.

The impact caused catastrophic structural damage to both aircraft.

The Tu-154 broke apart, while the Boeing 757 also lost critical structural components and became uncontrollable. Wreckage fell across an area near Überlingen.

All 69 occupants of the Tupolev died, as did both DHL crew members.

No one on the ground was killed by the falling aircraft, although the wreckage scattered across populated and wooded areas. Contemporary and later reporting emphasized the extraordinary human cost of the accident, including the large number of children aboard the Bashkirian Airlines flight. (pilotundflugzeug.de)

The crash site stretched across the countryside north of Überlingen. Investigators recovered wreckage from both aircraft and reconstructed the final flight paths using radar, flight-recorder information and aircraft wreckage.

The investigation ultimately showed that this was not a simple case of "pilot error" or "controller error."

What Went Wrong Inside ATC

The controller's workload became a central part of the investigation.

The BFU found that the impending loss of separation was not detected early enough. By the time the controller issued his descent instruction to the Tupolev, the situation had developed to the point where the normal separation margin could no longer be reliably restored.

The controller was operating without the normal redundancy of another controller at the position.

The investigation also identified organizational problems surrounding the use of single-controller operations. Such working arrangements had developed within Zurich ACC under certain circumstances, but the accident occurred while the controller was handling traffic in an environment where additional safeguards were unavailable.

The BFU found that the controller's working conditions were affected by the combination of staffing, maintenance activity, technical limitations and competing duties. (ICAO)

Another important problem was the loss of the conflict-alert function.

Normally, an automated alert can act as another layer of defense. It does not replace the controller, but it can draw attention to a developing conflict that might otherwise be missed.

That layer was absent.

The telephone coordination system was also unavailable, preventing another controller from Karlsruhe from effectively warning the Zurich controller about the developing situation.

The TCAS Problem Was Not a TCAS Failure

One of the most important lessons from Überlingen is that TCAS itself did not malfunction.

The systems detected the threat and generated compatible avoidance commands.

The Boeing 757 received an instruction to descend.

The problem was what happened after the warnings reached the cockpits.

The Tupolev crew had been trained and instructed in a system where ATC commands retained a very high level of authority. The crew therefore followed the controller's descent instruction even after TCAS generated an opposing Resolution Advisory.

The BFU found that international regulations and operator procedures concerning ACAS/TCAS were not sufficiently standardized and contained ambiguities and contradictions. Some guidance described TCAS as a backup to ATC, while other operational guidance required pilots to respond to an RA even when it conflicted with an ATC instruction. (ResearchGate)

That ambiguity was dangerous.

A collision-avoidance system cannot reliably protect aircraft if pilots are uncertain about whether its commands override instructions from the controller.

Following the accident, international procedures were changed to make the hierarchy clearer: when an ATC instruction conflicts with a TCAS Resolution Advisory, the crew is expected to follow the TCAS RA unless doing so would create another immediate hazard.

The German air navigation service provider noted after the BFU report that Germany had already incorporated this principle into its procedures before the international ICAO standard was updated. (Presseportal)

The Controller Was Not the Only Problem

It is tempting to tell the story as one of an "overburdened controller" who made a fatal mistake.

That description is incomplete.

The controller's actions were identified as an immediate cause, but the BFU investigation went deeper into the organizational conditions surrounding him.

The facility was undergoing maintenance.

He was also dealing with coordination tasks involving other aircraft and an airport.

At the same time, TCAS procedures were not sufficiently harmonized across the aviation system.

This is exactly why modern aviation accident investigation focuses on system defenses rather than simply identifying the last person who made an error.

The controller made a critical operational mistake, but the environment gave that mistake fewer opportunities to be detected and corrected.

The BFU's investigation therefore identified systemic shortcomings in the organization of air traffic control as well as problems with the integration of TCAS procedures. (ResearchGate)

The Human Cost Continued After the Crash

The consequences of Überlingen did not end when the aircraft struck the ground.

The families of the victims faced an enormous loss, particularly because so many passengers on the Tupolev were children traveling together.

Peter Nielsen was the Skyguide controller working the sector at the time of the collision. In February 2004, nearly two years after the accident, Nielsen was killed outside his home in Switzerland by a man who had lost his wife and two children in the Überlingen crash.

The later killing was a separate criminal act and should not obscure the findings of the aviation investigation. The BFU report examined the operational and systemic causes of the collision itself; it did not treat the later murder as part of the accident sequence. Contemporary reporting on the BFU findings also documented the extraordinary pressure placed on the controller and the wider Skyguide organization following the disaster. (pilotundflugzeug.de)

Accident Facts

The official BFU investigation report, published in May 2004, reconstructed the accident using radar information, flight-data recordings, cockpit information, ATC communications, wreckage evidence and detailed analysis of the TCAS systems. (doczz.net)

What Changed After Überlingen?

The accident became a landmark event in the development of modern collision-avoidance procedures.

One of its most important legacies was the clarification that TCAS Resolution Advisories must be followed when they conflict with an ATC instruction, unless an immediate safety consideration makes that impossible.

The accident also demonstrated why safety-critical organizations need redundancy.

A controller working alone may be capable of managing normal traffic, but the system must account for what happens when equipment fails, maintenance is underway, communication channels are unavailable and traffic complexity suddenly increases.

The aviation industry subsequently placed greater emphasis on integrating TCAS procedures, controller workload management and organizational risk assessment.

The Überlingen accident has since been studied extensively in aviation human-factors research because it demonstrates how several individually manageable problems can interact until the remaining safety barriers disappear. The FAA and National Academies have continued to cite the accident when discussing human-automation interaction and the importance of coordinating automated safety systems with human decision-making. (National Academies)

The Final Lesson

The most important lesson from Überlingen is not simply that a controller became overloaded, nor that a flight crew failed to follow TCAS.

The deeper lesson is that aviation safety depends on multiple defenses working together.

When one controller is handling multiple tasks, the system needs another layer of protection. When radar or conflict-alert equipment is unavailable, procedures must compensate. When ATC and an airborne collision-avoidance system provide conflicting instructions, the hierarchy must be unambiguous. And when workload rises beyond what one person can safely manage, the organization must have mechanisms to recognize and reduce that risk.

On the night of July 1, 2002, those defenses failed in combination.

The controller did not identify the developing conflict early enough. The aircraft received incompatible human and automated instructions. One crew followed the controller instead of its TCAS Resolution Advisory. The other followed TCAS. The two aircraft descended toward the same point in space.

Überlingen remains a powerful reminder that the safest aviation systems are not those that assume every controller, pilot and machine will perform perfectly. They are systems designed so that when a human makes a mistake, another person, another procedure or another technology has enough time and authority to stop that mistake from becoming a accident.

Sources

• Video source (ATC/audio reconstruction)

• German Federal Bureau of Aircraft Accident Investigation (BFU), Investigation Report AX001-1-2/02, collision between Boeing 757-200 and Tupolev Tu-154M near Überlingen, May 2004. (doczz.net)

• Federal Aviation Administration, Lessons Learned: Tupolev Tu-154M RA-85816 and Boeing 757-200 A9C-DHL, Überlingen, Germany. (FAA)

• Aviation Safety Network cross-reference, A9C-DHL / RA-85816, Überlingen, July 1, 2002. (dokument.pub)

• Flight Safety Foundation, Flight Safety Digest, March 2004, analysis of the developing collision and TCAS events. (Flight Safety Foundation)

• ICAO safety material discussing the Überlingen accident, degraded ATC operations and controller workload. (ICAO)

• Contemporary reporting and post-investigation coverage of the BFU report and its findings. (pilotundflugzeug.de)