Überlingen Mid-Air Collision

Date

1 July 2002

Phase of flight

Cruise

Location

Near Überlingen, Lake Constance, Germany

Aircraft

Tupolev Tu-154M and Boeing 757-200 freighter (757-23APF)

Operator

Bashkirian Airlines (Tu-154M) and DHL, operated under a Bahrain air operator certificate (Boeing 757)

Flight

Bashkirian Airlines 2937 and DHL 611

Occupants

71

Fatalities

7169 on the Tu-154M (9 crew and 60 passengers) and the 2 pilots of the Boeing 757

Investigating body

Bundesstelle für Flugunfalluntersuchung (German Federal Bureau of Aircraft Accidents Investigation)

Final report

AX001-1-2/02

Report date

19 May 2004

Report title

Investigation Report AX001-1-2/02: Accident near Ueberlingen/Lake of Constance/Germany, 1 July 2002, Boeing B757-200 and Tupolev TU154M

On the night of 1 July 2002, at 21:35:32 UTC, a Tupolev Tu-154M on a charter flight from Moscow to Barcelona, Bashkirian Airlines 2937, and a Boeing 757-200 freighter flying from Bergamo to Brussels, DHL 611, collided at 34,890 ft north of Überlingen, a town on Lake Constance in southern Germany. Both aircraft were under the control of ACC Zurich, to which Germany had delegated the airspace. All 71 people on board died: 69 on the Tu-154M, including 60 passengers, and the two pilots of the 757.

The German Federal Bureau of Aircraft Accidents Investigation (BFU) found two immediate causes: air traffic control noticed the conflict too late, and the Tu-154M crew followed the controller's instruction to descend even after their TCAS told them to climb. The 757 crew had correctly followed their own TCAS instruction to descend. Behind both lay systemic causes: rules on airborne collision avoidance that did not agree with one another, and a night staffing practice at Zurich that left one controller working alone.

Überlingen is the reference case behind the rule every pilot now learns: when a TCAS resolution advisory (RA) and an ATC instruction conflict, follow the RA. The BFU report names neither airline nor registration and refers to the aircraft by type (it quotes the 757's call sign, "Dilmun Six One One", once); this page also uses the publicly known flight numbers. Times are UTC.

The flights

DHL 611, Boeing 757-200

The 757 was a cargo aircraft, built in 1990, operated under a Bahrain air operator certificate by a company that was part of a worldwide air cargo group. It had left Bahrain at 13:30 with only its two pilots aboard, stopped at Bergamo, and taken off again for Brussels at 21:06, with the copilot as pilot flying. It reached FL360 at 21:29:50.

The commander, aged 47, had 11,942 hours, 4,145 of them on the 757. The copilot, aged 34, had 6,604 hours, 176 of them on the type. Both had received TCAS training, which the BFU found was a regular part of their operator's simulator training, and both flew line-oriented flight training exercises.

Bashkirian Airlines 2937, Tupolev Tu-154M

The Tu-154M, built in 1995, belonged to an operator based at Ufa in Bashkortostan. It left Moscow-Domodedovo at 18:48 with 9 crew members and 60 passengers and entered German airspace at FL360. Five flight crew were in the cockpit. The commander under supervision, flying from the left seat, was the pilot flying. The instructor in the right seat, the company's chief pilot, handled the radio as pilot not flying; in the BFU's opinion he was the pilot in command. A flight navigator, a flight engineer and a copilot with no function on this flight completed the crew.

The crew were highly experienced; the commander had 12,070 hours and the instructor 8,500. The pilots had received TCAS training, but the operator had no TCAS-equipped simulator, so they had never practised RA responses in one, and none of the crew had flown line-oriented flight training in a simulator.

ACC Zurich that night

Only one controller was at work in the control room. The second controller on duty had gone to rest in a lounge at about 21:15, an arrangement between controllers that management knew of and tolerated, and a controller assistant with no air traffic control rating remained. The controller was working two adjacent workstations: the whole of ACC Zurich's airspace on 128.050 MHz and, from the neighbouring position, a delayed Airbus A320 approaching Friedrichshafen on 119.920 MHz. Crews on one frequency could not hear crews on the other.

Work to re-sectorise the airspace had begun that evening, and from 21:13 the controller workstations were switched to the radar fallback mode: radar targets were no longer correlated automatically with flight plan data, the optical short-term conflict alert (STCA) was unavailable, and the minimum radar separation had been raised from 5 NM to 7 NM. The direct telephone lines to neighbouring units were unavailable from 21:23 until 21:34:37, and a defect in the bypass telephone system defeated the controller's seven attempts to call Friedrichshafen. The controllers had not read the written instructions on the work, and the controller was not aware that the optical STCA was unavailable.

The accident

From about 21:33 the Tu-154M crew watched the 757 on their TCAS display and discussed its position. At 21:34:30 the 757 copilot handed control to the commander and left his seat to go to the lavatory.

In the Tu-154M, when the climb advisory sounded, the copilot said that TCAS was saying "climb". The instructor replied that the controller was guiding them down. The copilot twice referred to the TCAS climb command, but the descent continued. In the 757, the autopilot was disconnected within about two seconds of the descend advisory, and the commander reached the required 1,500 ft/min within 12 seconds and increased the rate to about 2,600 ft/min after the strengthening advisory. The copilot, back in his seat, called "descend hard" two seconds before the collision, and both crews made last-second avoiding inputs.

The flight paths crossed at right angles, the 757 heading 004° and the Tu-154M 274°, with a closure rate of 702 to 718 kt in darkness. The 757's fin struck the Tu-154M's left wing and then its fuselage near the emergency exits. The Tu-154M suffered an explosive decompression and broke up in flight; the 757 lost about 80 % of its vertical tail and struck a forest at a pitch angle of about 70° nose down. The accident was non-survivable.

The investigation

Air traffic control

To keep the prescribed separation, the controller would have had to instruct the Tu-154M to descend by 21:33:49 at the latest, about one minute before he did. The BFU found that he noticed the conflict too late because his attention was taken by the A320 approach and the failed telephone calls, and that his instructions and traffic information to the Tu-154M did not match the urgency of the situation. Seeing the Tu-154M descend, he considered the problem solved and returned to the A320. The BFU judged that the radar in fallback mode was technically sufficient for safe operations, and that the optical STCA would have warned him about 2.5 minutes before the collision.

The BFU considered a duty schedule of two controllers for all of ACC Zurich's night work insufficient, and the long-tolerated practice of one controller working alone while the other rested a systemic cause.

What TCAS did

Both aircraft had ACSS TCAS 2000 units meeting TCAS II Version 7, retrofitted with the display integrated into the vertical speed indicator. The alerts were triggered as designed. Above FL200 the logic issues a traffic advisory when the time to the predicted closest point of approach falls below 48 seconds, and an RA when it falls below 35 seconds. The two aircraft were about 50 ft apart in altitude, with the 757 slightly below, so TCAS sent the 757 down and the Tu-154M up. A EUROCONTROL analysis confirmed that the initial RAs would have ensured safe vertical separation if both crews had followed them.

Because the Tu-154M descended, the conflict persisted. Strengthening advisories are not coordinated between aircraft; when the 757 obeyed "increase descent", the gap closed further. TCAS II Version 7 could reverse the sense of an RA only when several conditions were met, and they were not met in this encounter. The later modification CP 112, EUROCONTROL found, would have issued a reversal advisory that would have given sufficient separation had the 757 crew followed it.

The Tu-154M crew

The BFU found that the crew, who had tracked the 757 for some time, were expecting an avoiding manoeuvre and followed the controller's instruction swiftly. The climb advisory arrived just as the descent began, and the repeated instruction, with the controller's statement that the other aircraft was at FL360, confirmed their decision; the wrong "2 o'clock" position unsettled them for a time. The BFU assumed that the crew would have followed TCAS had the controller not already ordered a descent. It noted that the pilot in command did not doubt the controller, that the copilot "did not find audience", and that nobody said TCAS had priority over ATC. "After the crew initiated a descent contrary to the RA, the outcome was left to chance."

The operator's manual described ATC as the main means of collision avoidance and labelled RAs a "recommendation to the crew", although it also prohibited manoeuvres contrary to an RA. TCAS was not required in the Russian Federation, and the commander and instructor had flown only 12 and 4 flights respectively into regions requiring it in 2002.

The Boeing 757 crew

The copilot probably would not have left his seat had the crew noticed the other aircraft; at that moment it was 13.6 NM away, and the display range selected could not be determined. The commander then had to act as both pilot flying and pilot monitoring. He began the descent within five seconds, the response TCAS assumes, and met the increased rate promptly. The BFU considered the 23 seconds before the "TCAS descent" report generally too long, but found that the report was made at the earliest opportunity, given a busy frequency and his workload. The BFU concluded that the crew "had reacted correctly to the situation."

Rules that did not agree

The BFU found that the international and national texts on ACAS in force that day were incomplete and partly contradictory. ICAO's clearest warning against manoeuvres opposite to an RA sat in a technical annex; PANS-OPS left pilots free to use "best judgement and full authority"; the manufacturer's pilot's guide called TCAS 2000 "a backup to the ATC (Air Traffic Control) system"; the German Air Traffic Order spoke of "recommendations". EUROCONTROL's documents and the FAA's advisory circular were clear, but they were recommendations or had no legal effect on these aircraft. The BFU's conclusion was that the system allows only one procedure after an RA: comply without delay and report the manoeuvre to ATC.

Probable cause and contributing factors

The BFU identified these immediate causes:

• "The imminent separation infringement was not noticed by ATC in time. The instruction for the TU154M to descend was given at a time when the prescribed separation to the B757-200 could not be ensured anymore."
• "The TU154M crew followed the ATC instruction to descend and continued to do so even after TCAS advised them to climb. This manoeuvre was performed contrary to the generated TCAS RA."

And these systemic causes:

• The integration of ACAS/TCAS II into aviation was insufficient and did not correspond in all points with the system philosophy; the regulations of ICAO, national authorities, the manufacturer and the operators were not standardised, incomplete and partially contradictory.
• The air navigation service company's management and quality assurance did not ensure that all open workstations were continuously staffed at night.
• They tolerated for years that, at night, only one controller worked while the other rested.

Safety recommendations and what changed

On 1 October 2002 the BFU recommended (18/2002) that ICAO change Annex 2, Annex 6 and PANS-OPS (Doc 8168) so that pilots must follow RAs whatever ATC instructs, unless it is too dangerous to comply, until clear of conflict. On 21 July 2003 it asked the Swiss Federal Office for Civil Aviation (FOCA) for procedures governing maintenance work on ATC systems, for at least two controllers on active duty at all times with extra staff for approach work and breaks, and for emergency training on conflict recognition, restoring separation and urgent phraseology.

With the final report on 19 May 2004 it added:

• to ICAO: uniform ACAS rules requiring pilots to respond immediately and never to manoeuvre against an RA; ACAS training material raised to PANS status; downlinking RAs to ATC; recording of background sound at controller workstations; and auditing of ACAS compliance;
• to the FOCA: an STCA that shows when it is unavailable and sounds until acknowledged; automatic rerouting of calls to the bypass telephone system; radar updates within 8 seconds en route; full recording and replay of controller displays; an effective safety management system; a staffing evaluation; and refresher training;
• to the Russian civil aviation authority: ACAS training in simulators or computer-based trainers, ACAS scenarios in CRM and line-oriented flight training, and wider CRM training;
• to the FAA: that the TCAS 2000 manual be reworded to match the ACAS philosophy and international procedures.

The report also refers to deviating statements, published as its Appendix 10.

Lessons for pilots

An RA outranks an ATC instruction. The controller cannot see your RA unless you tell him, and he may be giving the opposite instruction at the same moment. Once you report the manoeuvre, the controller should not issue instructions contrary to it. Fly the RA, then report "TCAS climb" or "TCAS descent". See ACAS and TCAS.

The other aircraft is flying the mirror image. RAs are coordinated, so the other TCAS has already chosen the opposite sense. A crew that ignores its RA takes away the protection of the one that obeys. The Tu-154M crew's descent made the 757's correct descent unsafe.

Listen to the pilot who says "TCAS says climb". The Tu-154M's copilot twice pointed to the TCAS climb command, and the BFU found that he alone had judged the RA correctly, but nobody acted on it. Good crew resource management means a clear challenge and a leader who stops to check it, especially with a steep authority gradient on the flight deck.

Know what you leave behind. Before leaving the seat in cruise, check the traffic display on its longest range and brief the remaining pilot, who will be flying and monitoring alone.

Separation is ATC's job; TCAS is the last line. A late instruction, a single controller on two frequencies and degraded equipment removed the first layers of defence described under separation standards. At jet closure speeds, visual scanning supports ATC and TCAS but cannot replace them.

Crash Investigations pages summarise official investigation reports for study and exam preparation. The investigating body's report is the authoritative account and prevails wherever it differs from this page. Under ICAO Annex 13, an investigation exists to prevent accidents, not to apportion blame or liability.