Human Failings Underscored In Report of 2002 Mid-Air Collision Over Germany

A copilot hesitatingly asked the right question about the alert to descend, was ignored, and they all died. From the fatal July 2002 mid-air collision over Switzerland of a B757 cargo aircraft and a Russian TU154, the object lesson that surfaces is to follow the direction of the traffic alerting and collision avoidance system (TCAS). If there is a contrary instruction from air traffic control (ATC), follow TCAS.

That is but one of many messages contained in the report of investigation. The English language version of the German Federal Bureau of Aircraft Accidents Investigation (Bundesstelle fur Flugunfalluntersuchung, or BFU) report, released May 19, contains a sweeping agenda of 15 recommendations, in addition to the four issued during the course of the investigation. Among the recommended actions: TCAS should be enhanced to alert air traffic controllers when the airborne system issues a resolution advisory (RA) to its pilots. A resolution advisory is, in effect, a commanded avoidance maneuver when two airplanes are on a collision course. If both aircraft are TCAS-equipped, the systems communicate with each other, and one aircraft is alerted to climb and the other to descend. The alerts are sounded to give pilots at least five seconds to respond.

Such was the case in this mid-air collision. The TCAS worked as designed. But, as in most accidents, a range of insidious policy, training and procedural issues are involved. This accident was no exception. It was one where other breakdowns overwhelmed the last ditch defense that TCAS was intended to provide.

That the accident occurred in RVSM (reduced vertical separation minimum) airspace – with aircraft separated vertically by just 1,000 feet – makes it all the more important, considering the advent of domestic RVSM in the United States (see ASW, Nov. 3, 2003).

This is a case where the airplanes were equipped with the latest in TCAS technology, the pilots were trained in its use and rated as highly competent, the Swiss air traffic control system was rated as among the world’s best, the controller was “handling” just three airplanes at the time, and yet two airplanes collided on a clear night sky, littering the pastoral countryside with shivered parts of the jets and the remains of the 71 persons aboard both aircraft. The BFU report hints at the macabre effect, noting the “extreme destruction” of the pilots’ bodies and that 40 passengers in the TU154 “fell out of the airplane” when the stricken fuselage decompressed explosively. Those 40, mostly children, fell 35,000 feet to earth, perhaps shocked insensate by the explosive decompression and, in any event, the time of useful consciousness at that altitude is about nine seconds, a brief amount of time likely to be halved by the startle factor and the body’s adrenaline-stoked accelerated burning of oxygen.

Although the airplanes collided in Swiss-controlled airspace, they fell near the town of Uberlingen, Germany, hence the BFU’s primary role in the investigation.

Briefly, the DHL B757 cargo plane was on a flight from Bergamo, Italy, to Brussels. The Russian TU154 was on a flight from Moscow to Barcelona, Spain. The airport is located in mountainous terrain, and per company policy the Russian captain was making his second of two required flights under instruction to Barcelona. The instructor, in this case, was the company’s chief pilot, and the BFU considered him the pilot in command (PIC). Altogether, there were five flight crewmembers in the cockpit of the TU154 trijet.

The pilots of both airplanes had received instruction and training in the functioning of their TCAS systems. The two pilots of the B757 had undergone TCAS training in the simulator. This was not the case for the Russian pilots. They had received the requisite classroom training (except the flight engineer), but a simulator was not available for real-time exercises (nor was it required).

The accident flight was the Russians’ first operational experience with a TCAS alert. Moreover, two latent hazards lurked. First, although the pilots of both airplanes had completed crew resource management (CRM) training, the BFU noted a steep “authority gradient” in the Russian cockpit (i.e., the chief pilot definitely was in charge). Second, the documentation regarding TCAS compliance in the TU154 manual was, in the words of the BFU, “not sufficiently unambiguous.” The manual stated that “ATC measures are the main and major condition of collision avoidance.”

The priority of complying with a TCAS-generated RA was not stressed, although elsewhere the manual said maneuvers contrary to an RA were prohibited (i.e., if TCAS said climb, the pilot should climb).

This, basically, was the setup for the two aircrews.

The 35-year old Danish controller had been working at the Zurich area control center (ACC) since 1996 and was considered proficient. The center had recently been privatized and was operated by SkyGuide. On the night in question, the controller was slated to man the ACC in concert with another controller and two assistant controllers. He was aware that a 10-man team of technicians would be working on the ACC computers that night, and that the system would revert to the fallback mode for some hours.

However, according to the BFU, the controller was not aware of the limitations inherent to the fallback mode. Among them:

• Radar images are not correlated automatically with the airplanes’ flight plans (which meant the controller would have to do so manually, adding to the workload).
• The primary telephone system to neighboring ACCs would be disconnected, leaving only the bypass telephone line, which system failed, too, despite the controller’s frantic attempts later to get through to the Friedrichshafen ACC).
• The short term conflict alert (STCA) system would not provide an optical warning of a collision threat on the radar screens. Rather, it would sound an aural alert only (which, during this event, was not heard).

Nor was the controller aware that neighboring ACCs had not been informed of the planned computer work at Zurich.

Furthermore, it was customary for the second controller on the Zurich night shift to retire to the lounge when traffic volume diminished, to return the following morning when traffic picked up. The lounge is too far for the lone working controller to shout a call for assistance. Rather, he must use the telephone. In other words, the second controller was sleeping at the time of the accident, and SkyGuide management was aware of the practice, even though a safety management process was under way to stop such practices. Human redundancy was lost, the BFU said, without a second controller present to catch procedural errors or mistakes.

Of the two controller assistants on watch that night, only one was physically present in the ACC to assist with routine tasks.

At about the time the two accident aircraft entered Zurich ACC airspace, the controller also had to handle a delayed A320 on approach to Friedrichshafen. He had to move to an adjacent console, and use a second radio frequency, to direct the A320. This physical shifting diverted the controller’s attention from the B757 and the TU154, even though their positions were displayed on both consoles.

Hence, at the time of the accident, the lone controller was working two consoles using two radar screens on different scales (complicating his assessment of the impending collision), with two radio frequencies, a telephone failure, an impaired STCA, an urgent secondary task (the A320) and the distraction of the computer technicians doing their work.

The Zurich ACC’s safety defenses-in-depth were degraded, to say the least. The controller lost control. He did not hear the STCA warning. A radio call from the A320 overlapped the “TCAS descent” message from the B757, a problem of blocked radio transmissions discussed previously in this publication (see ASW, July 9, 2001, July 16, 2001, and July 30, 2001). The controller did not answer numerous telephone calls from the Karlsruhe ACC, whose concerned controllers were seeing the impending collision on their radar screens, thinking the main telephone system was still inoperative (which it was not, but the technicians hadn’t told him).

The countdown to collision reads like a slow-motion movie of impending disaster. As an historian once said, history is written in retrospect but is lived forward, so one can know the end but never know what it was like in the beginning only. Knowing the end in this case, however, makes the transcript of events all the more sobering. Because the apparent size of another aircraft remains small, until “exploding” into view moments before impact, the pilots may not have been aware of their mortal peril until only a second or two before impact.

Using the classical “Swiss cheese” model of accident causation, numerous defenses against disaster were penetrated. The BFU report dwelled critically and at some length on the safety breaches. We focus here on three of the many issues raised by the BFU. First, regulations published by the International Civil Aviation Organization (ICAO) and other national regulatory bodies were “not standardized, [were] incomplete and partially contradictory. The BFU said that in its opinion, “only one procedure can be permitted in the case of an RA.” If air traffic control issues a conflicting instruction, follow the RA and advise ATC accordingly. (ASW note: refer to the latest regulatory activity regarding TCAS, advising pilots to ignore an RA fail indication and to comply with RA aural guidance, injecting a comparable level of potential confusion evidenced in this mid-air collision; see ASW, May 24, and April 19. See also May 21 item in table).

Second, the guidance in the TU154 manual described TCAS as an additional system for indicating intruder traffic and that ATC is the basic system for collision avoidance. The BFU said, “This reference devalues the TCAS system’s priority, as it indicates the TCAS is a back-up when ATC is not available, and not a last resort defense …. even in the presence of full ATC services.”

Third, CRM training does not appear to be achieving the desired effect. Even though the Russian PIC was a CRM instructor, he made his decision to descend in a peremptory manner, and continued the descent even though the copilot twice questioned the decision in the face of the conflicting RA alert to climb. Whether CRM training is having the desired effect on cockpit decision-making has been raised recently in this publication (see ASW, Jan. 26).

A few additional comments are in order. Skyguide and other European ATC service providers have since banned the previously tolerated practice of sleeping on night shifts. The first principles of ATC require supervision, backup and anticipation to be consistent and continuous. The fact that ongoing maintenance on the night of the accident was going to undermine efficiency and safety simply was not factored into the staffing situation and the condoned sleeping on watch. A report issued by the German regulatory authority, the Luftfahrt-Bundesamt (LBA), a year before had found SkyGuide radar equipment, training and procedures to be wholly deficient. SkyGuide has since tightened ship, but the needed changes occurred after the accident.

A fairly ironic fact is buried deep on page 61 of the BFU report: although the two aircraft initially were both at flight level 360, their altitudes were 50-ft. apart. If they hadn’t done anything, they might have missed each other (albeit at hair-raising closeness). However, a correct RA was issued to climb. The TU154 crew maneuvered opposite of the RA, and not just once, but twice. To conclude that this is splitting hairs is to miss the point. The Golden Rule of surviving a TCAS event is “Don’t maneuver opposite.”

While a bit of conjecture, had the TU154 leveled at its assigned altitude of 35,000 feet, it would appear according to the detailed graphs in the BFU report that the B757 would have passed closely overhead by about 50 feet (a miss by that amount being as good as a miss by a mile, practically speaking). As it happened, the TU154’s attempt at climbing back to the assigned level made matters worse, the collision occurring at 34,890 feet. The TU154 not only failed to comply with the TCAS RA but also then failed to level off accurately at its assigned altitude.

Training trumps culture

Too much should not be read into simplified perceptions of an authoritarian Russian “culture.” Why did the Russian crew feel it necessary to follow ATC instructions and disregard TCAS? The crew was very experienced, but with the absence of a simulator they had not been trained on the mandatory reaction protocols associated with TCAS. This situation recalls the lack of training concerning the B747 para-visual display (PVD) cited by the Aviation Safety Council (ASC) of Taiwan in its investigation into the fiery October 31, 2000, takeoff crash on the wrong runway of Singapore Flight SQ006 (see ASW, March 5, 2001).

Further, the operating procedures for the flight crew specifically required compliance with ATC at all times. It was not Russian “culture.” It was poor, incorrect or absent training.

Big sky – little sky

This tragic case should end the “big sky” notion that the air traffic controller’s ultimate savior will be the vastness of the airspace and the smallness of the airplanes. Satellite navigation accuracy, RVSM and automated, computerized flight controls have combined to kill the big sky theory. Dense clusters of airplanes headed in both directions and separated by half the 2,000-ft. vertical separation of yesteryear can make the sky along preferred tracks very small. Constructing a mid-air collision is now as straightforward as putting two trains on one set of tracks. In this accident, the controller tried to close the switches after the locomotives had passed by on their intersecting tracks. Technical refinement of navigational tracking accuracy and height-holding precision has increased the efficiency of preferred airspace use, but at an increase in the risk of mid-air collisions. Controllers now need to become sensitized to the “small sky” theory. For pilots, the “see and avoid” principle of collision avoidance may no longer be sufficient.

The ‘strange attractor’

For pilots, sighting the threat can lead to a greater hazard that might be called the “strange attractor.” This term describes a scenario where two pilots at night without a defined horizon become fixated on keeping each other’s lights in sight. In this mid-air collision, note that the TU154 changed its heading from 264� to 274� about two seconds after sighting the B757. The result can be a mutually maintained constant relative bearing on each other, which can greatly increase the risk of collision or near-miss. The control inputs by both pilots in the last few seconds tends to bear out the sudden arousal of imminent collision as each “target” blossomed in size.

Pilots disregarding a coordinated TCAS RA while attempting visual avoidance do so at their peril.

(The full BFU report and appendices may be viewed at http://www.bfu-web.de/aktuinfo42.htm)