Accident details
Date: 01 July, 2002
Location: Above Überlingen, Germany
Accident type: Mid-air collision
Fatalities: 71
Primary causes: Errors made by air traffic control [ATC] facilitated by organisational failings
Aircraft #1
Operator: Bashkirian Airlines
Flight number: 2937
Aircraft type: Tupolev Tu-154M
Fatalities: 69 of 69
Aircraft #2
Operator: DHL
Flight number: 611
Aircraft type: Boeing 757-200
Fatalities: 2 of 2
Introduction
The following is an analysis of the mid-air collision of Flights 2937 and 611; factual information of the sequence of events is drawn primarily from the official accident report composed by the German Federal Bureau of Aircraft Accidents Investigation [BFU] (20041).
Sequence of events
Background information
The Tu-154M was a charter, being operated by Bashkirian Airlines as Flight 2937 and en route to Barcelona from Moscow, while the 757-200PF was a DHL freighter, Flight 611, flying from Bergamo, Italy, to Brussels. At the time of the accident, the aircraft were in controlled airspace being guided by the private Swiss air traffic control company, Skyguide.
Single controller
There were two Skyguide controllers on duty, but only one was working, while the other was on break for a significant period of time.
Disabled conflict detection system
Procedures required a conflict detection system to be operational while only one controller is working, however due to maintenance taking place at the time, it was disabled.
Downgraded radar
Furthermore, the maintenance work also meant that the radar systems were operating in a downgraded mode, which was less responsive and accurate.
Disabled phone line
The phone line was also disabled, meaning the controller wasted a significant amount of time trying to contact a local German ATC unit about another aircraft.
Unoperational backup phone system
Unfortunately, the backup phone system was not operational either, due to a software failure that was not detected even when tests were run on the ATC system three months previously.
Two discrete frequencies
A final consideration was that the controller was working two different radar screens with discrete frequencies. This meant that he had divided attention, and could only deal with one screen and frequency at a time.
Collision course established
At 21:21:50 UTC, the Boeing's crew requested a climb from FL320 to FL 360. Eight minutes later, after this had been confirmed by ATC and performed by the crew, the two aircraft were on a collision course at the same altitude.
Initial TCAS advisory
About five minutes after this, at 21:34:42, and 50 seconds before the collision, both crews received an initial TCAS traffic advisory: “traffic, traffic”, warning of the possible collision with the other aircraft. A few seconds later, the controller instructed the Tupolev's crew to descend expeditiously to avoid the Boeing, which the crew complied with but did not acknowledge.
Attempted sector controller warning
A German upper sector controller noticed the potential collision but could not warn the Skyguide controller due to the disabled phone lines.
TCAS RA
Fourteen seconds after the initial TCAS traffic advisory, the Boeing's TCAS issued a resolution advisory to descend: “descend, descend”, and the Tupolev's TCAS issued a resolution advisory to climb: “climb, climb”. The Boeing's crew began to descend, while the Tupolev's crew also continued to descend, following ATC's instructions and ignoring TCAS. Shortly before the collision, the Boeing and Tupolev's crews received an “increase descent” and “increase climb” command respectively.
Collision
One second before the collision, both crews conducted drastic evasive manoeuvres but it was too late to avoid the collision.
Considerations
Single controller duties
This procedure was met with great controversy when it was implemented a year before the collision, and resulted in many protests from the controllers' union. It was seen as an unsafe practice due to the lack of supervision or assistance in safety-critical situations.
Disabled systems
Skyguide's management should not have permitted maintenance to disable these key systems while there was only one controller working, and as a result of these errors, four Skyguide middle managers were prosecuted for negligent homicide.
Controller's workload
Even though traffic was light, the working conditions would have put extra strain on the controller and greatly lowered the possibility of him preventing the collision.
Conclusion
This accident is an excellent example of an organisational accident, as while it does appear that the controller should be held responsible for the event, the decisions made by Skyguide management made such an event almost inevitable.
Want to know more?
Link to the BFU final report in English
Flights 2937 and 611 on Wikipedia
Flights 2937 and 611 at airdisaster.com
Flight 611 at the Aviation safety network
Flight 2937 at the Aviation safety network
Dramatisation of the event on AviationKnowledge
