Say Again? #57: Überlingen
A quiet night with few airplanes in the sky and tired controllers working with them. Sounds like the typical midnight shift in any air traffic control room in the world. Until the radar goes out for maintenance and the phones don't work. AVweb's Don Brown wonders whether there will be enough controllers to prevent another midair collision like the one over Überlingen, Germany.
I don't know why air disasters take on the names of towns or places. I guess we have to give them some sort of name to catalogue them in our minds. Perhaps geography is just convenient. It does seem unfair to the towns. Lockerbie, Scotland, didn't have anything to do with Pan Am 103 blowing up. Cerritos, Calif., was just dairy country converted into a suburb when Aeromexico 496 and a Cherokee collided overhead. Tenerife, Canary Islands, should still be a little-known island off the coast of Africa instead of the site of the deadliest aircraft collision in history.
Fair or not, Überlingen now shares the same fate. On July 1, 2002, a DHL Boeing 757 and a Bashkirian Airlines Tupolev TU154 collided at 35,000 feet above Überlingen, Germany. All 71 souls on board both aircraft were lost. This incident wasn't any more or less tragic than any other air disaster but there was something that set it apart from almost all others.
Midair collisions aren't nearly as rare as you might believe. According to the Nall Report there were 11 in 2003. The average is 13 per year in the U.S. Midair collisions involving airliners are rare but not unheard of. I've already mentioned one, Cerritos (NTSB report), and then there was the one involving a PSA Boeing 727 and a Cessna 172 at San Diego. There was even one in my neck of the words back in 1967. A Piedmont Boeing 727 and a Cessna 310 collided just south of Asheville, N.C., over Hendersonville. As the Nall Report states (and you probably suspect), most midair collisions occur down low, in the relatively congested airspace near airports. Most, that is, but not all. The Überlingen midair is in the rarest category around: a midair collision at high altitude, in an advanced air traffic control system. To put it simply, this kind of accident isn't supposed to happen.
Some of you may remember I wrote a column about how an ATC system is designed to provide "layers" of safety shortly after this accident occurred. You might want to refresh your memory because I plan on sticking to the same frame of reference for this article. Our basic instinct when an accident occurs is to find someone or something to blame. While we may recognize that there are multiple factors at work, we still feel the need to identify at least the primary cause. This accident -- from my frame of reference -- doesn't let us satisfy that need.
My frame of reference is (of course) as an ARTCC (Air Route Traffic Control Center) controller and safety representative. Your's probably isn't. Furthermore, I'm a controller in the United States. This accident occurred in German airspace delegated to the Swiss air navigation service provider Skyguide. While I have read the final accident report published by the German Federal Bureau of Aircraft Accidents Investigation and I've consulted several other sources to understand this accident, I am not familiar with the rules and practices of Eurocontrol nor the ATC equipment used by Skyguide. This severely limits my ability to grasp all the details and nuances of this accident. The best I can hope to do is look for similarities, relate them to my frame of reference and hopefully learn something from this tragedy.
An Opportunity to Learn
Which brings me to my last point before I get into the details of the accident itself. We must -- as an industry -- take the opportunity to learn everything we can from this accident. Midair collisions in this type of environment are extremely rare. The only other one I can think of was the midair collision between a British Airways Trident and an Inex DC-9 near Gaj, Hrvastka, Yugoslavia, in 1976. If we want to keep them rare, we need to learn every single tidbit we can learn to prevent another.
You would think that sentiment would be universally shared. The NTSB gave an excellent briefing about this accident at one of our Communicating for Safety conferences. While at one of these conferences, the president of the National Air Traffic Controllers Association (NATCA), John Carr, dropped by my table and asked if I'd be interested in seeing the briefing the International Federation of Air Traffic Controllers' Associations (IFATCA) made at an international conference regarding this incident. You betcha. He emailed me the Power Point presentation and another one on human factors shortly thereafter. I was impressed. Here's a guy who has a 15,000+ person organization to run and he's taking the time to send (little ol') me stuff on an accident that happened halfway around the world. Some might think he had better things to do. Fortunately, he doesn't share that sentiment.
I only mention it because later (at that same conference) there was an open-panel discussion with some of the senior managers at the FAA. I took the opportunity to ask about Überlingen. Had the FAA reviewed the accident? Did they plan on developing a "lessons learned"-type briefing for their controllers? The answer just floored me. To paraphrase: Yes they had; and no, they weren't. The circumstances and ATC equipment were too dissimilar to be of much value to America's controllers.
In the Dark of Night
This accident occurred at 11:35 at night, local time or 2135 UTC. For the rest of the article I'll use UTC (Universal Time - Coordinated) but I don't want you to be confused about the frame of reference. From an ATC perspective, it's important to understand that this is the "midnight shift" even if it is slightly before midnight, local time. Like virtually all midnight shifts, this is a time of light traffic, minimum staffing and a favored time to perform maintenance on the system. This shift would be no different in that regard.
There were two controllers assigned to work the traffic at the Zurich ACC (Area Control Center) that night. They each had an assistant, but these assistants were not qualified (nor expected) to work traffic. Because of some technical maintenance during the period that the accident occurred, the radar scope was operated in the "fallback mode." In other words, the radar display system being used wasn't the primary system with all the usual capabilities. One of those missing capabilities was the optical Short Term Conflict Alert (STCA). In addition, an unrelated system -- the telecommunications system -- was being worked on.
As I said earlier, I'm not familiar with the specific equipment and procedures they use in Switzerland, but everything I've listed so far seems familiar to me. Our staffing at Atlanta Center (ZTL) is minimal on the midnight shift. We do a lot of maintenance on the mid, too. When they take the main Radar Data Processing system out we go to a backup system called DARC (Direct Access Radar Channel). Like the Swiss system, we too lose the Conflict Alert function on the backup system. Our Conflict Alert program continuously projects the flight path of aircraft. If it detects a conflict with another aircraft, it causes both of the data blocks to flash on the scope.
The similarities continue. The Swiss controllers were using two radar scopes. One was used for the high-altitude sector and one was used for the low-altitude sector. It appears their work stations (including the radar scopes) are slightly further apart than ours and, from what I can tell, one of their scopes is set on a (much smaller) scale more conducive to working Approach Control functions.
There is one other similarity I want to detail and it is perhaps the most significant one: taking a break. If you've got two scopes and you've only got two controllers, at some point in time, a controller will be working two scopes alone. This always has been and always will be a less-than-desirable situation. The argument is over how you address it. Midnight shifts are slow and boring (unless you work someplace like Memphis). Do you pay three (expensive) controllers to sit around being bored or do you take a chance that nothing significant will happen while one of only two controllers is on break. It's obvious what Skyguide chose.
Once you make that decision, you have to manage it. If you don't, here's the logic that will take over. If one controller can work two scopes for 20 to 30 minutes -- alone -- then why can't he work it alone for an hour? Or two hours? Or four? And that is exactly what happened. As soon as the traffic died down the second controller at Zurich took off on an extended break. Everybody does it. The controllers know it, management knows it and it has been going on for years.
A Light Load
During the period in which the accident occurred the controller was working three airplanes: The B757 and TU154 involved in the accident and an Airbus 320 landing at Friedrichshafen. The B757 and TU154 were on the high-altitude scope (and frequency) and the A320 was on the low altitude scope and corresponding frequency. The controller was to provide Approach Control services to the A320 landing at Friedrichshafen, including coordinating with the ATC Tower at Friedrichshafen. And this is where things began to go horribly wrong.
Three airplanes is a light workload for any controller. Anywhere. Under normal circumstances that is. But these circumstances weren't normal. When the controller tried to coordinate the inbound with Friedrichshafen, the telephone wouldn't work. He tried several times without success. He even sent his assistant to see if he could find another telephone number to call. He finally decided to have the A320 call Friedrichshafen on the radio directly. In other words, he was asking the crew of the A320 to coordinate their arrival with the Tower.
I think I should point out a little controller perspective here. First, it's embarrassing (and time consuming) to ask a pilot to do your job as a controller. I've had to do the same thing before but it's a last resort. More importantly, aviation gets more dangerous as airplanes get closer to the ground. It's a high workload period for the pilots and you don't want to distract the crew as they are getting closer and closer to the terrain. In other words, it's entirely understandable that this controller was fixated on handling the Airbus. But all controllers are trained to avoid fixating on any one situation too long.
When this controller finally did look back at the B757 and TU154, I feel certain he was shocked to notice them about to merge at the same altitude. I know some are asking how could he have not noticed it before. It happens. It happens the same way people run a stop sign or a red light while driving a car. People get distracted. The controller got distracted by the malfunctioning phone system while trying to coordinate the arriving A320. He allowed himself to be distracted too long. There wasn't a second controller there to notice (and help with the unexpected workload) and the Conflict Alert was disabled due to the other maintenance.
At 21:34:49 UTC the controller instructed the TU154 to descend to FL350: "B-T-C 2937, descend flight level 3-5-0, expedite, I have crossing traffic." The crew responded immediately. They had seen the traffic on their Traffic Alert and Collision Avoidance System (TCAS) nearly two minutes earlier and TCAS had issued a traffic alert seven seconds prior to the beginning of the controller's transmission. In other words, they were waiting for the controller to issue some type of instruction and when he did, they didn't hesitate. They knew they were in danger. The pilot actually commanded a descent before the controller's (eight second) transmission ended and the yoke was pushed forward within three seconds.
At this point, the airplanes were approximately seven miles apart. Because of the "fallback mode" of the radar, the minimum lateral separation required at this time was also seven miles. The controller knew he was having an Operational Error but that was all he knew. The second he observed the TU154 leave FL360 he went back to working the A320 into Friedrichshafen. The pilot of the A320 had already called him twice and he had been unable to answer him while he was prying these two apart. He'd had a "deal" but they were going to miss.
Let me pause right here. Let's suppose this is where the story ended. It was going to be close, but let's say they missed by more than 500 feet vertically. Do you suppose this incident would have been reported? I don't know about Switzerland but in the U.S., when we're on DARC (the backup) system, the Operational Error Detection Program doesn't work. In other words, the "snitch machine" wouldn't have alerted the manager at the front desk that an Operational Error had occurred. Would the typical controller report the incident? Would the typical pilot? Would anybody have filled out a NASA ASRS Report if this had been in the U.S.? Think about that and see what you come up with for an answer. Then ask yourself, "Why?"
A Time of Confusion
Unfortunately, the story didn't end there. Although the TU154 crew complied with the initial descent clearance, they didn't reply to it. Two seconds after the initial descent clearance was issued to the TU154, their TCAS system and the TCAS in the B757 issued resolution advisories (RA). It was a coordinated TCAS RA, meaning the two TCAS systems worked together: The TU154 was commanded to climb and TCAS issued a command to descend to the B757. The pilot in the B757 complied immediately to the RA. The crew of the TU154 didn't. Because the TU154 crew didn't acknowledge the controller's instruction to descend, the controller repeated the clearance to descend six seconds after TCAS had issued them a command to climb.
At the time of the accident, the current rules and regulation governing the TU154 crew gave precedent to an ATC clearance over a TCAS resolution advisory. There was a brief debate in the cockpit but they had already started a descent and they continued descending. In another cruel twist of fate, the pilot of the B757 was alone. The copilot was just coming back from the restroom. It is believed this delayed the B757 crew from informing the controller that they had initiated a TCAS descent. When they did, their transmission was made at the same time the A320 landing at Friedrichshafen made a transmission. The controller -- already focused on the A320 at Friedrichshafen -- never heard the B757's transmission. At 21:35:32 UTC, 13 seconds after the B757 crew advised they were descending, they collided with the TU154 at an altitude of 34,890 feet.
The most critical lesson I learned from this accident was how unforgiving time can be. From the time TCAS first alerted the B757 crew of the traffic until the collision, only 50 seconds passed. In less than one, single, solitary minute the controller issued a descent clearance (twice) and called the traffic, TCAS issued a resolution advisory, the TU154 co-pilot questioned the captain's decision to descend and the B757 co-pilot retook his seat and informed the controller they were descending. There was barely enough time for everyone to react much less discover the confusion, sort it out and come up with another course of action.
More and more aircraft are being equipped with TCAS. The potential for this type of situation is growing with each one. The time to think about "what if?" is now, not when TCAS issues an RA. A controller isn't going to depend on TCAS to intervene if he finds himself in a similar situation; he will do something and he doesn't know what TCAS will do. Because of this accident (and other incidents) there are controllers out there priming themselves to issue vectors instead of altitude changes should they ever find themselves in a similar situation. I'm not comfortable with that line of reasoning (because of other incidents I know about) but at least they are thinking. You should too.
I know some of you are saying to yourself, "I don't fly in the flight levels and I don't have TCAS so what's in it for me?" First, this incident could have happened at any altitude. Second, you talk on the radio. Think of the Airbus inbound to Friedrichshafen. There was absolutely no way for the pilot to be aware of the events unfolding above him. However, the flight's very presence contributed to this accident. There is no blame attached to the flight (nor should there be) but the next time you're out flying "all alone" late at night, keep in mind the controller might be working more than one position and talking on other frequencies. Try to resist the temptation to dominate the controller's time and attention because you perceive he isn't busy.
I urge you to try and wade through this report for yourself. There are literally hundreds of details I've had to leave out. There were five crewmembers in the cockpit of the TU154. The pilot in the right seat was the chief pilot of the airline. The controller had climbed the B757 from FL320 to FL360 some 13 minutes before the accident. Both pilots of the B757 transmitted that they were in a "TCAS descent" at the same time. The German Federal Bureau of Aircraft Accidents Investigation issued 21 safety recommendations derived from this accident. There is a lot to be learned.
Up to Date
As I was leaving work the other day, I overheard a conversation to the effect that there would only be two people on the midnight shift in my Area. Without bothering to listen to the rationale -- the reasons, the excuses -- I said in my usual sarcastic tone, "I guess you've never heard of Überlingen." I couldn't believe it but I was right. They hadn't. I asked a half-dozen controllers in the Area. Nobody knew what I was talking about. I must be the world's lousiest safety rep. One guy took a guess, "Was that the midair they made us watch the videotape of, about 20 years ago? The one in Yugoslavia?"
Amazing isn't it? Somebody can remember a video from 20 years ago. I had the Überlingen accident package on my safety bulletin board for about a month. I didn't expect it to have the impact a video and a briefing would have -- not that I can force anybody to attend a briefing anyway -- but I don't have the resources to make a video. The FAA does. They can compel controllers to attend briefings, too.
If it comes down to working the midnight shift with only two controllers -- and with the current controller shortage it will -- which would you rather have working your airplane: A controller who learned some lessons from the Überlingen tragedy or one who didn't?
You pay for this system -- perhaps no more than other taxpayers and passengers -- but you know more about it and can make better decisions than the general public. Get involved with the decision-making progress (through your elected representatives) instead of letting "low cost" set the agenda.
Have a safe flight.
Facility Safety Representative
National Air Traffic Controllers Association
Want to read more from air traffic controller Don Brown? Check out the rest of his columns.