At 23:34:49 on the night of 1 July 2002, the collision avoidance system aboard a Tupolev Tu-154M over southern Germany told its crew to climb. Seconds later the air traffic controller told them to descend. They descended. On the Boeing 757 converging with them, the same system said descend, and that crew did too.

Forty-three seconds after the first warning, the two aircraft met at almost a right angle at 10,630 metres over Lake Constance. Seventy-one people were killed, 52 of them children. What followed changed a rule that governs every airliner flying today.

One controller, two workstations

Peter Nielsen was working the sector alone. His colleague was resting in another room — against Skyguide’s written rules, but a practice the BFU found had gone on for years and was known and tolerated by management. Nielsen was manning two workstations at once.

The main radar image processing system was being maintained, so he was on a fallback. The ground-based optical collision warning system, which would have shown him the conflict roughly two minutes out, had been switched off for maintenance — and he had not been told. The telephone system was also down, cutting him off from other control centres. And a delayed Aero Lloyd flight was approaching Friedrichshafen at an hour when nobody expected another landing, so with the phones out he had to stay in radio contact with that crew himself.

The last six minutes

DHL 611 had checked in at 23:21 and been cleared up to FL320, then to FL360 to save fuel. It levelled off at 23:29. At 23:30 Flight 2937 came on frequency, also at FL360. Nielsen acknowledged and assigned neither aircraft a different level. They were now co-altitude and converging.

At 23:34:49 the Tu-154’s TCAS commanded a climb. Seconds later Nielsen, seeing the conflict, told 2937 to descend to FL350. The Russian crew disconnected the autopilot and went down. At almost the same moment the 757’s TCAS commanded a descent, and the DHL crew followed it — they could not tell Nielsen immediately, because he was talking to the other aircraft.

At 23:35:00 an audible short-term conflict alert sounded at the RE SUED workstation, 32 seconds before impact. Nobody heard it. Nielsen repeated the descent instruction and told the Russian crew the conflicting traffic was at their two o’clock. It was at ten. Two seconds before impact the Tu-154 crew finally followed their TCAS and pulled up. The 757’s vertical stabiliser cut through the Tupolev’s fuselage just ahead of the wings.

The Tu-154 broke apart over the Brachenreute district. The 757, missing 80 per cent of its fin, flew on in a flat spin for about two minutes and roughly seven kilometres before hitting woods near Taisersdorf.

The ambiguity at the centre of it

Both aircraft carried TCAS. Both crews got a correct, coordinated instruction from it. The system worked exactly as designed. The problem was that nothing told the crews which authority to obey when the two disagreed.

The same manual, three sub-chapters later, forbade manoeuvring contrary to TCAS. The TCAS Pilot’s Guide itself called the system a “back-up” to ATC separation services, which the BFU noted could reasonably be read as putting the controller first. There was no rule. There was a contradiction, and a crew with seconds to resolve it.

What changed

The BFU’s Safety Recommendation 18/2003 asked that the ambiguity be resolved in favour of TCAS. Eleven days after Überlingen, Japan published its report into a near-collision between two JAL aircraft in 2001 and asked ICAO for the same thing. In November 2003 ICAO amended its regulations: a resolution advisory takes precedence over an air traffic control instruction. That is now the rule everywhere. We wrote about how the system works in The Machine That Overrules the Pilot.

The hardware changed too. A pending change proposal, CP112, added the ability for TCAS to reverse an advisory in flight — which, Eurocontrol later concluded, would have told the DHL aircraft to climb and avoided this collision. Every TCAS II installation has since been upgraded to support reversals, and the ambiguous “Adjust Vertical Speed” callout was replaced with “Level-Off”.

Afterwards

Skyguide initially pointed at the Russian crew, then accepted full responsibility and asked the families for forgiveness. In 2006 a Swiss prosecutor charged eight employees with manslaughter; in September 2007 four managers were convicted, three receiving suspended sentences and one a fine, and four were acquitted. Colleagues kept a vase with a white rose at Nielsen’s old workstation.

Nielsen did not live to see the verdict. On 24 February 2004 Vitaly Kaloyev, a Russian architect who had lost his wife and both children aboard Flight 2937, went to Nielsen’s home near Zurich and killed him in front of his family. Kaloyev was convicted of manslaughter in 2005, had his sentence reduced on grounds of diminished responsibility, and was released in November 2007. He was appointed a deputy construction minister in North Ossetia the following January.

The memorial near Brachenreute is a string of pearls, broken. Seventy-one of them.

Sources: German Federal Bureau of Aircraft Accident Investigation (BFU), Investigation Report AX001-1-2/02, 19 May 2004; Wikipedia (2002 Überlingen mid-air collision); BBC News reporting on the Skyguide trial, 4 September 2007.