Just before midnight on 1 July 2002, two aircraft converged over the Bodensee at 36,000 feet. One was a DHL Boeing 757 freighter climbing out of Bergamo with two pilots aboard. The other was a Bashkirian Airlines Tupolev Tu-154 carrying 69 people from Moscow toward a holiday in Barcelona — among them 46 schoolchildren from the Russian city of Ufa. In Zurich, a single controller named Peter Nielsen was working two stations at once while colleagues performed overnight maintenance that had quietly switched off his conflict-alert system and most of his telephones.

Both aircraft carried a device designed for precisely this moment: TCAS, the Traffic Collision Avoidance System. In the final minute of the two flights, it worked exactly as designed. And 71 people died anyway — because of a question nobody had answered clearly enough: when the machine says climb and the human says descend, who is in charge?

Forty-Three Seconds

At 23:34:49 local time, the Tupolev's TCAS commanded: climb. Seconds later Nielsen — spotting the conflict late — instructed the same crew to descend. The Russian pilots faced a live contradiction between a synthetic voice and a human one, and their own operations manual described TCAS as a "backup" to air traffic control, wording that could be read as ranking the controller higher. They obeyed the human. Meanwhile the DHL crew, hearing their own coordinated instruction, followed TCAS and descended — which meant both aircraft were now descending into each other. At 23:35:32 the 757's tail fin sliced through the Tupolev's fuselage. There were no survivors: 69 aboard the Tu-154, two aboard the Boeing. Of the 71 dead, 52 were children.

The German Federal Bureau of Aircraft Accident Investigation, the BFU, spent two years reconstructing those minutes. Its verdict spread the causes widely — a lone controller left to cover two stations, degraded ground equipment, and dangerously ambiguous international procedures. But its statement of the immediate causes was stark.

The cruelty of the finding is its simplicity: if both crews had followed their TCAS advisories, the aircraft would have flown safely past one another. The DHL crew followed theirs to the end. The Tupolev crew, trained in a system where the controller's word was law, began obeying the machine only two seconds before impact — far too late.

The full story of the Überlingen collision — and the murder that followed it.

How the Machine Thinks

To understand what failed — and what has been fixed — it helps to know what TCAS actually is. Every TCAS II unit interrogates the transponders of nearby aircraft on 1030 MHz; their replies on 1090 MHz let it build a constantly updated map of surrounding traffic: range from the signal's round-trip time, altitude from the reply itself, bearing from a directional antenna. From that, the computer projects everyone's path a short distance into the future.

If another aircraft will pass too close, the system escalates in two stages. Around 40 seconds from a potential collision comes the Traffic Advisory — "Traffic, traffic" — telling the crew to look. Around 25 seconds out comes the Resolution Advisory, or RA: a direct flight command such as "Climb, climb" or "Descend, descend". And here is the elegant part: when both aircraft carry TCAS II, the two computers negotiate with each other through their Mode S transponders and issue complementary, coordinated orders — one jet is sent up, the other down. The choreography only works if both crews dance. That assumption, hard-wired into the logic, is what Überlingen broke.

The warning signs had been there. Seventeen months earlier, over Japan, two Japan Airlines jets nearly collided when a crew followed a controller's instruction instead of a TCAS climb command; only a last-second manoeuvre avoided catastrophe, and about 100 people were injured. The lesson from that near-miss was written up, circulated — and not yet turned into binding worldwide rules by the night the same trap sprang shut over Lake Constance.

Captain Joe walks through TCAS displays, TAs and RAs from the pilot's seat.

Born in the Smog Over Los Angeles

TCAS itself was written in blood a generation earlier. On 31 August 1986, Aeroméxico Flight 498, a DC-9 descending toward Los Angeles, was struck by a private Piper Archer that had wandered into the terminal control area. The airliner fell inverted onto the suburb of Cerritos. All 64 aboard the DC-9 died, along with the Piper's three occupants and 15 people on the ground: 82 in all.

The FAA had been researching collision avoidance for decades — the 1956 Grand Canyon collision started that clock — but Cerritos ended the deliberating. In December 1987 Congress passed Public Law 100-223, ordering TCAS II onto every airliner with more than 30 seats flying in US airspace by the early 1990s; the fleet was fully equipped by the end of 1993. Much of the world followed, and mid-air collisions between equipped airliners became vanishingly rare. The machine worked. What remained untested was the seam between the machine and human authority.

The Aftermath, and a Second Tragedy

Überlingen's grief did not end at the crash site. Peter Nielsen, the controller on duty, survived the night but not the story. On 24 February 2004, Vitaly Kaloyev — a Russian architect who had lost his wife and both children on Flight 2937, and who had personally searched the fields for his daughter — travelled to Nielsen's home near Zurich and stabbed him to death in front of his family. A Swiss court convicted Kaloyev, later ruling he had acted with diminished responsibility; he was released in 2007 and returned home. It needs saying plainly: Nielsen was one man holding together a failing system that his employer had allowed to degrade around him. The BFU's report, and later a Swiss court's convictions of Skyguide managers, placed the institutional failures above any individual's.

Skyguide itself, after initially pointing at the Russian crew, accepted responsibility when the final report appeared in 2004. Its chief executive, Alain Rossier, addressed the families directly.

Near Brachenreute, where much of the Tupolev came down, stands a memorial by the artist Andrea Zaumseil: a giant torn string of pearls in steel, recalling the broken necklace Kaloyev found beside his daughter. Every July, relatives still gather there.

What Überlingen Changed

The regulatory answer came fast and has never been softened. ICAO procedures were rewritten to remove all ambiguity: once a Resolution Advisory sounds, the crew must follow it — immediately, even when it contradicts an explicit air traffic control instruction. Pilots report "TCAS RA" on the radio, and from that moment the controller stops issuing manoeuvring instructions to that aircraft until the crew reports clear of conflict. In the vertical dimension, for those few seconds, the machine outranks everyone.

The software learned too. TCAS II version 7.1, developed after Überlingen and mandated in European airspace between 2012 and 2015, added exactly the feature that night demanded: if one aircraft fails to follow its coordinated RA, the system detects the non-compliance and reverses the other aircraft's instruction — turning a doomed descend-descend geometry into descend-and-climb. It also replaced the frequently misflown "Adjust vertical speed, adjust" call with a blunt "Level off, level off". The next generation, ACAS X, goes further still, using probabilistically optimised logic and new surveillance sources such as ADS-B; it is now flying in new-build airliners.

Modern TCAS is, by any measure, one of the quiet triumphs of aviation engineering — a last line of defence that has helped make the mid-air collision between airliners nearly extinct. But its most important component was never the antenna or the algorithm. It is a rule, written in the plainest language regulators know, purchased at Überlingen for the highest price imaginable: when the machine speaks, you do what it says.

Sources: BFU Investigation Report AX001-1-2/02, FAA Lessons Learned Library, EUROCONTROL, SKYbrary, Wikipedia, swissinfo.ch