Human Failings Underscored In Report of 2002 Mid-Air Collision Over Germany

Air Safety Week, May 31, 2004

However, according to the BFU, the controller was not aware of the limitations inherent to the fallback mode. Among them:

* Radar images are not correlated automatically with the airplanes' flight plans (which meant the controller would have to do so manually, adding to the workload).

* The primary telephone system to neighboring ACCs would be disconnected, leaving only the bypass telephone line, which system failed, too, despite the controller's frantic attempts later to get through to the Friedrichshafen ACC).

* The short term conflict alert (STCA) system would not provide an optical warning of a collision threat on the radar screens. Rather, it would sound an aural alert only (which, during this event, was not heard).

Nor was the controller aware that neighboring ACCs had not been informed of the planned computer work at Zurich.

Furthermore, it was customary for the second controller on the Zurich night shift to retire to the lounge when traffic volume diminished, to return the following morning when traffic picked up. The lounge is too far for the lone working controller to shout a call for assistance. Rather, he must use the telephone. In other words, the second controller was sleeping at the time of the accident, and SkyGuide management was aware of the practice, even though a safety management process was under way to stop such practices. Human redundancy was lost, the BFU said, without a second controller present to catch procedural errors or mistakes.

Of the two controller assistants on watch that night, only one was physically present in the ACC to assist with routine tasks.

At about the time the two accident aircraft entered Zurich ACC airspace, the controller also had to handle a delayed A320 on approach to Friedrichshafen. He had to move to an adjacent console, and use a second radio frequency, to direct the A320. This physical shifting diverted the controller's attention from the B757 and the TU154, even though their positions were displayed on both consoles.

Hence, at the time of the accident, the lone controller was working two consoles using two radar screens on different scales (complicating his assessment of the impending collision), with two radio frequencies, a telephone failure, an impaired STCA, an urgent secondary task (the A320) and the distraction of the computer technicians doing their work.

The Zurich ACC's safety defenses-in-depth were degraded, to say the least. The controller lost control. He did not hear the STCA warning. A radio call from the A320 overlapped the "TCAS descent" message from the B757, a problem of blocked radio transmissions discussed previously in this publication (see ASW, July 9, 2001, July 16, 2001, and July 30, 2001). The controller did not answer numerous telephone calls from the Karlsruhe ACC, whose concerned controllers were seeing the impending collision on their radar screens, thinking the main telephone system was still inoperative (which it was not, but the technicians hadn't told him).

The countdown to collision reads like a slow-motion movie of impending disaster. As an historian once said, history is written in retrospect but is lived forward, so one can know the end but never know what it was like in the beginning only. Knowing the end in this case, however, makes the transcript of events all the more sobering. Because the apparent size of another aircraft remains small, until "exploding" into view moments before impact, the pilots may not have been aware of their mortal peril until only a second or two before impact.