Uberlingen PDF

Bundesstelle fr Flugunfalluntersuchung
German Federal Bureau of Aircraft Accidents Investigation
Investigation Report
AX001-1-2/02 May 2004
Identification
Kind of occurrence: Date: Location:
Accident 1 July 2002 (near) Ueberlingen/Lake of Constance/Germany Transport Aircraft 1. Boeing B757-200 2. Tupolev TU154M 71 fatals Both aircraft destroyed Damage to open field and forest BFU Investigation
Type of aircraft: Manufacturer/Model:
Injuries to persons: Damage to aircraft: Other damage: Source of Information:
Editor/Distribution: mail: [email protected] http:// www.bfu-web.de Tel: +49 531 35 48 0 Fax: +49 531 35 48 246 Bundesstelle fr Flugunfalluntersuchung Hermann-Blenk-Str. 16 38108 Braunschweig
German Federal Bureau of Aircraft Accidents Investigation
Investigation Report
AX001-1-2/02 May 2004
Identification
Kind of occurrence: Date: Location:
Accident 1 July 2002 (near) Ueberlingen/Lake of Constance/Germany Transport Aircraft 1. Boeing B757-200 2. Tupolev TU154M 71 fatals Both aircraft destroyed Damage to open field and forest BFU Investigation
Type of aircraft: Manufacturer/Model:
Injuries to persons: Damage to aircraft: Other damage: Source of Information:
The investigation has been conducted in compliance with the law relating to the Investigation of Accidents and Incidents associated with the Operation of Civil Aircraft (FlugunfallUntersuchungsgesetz - FlUUG) dated 26 August 1998. According to the law the sole objective of the investigation shall be the prevention of future accidents and incidents. It is not the purpose of this activity to asign blame or liability or to establish claims. The present document is the translation of the German Investigation Report. Although efforts are made to translate it as accurate as possible, discrepancies may occur. In this case the German version is authentic.
Editor/Distribution: mail: [email protected] http:// www.bfu-web.de Tel: +49 531 35 48 0 Fax: +49 531 35 48 246 Bundesstelle fr Flugunfalluntersuchung Hermann-Blenk-Str. 16 38108 Braunschweig
BFU
Table of contents
Abbreviations...............................................................................................................................................3 Synopsis.......................................................................................................................................................5 1. 1.1 1.1.1 1.1.2 1.2 1.3 1.4 1.5 1.5.1 1.5.2 1.5.3 1.6 1.6.1 1.6.2 1.7 1.8 1.8.1 1.8.2 1.9 1.9.1 1.9.2 1.10 1.11 1.11.1 1.11.2 1.11.3 1.12 1.12.1 1.12.2 1.13 1.14 1.15 1.16 1.16.1 1.16.2 1.17 1.17.1 1.17.2 1.17.3 1.18 FACTUAL INFORMATION ..............................................................................................................6 History of the flights .......................................................................................................................6 Boeing B757-200 ..............................................................................................................................6 Tupolev TU154M ..............................................................................................................................7 Injuries to persons..........................................................................................................................9 Damage to aircraft ..........................................................................................................................9 Other damage..................................................................................................................................9 Personnel information..................................................................................................................10 Boeing B757-200 ............................................................................................................................10 Tupolev TU154M ............................................................................................................................11 ATC Controller at ACC Zurich ........................................................................................................13 Aircraft information ......................................................................................................................14 Boeing B757-200 ............................................................................................................................14 Tupolev TU154M ............................................................................................................................14 Meteorological information .........................................................................................................15 Aids to navigation.........................................................................................................................16 Boeing B757-200 ............................................................................................................................16 Tupolev TU154M ............................................................................................................................16 Communications...........................................................................................................................16 Communications between ACC Zurich and the airplanes..............................................................16 Phone communication between ACC Zurich and neighbouring ATC units....................................17 Aerodrome information ................................................................................................................17 Flight recorders ............................................................................................................................17 Boeing B757-200 ............................................................................................................................17 Tupolev TU154M ............................................................................................................................18 Further action..................................................................................................................................18 Wreckages and impacts information ..........................................................................................19 Boeing B757-200 ............................................................................................................................19 Tupolev TU154M ............................................................................................................................25 Medical and pathological information ........................................................................................34 Fire .................................................................................................................................................34 Survival aspects ...........................................................................................................................34 Tests and research .......................................................................................................................34 Investigation on the radar system of ACC Zurich...........................................................................34 Eurocontrol ACAS/TCAS II analysis...............................................................................................34 Organizational and management information ...........................................................................35 ATC Zurich......................................................................................................................................35 Operator of the B757-200...............................................................................................................42 Operator of the TU154M.................................................................................................................43 Additional information .................................................................................................................43
AX001-1-2/02
BFU 1.18.1 1.18.2 1.18.3 1.18.4 1.18.5 1.19 2. 2.1 2.2 2.2.1 2.2.2 2.2.3 2.3 2.3.1 2.4 2.4.1 2.4.2 2.5 2.6 2.6.1 2.6.2 2.6.3 2.7 3. 3.1 3.2 4. 5.
Bundesstelle fr Flugunfalluntersuchung The Air Navigation Service of Switzerland .....................................................................................43 ATC Karlsruhe ................................................................................................................................44 ATC Munich ....................................................................................................................................44 ACAS/TCAS ...................................................................................................................................44 Rules of the air (right of way)..........................................................................................................66 Useful or effective investigation techniques .............................................................................67 ANALYSIS......................................................................................................................................68 General ..........................................................................................................................................68 Operations .....................................................................................................................................68 Boeing B757-200 ............................................................................................................................68 Tupolev TU154M ............................................................................................................................69 Avoidance of collisions according to the principle see and avoid ................................................71 Aircraft ...........................................................................................................................................74 Boeing 757-200 and Tupolev TU154M...........................................................................................74 ATC.................................................................................................................................................74 ATC Zurich......................................................................................................................................74 ATC Karlsruhe ................................................................................................................................77 ACAS/TCAS ...................................................................................................................................77 Human Factors..............................................................................................................................81 ACC Zurich .....................................................................................................................................81 Boeing B757-200 ............................................................................................................................93 Tupolev TU154M ............................................................................................................................98 Analysis summary ......................................................................................................................104 CONCLUSIONS ..........................................................................................................................107 Findings .......................................................................................................................................107 Causes .........................................................................................................................................110 SAFETY RECOMMENDATIONS.................................................................................................111 APPENDICES ..............................................................................................................................114
AX001-1-2/02
II
BFU
Abbreviations
ACAS ACC ACSS AIP AP AOM APU ATC ATCO, ATCo ATM ATMM ATPL ATS CA CIR CoC CPA CRM CVR DL ENG EPR FAA FbRDPS FDR FL FMS FO FPL Ft ft/min GPS GPWS HPa ICAO Airborne Collision Avoidance System Area Control Center Name: Manufacture of electronic equipment (TCAS) Aeronautical Information Publication Autopilot Aircraft Operating Manual Auxiliary Power Unit Air Traffic Control Air Traffic Control Officer, Air Traffic Controller, Air Traffic Management Air Traffic Management Manual Air Transport Pilots Licence Air Traffic Services Controller Assistant Common IFR Room Center of Competence Critical Point of Approach Crew Resource Management (earlier : Cockpit Ressource Management) Cockpit-Voice-Recorder Dienstleiter (supervisor at ACC Zurich) Engine Engine Pressure Ratio Federal Aviation Administration fallback Radar Data Processing System Flight-Data-Recorder Flight Level Flight Management System First Officer (Copilot) Flight Plan feet feet per minute Global Positioning System Ground Proximity Warning System Hektopascal International Civil Aviation Organization
AX001-1-2/02
BFU Integrated Controller Workstation Instrument Flight Rules Interstate Aviation Committee Instrument Landing System Inertial Navigation System Joint Aviation Authority knots Luftfahrt-Bundesamt Letter of Agreement Multi Crew Concept Minimum Equipment List Magnetic Heading Mean Sea Level Engine Compressor Speed Nautical Mile Operations Manual Pilot Flying Pilot in Command Pilot non Flying Resolution Advisory Radar Executive Area Navigation Radar Planning Reduced Vertical Separation Minima Standard Operating Procedure Short Term Conflict Alert System Manager Traffic Advisory Traffic Alert and Collision Avoidance System Team Resource Management Upper Area Control Vertical Speed
ICWS IFR IAC ILS INS JAA Kt LBA LoA MCC MEL MH MSL N1 NM OM PF PIC PNF RA RE RNAV RP RVSM SOP STCA SYMA TA TCAS TRM UAC V/S VOR VSI VSI/TRA
Very High Frequency Omni directional Radio Range Vertical Speed Indicator Vertical Speed Indicator/Traffic Resolution Advisory Display
AX001-1-2/02
BFU
Synopsis
The accident was notified to the German Federal Bureau of Aircraft Accidents Investigation (BFU) at 21:50 hrs1 on 1 July 2002. A witness standing outdoors in Ueberlingen reported the accident by phone. The witness had become aware of the collision of two transport aircraft through explosive sounds. The investigation was initiated by the BFU as soon as the information proved to be correct. On 2 July 2002 six BFU staff members arrived at the accident site. Because the two airplanes were under control of ACC Zurich during the time of the accident two other BFU staff members flew to Zurich in order to conduct the necessary investigation in cooperation with the Swiss accident investigation authority (BFU - Bro fr Flugunfalluntersuchungen). The investigation was carried out in accordance with the international Standards and Recommended Practices (SARPs) contained in ICAO Annex 13 and the German investigation law (FIUUG) under the responsibility of the BFU. The countries Kingdom of Bahrain, Russian Federation, Confoederatio Helvetica (Switzerland) and the USA were involved in the investigation through their Accredited Representatives and advisers. In the first phase of the investigation the investigation team worked simultaneously in a headquarter at the airport Friedrichshafen, at ACC Zurich, at the different accident sites in the area around the city of Ueberlingen and at the BFU in Braunschweig. On 1 July 2002 at 21:35:32 hrs a collision between a Tupolev TU154M, which was on a flight from Moscow/ Russia to Barcelona/ Spain, and a Boeing B757-200, on a flight from Bergamo/Italy to Brussels/ Belgium, occurred north of the city of Ueberlingen (Lake of Constance). Both aircraft flew according to IFR (Instrument Flight Rules) and were under control of ACC Zurich. After the collision both aircraft crashed into an area north of Ueberlingen. There were a total of 71 people on board of the two airplanes, none of which survived the crash. The following immediate causes have been identified: The imminent separation infringement was not noticed by ATC in time. The instruction for the TU154M to descend was given at a time when the prescribed separation to the B757-200 could not be ensured anymore. The TU154M crew followed the ATC instruction to descend and continued to do so even after TCAS advised them to climb. This manoeuvre was performed contrary to the generated TCAS RA.
The following systemic causes have been identified: The integration of ACAS/TCAS II into the system aviation was insufficient and did not correspond in all points with the system philosophy. The regulations concerning ACAS/TCAS published by ICAO and as a result the regulations of national aviation authorities, operations and procedural instructions of the TCAS manufacturer and the operators were not standardised, incomplete and partially contradictory. Management and quality assurance of the air navigation service company did not ensure that during the night all open workstations were continuously staffed by controllers. Management and quality assurance of the air navigation service company tolerated for years that during times of low traffic flow at night only one controller worked and the other one retired to rest.
All times given are in UTC unless indicated differently
AX001-1-2/02
BFU
1.
1.1
FACTUAL INFORMATION
History of the flights
On 1 July 2002 at 21:35:32 hrs a Tupolev TU154M on its flight from Moscow-Domodedovo /Russia to Barcelona/ Spain and a Boeing B757-200, which was on a flight from Bergamo /Italy to Brussels /Belgium, collided near the town of Ueberlingen (Lake Constance) in a dark night; the in-flight visibility at the flight level concerned was 10 km and more. Both airplanes impacted the ground north of the town of Ueberlingen. A larger number of witnesses had become aware of the accident by explosive noises, a prolonged roaring and rumbling as well as reflections of fire. Many of them saw pieces of debris burning while falling from the sky. The histories of the flights were reconstructed on the basis of the evaluation of the airborne flight data recorders (FDR) and cockpit voice recorders (CVR) and of the TCAS data stored in the airplanes, the radio communications between the Swiss Air Traffic Control Centre (ACC Zurich) and the crews of the Tupolev TU154M and the Boeing B757-200 stored on the ground and the ground radar data recorded by the Swiss Air Navigation Services.
1.1.1
Boeing B757-200 During the whole month of June 2002 both pilots, the pilot-in-command (PIC) and the copilot, had flown together as a crew. Several times they flew the route Bahrain - Bergamo - Brussels Bahrain. The last flight prior to this flight cycle was conducted on 28 June 2002 on the route Brussels Bahrain. Prior to this flight the crew was off duty for 75 hours. They checked in at 11:50 hrs in Bahrain.
At 13:30 hrs the airplane departed from Bahrain airport (OBBI) for a cargo flight to Brussels EBBR) with one intermediate stop at Bergamo (LIME). Only the two pilots were aboard the aircraft. The landing at Bergamo airport took place at 19:10 hrs after a flight time of 05 hours 40 minutes. In Bergamo, the airplane was refuelled, unloaded and reloaded with cargo. Take-off to continue the flight to Brussels was at 21:06 hrs. The airplane was flown by the copilot (PF). The flight was conducted under instrument flight rules (IFR). The flight plan (FPL) included the following information relevant to the flight: Aerodrome of departure: LIME, scheduled time of departure: 21:00 hrs, cruise speed: 463 kt, cruise level: FL 360, flight route: ABESI-UN851-TGO-UL608-LAMGO-UZ738-ANEKI-UZ917BATTY, aerodrome of destination: EBBR, estimated flight time: 01:11 hrs, alternate aerodrome: EDDK (Cologne). At 21:21:50 hrs, the PIC contacted ACC Zurich on the frequency 128.050 MHz at FL 260 and in direct approach to the waypoint ABESI. At 21:21:56 hrs, the transponder code 7524 was assigned. With the identification of the airplane a clearance for a direct approach to the TANGO VOR as well as for a climb from FL 260 to FL 320 was given. The PIC requested to climb to FL
AX001-1-2/02
BFU
Bundesstelle fr Flugunfalluntersuchung 360, which was approved approximately four minutes later at 21:26:36 hrs. At 21:29:50 hrs the airplane reached this flight level, without the pilots reporting it. At 21:34:30 hrs the copilot handed over the control of the airplane to the PIC in order to go to the lavatory installed in a cubicle at the rear of the cockpit. At 21:34:31 hrs the PIC confirmed that he had taken over. At 21:34:42 hrs the airborne TCAS alarmed the crew about possibly conflicting traffic by a Traffic Advisory (TA): traffic, traffic". After the TA the CVR recorded clicking noises. 14 seconds later (21:34:56 hrs) TCAS issued a Resolution Advisory (RA) descend, descend". Approximately two seconds later the autopilot (AP) was switched off, the control column pushed and the thrust of the engines reduced. FDR data shows that the pitch was reduced from 2.5 to approximately 1.5 and the vertical acceleration lowered from about 1.0 g to 0.9 g. According to the FDR and the TCAS recordings the airplane had reached a rate of descent of 1500 ft/min 12 seconds after the autopilot had been switched off. At 21:35:05 hrs the CVR recorded via the cockpit area microphone the remark of the copilot traffic right there which was confirmed by the PIC with yes. At 21:35:10 hrs, i.e. 14 seconds after the RA descend, descend, TCAS issued the advisory to increase the descent (increase descent, increase descent). At this time the copilot had returned to his work station and put on his headset. His reaction to the RA was recorded as "increase". Following this RA, the rate of descent was changed and reached approximately 2600 ft/min 10 seconds later. During the descent the pitch angle decreased to 1 and the powerplant thrust was reduced to approximately 1.2 (EPR). According to the CVR at 21:35:14 hrs a Master Caution Aural Warning is heard for two seconds. According to the FDR the autothrottle was switched off by the crew at 21:35:18 hrs. At 21:35:19 hrs the crew reported the TCAS descent to ACC Zurich. Subsequently the copilot requested the PIC twice to descend. Once with the word descend (21:35:26 hrs) and then by saying descend hard (21:35:30 hrs). Approximately two seconds prior to the collision the control column was pushed fully forward. At 21:35:32 hrs the airplane flying a northern heading (MH = 004) with a pitch angle of approximately 2 and no bank angle collided with the TU154M at 34 890 ft.
1.1.2
Tupolev TU154M The crew was off duty for 24 hours before take-off for the charter flight to Barcelona (LEBL). They checked in at 17:30 hrs. At 18:48 hrs the airplane departed from the airport MoscowDomodedovo (UUDD). Nine crew members and 60 passengers were aboard the airplane. The flight was conducted under instrument flight rules (IFR) in accordance with the flight plan (FPL) filed. The FPL included the following information relevant to the flight: Aerodrome of departure: UUDD, planned time of departure: 18:30 hrs, cruise speed: 880 km/h, cruise level: 10 600 m, flight route: KLIMOVSK-KAMENKA-ZAKHAROVKA-R11-YUKHNOVB102-BAEVO/cruise speed: 470 kt, cruise level: FL 360, flight route: UL979-MATUS-UM984BOLMU-UT43-STOCKERAU-UR23-SALZBURG-UL856-TRASADINGEN-Z69-OLBEN-UN869OLRAK-UN855-PERPIGNAN-UB384-GIRONA-UB38-SABADELL, aerodrome of arrival: LEBL, estimated flight time: 04:20 hours, alternate aerodrome: LEGE (Girona). Five flight crew members were in the cockpit. The commander (under supervision) - who was the PF (Pilot flying) on this flight - occupied the left-hand seat in the cockpit. The right-hand seat was occupied by an instructor, who as a PNF (Pilot non flying) also conducted the radio communications. He was also the pilot-in-command (PIC). The seat of the flight navigator was between and slightly behind the pilots. The work station of the flight engineer was behind the instructor. A further pilot (copilot), who had no function on this flight, was on a vacant seat behind the commander.
AX001-1-2/02
BFU
At 21:11:55 hrs - near Salzburg still over Austrian territory - the crew received the clearance from Vienna radar for a direct approach to the Trasadingen VOR at FL 360. At 21:16:10 hrs, the airplane entered German airspace and was controlled by Munich Radar. At 21:29:54 hrs, the crew was instructed by Munich to change over to ACC Zurich on 128.050 MHz. At 21:30:11 hrs and at FL 360 the PNF contacted ACC Zurich. At 21:30:33 hrs, ACC Zurich assigned the transponder code 7520 to the airplane, which was acknowledged 6 seconds later. For the time between about 21:33:00 hrs and 21:34:41 hrs the CVR recorded crew discussions concerning an airplane approaching from the left which was displayed on the vertical speed indicator (VSI/TRA) which is part of the TCAS. All flight crew members with the exception of the flight engineer were involved in these discussions. These recordings suggest that the crew strived to localize the other airplane as to its position and its flight level. At 21:34:36 hrs, the commander stated: Here it is in sight, and two seconds later: Look here, it indicates zero. During the time from 21:34:25 hrs to 21:34:55 hrs, the airplane turned at a bank angle of approximately 10 from a magnetic heading (MH) of 254 to 264. At 21:34:42 hrs, TCAS generated a TA (traffic, traffic). The CVR recorded that both the PIC and the copilot called out traffic, traffic. At 21:34:49 hrs - i.e. seven seconds later - ACC Zurich instructed the crew to expedite descent to FL 350 with reference to conflicting traffic (...... descend flight level 350, expedite, I have crossing traffic). While the controller was giving the instruction - the radio transmission took just under eight seconds - the PIC requested the PF to descend. At 21:34:56 hrs, the control column was pushed forward, the autopilot (pitch channel) was switched off and the powerplant thrust reduced to approximately 72 % (N1). FDR data shows a reduction of the pitch angle of the airplane from 0 to approximately 2.5 as well as a reduction of the vertical acceleration from approximately 1 g (normal acceleration of the earth near the airplane centre of gravity) to 0.8 g. The instruction to descend was not verbally acknowledged by the crew. At the same time (21:34:56 hrs) TCAS generated an RA (climb, climb). At 21:34:59 hrs, the CVR recorded the voice of the copilot stating: It (TCAS) says (): climb. The PIC replied: He (ATC) is guiding us down. The copilot's enquiring response: descend? At 21:35:02 hrs, (six seconds after the RA climb, climb) the PF pulled the control column. As a result, the rate of descent ceased to increase. The vertical acceleration rose from 0.75 g to 1.07 g. The engine thrust remained unchanged in conjunction with this control input (refer to Appendix 5a). At 21:35:03 hrs, the engine throttles were pulled back further. The discussion between the crew members was interrupted at 21:35:03 hrs by the controller instructing the crew once again to expedite descend to FL 350 (... descend level 350, expedite descend).This instruction was immediately acknowledged by the PNF. The controller then informed the crew about other flight traffic at FL 360 in the 2 oclock position (...Ya, we have traffic at your 2 oclock position now at 3-6-0) and the PIC asked: Where is it?, the copilot answered: Here on the left side!. At the time, the rate of descent was approximately 1 500 ft/min. The voice of the flight navigator can be heard on the CVR saying:" It is going to pass beneath us!" while the controller was giving his last instruction.
AX001-1-2/02
BFU
Bundesstelle fr Flugunfalluntersuchung At 21:35:04 hrs the roll channel of the autopilot was switched off. At 21:35:05 hrs, the PF pushed the control column again and the rate of descent increased to more than 2 000 ft/min. From 21:35:07 hrs to 21:35:24 hrs the aircraft heading changed to the right from 264 to 274 MH. At 21:35:24 hrs TCAS issued an RA increase climb. The copilot commented this with the words: It says climb! At the time of the RA increase climb, the FDR recorded a slow movement of the control column nose down leading to a change in pitch angle from 1 to approximately 2 and in a reduction in vertical acceleration. The descent rate was approximately 1800 ft/min (refer to Appendix 5b). Five seconds before the collision the control column was pulled back, associated with a minor increase of thrust levers setting. One second prior to the collision the pitch angle reached 1 and the vertical acceleration 1.1 g. During the last second before the collision the control column was pulled back abruptly and the thrust levers were pushed fully forward. At the time of the collision the pitch angle was 0; the vertical acceleration was 1.4 g but the airplane was still in a descent. The airplane collided with a heading of 274 and a bank angle to the right of 10 with the Boeing B757-200 at 21:35:32 hrs at a flight level of 34 890 ft. After the collision, the TU154M rolled with increasing rate about the longitudinal axis to the left. Simultaneously with this rolling movement the extension of the aileron-spoiler on the right wing was recorded. Within approximately two seconds after the collision the pitch angle changed from 0 to -6 and the cabin differential pressure decreased within one second from 0.6 kg/cm2 to a value close to 0 kg/ cm2. Note: The events in both cockpits are presented in Appendix 2
1.2
Injuries to persons
Aircraft B757-200 TU154M Injuries fatal fatal total Crew 2 9 11 60 60 Passengers Total 2 69 71 Others
1.3
Damage to aircraft
Both aircraft were destroyed. The Boeing B757-200 lost most of its vertical tail by the collision and was destroyed by impact forces. The Tupolev TU154M broke in flight into several pieces.
1.4
Other damage
The wreckages and wreckage parts caused damage to fields and forests at the various impact sites.
AX001-1-2/02
BFU
1.5
1.5.1
Personnel information
Boeing B757-200 Commander (PIC) aged 47 years, male ATPL, USA issued 25 September 1991 validation by the Kingdom of Bahrain on 20 April 2002, valid until 31 July 2002 Ratings: Boeing 757 and 767, SA-227 (Boeing 757 issued 26 May 1997) Instrument rating PIC rating on 11 October 1991 CAT II flight operations flight instructor on Boeing 757 proficiency check on simulator on 25 June 2002 line check as a PIC on 16 May 2001 Flying experience: total flight time: 11 942 hours total flight time as PIC: 6 655 hours total flight time on Boeing 757: 4 145 hours flight time during the last 24 hours: 7 hours flight time during the last 30 days: 88 hours flight time during the last 90 days: 233 hours flight time during the last 12 months: 851 hours Time on duty last 24 hours: 10 hours Time off duty prior to the flight: 75 hours Medical: Class 1; must wear corrective lenses and carry spare spectacles. Specials: TCAS training on 19 November 2001 Copilot Age: Licenses: aged 34 years, male ATPL, USA issued 22 March 2002 validation by the Kingdom of Bahrain on 9 June 2002, valid until 30 June 2004 Ratings: Boeing 757 issued on 22 March 2002 Instrument rating CAT II flight operations proficiency check on simulator on 13 April 2002 Flying experience: total flight time: 6 604 hours total flight time on Boeing 757: 176 hours flight time during the last 24 hours: 7 hours flight time during the last 30 days: 88 hours flight time during the last 90 days: 176 hours flight time during the last 12 months: 531 hours Time on duty last 24 hours: 10 hours Time off duty prior to the flight: 75 hours Medical: Class 1 without limitations Specials: TCAS training on 15 April 2002 ICAO Human Factors Digest 2 - Flight Crew Training: Cockpit Resource Management (CRM) and Line-Oriented Flight Training (LOFT) gives guidance on the principles of CRM, and the preferred training method LOFT. Several months before the accident flight the company incorporated a new CRM training programme in its OM Part D (Training) and this programme embodied the guidance and objectives of the ICAO Human Factors Digest 2. Both pilots were regularly exposed to LOFT exercises during their various training requirements. Age: Licences:
AX001-1-2/02
10
BFU 1.5.2 Tupolev TU154M Commander (under supervision) Age: Licenses:
aged 52 years, male Russian Federation airline transport pilot license Class 1 issued 16 November 1993, valid until 16 November 2002 Ratings: Tupolev TU154M Instrument rating PIC rating CAT II flight operations rating issued on 25 May 2001 rating for flight operations in foreign countries on 12 April 1991 line check as a PIC on 13 June 2002 Flying experience: total flight time: 12 070 hours total flight time on TU154M: 4 918 hours total flight time as a PIC on TU154M: 2 050 hours flight time during the last 24 hours: 3 hours flight time during the last 30 days: 8 hours flight time during the last 90 days: 81 hours flight time during the last 12 months: 292 hours Time on duty last 24 hours: 4 hours Time off duty prior to the flight: 24 hours Medical: Class 1 without limitations Specials: TCAS training on 14 November 2000 According to documentation (approval of flights) provided by the operator the pilot sitting on the left was the commander (PIC). According to documentation (instruction for the conduct of flights) provided by the Aviation Ministry the instructor sitting on the right was the pilot in command (PIC). According to the regulations of the aircraft operator, Barcelona airport was classified as an aerodrome in mountainous terrain. Each pilot flying to this destination had to make at least two flights with an instructor. For the commander (under supervision), this was the second flight to Barcelona. He was sitting in the front of the cockpit on the left while the instructor was sitting on the right. The instructor was in the opinion of the BFU - the pilot in command. Instructor (PIC) Age: Licenses: aged 40 years, male Russian Federation airline transport pilot license Class 1 issued 6 March 1997, valid until 22 October 2002 Ratings: Tupolev TU154M Instrument rating PIC rating Flight instructor rating issued 8 July 2001 CAT II flight operations rating issued on 20 November 2001 rating for flight operations in foreign countries on 8 June 1999 line check as a PIC: 11 March 2002 Flying experience: total flight time: 8 500 hours total flight time on TU154: 4 317 hours total flight time as a PIC on TU154: 2 025 hours flight time during the last 24 hours: 3 hours flight time during the last 30 days: 55 hours flight time during the last 90 days: 104 hours flight time during the last 12 months: 484 hours Time on duty last 24 hours: 4 hours Time off duty prior to the flight: 24 hours
AX001-1-2/02
11
BFU Medical: Class 1 without limitations Specials: TCAS training on 22 December 2000 Copilot Age: Licenses:
aged 41 years, male Russian Federation airline transport pilot license Class 1 issued 28 November 2000, valid until 20 February 2003 Ratings: Tupolev TU154M Instrument rating CAT II flight operations rating issued on 24 April 2001 rating for flight operations in foreign countries on 10 March 1994 line check on 13 June 2002 Flying experience: total flight time: 7 884 hours total flight time on TU154: 4 181 hours flight time during the last 24 hours: 3 hours flight time during the last 30 days: 8 hours flight time during the last 90 days: 69 hours flight time during the last 12 months: 218 hours Time on duty last 24 hours: 4 hours Time off duty prior to the flight: 24 hours Medical: Class 1 without limitations Specials: TCAS training on 18 October 2000 The copilot was sitting on the left behind the commander and had no official function in the cockpit. Flight navigator Age: Licenses: aged 51 years, male Russian Federation Flight Navigators license Class 1 issued 22 June 1996, valid until 1 March 2003 Ratings: Tupolev TU154M rating for flight operations in foreign countries on 12 August 1996 line check as a flight navigator on 13 June 2002 Flying experience: total flight time: 12 978 hours total flight time on TU154M: 6 421 hours flight time during the last 24 hours: 3 hours flight time during the last 30 days: 8 hours flight time during the last 90 days: 77 hours flight time during the last 12 months: 280 hours Time on duty last 24 hours: 4 hours Time off duty prior to the flight: 24 hours Medical: Class 1 without limitations Specials: TCAS training on 9 January 2001
AX001-1-2/02
12
BFU Flight engineer Age: Licenses:
aged 37 years, male Russian Federation Flight Engineers license Class 1 issued 20 July 2000, valid until 6 December 2002 Ratings: Tupolev TU154M rating for flight operations in foreign countries issued on 25 April 1997 line check as a flight engineer on 14 June 2002 Flying experience: total flight time: 4 191 hours total flight time on TU154M: 4 191 hours flight time during the last 24 hours: 3 hours flight time during the last 30 days: 8 hours flight time during the last 90 days: 81 hours flight time during the last 12 months: 297 hours Time on duty last 24 hours: 4 hours Time off duty prior to the flight: 24 hours Medical: Class 1 without limitations
In the Russian Federation the flight crews are awarded "performance classes" on the basis of their qualifications and flight experiences. There are four performance classes with class 4 being the lowest and class 1 being the highest. All TU154M crew members held the highest performance class. ICAO Human Factors Digest No 2 Flight Crew Training: Cockpit Resource Management (CRM) and Line-Oriented Flight Training (LOFT) gives guidance on the principles of CRM, and the preferred training method LOFT. A training programme based on an FAA course has been developed and has incorporated the guidance and objectives of the ICAO HF Digest No 2. None of the TU154M crew had been exposed to LOFT in the simulator as part of their training development. 1.5.3 ATC Controller at ACC Zurich Age: Licenses: Ratings: aged 35 years, male Swiss Air Traffic Control Officer (ATCO), valid until 7 March 2003 Approach control for St. Gallen/Friedrichshafen, valid until 7 March 2003 Area control ACC Zurich, valid until 7 March 2003 Radar approach control for St. Gallen/Friedrichshafen valid until 7 March 2003 22 hours 03:32 hours Medical Class 1 (Air Traffic Controller)
Time off duty prior duty: time on duty prior to the occurrence Medical:
The air traffic controller had started his training in January 1991 in Copenhagen/Denmark and completed it in 1994 with obtaining the Air Traffic Controllers licence. He worked for ACC Copenhagen until 1995 and then joined ACC Zurich where he obtained the necessary licences and ratings in February 1996. He had been working there since then without any major interruptions. In May 2001 a separation infringement occurred within the scope of the ATCO. The incident was investigated by the Swiss BFU.
AX001-1-2/02
13
BFU
1.6
1.6.1
Aircraft information
Boeing B757-200 The Boeing B757-200 is a twinjet transport category airplane. The powerplants have a thrust of 178 kN each. The airplane was certificated as a cargo airplane. It had valid certificates of registration and airworthiness issued by the Kingdom of Bahrain. The airplane was approved for CAT II approaches, for B-RNAV and for RVSM flights. Manufacturer: Boeing Company, Seattle/USA Type: B757-200 (757-23APF) Year of manufacture: 1990 Serial number: 24635 Maximum mass: 115 892 kg mass at the accident time: approximately 91 000 kg powerplant manufacturer: Rolls-Royce Type of powerplant: RB211-535E4-37 Type of fuel: Jet A1 Fuel quantity at accident: approximately 13 500 l (determined by calculation) Last technical inspection: 1 A-Check on 14 April 2002 Aircraft total time: 39 022 hours The airplane had position lights on the wing tips and the fuselage tail. It was also fitted with white strobe lights on the wing tips and red strobe lights on the top and bottom of the fuselage. For information on the aircraft equipment, see Chapters 1.8 (Aids to navigation) and 1.18.4 (ACAS/TCAS).
1.6.2
Tupolev TU154M The airplane Tupolev TU154M is a medium range transport category airplane with three turbojet engines. The powerplants have a thrust of 104 kN each. The airplane was equipped with 166 passenger seats. It had valid certificates of registration and airworthiness (valid until 11 October 2002) issued by the Russian Federation. The airplane was approved by the Russian authorities for ICAO CAT II approaches, for R-NAV and for RVSM flights. Manufacturer: Tupolev PSC Moscow/Russia Type: TU154M Year of manufacture: 1995 Serial number: 95A1006 Maximum mass: 100 000 kg Manufacture of powerplants: Soloview Type of powerplants: DK-30KU-154 Type of fuel: Jet A1 Fuel quantity at accident: approximately 22 800 kg Last technical inspection: F2 - Check on 28 June 2002 Aircraft total time: 10 788 h The airplane had position lights on the wing tips and the tail. It was also fitted with two red anticollision lights on the horizontal stabilizer and the bottom of the fuselage. For information on the aircraft equipment, refer to Chapters 1.8 (Aids to navigation) and 1.18.4 (ACAS/TCAS).
AX001-1-2/02
14
BFU
1.7
Meteorological information
The German Meteorological Service (Deutscher Wetterdienst DWD) was asked to give an expert opinion in order to establish the meteorological conditions. The following is an excerpt of that expert opinion: Weather situation On 1 July 2002, the area around the accident site was in front of a cold front moving east. This cold front extended from a low pressure system which centred over the north of Great Britain from the North Sea over Germany and France to the Biscay. While the southeast of Germany had scattered to broken clouds in the evening the middle and eastern part of Germany experienced cold front-related slight to moderate rain with local showers. A convergence line with little impact on the weather in the area concerned formed during the night in front of the cold front. Meteorological conditions on the ground Below a temperature inversion near the ground was a weak, mostly south-westerly to westerly airflow moving with 2 to 5 kt in the area of the accident site. The horizontal visibility on the ground was between 10 and 30 km. The surface air temperature was 19 to 20 C. High altitude meteorological conditions Above the inversion near the ground, the wind velocity increased continuously. Wind: FL 050: 240 to 260 20 to 30 kt FL 100: 230 to 250 30 to 40 kt FL 240: 230 to 250 30 to 40 kt FL 360: 200 to 230 35 to 45 kt Temperature: -50 to 52 Celsius Freezing level: 10 000 to 11 000 ft MSL Clouds: several layers of clouds, upper limit in the area of Lake Constance between FL 250 and FL 280. The expert opinion assumes that both airplanes were flying above existing clouds and that the visibility at this altitude was 10 km and more. Astronomic data The German Military Geophysical Office of the Federal Armed Forces supplied the following astronomic data to the German Meteorological Service (DWD). The moon was in the waning phase below the horizon and had not yet risen at the time of the accident. Observations of other flight crews There are statements of five other flight crews available concerning the meteorological conditions at time and site of the accident. Their condensed statements are: The stars were to be seen quite well, there was no moonlight. Flight visibility was good, ground visibility was unavailable There were cloud layers with upper limits of FL 200
AX001-1-2/02
15
BFU
1.8
Aids to navigation
Navigational aids on the ground were not concerned. The flights of the B757-200 and the TU154M took place in the RVSM airspace (Reduced Vertical Separation Minimum) on RNAV routes. The necessary equipment was stated in the flight plans for both flights with the letters R and W.
1.8.1
Boeing B757-200 The aircraft was equipped with: two VOR-DME three IRS two FMS The above-mentioned navigation equipment supplies data to the FMS, which can be connected to the autopilot.
1.8.2
Tupolev TU154M The airplane was equipped with: Two VOR-DME Doppler navigation system Directional gyro system GPS (not integrated in the system) Except for the GPS, the above-mentioned navigation equipment supplies data to the analogous navigation computer, which can be connected to the autopilot.
1.9
1.9.1
Communications
Communications between ACC Zurich and the airplanes The radio communications between ACC Zurich and the B757-200 and the TU154M, respectively, were conducted in English on frequency 128.050 MHz. All flight crews could listen into the radio communications provided they were on this frequency at the time. The B757-200 crew could listen into the complete radio communications between the TU154M crew and ACC Zurich as they were already on the frequency 128.050 when the TU154M first contacted ACC Zurich. The TU154M crew, however, could not hear anything from the B757-200 because there were no radio communications between them and ACC Zurich after their first contact with ACC Zurich at 21:30:11 hrs. ACC Zurich controlled only these two airplanes on this frequency in the time period right before the collision. The controller of ACC Zurich had also to handle a delayed approach of an Airbus A320 to Friedrichshafen on frequency 119.920 MHz. The work station for this approach was right next to the work station from which he had to guide the B757-200 and the TU154M and could be reached by rolling his work chair. The flight crews on frequencies 128.050 MHz and 119.20 MHz could not hear each other which sometimes resulted in simultaneous transmissions. Often the controller did not respond to these transmissions or only after the calls were repeated. The four frequencies of the upper sectors were switched over to the workstation RP (Radar Planning) by means of the coupling function. The coupling of frequencies ensures that the users of the frequencies can hear each other. Only four frequencies should be coupled in order to avoid interferences. The approach frequency for Friedrichshafen, 119.920 MHz, was switched to the RE (Radar Executive) workstation. Radio communications on all work stations were conducted by means of table top microphones and loudspeakers. The complete radio communications were recorded and made available to the BFU as a copy and a transcription for the purpose of analysis.
AX001-1-2/02
16
BFU
Bundesstelle fr Flugunfalluntersuchung At 21:35:38 hrs and 21:35:44 hrs the CVRs of both airplanes and the devices at ACC Zurich had recorded short sound signals similar to Morse signals. The investigation conducted by the ATC unit could not unambiguously clarify whether or not the sound signals were Morse signals or from which source they originated. It is to be assumed that they originated from one of the airplanes. Note: The essential passages of the radio communications are documented in appendices 2 and 3.
1.9.2
Phone communication between ACC Zurich and neighbouring ATC units There were two telephone systems available for the connection to the neighbouring ATC centres and services, the ATS Telephone System Switch 02 (SWI-02) and the Bypass System. The SWI-02 consisted of two parallel systems A and B which could be operated simultaneously or independently of each other. The calls to the neighbouring ATC centres were made via permanently leased lines. The Bypass Telephone System was available as a redundant system. The Bypass System is an analogue system which uses the public telephone network. The individual numbers have been pre-programmed. Calls received over the permanent lines could not be transferred to the Bypass System. The rearrangement of the sectors (refer to chapter 1.17.1) required some telephone reconnecting. This was the reason why the bypass system, only, was available after 21:23 hrs with the controllers consent duly obtained. By 21:34:37 hrs, the system SWI-02 was technically available again. The controller did not receive a release to service. The one-sided switch-off of the main system was not coordinated with the neighbouring services, although required by the ATMM ZC (ATM-Manual Zurich) Volume 2. During the above-mentioned time period a technical defect occurred in the Bypass System. As a result of this malfunction, the controller was unable to establish a connection with Friedrichshafen, in spite of seven trials, which were recorded and occupied his attention for an extended period. Between 21:34:44 hrs and the collision three calls from UAC Karlsruhe and one from Friedrichshafen were recorded in the system SWI-02, which, however, the controller did not answer.
1.10
Aerodrome information
Not applicable
1.11
Flight recorders
The flight data recorders (FDR) and the cockpit voice recorders (CVR) of both airplanes were recovered on the first day of the investigation and transported to Braunschweig by BFU staff members. The FDR of the TU154M turned out to be an uninstalled recorder carried aboard as a spare, only. The necessary search for the recorder which had been in operation was quickly successful. All data was read out at the BFU Braunschweig flight data recorder laboratory.
1.11.1
Boeing B757-200 Flight-Data-Recorder: Manufacturer: AlliedSignal (Sundstrand) Type: UFDR P/N: 980-4100-DXUS S/N: 8060 It was an eight track magnetic tape recorder, which had recorded 335 parameters. After the collision, the FDR supplied usable data for one further second and had recorded data for a further period of eight seconds; this data, however, was not analysable because the tape was damaged.
AX001-1-2/02
17
BFU Cockpit-Voice-Recorder: Manufacturer: L-3com (Loral/Fairchild) Type: A100A P/N: 93-A100-80 S/N: 54743
The CVR of the B757-200 was a four track analogous tape device, which had recorded the last 30 minutes of the accident flight. After the collision, the CVR recorded for a further period of nine seconds. The listed devices including the tapes were heavily damaged in the accident and could only be read out after extensive repair. 1.11.2 Tupolev TU154M Flight-Data-Recorder: Type: MSRP 64-2 S/N: 7945 It was a 28 track magnetic tape recorder, which had recorded 107 parameters. It was in an excellent, almost undamaged, condition and could be read out without any problems. After the collision, the FDR had recorded analysable data for another 3.5 seconds. Cockpit-Voice-Recorder : Type : MARS-BM S/N: 8886 The CVR of the TU154M was a four track analogous tape device, which had recorded the last 30 minutes of the accident flight. After the collision, the CVR recorded for a further period of 01:55 minutes. The recorder including the tape were heavily damaged in the accident and read-out was only possible after an extensive repair. 1.11.3 Further action On the fifth day of the investigation all recorders had been read out and the data stored for further analysis. An initial analysis confirmed all the then known facts about the accident. The investigation team in Friedrichshafen was informed in detail about the results. The evaluation of the FDRs of both airplanes was carried out mainly in the scope of the investigations by the working group Operations and is reflected in the respective chapters of this investigation report. The CVR of the Boeing B757-200 was read out by BFU staff members (flight data recorder laboratory) in cooperation with a B757-200 commander, who is a member of the team of the Kingdom of Bahrain. The transcription which has been approved by all participants documents the last 30 minutes of the flight. The CVR of the Tupolev TU154M was read out by BFU staff members (flight data recorder laboratory) and by specialists of the team of the Russian Federation. In doing so, the voices were assigned to the persons involved and the Russian spoken words translated into English. The recordings were documented in a transcription and reconstructed and verified by an LBA staff member whose mother tongue is Russian. The result was a transcription of the last seven minutes of the flight approved by all those involved. The CVRs of both airplanes were evaluated in the scope of the investigations by the working group Operations. The working group Human Factors investigated the whole 30 minutes, which had been recorded by the CVR. The evaluation of the FDRs of both airplanes is reflected in the investigations conducted by the working group Operations and by other working groups dealing with the history of the flight. Note: The last minute of the flight of each airplane with selected parameters of the FDR is enclosed in this report as appendices 4 and 5.
AX001-1-2/02
18
BFU
1.12
Wreckages and impacts information

The wreckage parts of both airplanes had impacted the ground north of Lake Constance in a relatively sparsely populated area. The debris was scattered over seven sites with large wreckage parts (see Appendix 8) and many sites with smaller wreckage parts encompassing a total area of about 350 km2. Separate working groups for the B757-200 and the TU154M were established. They conducted the investigation of the accident sites, the support of the police, e.g. recovery of the bodies and the documentation, and the recovery of the FDRs. The recovery of both wreckages and transportation to the hangar at Friedrichshafen airport was in some respect very difficult because some of the debris was very large and was to remain intact. After the recovery of the wreckages, which was completed on the fifth day of the investigation, the wreckage parts were laid out in a hangar at Friedrichshafen airport and inspected in detail for collision evidence.
1.12.1
Boeing B757-200 Accident site and findings The main wreckage of the B757-200 was found approximately 1 km west-south-west of the village of Taisersdorf, eastward of the street K 7788 in a mixed forest. The accident site covered an area of 110 m x 30 m.
Main wreckage
AX001-1-2/02
19
BFU
Bundesstelle fr Flugunfalluntersuchung The right engine had crashed on a meadow 250 m west and the left powerplant in a corn field 300 m southwest of the main wreckage. Both engines showed traces of fire caused by the burning of the remaining fuel in the fuel systems. Both engines had penetrated the ground to such an extent that they were almost level with the surface. They exhibited significant mechanical damage. main wreckage
right engine
left engine
The B757-200 had crashed with a negative pitch of about 70 into a mixed forest. The cockpit stuck about 2 m deep in the loamy soil of the forest. The airplanes longitudinal axis pointed to the east-north-east. The crash and the fire had destroyed most of the fuselage except for the empennage and about 2 m of fuselage. The cargo had been stored in cargo shipment containers. These were now only identifiable as fragments and were scattered over the whole crash site of the fuselage. The left outer wing had been burnt. The contours, however, were identifiable. So were the ailerons and trailing edge flaps. The right wing showed similar damage. Parts of the aileron and the trailing edge flaps had separated at ground impact.
AX001-1-2/02
20
BFU
Bundesstelle fr Flugunfalluntersuchung The empennage section showed severe damage but no evidence of fire. The tail boom was well recognizable. The components of the horizontal tail unit were completely present. Of the vertical tail only a portion of the vertical stabilizer remained (1.30 m x 2.50 m). In the front area of the stub the control rods and the hydraulic cylinder could be identified (see below).
The left side of the skin was torn off in several pieces to the rear left.
The top of the right side was bent to the rear left.
AX001-1-2/02
21
BFU
direction of flight
The top section of the vertical fin with a length of about 2,30 m was found south-east of the main wreckage at a distance of 4 to 5 km from the village of Altheim. The centre part of the vertical tail with a height of about 4 m and a length of about 5 m was not found. The APU access doors were present. The APU was torn off its bracings.
exhaust of APU
AX001-1-2/02
22
BFU
Bundesstelle fr Flugunfalluntersuchung The FDR and the CVR were recovered from the aft part of the fuselage.
The ram air turbine (RAT) was found almost undamaged and without any traces of fire.
ram air turbine without propeller
The cockpit instruments were found in fragments. The avionic compartment was excavated, the instruments were found severely damaged. The TCAS instruments were not found. The TCAS antennas were identified.
AX001-1-2/02
23
BFU Additional findings:
On collision, the airplane lost about 80% of the vertical tail. The manufacturer stated that the loss caused the airplane to become aerodynamically unstable in the yaw axis.
Separated top portion of vertical fin and rudder
TU154M fuselage cross-section
Remaining stub of vertical fin on main wreckage
B757-200 damage on vertical tail in relation to cross-section of TU154M
The landing gear and the wing flaps were in the retracted position. The distance between the geographical position of the collision and the position where the main wreckage crashed was about 7 km. The upper parts of the vertical tail were found about 8 km north east of the collision point and 4 to 5 km southeast of the main wreckage. The left powerplant was found on the right and the right powerplant on the left of the determined flight path. During the dive into the forest the tail area was torn off by the trees and did not catch fire.
AX001-1-2/02
24
BFU 1.12.2 Tupolev TU154M
The TU154 M suffered an in-flight break-up. At the four main crash sites the fuselage, the right and left wing including the central supporting structure and the tail unit, including the power plants were found. The crash site spanned an area of about 2.3 km. From the 69 occupants 40 bodies were found outside the wreckage parts and 29 within the fuselage or in its immediate vicinity. Fuselage The forward fuselage section had crashed in the area of Brachenreuthe in level terrain (apple plantation) immediately south of a power line running in a direction of 290 and 20 m north of a paved field path. The wreckage part with a total length of about 19 m was lying on its left side. It had been separated in the area of the 41st frame of a total of 83 frames and pointed in the direction of 127. The fuselage frames were broken. The skin on the bottom was torn open over a length of 9 m. The skin on top of the fuselage had burst open in two areas in longitudinal direction. The fuselage had been flattened to about half of its original diameter of 3.80 m.
overall view forward section of the aircraft fuselage
Evidence of fire or collision evidence was not found. The bodies of the five crew members were recovered from the flight deck. The certificate of registration, the certificate of airworthiness, the flight log and the documentation of the last technical checks of the aircraft were recovered. The indications of the instruments and the positions of switches and levers in the cockpit could be documented only to a limited extent due to the degree of destruction. The TCAS control panel, both indicators (VSI/TRA), both antennas and the TCAS computer were recovered. Left wing The left wing and centre wing section had crashed into a residential garden at the access road to a golf course in Owingen. The impact site was at a distance of 1.8 km northeast of the airplane fuselage. The centre wing section was found on the paved access road in front of a wall. The wreckage part itself had burnt. The fire had affected the road very little. The right wing had separated from the centre wing section at the area of the wing root.
AX001-1-2/02
25
BFU
centre wing section
The connection of left wing and centre wing section consisted of the trailing edge in the area of the inboard flap and hydraulic lines. The wing was found at a residential garden at a level higher than and at a distance of about 10 m from the house. The wing had been separated from the leading edge in a transversal line in the direction of the fuselage. The point of rupture is located between wing root and inboard slat. Some parts of this wing area were not present.
Left wing
The fire melted the outer third of the wing. The completeness of the wing, however, could be told by its outlines which included the wing tip.
AX001-1-2/02
26
BFU Tail section
The wreckage part had crashed, with no horizontal velocity, on a field some 300 m north of the forward fuselage section at the access road to the Brachenreuthe boarding school for retarded children. At impact, the vertical fin had broken off below the rudder. The T-tail was found about 15 m east of the rear part of the fuselage.
overall view rear fuselage section/tail unit
The rear fuselage had on the left side broken off at frame 56 and on the right side at frame 52. It was destroyed by fire and impact forces and pointed into the direction of 235. No collision evidence was found on the leading edges of the vertical fin and horizontal stabilizer and at the air intakes of the three engines.
AX001-1-2/02
27
BFU
Bundesstelle fr Flugunfalluntersuchung Right Wing The wreckage part was found in a corn field some 800 m south of the accident site of the fuselage and some 30 m west of the district road 7786 north of the village Aufkirch. Leaking and burning fuel affected the plants in a radius of 15-20 m around the crash site. The plants showed a brownish colour.
overall view right wing
The ditch caused by the impact had a length of about 18 m and pointed into the direction of 228. The inner section of the wing from the wing root to the main landing gear stuck 3.5 m deep in the earth. Most of the outer section of the right wing from the main landing gear to the wing tip had been destroyed by the fire except for the leading edge and the slats. A 6 m long wreckage part of the right wings upper surface including the remains of the registration marks was found some 20 m from the wings crash site. On the wings lower surface between the wing root and the main landing gear scratch marks of about 3.6 m length and 0.9 m width and red paint transfer were found. The flap track and carriage of the inner flap, one landing gear door and the rear part of the main landing gear fairing were missing.
lower surface of the right wing with scratch marks
The fire brigade pumped approximately 4 000 litre fuel out of the wing.
AX001-1-2/02
28
BFU Scattered debris
An about 5 m long part of the fuselages right side between frames 41 and 51 was found some 400 m east of the right wings crash site. Evidence of fire was found on this wreckage part. A 2.5 m long part of the left wings lower surface from the transition area of fuselage and wing was found in a forest about 2 km east of Owingen. The right wings flap track and carriage was also found near Owingen. The wreckage part showed red paint transfer and mechanical deformations. A part of the fuselages left side measuring 3.60 x 3.70 m was found 1 kilometre west of the village Ernatsreute. The part included the seven windows (frames 48 to 55) located rearward of the overwing emergency exits. An extensive white paint scrape off and scratch marks were found at the frame of the rear emergency exit running in a transversal line to the rear. In the area of the village Steinhfe a part of the fuselage roof of 3.60 m length and 1.20 m width was found. This wreckage part showed scratch marks of 1.30 m length and 0.90 m width running in a direction of 45 to the airplanes longitudinal axis. On a meadow west of Steinhfe one seat row of the left cabin side with three passenger seats was found. The aisle seats cover and upholstery showed evidence of fire. A 2.80 m long part of the TU154Ms fairing of the right main landing gear was found 1 kilometre west of Steinhfe. It showed traces of red paint and remains of the honeycomb structure of the B757-200.
Fairing of right main landing gear
West of Altheim, debris of both airplanes was found on an area of about 4 km. The top part of the B757-200s vertical stabilizer was found in the immediate vicinity of two parts of the Tupolevs left wing leading edge of about 30 cm in width each.
One door of the TU154Ms right main landing gear with traces of red paint and a part of the cabins interior lining with the seat row number 21 were found in this area. Near Altheim an emergency slide, parts of the galley and the interior lining of the airplane were found also.
AX001-1-2/02
29
BFU
Bundesstelle fr Flugunfalluntersuchung Reconstruction of the collision on the basis of collision evidence On the left wing collision traces between the wing root and the inboard slat were found. The fragments of the wing leading edge showed traces of red paint.
The wing including the wing spars had been severed by the collision. At the point of rupture the stringers of the wing were bent rearwards.
AX001-1-2/02
30
BFU
Bundesstelle fr Flugunfalluntersuchung The area of both overwing emergency exits on the left side of the fuselage was smashed. Scratch marks, an extensive paint scrape-off and traces of red paint were found.
The angle between the scratch marks found on parts of the fuselage roof and the TU154Ms longitudinal axis was 46.
AX001-1-2/02
31
BFU
Bundesstelle fr Flugunfalluntersuchung On the right wings lower surface several parallel scratch marks of 3.60 m maximum length and 0,90 m width were found. They ran at an angle of 46 to the airplanes longitudinal axis into the direction of the right main landing gear. Traces of red paint were also found in this area.
right wing lower surface with traces of the collision
On the inboard side of the flap trap and carriage originating from the right wing, mechanical deformations and traces of red paint were found.
AX001-1-2/02
32
BFU
Bundesstelle fr Flugunfalluntersuchung On the rear part of the fairing of the right main landing gear which had also been separated from the wing, traces of red paint and remains of the honeycomb structure of the B757-200 rudder were found.
Red paint and debris of the B757-200
FDR data shows that the TU154M had a MH of 274, a pitch angle of 0 and a bank angle of 10 right at the time of the collision. The B757-200 flew a MH of 004, with a pitch of approximately - 2 and a bank angle of 0.
Reconstruction of the collision according to FDR data and collision evidence
Further investigations The criminal investigation department (Landeskriminalamt) of the state Lower Saxony was asked to examine paint samples and metal sheet parts. The work was accomplished by using optical devices, an infrared spectrometer, a Fourier transform infrared and an infrared microscope. The expert opinion of the criminal investigation department dated 1 November 2002 states the following: Individual layers of red paint from the B757-200 correspond with the red pant transfer found on the left wing leading edge of the TU154M in regard to their infrared spectra. Sequence, thickness and other visual impressions of all seven layers correspond also. In summary it can be stated that on the TU154Ms left wing leading edge red paint was found which had up to seven layers and which was identical in material to the red paint of the B757200.
AX001-1-2/02
33
BFU
1.13
Medical and pathological information

Post-mortem examinations were performed on all seven flight crew members of the two accident aircraft. The examinations were conducted by the Institute of Forensic Medicine of Tuebingen University by direction of the Public Prosecutors office in Constance. The pathological reports state in summary that the death of all crew members was caused by extreme destruction of their bodies by the collision or the impact, respectively. Examinations for pre-existing medical impairments, alcohol, medicine and drugs produced negative results . There were no indications of physiological or medical impairments. On 2 July 2002 at 07:15:00 hrs blood and urine specimens were collected from the responsible controller of ACC Zurich and examined for drugs, alcohol and medicine by the Institute of Forensic Medicine of Zurich University. The examinations produced negative results. Autopsies on passengers were not performed. They could be identified on the basis of dental patterns, personal descriptions, garments and jewellery as well as molecular biological examinations (DNA comparison).
1.14
Fire
The ground impact of the B757-200 resulted in an extensive fire which also involved the forest. On all main wreckage parts of the TU154M except for the fuselage traces of fire were found. Eye witnesses confirmed an in-flight burning of the airplane. The local fire brigades extinguished the fires.
1.15
Survival aspects
The accident was non-survivable because of the collision results (Tupolev TU154M) and the impact situation (Boeing B757-200) described in more detail in Chapter 1.12. After the collision, 40 occupants of the TU154M fell out of the airplane.
1.16
1.16.1
Tests and research

Investigation on the radar system of ACC Zurich The radar system used by ACC Zurich was investigated by the Swiss BFU in Bern after the accident. The main focus of this investigation was the clarification of the system architecture and its technical configuration at the time of the accident. The investigation included an analysis of the system functionalities of the radar data display in fallback mode and of the STCA. The Swiss BFU made a report and the results have become a part of our investigation and are presented in chapter 1.17.1.
1.16.2
Eurocontrol ACAS/TCAS II analysis A Eurocontrol TCAS specialist team has analysed the accident based on three TCAS simulations. Three different data sources and two different analysing tools for TCAS II were used. It is the BFUs opinion that the following important insights can be drawn from the Eurocontrol study: The analysis confirmed that the TAs and RAs in both airplanes were triggered according to the design of the CAS-logic. The simulation and the analysis of the alert sequence showed that the initial RAs would have ensured a safe vertical separation of both airplanes if both crews had followed the instructions accurately.
AX001-1-2/02
34
BFU
Bundesstelle fr Flugunfalluntersuchung Moreover, Eurocontrol conducted a further analysis how TCAS II would have reacted in this case with the modification CP 112 which had already been developed prior to the accident. According to the results provided, TCAS would have generated a Reversal RA after the initial RA which would have led to a sufficient vertical separation of both aircraft if the Boeing B757-200 crew would have reacted accordingly to the reversal RA.
1.17
1.17.1
Organizational and management information

ATC Zurich The accident happened over the territory of the Federal Republic of Germany. Control of the airspace, in which the accident happened is delegated to the Swiss Air Navigation Services. In accordance with the requirements of ICAO Annex 11 (Chapter 3.5) the conditions of the delegation of control were established between the responsible Air Navigation Services in Letters of Agreement (LoA). The Air Traffic Control company of Switzerland is a Swiss public limited company under private law. It developed from the public air navigation services and is operating under the new company name since 1 January 2001. On behalf of the Swiss Confederation the company assumes the air navigation services in Swiss airspace and the control of airspaces of adjoining states which had been delegated to them. The legal mandate of the Swiss Confederation covers the air traffic organisation of the air navigation services, telecommunication services, technical services, the aviation information and the aeronautical weather services, which is provided in cooperation with MeteoSwitzerland. Responsible for the surveillance of the Air Navigation Service company is Bundesamt fr Zivilluftfahrt (BAZL) (Federal Office of Civil Aviation/FOCA) in Berne. The airspace is divided into the two ACCs, Zurich and Geneva and the control zones of the airports Zurich, Geneva, Bern-Belp and Lugano-Agno. The regional airfields provide their own local air traffic services on behalf of the air navigation service. The air traffic volume at ACC Zurich is characterized by three different main traffic flows: Approaches to and departures from the airports within the responsibility of ACC Zurich, especially very heavy traffic to Zurich airport, as well as to the airport Friedrichshafen; both airports, however, are closed at night. Climbs and descents to the airports of Southern Germany, Northern Italy and Bale/Muhlhouse. Transit flights from central and Northern Europe to Southern Europe and vice versa as well as from Western Europe to Eastern Europe and vice versa. The air traffic volume at night is characterized by transit overflights. Flight plan data (control strips) Besides the radar system control strips are also used as a means to display the traffic flow. They are of special importance to the RP (Radar Planning) as he is responsible for the prospective traffic planning and has to inform the RE (Radar Executive), if the separation at intersection points is no longer ensured. They contain all necessary information the controller needs for the safe planning and control of the respective flights. For each flight for which the flight plan data have been entered into the FDPS (flight data processing system) (SYCO), the system prepares the control strip necessary to display and analyse the air traffic. The data shown on the control strip is divided into flight plan data, flight path data and the transponder code. Each control strip contains entry, intersection and departure points. Normally the control strips are already available to the controllers even before the aircraft concerned are displayed on the radar monitor. All instructions given by the Air Traffic Control unit and each coordination with adjacent units as well as the data reported by the pilots are to be documented completely on these control strips. The control strips are to be archived for at least 30 days for the purpose of later evaluations. For all flights concerned the control strips were available approximately 20 minutes prior to the entry into the area of responsibility. For the flights of the B757-200, the TU154M and the A320, the corresponding system messages were sent to ACC Zurich at 21:11 hrs and acknowledged
AX001-1-2/02
35
BFU
Bundesstelle fr Flugunfalluntersuchung by ACC Zurich. It is to be assumed that immediately afterwards the control strips were printed out. It could not be clarified at what point in time the controller took note of the control strips.
Control strip for B757-200
The control strip for the B757-200 shows the intended routing ABESI-KUDES-LOKTA. The estimated times of passing the listed waypoints were indicated with 21:20 hrs, 21:30 hrs and 21:35 hrs. The entry into the area of responsibility of ACC Zurich was planned at FL260. The flight level indicated for the point of departure was FL360.
Control strip for TU154M
The control strip for the TU154M shows the intended routing NEGRA-Trasadingen (TRA) BENOT. The estimated times of passing the listed waypoints were indicated with 21:36 hrs, 21:42 hrs and 21:51 hrs. Following the passing of Trasadingen VOR (TRA) a descent to FL350 was planned because the AIP Switzerland states that odd level numbers are to be used for the intended flight route. Although both routes were to intersect at FL 360 no crossing-fix was indicated on the control strips. Radar system of ACC Zurich The flights of the aircraft concerned were recorded by the radar system and made available for the investigation as print outs and data of the radar station. For the reconstruction of the flight tracks data of Approach Radar Stuttgart was also used. The radar data processing system consists of three main Thomson MV9800 computers. One MV computer generally is in hot operation, the second is on hot standby and the third is used for test purposes and software development. This one is on cold standby. The MV9800 processes the incoming signals and correlates them automatically with the flight plan data supplied by the flight data processing system (SYCO). The MV9800 is controlled and monitored by the RCMS (Remote Control & Monitoring System). The radar images correlated in the MV computer are sent via the IPG-IPS Interface Gateway to the monitors at the controllers workstations (ICWS Integrated-Controller-Workstation). Legal Recording records the radar raw data and the output of the radar data processed by the MV9800. The output of the TracView of the Fallback Computer fbRDPS is not recorded.
AX001-1-2/02
36
BFU
The fallback tracker (fbRDPS fallback Radar-Data-Processing-System) and the radar direct indication (FEP Front-end Processor) are simultaneously supplied with radar data by the antennas. The renewal rate of the radar image on the ICWS is 12 seconds on the basis (synchronized) of the radar station Lgern. The system has a visual and acoustical STCA (Short Term Conflict Alert).The optical STCA is set off 120s before the aircraft approach is less than 6.5 NM and 1500 ft or less than 750 ft if RVSM is in use. The acoustical warning is set off if the separation between the aircraft concerned falls below 6,5 NM. The acoustical warning is de-activated during the day. The system manager (SYMA) switches it on at the beginning of each night shift. The system does not record the activation or deactivation. They are, however, a check mark of the SYMAs daily checklist. In normal operation the modes indicated below work simultaneously: MV (MV9800 Computer) Fallback (MV9800 is not available) SR Radar (MV9800 and fbRDPS are not available) LR Radar (MV9800 and fbRDPS are not available) The controller can select the respective mode. In normal operation the controller would select the MV mode and get a correlated radar image from the MV computer via the IPG on his ICWS (controllers workstation) which is selected and set according to the sector. If a mode is not available, the respective indication shows red. If the connection via the IPG is interrupted, the correlated radar image will not be available any more. The controller has then to work in the fallback mode. In the fallback mode the radar image is generated in the fallback radar computer (fbRDPS). As the fbRDPS has no connection to the system SYCO (flightplan data) an automatically correlated
AX001-1-2/02
37
BFU
Bundesstelle fr Flugunfalluntersuchung radar image is not generated. This means that there is no automatic correlation of the radar data with the corresponding flight plan data. Manual correlation is possible it requires, however, appropriate input from the controller in each individual case. If the fallback mode is selected because the MV computer failed neither the optical nor the acoustical STCA is available. In the night from 1 July 2002 to 2 July 2002 the connection between the MV Computer and the ICWS via the IPG was interrupted due to system work in the ADAPT system (see wiring diagram). Thus the visual STCA was not available. The computer had not failed but continued working in the background. The issuance of the signal for the acoustical STCA to the respective sector occurred through a direct connection between the MV Computer and a separate STCA loudspeaker. This connection was not interrupted by the system work and the acoustical STCA was therefore available. ACC Zurich uses the signals of the following radar stations: Lgern - Enroute Radar Holberg - Approach Radar La Dole - Enroute Radar TG (Lukmanier) - Enroute Radar Monte-Lesima, Italy - Enroute Radar Gosheim, Germany - Enroute Radar Situation in the control room at ACC Zurich For the night from 1 to 2 July 2002 a modification of the sectorisation of the upper airspace (upper sectors) had been planned. There were a total of four upper sectors. In order to simplify the processes for the 2 or 3 sectors operation, the airspace above FL 245 was divided horizontally for a 2 or 3 sectors operation. It is the companys estimation that the partially vertical division proved to be disadvantageous especially in connection with the introduction of RVSM. The modification work was to start on 1 July 2002 at 21:00 hrs and was to last about six hours. For this purpose a modification of the flight plan processing system (SYCO Systme de Communication) was necessary. The following systems were affected as well: the radar data processing and presentation system (ADAPT ATM/AIS Data Aquisition Processing and Transfer System) the Multi radar data computer (MV9800 Multiradar Tracker) The flight plan data processing system for the tower and the approach control (TACO Tower-Approach-Communication) the landing sequence computer (CALM Computer-Assisted-Landing-ManagementSystem) the Departure and Arrival Traffic Management System (DARTS). The ATS ground-ground telecommunication system (SWI-02 Switch 02 ATS Telephone System) was affected as well and had to be switched off in order to perform the necessary sectorisation changes. Two Official Instructions (Z 2002-022 and Z 2002-024) regarding these changes were issued. These instructions described the assignment of the new sectors and the procedures to be followed after the completion of the sectorisation. A list of the necessary work and the effects on the individual workstations at ACC Zurich for the time of the systems deactivation during the nightshift was not part of the instructions. The instructions were available in the briefing room and at the workstation of the supervisor (DL). An additional memorandum (Auergewhnliche Arbeiten an Flugsicherungsanlagen TDR-z 40/02) dated 25 June 2002 had been issued. It included a list of the systems concerned and the information that the controllers had to work in the fallback mode. This means that the visual STCA was not available and that there was no automatic correlation between the flight plan data and the target symbol. This fact, however, was not explicitly described. ATMM ZC, volume two states that in such cases a minimum radar separation of 7 NM (instead of 5 NM) is required. An information that the system SWI-02 (ground-ground direct phone connections) had to be switched off was missing.
AX001-1-2/02
38
BFU
Bundesstelle fr Flugunfalluntersuchung Ten technicians were scheduled to carry out the planned work. They were distributed to the different workrooms, about five to six of them stayed in the control room. One particular staff member from the ACC management was instructed to act as a coordinator between controllers and technicians. During the whole time he stayed in close vicinity to the controllers workstation. In addition, a SYMA was on the roster; he stayed at the SYMA workstation. The controller had not been informed about the tasks of these two additional staff members. He assumed that the SYMA shift had ended on schedule at about 21:00 hrs and that he had to take over these tasks during the night shift. The special tasks of the two additional staff members were not defined in the corresponding directives. The neighbouring air traffic control services Munich and Rhine Control (Karlsruhe) had not been informed about the planned work for the modification of the sectorisation. On 1 July 2002 at about 21:10 hrs the technicians entered the control room and set to work. Prior to the beginning of the sectorisation work the controllers were orally instructed by the system manager. He did not, however, mention the particularities regarding the disconnection of the MV9800 computer. At 21:13 hrs, the ICWS at the sector SUED were switched over to the fallback mode. The isolation was finished at 21:18 hrs, i.e. an automatic correlation of new radar targets did not occur any more. The optical STCA was not available either. After 21:23 hrs the direct telephone lines (SWI-02) to the neighbouring ATC units were no longer available. Organisation of the night shift at ACC Zurich During the night shift the whole airspace of ACC Zurich is centralised into one sector (sectorisation phase A) and controlled from the workstation for the southern sector. All necessary radio communications and coordination tasks as well as the issuance of written information (e.g. control strips) are switched to this workstation. In this configuration the whole flight level range from FL 1 up to FL 600 is displayed.
View of the three workstations for the sector SUED in the control room at ACC Zurich. (During the night shift from 1 July to 2 July 2002 the whole airspace of ACC Zurich had been switched to the workstation RP (128.050 MHz) and the ARFA sector had been switched to the workstation RE (119.920 MHz).
AX001-1-2/02
39
BFU
Bundesstelle fr Flugunfalluntersuchung During the night shift normally two controllers and two assistants (CA) work at ACC Zurich. This number of staff members results from the staff members for the southern sector (night shift sector) consisting of the controller radar planning (RP) and the controller radar executive (RE) as well as one CA. One of the controllers has also to assume the tasks of the supervisor (DL) and the system manager (SYMA) when they finish work at about 21:00 hrs. Normally the controllers do two successive night shifts. In this system, the senior controller has also to assume the tasks of the supervisor. In the ATMM ZC (ATM Manual of Zurich) the following tasks are, among other things, described for the individual workstations: Management tasks during the night shift: During the night when the workstations of the supervisor and the SYMA are not occupied the senior air traffic controller assumes their functions to a limited extent. At the end of their shift the supervisor and the SYMA inform the night shift staff about special operational and technical occurrences. The radar controller (RE radar executive): The RE is responsible for the radar control in one sector. He is supported by the complete sector team. He is responsible in particular for the following tasks: Ensuring the radar indication needed by appropriately adjusting the device. Being familiarized with the traffic situation within the assigned airspace Issuing clearances and instructions to aircraft Providing radar service to controlled aircraft. The fulfilment of this task is subject to limiting factors, such as work load, meteorological influences and performance of the technical infrastructure. Conduct of the flight information and the alerting service in the case of a radar failure ensuring separation and the continuation of the traffic service in accordance with published emergency procedures in close cooperation with RP Informing the supervisor about an announced ATIR as well as about occurrences leading to an OIR and drawing up of the reports. in the case of excessive workload he may delegate tasks to an RP. The planning radar controller (RP): In his sector, the RP is responsible for the planning of traffic and for the tasks delegated to him. He has to be familiarized with the traffic situation to such a degree that he can suitably support the work of the RE. In order to be able to concentrate on his essential tasks he shall delegate routine tasks as far as possible to a CA. He is responsible in particular for the following tasks: Updating of the control strips with the data required for traffic planning and as far possible monitoring of the sector frequency Ensuring compliance with the required separations at the transfer-of-control point Transmission of the control strips to RE Informing the RE if the separation at the intersection points is no longer assured. The ARFA controller (ARFA): He is responsible in particular for the following tasks: ARFA is responsible for the radar and approach service of the ARFA sector. Being familiarized with the traffic situation within the assigned airspace Issuing clearances and instructions to aircraft Ensuring compliance with the required separations at the transfer-of-control point Providing radar service to controlled aircraft. The fulfilment of this task is subject to limiting factors, such as work load, meteorological influences and performance of the technical infrastructure. In particular he has: to identify the aircraft
AX001-1-2/02
40
BFU
Bundesstelle fr Flugunfalluntersuchung to conduct the radar coordination with other sectors to conduct the necessary coordination with FRIEDRICHSHAFEN (EDNY), ST. GALLEN for each approach to transmit a position report (approximately 10 15 track miles) via phone to FRIEDRICHSHAFEN or ST.GALLEN to follow the course of the flight to guide aircraft by radar for the purpose of navigational support
Controller Assistant (CA): The CA is responsible for the acceptance, processing and transfer of estimates and flight plans. Generally the CA is assigned to RP. In particular the CA is responsible for: Establishing, processing and distributing the necessary control strips Entering the required flight plan data into the SYCO Receiving or calling for SSR codes Independent transfer of estimates in case of NO LAM and deletion of the NO LAM alert Completion of lacking flight plan data on the basis of the corresponding data from the CFMU computer Receiving, processing or transferring phone calls coming in at the workstation of the CA. Accomplishing additional work as instructed by RP Transmitting of air traffic control messages as instructed by RP Independent processing and transfer of air traffic control messages transmitted as instructed by RP. Accomplishment of enquiries and clarifications as instructed by RP Receiving incoming messages from regional aerodromes and transfer of the messages to RP or to the chief controller on duty Transmission of take-off clearances, SSR Codes, Release as instructed by RP Receiving and answering enquiries from regional aerodromes, transfer to RP Obtaining information from regional aerodromes and accomplishment of clarifications as instructed by RP The procedures for the regional sector Friedrichshafen and St. Gallen-Altenrhein (ARFA) are laid out in the ATM Manual, Vol. 2 ATC Manual. Point one General Procedures includes: The radar control to the final approach requires the unrestricted attention of the air traffic control officer. Even the shortest delay in the assignment of headings may result in an airplane position from which an approach is no longer possible. The controller on the second night shift retires to one of the lounges once traffic flow decreases. This is done in accordance with an internal arrangement between the controllers which is known to and tolerated by the management. He usually reappears in the control room in the morning once traffic flow increases. As the lounges are beyond calling distance from the workstations, the controller has to be called by phone if he is needed at his workstation. Both controllers had reported for duty at 17:50 hrs. The chief controller who was on duty until about 21:00 hrs informed them about the scheduled work. According to their statements, they had no knowledge of the corresponding written instructions. At the time of the accident only one controller was in the control room at ACC Zurich. He had to assume simultaneously the tasks of the RP, RE and the chief controller on duty. One CA was with him in the control room. It was her duty to support the controller with routine and coordination tasks; she had no tasks or ratings in the scope of air traffic control. At the workstation on the left (RP) the whole airspace of ACC Zurich was displayed. At the workstation on the right (RE) the controller had selected the appropriate area (ARFA sector = approach sector for St. Gallen-Altenrhein and Friedrichshafen) for the approach to Friedrichshafen and switched the frequency to 119.920 MHz. At this workstation all flight movements within the selected area and thus also the B757-200 and the TU154M were displayed.
AX001-1-2/02
41
BFU
Bundesstelle fr Flugunfalluntersuchung The individual flight tracks became most likely visible on the radar display of the ARFA sector at: for A320 at about 21:30:52 hrs for TU154M at about 21:29:52 hrs for B757-200 at about 21:32:38 hrs In order to transmit on the respective frequencies 128.050 and 119.920 MHz it was necessary to change workstations (see photograph). The second controller on duty left the control room at about 21:15 hrs after prior consultation and retired to rest at the lounge. The second assistant left the control room about 10 minutes later. Training and advanced training of the Air Traffic Control Officer (ATCO) The ATCOs are trained in Switzerland by a central training school of the air navigation service company. After the completion of the training at the training school the ATCOs work under supervision until they have obtained the rating for the corresponding duty before they work independently. The advanced training is accomplished by a continuity training on refresher days. Normally the ATCOs participate in two refresher days per year. The participation of the controllers is obligatory and organized by the operations department. This continuity training may be accomplished in a simulation device but may also take place as a familiarization with new procedures, new airspace structures or newly designed technical equipment. In addition periodical checks in the scope of the annual licence renewal take place. During these tests the theoretical knowledge of the ATCOs is checked by the multiple choice procedure. For these checks all manuals may be used. There is no time limit for the accomplishment of the checks. The test is passed if at least 85% of all questions are answered correctly. Up to now practical checks have not been conducted. Relevant information and working instructions are presented in the briefing room and kept up to date continuously. The ATCOs are obliged to read this information. The duty roster allows 10 minutes a day for such reading. There is no proof that the ATCO informed himself. Additional findings: When the second controller retired neither of the two controllers knew that a delayed Airbus A320 would approach Friedrichshafen. Up to the collision, the clearance of the controller to the B757-200 crew for a direct approach Tango VOR had not been coordinated with the UAC (Upper Area Control) Karlsruhe. At 21:35:00 hrs the MV computer of ACC Zurich generated an acoustic STCA message which was addressed to the workstation RE SUED. It was not heard by any of the staff members present in the control room. Technical checks conducted later did not indicate any malfunction. The message of the B757-200 crew at 21:35:19 hrs that they had initiated a descent due to TCAS (TCAS descent) was not heard by the controller. Within ACC Zurich Single Manned Operation was introduced. The principle procedures (Single Manned Operation Procedures SMOP) are presented in Appendix 9.
1.17.2
Operator of the B757-200 The Operator of the B757-200 is the holder of an Air Operator Certificate issued by the Kingdom of Bahrain. Date of issue was 20 May 1996. The Operator in Bahrain has been in operation since 1979, based at Bahrain International Airport and is part of a worldwide operating air cargo company. The aircraft are employed on scheduled and non-scheduled domestic and international cargo services throughout Europe, Asia, Middle East and Africa. Number of aircraft operating under the Bahrain AOC: one Fairchild Metro SA227 and one Boeing 757-200PF. One Airbus A300-600F and four Antonov AN12s and their respective crews are operated on wet-lease. As jet operations began in 1996 the B757-200 was added to conduct daily flights between Bahrain and Europe.
AX001-1-2/02
42
BFU 1.17.3 Operator of the TU154M
The Operator of the TU154M is the holder of an Air Operator Certificate issued by the Russian Federation. Date of issue was 13 May 2002 under registration number 32/04. The operator is based at Ufa/Bashkortostan. The aircraft are employed on scheduled domestic and international passenger and freight services and aviation work throughout Africa, Near East, Europe, Central- and South-Eastern Asia and Community Independent States (CIS). Number of aircraft operating under Russian Federation AOC: Nine TU154M, two TU134A, one AN24RV, two AN74, three MI34C and six MI8T.
1.18
1.18.1
Additional information
The Air Navigation Service of Switzerland The company was founded in 2001 as the successor of the former state controlled ATC "Swisscontrol". It was a mature organisation, but one that had been subjected to major transformations due to its privatisation and restructuring. It was no longer funded by the state and had to maintain and justify its economic performance. The foundation was one of a well-established ATC service because it had inherited the structures and procedures of its predecessor. It was necessary to maintain, advance and enhance all elements of its operation in accordance with regulatory requirements and ongoing developments. Safety culture of the Air Navigation Service The company developed a Safety Policy and published it on 23 October 2001. Some pertinent passages are reproduced below: 2. Principles: 2.1 The safety of Air Navigation will be given the highest priority. An explicit, pro-active approach to Safety Management will ensure reasonable assurance of maintaining optimum levels of safety in the development, implementation and continued function of the [] operation. 2.2 All staff have an individual responsibility for their own actions whilst Managers are responsible for the Safety Performance of their own divisions. 2.3 All staff members performing activities with safety related implications will be adequately trained, motivated and competent to undertake the tasks required of them, and properly licensed where appropriate. 3. Description: 3.1 Quantitative Safety Levels meeting appropriate and agreed target levels of safety will be derived for all systems. 3.2 New systems and changes to existing systems, operations and procedures (including Engineering systems) will be regularly assessed for their safety significance and safety criticality. The results of these safety assessments will be documented in an appropriate manner allied to the requirements of the established quality environment. 3.3 To provide Safety Assurance, Safety Audits will be performed routinely in order to confirm conformance with applicable parts of the Safety Management System and to provide assurance to Managers that the continued operations and risks are identified, conform to appropriate safety levels and are being adequately managed. 3.4 Reflecting best Safety Practice these Safety Audits will enable appropriate measures to be taken for the attainment and maintenance of the agreed Target Safety Levels. 3.5 [] 3.6. A Safety Culture will be promoted which will aim, amongst other objectives, at disclosing mistakes and motivating all staff members to endeavour to constantly improve safety
AX001-1-2/02
43
BFU
Bundesstelle fr Flugunfalluntersuchung through their own individual contributions. An integral part of this enhancement may be the adoption of a unique and non punitive company confidential reporting scheme. 3.7 An enhanced Safety Culture will ensure that the lessons and experience gained from safety related investigative processes will be widely distributed and actioned to minimise the residual risk of reoccurrence.
1.18.2
ATC Karlsruhe The flight of the B757-200 was automatically reported by Zurich to the UAC Karlsruhe at 21:21:02 hrs as an ACT (Activation message). From 21:27:04 hrs the airplane still in climb was displayed on the monitor. At the same time an unidentified flight target with the transponder code 7520 was observed as crossing traffic coming from Kempten VOR flying at FL 360 in the direction of Trasadingen VOR. At 21:33:24 hrs the STCA released an alarm. The controller alerted his supervisor and tried to contact ACC Zurich via the direct phone connection in order to warn the controller. From 21:33:36 hrs on the controllers tried eleven times in vain even by using the priority button to contact Zurich. From 21:33:36 hrs until 21:34:45 hrs first a busy signal and later a ringing tone was heard. A call via the public telephone network the phone number is published in the LoA (Letter of Agreement) was not tried because there was no time. The collision of the two aircraft was observed on the radar monitors. The UAC Karlsruhe has a possibility of selecting the international emergency frequency 121.50 MHz. On this frequency it would have theoretically been possible to emit a general warning to the aircraft. This possibility was not considered because the requirements were not met. Prior to initiating activities outside their own area of responsibility, the controllers must, in accordance with the effective regulations, coordinate them with the responsible controller, who, however, was not reachable. It was not possible to determine whether the frequency 121.50 MHz was selected in one or both airplanes.
1.18.3 ATC Munich The control of the flight of the TU154M had been taken over at 21:15 hrs from Vienna radar. At 21:29:54 hrs the controller of ACC Munich requested the crew to contact ACC Zurich on 128.050 MHz. At this point, the airplane was north of the Kempten VOR. The crew acknowledged the instruction and said good bye. From 21:31:00 hrs the acceptance of control by ACC Zurich became discernible on the radar monitor of ACC Munich because the transponder code changed to 7520. As the airplane then also left the area of control, it was no longer observed. Shortly afterwards it also left the selected range on the radar monitor so that the collision was not observed. 1.18.4 ACAS/TCAS
1.18.4.1 Introduction Historical development of ACAS/TCAS Following several concept studies, the Airborne Collision Avoidance System (ACAS) was described in 1993 by the International Civil Aviation Organization (ICAO) in Annex 2 as a Standard. The advancement (ACAS II) was adopted in 1995 by the ICAO as Standards and Recommended Practices (SARPs). In Europe Eurocontrol had participated significantly in the development and implementation of ACAS. Parallel to the development of ACAS on the basis of ICAO standards, the Traffic Alert and Collision Avoidance System (TCAS) was developed in the USA. ACAS and TCAS were designed as autonomous airborne systems which are independent of navigation systems. They are, however, not compatible with each other.
AX001-1-2/02
44
BFU
Bundesstelle fr Flugunfalluntersuchung Development of TCAS II, Version 7, established compatibility with ACAS. Note: Instead of the ICAO term ACAS the term TCAS is mainly used in the following text, which has been introduced internationally by the American manufacturers of TCAS equipment. An accumulation of accidents and near misses in the American airspace resulted in the mandatory installation of TCAS into civil aircraft with more than 30 seats starting already on 30 December 1993 in the USA. In Europe the mandatory installation of ACAS was established in agreement with all Eurocontrol member states. Thus Eurocontrol decided in 1995 on the basic procedure for the mandatory installation of ACAS in Europe and suggested the introduction in two steps. 1. step: From 1 January 2000 on mandatory installation of ACAS into airplanes with more than 30 seats or a certificated take-off mass of more than 15 000 kg. 2. step: From 1 January 2005 on mandatory installation of ACAS into airplanes with more than 19 seats or a certificated take-off mass of more than 5 700 kg. In order to actually allow a timely and coordinated installation of ACAS into all airplanes concerned, an implementation transition period until 31 March 2001 was agreed on. In order to deal with any problems concerning the introduction of ACAS, exceptional provisions were established for individual cases applicable until 30 September 2001. This established definitely that after 30 September 2001, airplanes of step 1 not being equipped with ACAS were no longer allowed to use the airspace of the European Civil Aviation Conference (ECAC). Description of the system TCAS is a warning system which functions independently of ground equipment, of the aircraft navigation equipment and of the pilots. TCAS uses the transponder (Mode C or S) of other airplanes as a source of information, it possesses its own transmitter/receiver/locator systems and computers for the fast determination of flight paths and the generation of advisories for the pilots. Only one TCAS device is installed aboard a transport category airplane, i.e. there is no redundancy for fail-safe operation. It is permitted according to the MEL (Minimum Equipment List) to continue to operate an aircraft for up to 10 days in case of TCAS failure.
AX001-1-2/02
45
BFU
Bundesstelle fr Flugunfalluntersuchung The TCAS system consists of the following components:
TCAS system components
TCAS II Computer It determines the bearing by means of direction finding via directional antenna(s). It determines the distance by analysis of the total response time. It performs airspace surveillance, intruder tracking, threat detection, avoidance manoeuvre determination and the generation of advisories. TCAS + Transponder Control Panel Combined device for TCAS and Transponder There is a 3-position selector for TCAS: 1 TCAS off 2 TA only only TA (Traffic Advisories) will be generated 3 Automatic or TA/RA unlimited operation of TCAS Two antennas (on top and bottom of the fuselage) The top antenna is a directional antenna. The TCAS transmission and reception channels are the counterpart of the transponder. Transmission frequency: 1030 MHz to interrogate transponders Reception frequency: 1090 MHz for the reception of transponder responses Connection to the Mode S Transponder Data transfer between TCAS and the Mode S transponder includes the transfer of time and direction of an RA: The TCAS computer receives the altitude measured by the Air Data Computer via the Mode S transponder using the ARINC-429 bus. Connection to the radar altimeter In order to prevent avoidance manoeuvre advisories close to the ground, the TCAS computer receives the height of the airplane above ground level determined by means of radio waves. Loudspeaker Alert the crew, by means of aural annunciations, of TCAS generated TAs and RAs.
AX001-1-2/02
46
BFU Displays in the cockpit
Traffic monitored within the surrounding airspace is presented on displays so that the pilots can observe the relative position, relative altitude, and vertical trend of other airplanes. Airplanes with retrofitted TCAS: The information is displayed on additional instruments or combinations instead of classical flight instruments. The most frequently used installation: a VSI/TRA with an integrated TCAS display instead of a conventional VSI. Besides the own vertical speed the movement of one or several intruders, position and altitude difference with tendency information are displayed.
VSI with integrated TCAS
Indications on VSI/TRA of the most important TCAS-Advisories
AX001-1-2/02
47
BFU
Bundesstelle fr Flugunfalluntersuchung Aircraft equipped with Electronic Flight Instrument System (EFIS) The indication can be displayed on the PFD (Primary Flight Display) and the ND (Navigation Display).
RA: vertical rate to be avoided
Vertical speed needle
RA: required vertical rate
RA displayed on PFD
Target symbol
EFIS navigation display in ROSE-Mode with TCAS information
AX001-1-2/02
48
BFU Collision Avoidance Logic
The tracking of the flight paths of the airplanes within surveillance range is the basis of the CAS (Collision Avoidance System). The TCAS system monitors the airspace up to 40 NM in front, up to 15 NM behind, up to 20 NM on both sides and up to approximately 9 000 ft above and below the airplane. TCAS tracks the trajectory of all aircraft equipped with operating transponders within surveillance range and calculates possible conflicts. These calculations are based on the following parameters: slant range bearing closure rate altitude vertical speed. The CAS logic computes predictive trajectories of target airplanes. A conflict is determined by the CPA (closest point of approach) where the necessary safe vertical distance cannot be achieved. In this case the target airplane becomes a threat. The time-to-go to the CPA is recalculated every second. If the time-to-go drops below defined thresholds (for FL >200 the threshold is 48 seconds for a TA and 35 seconds for an RA) CAS logic will issue advisories. TCAS is designed to coordinate the RAs in the airplanes involved and issues them almost simultaneously. This means they are always complementary, i.e. one airplane is advised to climb and the other one to descend. The avoidance manoeuvre(s) occur only vertical.
Advisory type TA Initial preventive RA Corrective RA Strengthening RA Weakening RA Reversing sense RA RA with altitude crossing RA to maintain vertical speed RA to maintain vertical speed with altitude crossing RA to reduce vertical speed RA termination message
Downward sense Traffic, traffic Monitor vertical speed Descend, descend Increase descend , increase descend Adjust vertical speed, adjust Descend, descend now Descend, crossing descend, descend, crossing descend Maintain vertical speed, maintain Maintain vertical speed, crossing maintain Adjust vertical speed, adjust
Upward sense
Monitor vertical speed Climb, climb Increase climb, increase climb Adjust vertical speed, adjust Climb, climb now Climb, crossing climb, Climb, crossing, climb Maintain vertical speed, maintain Maintain vertical speed, crossing maintain Adjust vertical speed, adjust
Clear of conflict
TCAS indications and commands
Subsequent corrections of the RA In order to cope with changing conditions after the initial RA, CAS logic can issue further RAs such as increase... (increase of rate of climb or descent) or Adjust... (reduction of rate of climb or descent). For TCAS II Version 7 this also includes the reversal of the sense of the initial RA.
AX001-1-2/02
49
BFU
Bundesstelle fr Flugunfalluntersuchung Once the conflict is averted, TCAS generates an aural annunciation clear of conflict in both airplanes. The design of TCAS avoidance manoeuvres require the following rates of descent or climb: RA Downward sense
Required rate
-2500 ft/min -1500 ft/min -1500 ft/min -1500 ft/min -4400 ft/min < V/S < 1500 ft/min V/S < 0 ft/min V/S < +500 ft/min
RA Upward sense
Advisory
Increase climb Climb Reversal climb Crossing climb Maintain climb
Advisory
Increase descend Descend Reversal descend Crossing descend Maintain descend
Required rate
+2500 ft/min +1500 ft/min +1500 ft/min +1500 ft/min +4400 ft/min > V/S > +1500 ft/min V/S > 0 ft/min V/S > -500 ft/min
Dont climb Dont climb > 500 ft/min
Dont descend Dont descend > 500 ft/min Dont descend > 1000 ft/min Dont descend > 2000 ft/min
V/S < +1000 ft/min V/S < +2000 ft/min
Dont climb > 1000 ft/min Dont climb > 2000 ft/min
V/S > -1000 ft/min V/S > -2000 ft/min
An automatic downlink, integrated in the TCAS equipment, carrying information about issued RAs to the respective ATC units has not been activated yet. Operational procedures If TCAS issues a TA aboard an airplane a voice alert is issued traffic, traffic. On the TCAS display the circle symbolizing the possible intruder will be filled yellow. Relative altitude (ft x 100) and an appropriate vertical trend arrow for a climb or descent in relation to own airplane will appear next to the yellow circle. If a TA becomes an RA the circular symbol on the TCAS display will change into a red (solid) square and an advisory to avoid the threat is issued. If an advisory to climb is issued a synthetic vocal advisory climb, climb is generated and on the outer circumference of the vertical speed indicator a green arc from 1 500 to 2 000 ft/min appears and the range from 6 000 to 1 500 ft/min is marked red. If an advisory to descend is issued a synthetic vocal advisory descend, descend is generated and on the outer circumference of the vertical speed indicator a green arc from 1 500 to 2 000 ft/min appears and the range from 1 500 to 6 000 ft/min is marked red. If TCAS issues an RA to increase a climb a synthetic vocal advisory increase climb, increase climb is generated. On the outer circumference of the vertical speed indicator the green arc marking the range of climb changes to 2 500 3000 ft/min and the range from 2 500 to 6 000 ft/min is marked red. In case of an advisory increase descent, increase descent the green range of descent will change to 2 500 to 3 000 ft/min and the range from 2 500 to 6 000 ft/min will be marked red.
AX001-1-2/02
50
BFU Publications of ICAO
Due to the international significance of TCAS, the ICAO Standards and Recommendations are of major importance. ACAS/TCAS II is discussed in the following ICAO documents, which have been published prior to 1 July 2002: Annex 2 Rules of the Air, Chapter 3 Annex 10 Aeronautical Telecommunications, Volume IV Surveillance Radar and Collision Avoidance Systems, Attachment A Annex 11 Air Traffic Services Procedure for Air Navigation Services Aircraft Operations, Volume I, Flight Procedures (Doc 8186, PANS-OPS) Procedure for Air Navigation Services Air Traffic Management (Doc 4444, PANS-ATM) State letter AN 11/19-02/82 Concerning the procedures in case of TCAS-RAs and the responsibility for separation, ICAO has established the following: Annex 2 (Rules of the Air, Chapter 3, 3.2.2 Rightofway) The aircraft that has the rightof-way shall maintain its heading and speed, but nothing in these rules shall relieve the pilot-in-command of an aircraft from the responsibility of taking such action, including collision avoidance manoeuvres based on resolution advisories provided by ACAS equipment, as will best avert collision. Annex 10 (Attachment A, paragraph 3.5.8.10.3 Contrary pilot response. Manoeuvres opposite to sense of an RA may result in a reduction in vertical separation with the threat aircraft and therefore must be avoided. This is particularly true in the case of an ACASACAS co-ordinated encounter. Annex 11 (ICAO-Annex 11 Air Traffic Services, Chapter 2 General, Paragraph 2.4) The carriage of airborne collision avoidance systems (ACAS) by aircraft in a given area shall not be a factor in determining the need for air traffic services in that area. Doc 8186, PANS-OPS (Chapter 3, Operation of ACAS Equipment) 3.1 General 3.1.1 The information provided by airborne collision avoidance System (ACAS) is intended to assist pilots in the operation of aircraft. 3.1.2 Nothing in the procedures specified in 3.2 hereunder shall prevent pilots-in-command from exercising their best judgement and full authority in the choice of the course of action to resolve a traffic conflict. 3.2 Use of ACAS Indications ACAS indications are intended to assist the pilots in the active search for, and visual acquisition of, the conflicting traffic, and the avoidance of potential collisions. The indications generated by ACAS shall be used by pilots in conformity with the following safety considerations: a) pilot shall not manoeuvre their aircraft in response to traffic advisories only; Note 1. [] Note 2. [] b) in the event of a resolution advisory to alter the flight path, the search for the conflicting traffic shall include a visual scan of the airspace into which own ACAS aircraft might manoeuvre;
AX001-1-2/02
51
BFU
Bundesstelle fr Flugunfalluntersuchung c) the alteration of the flight path shall be limited to the minimum extent necessary to comply with the resolution advisories. d) pilot who deviate from an air traffic control instruction in response to a resolution advisory shall promptly return to the terms of that instruction or clearance when the conflict is resolved and shall notify the appropriate ATC unit as soon as practicable, of the deviation, including its direction and when the deviation has ended. Note.- The phraseology to be used for the notification of manoeuvres in response to a resolution advisory is contained in the PANS-ATM (Doc 4444), Chapter 12. Doc 4444, PANS-ATM (Procedures for Air Navigation Services B Air Traffic Management) The procedures to be applied for the provision of air traffic services to aircraft equipped with ACAS shall be identical to those applicable to non-ACAS equipped aircraft. In particular, the prevention of collisions, the establishment of appropriate separation and the information which might be provided in relation to conflicting traffic and to possible avoiding action shall conform with the normal ATS procedure and shall exclude consideration of aircraft capabilities dependent on ACAS equipment. 15.6.3.2 When a pilot reports a manoeuvre induced by an ACAS resolution advisory, the controller shall not attempt to modify the aircraft flight path until the pilot reports returning to the terms of the current air traffic control instructions or clearance but shall provide traffic information as appropriate. 15.6.3.3 Once an aircraft departs from its clearance in compliance with a resolution advisory, the controller ceases to be responsible for providing separation between that aircraft and any other aircraft affected as a direct consequence of the manoeuvre induced by the resolution advisory. The controller shall resume responsibility for providing separation for all the affected aircraft when: a) the controller acknowledges a report from the flight crew that the aircraft has resumed the current clearance; or b) the controller acknowledges a report from the flight crew that the aircraft is resuming the current clearance and issues an alternative clearance which is acknowledged by the flight crew. Section 20.02 (Responsibility for separation of aircraft during manoeuvres in compliance with a resolution advisory) The use of ACAS II does not alter the respective responsibilities of pilots and controllers for the safe operation of aircraft. On being notified that a aircraft, under air traffic control, is manoeuvring in accordance with a resolution advisory (RA), a controller should not issue instructions to that aircraft which are contrary to the RA as communicated by the pilot. Once an aircraft departs from the current ATC clearance in compliance with an RA, the controllers cease to be responsible for providing separation between that aircraft and other aircraft affected as a direct consequence of the manoeuvre induced by the RA. However, when circumstances permit, the controller should endeavour to provide traffic information to aircraft affected by the manoeuvre. The controllers responsibility for providing separation for all the affected aircraft resumes when: 1. the controller acknowledges a report from the pilot that the aircraft has resumed the current clearance; or 2. the controller acknowledges a report from the pilot that the aircraft is resuming the current clearance and issues an alternative clearance which is acknowledged by the flight crew.
AX001-1-2/02
52
BFU State letter AN 11/19-02/82
In the State letter the requirements for ACAS training are described in detail. It includes simulator training for flight crews: 3.2 ACAS manuvres training 3.2.3 b) RA responses [] 3) for corrective RAs, the response is initiated in the proper direction within 5 seconds of the RA being displayed. The change in vertical speed is accomplished with an acceleration of approximately g. TCAS 2000/TCAS II Traffic Collision and Avoidance System Pilots Guide The manufacturers TCAS 2000 Pilots Guide describes functionality, handling and procedures. The Introduction describes the TCAS system philosophy. It includes the following sentence: TCAS 2000 is a backup to the ATC (Air Traffic Control) system and the see and avoid concept. Chapter 6.1 Pilot Responsibilities includes the following: TCAS 2000 is intended as a backup to visual collision avoidance, application of right-ofway rules, and Air Traffic Control separation service. ........ If a TCAS 2000 RA requires manoeuvring contrary to an ATC clearance, satisfy the RA in a way that most nearly complies with the ATC clearance. If it is possible to both respond to a TCAS 2000 RA and continue to satisfy a clearance at the same time, you may do so. For example, you may respond to a climb RA while continuing to satisfy an ATC clearance to intercept a localizer. If a TCAS 2000 RA manoeuvre is inconsistent with the current ATC clearance, the pilot: - Must not delay in responding the RA. - Must not modify a response to an RA. - Must follow the RA manoeuvre, unless invoking Emergency Pilot Authority. - Must provide a vertical rate that minimizes ATC deviations ........ If a TCAS 2000 RA requires manoeuvring contrary to right-of-way rules, cloud clearances rules while VFR, Flight Handbook limitations, or other such criteria, pilots may, and are expected to, follow the TCAS 2000 RAs to resolve the immediate traffic conflict.
The manufacturer published the Pilots Guide, which includes the above-mentioned passages, in English and Russian. TU154M Flight Operations Manual The TU154M Flight Operations Manual ( 154M), chapter 8.18.3.4, dated 6 December 1999 describes the significance of TCAS with the following passage: (1) ... (2) For the avoidance of in-flight collisions is the visual control of the situation in the airspace by the crew and the correct execution of all instructions issued by ATC to be viewed as the most important tool. TCAS is an additional instrument which ensures the timely determination of oncoming traffic, the classification of the risk and, if necessary, planning of an advice for a vertical avoidance manoeuvre. Publications of Eurocontrol On the basis of the ICAO criteria, Eurocontrol was involved significantly in the development and implementation of ACAS. Eurocontrol has issued several publications regarding this topic, which are, however, only descriptions or recommendations. These publications include:
AX001-1-2/02
53
BFU
Bundesstelle fr Flugunfalluntersuchung Aeronautical Information Circular (AIC) The document published in January 1996 was addressed to the ECAC States. This publication describes ACAS and the introduction of the system in Europe. WP 6-1 ACAS II Program The document prepared by the Eurocontrol ACAS working group was published in 1999 as a summary of the technical and operational aspects for the introduction of ACAS. The document was to serve as information material for people involved in the introduction and the operation of ACAS. Publications of the JAA In October 1998, the JAA issued the Leaflet no. 11 Guidance for Operators on Training Programmes for the use of Airborne Collisions Avoidance Systems (ACAS). As a result of the discussions with the ICAO concerning the introduction of ACAS, the leaflet described the aspects of pilot training. In the leaflet the training subjects theory of operation, pre-flight operations, general in-flight operations, response to traffic advisories (TAs), response to resolution advisories (RAs) were included. The section RA Responses includes the following description: 3.2.3b. (iii) For corrective RAs, the response is initiated in the proper direction within the 5 seconds of the RA being displayed. The change in vertical speed is accomplished with an acceleration of approximately g. 3.2.3b (ix) The controller is informed of the RA as soon as time and workload permit using the standard phraseology 3.2.3b (x) When possible, an ATC clearance is complied with while responding to an RA [] Note 3: If pilots simultaneously receive instructions to manoeuvre from ATC and an RA which are in conflict, the pilot should follow the RA. National regulations and procedures Aeronautical Information Publication (AIP) Germany: Information about the use of TCAS II were published in the Aeronautical Information Publication Germany under ENR 1.8-22, dated 2 November 2000. This paragraph includes: 2.2.2 Resolution Advisories a) All Resolution Advisories (corrective or preventive) should be followed unless the pilot can visually identify the conflicting traffic and decide that no deviation from the current flight path is needed. When subsequently the Resolution Advisory changes the pilot should again respond promptly in compliance with the indications. Failure to comply with a Resolution Advisory can result in a less desired vertical miss distance at the closest point of approach. c) If a decision is made not to follow a Resolution advisory (corrective or preventive) a manoeuvre should never be made in a direction opposite to the one indicated by the Resolution Advisory. This is particularly important as the system may coordinate, unknown to the pilot, with another equipped aircraft. d) Recovery manoeuvres to resume the assigned ATC clearance should be initiated immediately after the system announces clear of conflict. 3) Responsibility for separation of aircraft during manoeuvres in compliance with a Resolution Advisory: The use of TCAS II does not alter the respective responsibilities of pilots and controllers for the safe operation of aircraft. On being notified that an aircraft under Air Traffic Control is manoeu-
AX001-1-2/02
54
BFU
Bundesstelle fr Flugunfalluntersuchung vring in accordance with a Resolution Advisory, a controller should not issue instructions to that aircraft which are contrary to the Resolution Advisory as communicated by the pilot. [] 4. Radiotelephony Reporting Procedures 4.1 The ICAO provisions published already approved do not yet address the verbal exchange which needs to take place between pilots and controllers in relation to the use of airborne collision systems. [] 4.5 Proposed Reporting Phraseologies The pilot should report the commencement of the manoeuvre as follows, as soon as time and circumstances permit: TCAS climb or TCAS descent [] Air Traffic Order 13 (Luftverkehrsordnung LuftVO - 13) In 13 subpara 9 is a deviation from the right-of-way rules on the basis of ACAS/TCAS RA regulated as follows: (9) The regulations concerning the right-of-way rules do not release the pilots of the responsibility to act in a way that a collision is avoided. This also applies to diversionary manoeuvres which are based on recommendations given by collision avoidance equipment on board. [] Advisory Circular (AC) of the FAA On 22 October 2001 the American aviation authority FAA published the AC 120-55B Air Carrier Operational Approval and use of TCAS II. The AC contains recommendations for TCAS II installation, operation and training. The responsibility of the pilot for example is described as follows: 11. TCAS Operational Use [] 11.b. Pilot Responsibilities [] 11.b. (2): When an RA occurs, the PF should respond immediately by direct attention to RA displays and manoeuvre as indicated, unless doing so would jeopardize the safe operation of the flight or the flight crew can assure separation with the help of definitive visual acquisition of the aircraft causing the RA. By not responding to an RA, the flight crew effectively takes responsibility for achieving safe operation. [] 11.b. (5):The PNF should advise the PF on the progress of achieving the vertical rates commanded by TCAS. The PNF and any on-board observers will assist in the visual search for the intruder and continue to cross-check the TCAS displayed information with other available traffic information to ensure the RA response is being flown correctly. [] 11.f ATC Responsibilities (1)Controllers will not knowingly issue instructions that are contrary to RA guidance when they are aware that a TCAS manoeuvre is in progress. When an aircraft deviates from its clearance in response to an RA, ATC is still responsible for providing assistance to the deviating aircraft as requested until: a) The pilot informs ATC that the RA conflict is clear; and b) The aircraft has returned to the previously assigned altitude; or c) Alternate ATC instructions have been issued and acknowledged.
AX001-1-2/02
55
BFU
1.18.4.2 Findings Boeing B757-200: TCAS equipment and findings The Boeing B757-200 was equipped with the system TCAS 2000 manufactured by ACSS (Aviation Communication and Surveillance Systems, LLC). The following components were installed: TCAS Computer RT 950 : P/N: 7517900-10003 S/N: 99112884 Mode S Address: 894012 H Vertical Speed Indicator: P/N: 457400RA0711 S/N: 8061 Vertical Speed Indicator: P/N: 457400RA0711 S/N: 8060 TCAS Antenna: P/N: 751409-901 S/N: 9504XXXX TCAS Antenna P/N: 751409-901 S/N: 9505A712 The system met the requirements of TCAS II, Version 7. It had been retrofitted and certificated after a supplementary type certification.
VSI/TRA of the B757-200
The displayed range 4 NM, 8 NM or 16 NM can be selected manually. The range selected at the time of the accident could not be determined.
Position of the VSI/TRA in the B757-200 cockpit
AX001-1-2/02
56
BFU Findings
The TCAS computer of the B757-200 was completely destroyed by impact forces and fire. Some data could be determined by reading out the TU154M computer because each TCAS computer of the airplanes involved stores data of the other. Excerpt from the TCAS data of the B757-200 interrogated and stored by the TU154M computer:
Time
(UTC)
Altitude
(feet)
V/S
(ft/min)
Advisory RA Descent RA Descent RA Descent RA Descent RA Descent RA Descent RA Descent RA Descent RA Descent RA Descent RA Descent RA Descent RA Descent RA Descent RA Descent RA Descent RA Descent RA Descent RA Descent RA Descent -
21:34:32 21:34:34 21:34:36 21:34:38 21:34:40 21:34:42 21:34:44 21:34:46 21:34:48 21:34:50 21:34:52 21:34:54 21:34:56 21:34:58 21:35:00 21:35:02 21:35:04 21:35:06 21:35:08 21:35:10 21:35:12 21:35:14 21:35:16 21:35:18 21:35:20 21:35:22 21:35:23 21:35:25 21:35:27 21:35:29 21:35:31 21:35:33 21:35:34
35968 35968 35968 35968 35968 35968 35968 35968 35968 35968 35968 35968 35968 35968 35968 35968 35968 35840 35840 35840 35712 35712 35584 35456 35456 35328 35328 35200 35072 35072 34944 34816 34688
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 -377 -624 -1222 -1462 -1541 -1987 -2047 -2640 -2617 -2700 -2535 -2370 -2452 -2422 -2392 -4260 -4260
Instead of the relative time scale of the TCAS devices (elapsed time) the UTC time was included by the BFU. Altitude: Resolution 128 ft, truncation, calculation based on a source with 25 ft resolution (transponder reply of B757-200) V/S: calculation based on altitude, resolution 25 ft The advisory increase descent as an individual command was not transmitted to the TU154M. This command was recorded on the CVR at 21:35:10 hrs.
AX001-1-2/02
57
BFU Tupolev TU154M: TCAS equipment and findings
Die TU154M was equipped with TCAS 2000 from the manufacturer ACSS as well. The following components were installed: TCAS Computer RT 950: P/N: 7517900-1000 S/N: G1064787 Mode S Adresse: 154F38 H Vertical Speed Indicator : P/N: 4067241-890 S/N: 01085842 Mod.Lev.: M Vertical Speed Indicator : P/N: 4067241-890 S/N: 01085838 Mod.Lev.: M TCAS Antenna: P/N: 7514081-90 S/N: 0103E925 TCAS Antenna: P/N: 7514081-90 S/N: 0105F312 The system met the requirements of TCAS II, Version 7. It had been retrofitted and certificated after a supplementary type certification.
Position of the VSI/TRA) in the TU154M cockpit
The displayed range 6 NM, 12 NM or 40 NM can be selected manually. Findings The non volatile memory of the TCAS computer of the TU154M was read out on 13 August 2002 at the manufacturer ACSS in the presence of members of the BFU investigation team. There were two situations during the flight for which the TCAS computer generated event numbers and stored the course of events in the data memory. Event no. 1: Between 18:48:12 hrs and 18:48:28 hrs: TCAS issued a TA - the airplane was in initial climb following the departure from Moscow (radar height between 139 and 653 ft). Event no. 2: Started with the approach to the B757-200 at 21:34:32 hrs and ended at 21:35:34 hrs.
AX001-1-2/02
58
BFU Extraction from TCAS-Data of the TU154M:

Time (UTC) 21:34:32 21:34:34 21:34:36 21:34:38 21:34:40 21:34:42 21:34:44 21:34:46 21:34:48 21:34:50 21:34:52 21:34:54 21:34:56 21:34:58 21:35:00 21:35:02 21:35:04 21:35:06 21:35:08 21:35:10 21:35:12 21:35:14 21:35:16 21:35:18 21:35:20 21:35:22 21:35:23 21:35:25 21:35:27 21:35:29 21:35:31 21:35:33 21:35:34 Altitude (feet) 35968 35968 35968 35968 35968 35968 35968 35968 35968 35968 35968 35968 35968 35968 35968 35968 35840 35840 35840 35712 35712 35584 35456 35456 35328 35328 35200 35200 35072 35072 34944 34944 34944 V/S (ft/min) 217 140 45 49 -70 -101 -66 -62 -13 42 -65 -166 -155 -168 -451 -705 -1072 -1117 -1421 -1871 -1841 -2025 -2227 -2347 -2377 -2212 -2152 -1920 -1766 -1957 -1841 -1335 -1335
Intruder Range (NM) 11.97 11.56 11.16 10.75 10.31 9.94 9.53 9.12 8.69 8.31 7.88 7.48 7.11 6.69 6.31 5.91 5.48 5.09 4.69 4.30 3.91 3.52 3.12 2.73 2.34 1.96 1.77 1.40 1.00 0.63 0.24 0.00 0
Bearing (deg) 325 326 326 328 328 328 328 328 328 328 329 328 326 325 323 322 322 323 323 322 321 321 321 319 316 315 316 315 315 314 307 162 152
Advisory TA TA TA TA TA TA TA RA Climb RA Climb RA Climb RA Climb RA Climb RA Climb RA Climb RA Climb RA Climb RA Climb RA Climb RA Climb RA Climb RA Climb RA Climb RA Climb RA Climb RA Climb RA Climb RA Climb -
Explanations: Instead of the relative time scale of the TCAS devices (elapsed time) the UTC time was included by the BFU. Altitude: resolution 128 ft, truncation, calculation based on a source with 25 ft resolution V/S: Calculation based on altitude, resolution 25 ft Intruder Range: distance from the B757-200 in NM Intruder Bearing: Angle to the B757-200 related to the longitudinal axis of the TU154M The advisory increase climb was stored in the memory and the time of storage determined by ACSS on the basis of the raw data was 21:35:24 hrs. Measurement of altitude for TCAS An essential parameter for the functioning of TCAS was the airborne altitude measurement. In order to clarify the accuracy of the altitude information and the transmission to TCAS the system architecture of TCAS was investigated for both aircraft.
AX001-1-2/02
59
BFU
Bundesstelle fr Flugunfalluntersuchung Measurement and processing of the altitude information in the B757-200:
The Air Data Computer (ADC) supplied the altitude with an accuracy of +/-25 ft. The transmission to additional system components was carried out via an ARINC-429 bus (Label 203) with a resolution of 1 ft. For the recording on the flight data recorder the altitude information was transmitted via the interface unit (FDAU) with the full resolution. Before the two airplanes approached each other a mean flight altitude of 36 005 ft was recorded by the FDR. The replies of the transponder registered on the ground were a constant FL 360.
AX001-1-2/02
60
BFU
Bundesstelle fr Flugunfalluntersuchung Measurement and data processing of altitude information in the TU154M:
The Air Data Computer (VBE-SWS) supplied the altitude with an accuracy of +/-25 ft. The transmission to the transponder was carried out via an ARINC-429 bus (Label 203) with a resolution of 1 ft. The altitude for the flight data recorder was determined by a separate sensor DWBP-13. A reproduction of dynamic processes was not possible because of its internal mechanical inertia. The measurement uncertainty of DWBP-13 and the resolution (approximately 200 ft) of the FDR result in recorded data which is insufficient for an exact determination of the altitude. As substitutes were used: The altitude measured by the height monitoring unit (HMU) Linz (Austria) 25 minutes prior to the accident was 36 040 ft. FDR data shows that the autopilot (with engaged altitude hold mode) controlled the aircraft between Linz and the generation of the RA. The altitudes transmitted by the transponder and recorded by ATC toggled between FL 360 and FL 361 (mode C). From 21:34:30 hrs until the initiation of the descent, the transponder transmitted FL 361. Operational findings The following timeline shows the functions of the TCAS computers after the identification, the positioning and the transponder interrogation: 21:34:32 hrs The airplanes flew at FL 360 (altitude difference was approximately 50 ft) and at a distance of 11.97 NM. The TCAS of the TU154M localized the B757-200 at an angle of 325 (-35 related to its own longitudinal axis). 21:34:42 hrs The TCAS devices of both airplanes generated a TA simultaneously. The distance between the two airplanes was 9.94 NM.
AX001-1-2/02
61
BFU
Bundesstelle fr Flugunfalluntersuchung 21:34:56 hrs The TCAS devices of both airplanes generated an RA simultaneously because they continued to fly at the same altitude. The distance between the two airplanes was 7.11 NM. The RA in the TU154M was climb, climb The RA in the B757-200 was descend, descend FDR data shows that both airplanes started to descend at 21:34:57 hrs. 21:35:10 hrs The distance between the two airplanes was 4.3 NM. The TCAS of the B757-200 generated the advisory increase descent. 21:35:24 hrs The distance between the two airplanes was 1.54 NM. The TCAS of the TU154M generated the advisory increase climb. Both airplanes were still in descent with almost the same rate of descent and an altitude difference of less than 100 ft. TCAS-Training on Boeing B757-200 General regulations Training within the operator was based on the booklet Introduction to TCAS II Version 7 issued in November 2000 by the U.S. Department of Transport FAA. The theoretical training included the following main points under the title How TCAS works: system explanation alert thresholds expected response to TAs and RAs use of TCAS displayed information Phraseology for reporting RAs system limitation line operations Basics, regulations and procedures of the operator The operational basics, regulations and procedures are defined in the Operations Manual, Part A, Section 8 dated 4 February 2002. In the subparagraph 8.3.2.6.5 TCAS/ACAS ALERTS AND WARNINGS the following procedures are documented for the crew: If TCAS emits a TA aboard the airplane the crew will have to visually search for the threat airplane and to be prepared for an RA, in case an RA is released. In case of an RA, the crew has to initiate immediately the required manoeuvre and to subsequently adjust the powerplant thrust and the trim setting. Special attention is to be paid to the fact that the manoeuvre should never be performed in a direction contrary to the RA. The RA should be disregarded only if the potential conflicting traffic has been positively identified and if it is absolutely clear that a diversion from the flight path is not necessary. All RAs should be reported orally to ATC as soon as practicable and should be reported in a written form to the responsible authority after the flight. In the 757 Flight Crew Training Manual, which according to the statement of the operator was the basis of the flight crew training, the following actions are prescribed in Sections 5.19 and 5.20 dated 31 October 2001, issued by Boeing, in case of TAs and RAs.
AX001-1-2/02
62
BFU
Bundesstelle fr Flugunfalluntersuchung TA When a TA is received, expeditiously accomplish the following: Look for traffic using the traffic display as an aid. Call out any conflicting traffic. Do not maneuver unless visual contact confirms that separation is not adequate. Maneuver based solely on a TA may result in reduced separation and are not recommended. RA Flight crews should follow the RAs using established procedures unless doing so would jeopardize the safe operation of the airplane or positive visual contact confirms that there is a safer course of action. If an RA occurs, expeditiously accomplish the following: If maneuvering is required, disengage the autopilot and smoothly adjust pitch and thrust to satisfy RAs. The pitch must be adjusted to fly the airplane symbol just out of the red region(s) on the attitude indicator or to achieve a vertical speed just outside the red band(s) on the RA VSI/TRA (as installed). Adjust thrust as required to maintain desired speed. Attempt to establish visual contact: When clear of conflict, advise ATC and smoothly return to previous clearance. In addition the manual offers some information concerning the control of the airplane in RA maneuvers on passenger flights. The remarks concerning RAs in the manual end with the statement: maneuvering contrary to an RA is not recommended since TCAS may be coordinating maneuvers with other airplanes. Flight Crew Training Prior to working for the operator both flight crew members (PIC and copilot) had received theoretical and practical TCAS training in accordance with the AC (Advisory Circular) 120-55 Pilot Training Program. The training had been concluded with a test (TCAS Examination). Both pilots passed the test successfully (more than 90% of the possible number of points), the PIC on 19 November 2001 and the copilot on 15 April 2002. Afterwards a practical flight training was executed in the Boeing-757 simulator with a simulated TCAS system of Gulf Air in Doha, Qatar. During this practical flight training, the correct operational handling of TCAS, i.e. the distribution of attention and the actions in case of TAs and RAs between the PF and the PNF, the development of skills in case of RAs, especially the immediate and adequate reaction to RAs which were released in the programmed simulator, were imparted. A joint flight simulator training and a proficiency check of the PIC on 24 and 25 June 2002 also covered these elements of the TCAS training. TCAS-Training on Tupolev TU154M General regulations Training within the operator was based on the training program: "Program for the preparation of the flight crews of civil air carriers for flights with the airborne system TCAS/ACAS", which was validated on 10 August 2000 by the Deputy Director of the civil aviation authority of the Russian Federation. In the introduction it is pointed out that the document ACAS Implementation Guidance Document dated 1 July 1997 and published by EUROCONTROL is the basis of this program.
AX001-1-2/02
63
BFU
Bundesstelle fr Flugunfalluntersuchung This training program includes three parts: 1) Theory and principles of functioning of the system and the processing of information received 2) Special features of installation and the flight operational application on the airplane type concerned. 3) Practical training aboard the airplane following the conclusion of the theoretical part. For all three parts a training time of 48 hours, 40 hours of theoretical and 8 hours of practical training, is scheduled. The training takes place in certificated special state centres by instructors trained by the American manufacturers of the TCAS/ACAS devices and at the academy for civil aviation in St. Peterborough (Russia). The flight crews receive a certificate on the basis of the theoretical instruction, the practical training and the passing of an examination. The theoretical training includes the following main subjects: Basic principles of TCAS/ACAS, ICAO Standards and definitions principles of design including components explanation of the system on the basis of the installation aboard the aircraft technical data Presentation of the aural and visual annunciation in the cockpit according to version 7.0 Actions in case of TAs and avoidance manoeuvres in case of RAs, phraseology for the reporting to ATC Here the actions to be taken by the flight crew in case of TA/RA are presented in detail. System limitations Installation and operation of the technical systems on the airplane type concerned The practical ground training for TCAS/ACAS is carried out aboard an aeroplane. Basics, regulations and procedures of the operator The operational basics, regulations and procedures for the handling of equipment and systems are defined in the Flight Operational Instruction for the TU154M ( 154M). In Section 8.18.3, page 8.18.1/2 dated 22 March 2001 the procedures to be followed by the crew are documented under the title Collision Avoidance System TCAS-2000/Transponder Mode S, Version 7 made by Honeywell. Operating restrictions (according to 8.18.3.1): TCAS can only detect aircraft equipped with transponders which are switched to one of the control modes RBS (A,C) or S. Aircraft without a transponder or with a transponder switched to the control mode UWD cannot be detected by the system. If the transponder of an intruder does not transmit an altitude (works only in the control mode A) TCAS can only establish azimuth and distance of the aircraft and can therefore not give any advisory to avoid a conflict situation. The system thereby assumes that the intruder is in the same altitude as own aircraft. On a flight level above 18 000 ft (5 500m) aircraft which do not transmit their altitude are not displayed.
AX001-1-2/02
64
BFU
Bundesstelle fr Flugunfalluntersuchung The restrictions in the following table are effective in TCAS in connection with the geometrical flight level (according to radio altimeter). Conditions of flight At an altitude below 1450 ft (442 m) At an altitude below 900 ft (274,3 m) at descent of the aircraft and at an altitude up to 1100 ft (335,3 m) at the climb At an altitude below 400 ft (122 m) at descent of the aircraft and at an altitude up to 600 ft (183 m) at the climb Restrictions of the TCAS There will be no advisory for an increased descent given There will be no RA for a vertical manoeuvre given (TCAS automatically switches into the control mode TA only)
There will be no aural message
At a temperature below 15C in the cabin the system should not be activated because of the possibly diminished reliability of the VSI/TRA display. In subsection 8.18.3.2, the normal operation of the system is described. No. 4 of this subsection, page 8.18.6 dated 6 December 1999, includes the following for the individual stages of flight: All flight phases: For the conduct of the flight changes in the airspace which are displayed on the VSI/TRA are to be observed. Follow the advisories issued by the system for the avoidance of collisions. En-route flight: After reaching the en-route flight level switch the range over to 40 NM and N (normal coverage). This sentence is followed by the following items under the title ATTENTION: 1. Prior to following the resolution advisory it is necessary to get contact with the conflicting traffic. 2. The advisory is to be followed safely and smoothly without exceeding the operating limitations indicated in the operating instruction for the TU154M. The system assumes that the crew will react within five seconds after an RA. 3. It is prohibited to initiate a manoeuvre contrary to the advisory issued by the system. 4. In case of simultaneous advisories from the TCAS and the GPWS the GPWS advisory has priority. 5. [...] After the accomplishment of the necessary command, the passing of the conflicting traffic and the aural annunciation of the TCAS clear of conflict, a report is to be addressed to ATC. Return to the flight level assigned by ATC. In the table 8.18.3.3 (page 8.18.9), dated 22 March 2001, of the TU154M operating instruction the following actions are recommended to the crew in case of advisories issued by TCAS: TA If aboard an airplane a TA is generated it is recommended that the crew search for the position of the conflicting traffic on the VSI/TRA and to establish visual contact if possible. In case of a TA a solid yellow circle is displayed on the VSI/TRA (20 to 48 seconds prior to a possible collision). RA In case of an RA climb, climb the crew has to rapidly and smoothly obtain a rate of climb of 7.6 m/s (=1500 ft/min). The pointer of the VSI/TRA shall be brought into the green range.
AX001-1-2/02
65
BFU
Bundesstelle fr Flugunfalluntersuchung In case of an RA climb, climb a green range from 7,6 m/s to 10 m/s is marked on the VSI/TRA. The range 30 m/s up to 7.6 m/s appears in red. Flight Crew Training Documents provided by the operator show that all flight crew members, except the flight engineer, had successfully accomplished the complete training program including a test (the commander on 14 November 2000, the instructor on 22 December 2000, the copilot on 18 October 2000 and the flight navigator on 9 January 2001). The practical ground training had been performed aboard a TU154M. Simulator training did not take place. In 2002, the commander and the instructor had conducted the following international flights outside the airspace of the Russian Federation with airplanes equipped with TCAS: January Commander Instructor 2 February March 4 April 2 May 2 June 4 2
According to the operator, the pilots have not been faced with TCAS occurrences. 1.18.5 Rules of the air (right of way) Independent of instructions given by ATC and technical equipment for collision avoidance, general rules of right of way are defined according to which pilots are to fly manoeuvres to avoid collisions. These rules are published in corresponding regulations: AIP Germany (2) When two a/c are converging at approximately the same altitude, the a/c that comes from the left shall give way. (8) An aircraft that, according to paras (1) to (5) and (7), need not to give way or change its heading, shall keep its heading and speed until the danger of collision is excluded. (9) The provisions of the rules on right-of-way do not release the pilots concerned from their responsibility to take such action as will best avert collision. This also applies to diversionary manoeuvres which are based on recommendations given by collision avoidance equipment on board. [] ICAO Annex 2, (3.2 Avoidance of collisions) 3.2.2.3 When two a/c are converging at approximately the same level, the a/c that has the other on its right shall give way The a/c that has the right of way shall maintain its heading and speed, but nothing in this rules shall relieve the PIC of an a/c from the responsibility of taking such action, including collision avoidance manoeuvres based on RA provided by ACAS equipment, as will best avert collision. Note 1 : Operating procedures for use of ACAS equipment are contained in PANS-OPS (Doc 8168) Volume I, Part VIII Chapter 3. Note 2: Carriage requirements for ACAS equipment are addressed in Annex 6, Part I, Chapter 6 National regulations in Bahrain and Switzerland The states Bahrain and Switzerland had notified ICAO that no differences regarding ICAO Annex 2 are effective in their territories.
AX001-1-2/02
66
BFU
Bundesstelle fr Flugunfalluntersuchung National regulations in the Russian Federation The Russian Federation had published differences between national and international rules and procedures in the AIP Russia: Para. 3.2.2.3 When carrying out flights on collision courses at the same flight level (altitude) the pilot-in-command who has noticed another aircraft on his left, shall reduce flight altitude and the pilot-in-command, who has noticed the aircraft on his right, shall increase flight altitude so that the difference in altitude should provide safe separation for them.
1.19
Useful or effective investigation techniques

In the scope of the investigation information of the non volatile storage of the TU154M TCAS computer was read out. Despite the massive damage through the impact it was possible to identify the memory chip with support of the TCAS manufacturer and read it out bit by bit. The data included measured values of own aircraft (altitudes, bearing, distances) and also information of altitudes from the transponder of the B757-200 whose TCAS computer had been totally destroyed. The TCAS computer calculated the rate of climb and descent from the altitude data received and stored it. Important data for the reconstruction of the flight path of both airplanes and for the evaluation of the TAs/RAs generated by TCAS in both airplanes was available.
AX001-1-2/02
67
BFU
2.
2.1
ANALYSIS
General
For the analysis generally all factual information found has been considered. If the BFU investigation team was in agreement that certain facts were not relevant to the course of the accident, a written evaluation of those facts would not appear in this report. Examples: First evaluations of FDR, CVR, radio communications and radar data showed within the first week that there were no technical defects on either airplane which might have been relevant to the accident. The investigation team therefore decided not to conduct more detailed investigations in this respect. This, however, does not apply to the investigation of TCAS, which is described under Chapter 1.18.4. The meteorological conditions were not relevant for the accident. Above FL 280 visual meteorological conditions prevailed with visibilities of more than 10 km, a starlit sky and no ground visibility. The moon had not risen yet. The autopsies of all seven flight crew members of both airplanes did not indicate any physiological or other impairments of health. The same is true for the blood and urine specimens of the involved controller of ACC Zurich. The accident was non-survivable because of the collision consequences (Tupolev TU154M) and the impact (Boeing B757-200) described in more detail in Chapter 1.12.
The detailed and extensive investigation group reports were not included into this report in full length. The most important results of these reports are presented in chapters 2.2 to 2.6.
2.2
2.2.1
Operations
Boeing B757-200 The BFU considers the crews qualification and experience to be high. In June 2002 the two flight crew members had exclusively flown together on the flight routes in question. They had sufficient time to relax after the last flight duty period. The TCAS training of the crew corresponded to the recommendations of the system manufacturer. The TCAS training was a regular component of the simulator training. At 21:29:50 hrs the Boeing 757-200 reached the flight level FL 360 in the Swiss airspace. Shortly afterwards, at 21:30:11 hrs, the TU154M flight crew contacted ACC Zurich for the first time on 128.050 MHz at the same flight level. The B757-200 crew could hear this message, it had, however, secondary importance because no position was reported which was not necessary. The CVR did not record comments by the crew either. When the copilot as the PF at 21:34:30 hrs handed over the control of the airplane to the PIC in order to go to the lavatory, the distance between both airplanes was still 13.6 NM. The crew would have been able to recognise the other airplane on the VSI/TRA if a range of 16 NM was set. The setting, however, could not be determined. It is probable that the crew had not noticed the other airplane at that time otherwise the copilot would not have left his seat. It is not part of the prescribed and practised procedures to constantly observe the TCAS display on the respective instruments. According to the system philosophy, the attention of the crew is drawn to a potential conflict by the acoustical annunciation of a TA or an RA. At 21:34:42 hrs a TA was issued aboard the B757-200. It could not be clarified whether the PIC conducted a positive visual identification as required in the Manual (Operations Manual, Part A). After the TA the CVR recorded sounds and noises which could not be identified clearly. They can be associated to the presence of the copilot in the rear cockpit area. When at 21:34:56 hrs the TCAS issued an RA descend, descend, the autopilot was switched off within two seconds, the control column pushed forward and the engine thrust reduced. Nine seconds after the RA the CVR recorded on the area-mic channel a comment of the copilot
AX001-1-2/02
68
BFU
Bundesstelle fr Flugunfalluntersuchung (traffic right there) indicating traffic. The BFU considers this exclamation to be a positive identification of the conflicting traffic. At this time the copilot had not put on the headset yet. Twelve seconds after the RA the airplane had reached the required rate of descent of 1 500 ft/min. A time limit is not specified in the operators OM (Operations Manual), Section 08, Page 50E dated 4 February 2002. This section reads: ..., initiate the required manoeuvre immediately, .... The manual of the TCAS manufacturer states that the PF has 5 seconds reaction time to an RA, i.e. the TCAS assumes that the avoidance manoeuvre is initiated within 5 seconds. The manual reduces the reaction time to 2.5 seconds in case of an advisory "increase descent". The TCAS procedures for an RA are designed in a way that a correct reaction results in low gload. The g-load with an advisory descend, descend shall change by 0.25 g. For an advisory increase descent this value has a maximum of 0.35 g. When at 21:35:10 hrs the TCAS issued an advisory to increase descent (increase descent) and the PIC immediately complied with the command, the copilot was already sitting at his place again and had put on the headset. The CVR recorded the comment increase on the channel of the copilot. The crew had reacted correctly to the RA. The descent was initiated as predetermined within five seconds and the required rate of descent had been reached within an adequate period of time. It could not be determined whether the crew continued to observe the other airplane on the VSI/TRA after the RA and also noticed altitude and their differences or whether they had already established visual contact. CVR data shows that at 21:35:14 hrs an acoustical warning (Master Caution Aural Warning) had been recorded for about two seconds. Most probably this warning was triggered because the preset cruise level had been left. At 21:35:19 hrs - 23 seconds after the RA - both pilots reported to ACC Zurich that they had initiated a TCAS descent. Both pilots began the message and the copilot completed it. The OM requests the crew to inform ATC as soon as practicable about an RA followed. The BFU considers the delay in transmitting the message to ACC Zurich generally as too long. However the report was made at the earliest time possible, due to the blocked communication channel. A more detailed assessment of this fact is included in the human factors chapter. Approximately two seconds prior to the collision the control column was pushed forward to the stop after the copilot had requested an even stronger descent (descend hard). The BFU considers this as an attempt to avoid the imminent collision with the TU154M which had been visually identified by that time.
2.2.2
Tupolev TU154M The BFU considers the crews qualification and experience to be high. The pilot sitting on the right seat was the chief pilot of the company. It was his task to familiarize the commander (under supervision) sitting on the left seat with the approach to Barcelona. The other crew members, i.e. the flight engineer and the flight navigator, are also to be considered as experienced. The copilot had no official function on this flight leg, but was sitting in the cockpit. With the exception of the flight engineer all flight crew members had received TCAS training in accordance with the national regulations. The training procedures ACAS Manoeuvres and RA responses described in the ICAO State Letter AN 11/19-02/82 had not been realized completely. As the operator did not have TCAS equipped flight simulators available, practical simulator training was not possible, however, instead a familiarization in the cockpit was provided and also accomplished. The BFU considers the lacking possibility of practical TCAS simulator training as disadvantageous for the crew. None of the two pilots had gained practical experience following real RAs. As TCAS is not mandatory in the Russian Federation only those company airplanes flying into regions where TCAS is mandatory are equipped with it. The low number of flights conducted in these regions (12 flights of the commander and 4 of the instructor in the year 2002) implies a marginal practical TCAS experience. The BFU assess the regulations in the operators flight operations manual as not sufficiently unambiguous. This manual stated e.g.: ATC measures are the main and major condition of colli-
AX001-1-2/02
69
BFU
Bundesstelle fr Flugunfalluntersuchung sion avoidance; but did not consider the priority of a TCAS-RA. Manoeuvres which are contradictory to a TCAS RA were, however, prohibited according to the OM. All flight crew members had sufficient time to relax after the last flight duty period. At 21:16:10 hrs the airplane - in accordance with the flight plan filed - entered German airspace at FL 360. In the flight plan filed a flight level change had not been scheduled. Investigation findings show that the flight went according to plan until the transfer to ACC Zurich at 21:29:54 hrs. The TU154M crew noticed at 21:33:18 hrs for the first time on the TCAS display (VSI/TRA) another airplane approaching from the left. At this time the distance between the two airplanes was still approximately 27 NM. It is to be assumed that the display had been set to a range of 40 NM, as provided by the flight operations manual. There is no doubt that it was the B757-200 with which the TU154M later collided because there was no other airplane in this airspace at the time. At 21:34:36 hrs - six seconds prior to the TA - the commander said that he had recognized the airplane at the same flight level. This finding is based on the commander's statements: "Here visually" and two seconds later: "Here, it is showing us zero". This statement referred to the altitude difference indicated on the VSI/TRA display (00 indication near the blue solid diamond). The essential information regarding the altitude can only originate from the instruments because a visual altitude estimation of conflicting traffic at dark night and at such a distance is not possible. Especially since the TU154M just then executed a heading correction with a right bank angle of about 10. The distance between the two airplanes was still approximately 10 NM. At 21:34:42 hrs the TCAS generated a TA aboard the TU154M indicating that the intruder was in the immediate proximity. This TA was issued as an aural annunciation and indicated as a yellow circle on the VSI/TRA. CVR data shows that the crew had already established visual contact. Thus a visual search (identification of the conflicting traffic) as required by the flight operations manual was no longer necessary. Corresponding exclamations by the instructor and the copilot confirmed that the crew had heard the TA. It is to be assumed that after the TA the crew was in a certain anticipation of an avoidance manoeuvre. At 21:34:49 hrs - seven seconds after the TA - the controller of ACC Zurich instructed the TU154M crew to descend to FL 350 because of other traffic. Even before this radio transmission ended it lasted just under eight seconds - the instructor acting as PNF commanded: descend. This command was pronounced in the imperative. This instruction to descend was in compliance with the anticipation of the crew and was therefore logical. Within the next three seconds the control column was pushed forward, the autopilot (pitch channel) was switched off and the engine thrust reduced. Thus the crew had reacted in time. At 21:34:56 hrs three events occurred for the crew simultaneously: the instruction of the controller to descend to FL 350 had just ended the PF pushed the control column forward and the airplane was in the transition to descend an RA climb, climb was generated by TCAS. CVR data shows that the copilot reacted to the RA with the comment: It (TCAS) says climb. The PNF replied: He (the controller) is guiding us down! The copilot's enquiring response: To descend?. The co-occurrence of these events obviously led to disagreements. At 21:35:02 hrs the control column was pulled. This could either be a delayed reaction of the PF to the RA climb, climb or a reaction to the exclamation of the copilot: it says climb. It is the BFU's opinion that this action was taken to adjust the descent rate after a rapidly initiated descent. The analysed TCAS data shows a continued rate of descend of approximately 1 200 ft/min after stabilisation. It is assumed that the indication on the VSI/TRA display was within the red arc during the whole time between the generation of the RA climb, climb and the collision. The descent was continued after the RA and the crew's decision to follow the instruction of ACC Zurich was maintained. The conversation of the flight crew was interrupted by the controller who instructed them once again to expedite descent to FL 350. The second instruction of the controller had become nec-
AX001-1-2/02
70
BFU
Bundesstelle fr Flugunfalluntersuchung essary as the TU154M crew had not verbally replied to the first one. The disagreements have obviously prevented that the first instruction was acknowledged. The second instruction of the controller stopped the conversation of the crew about the RA. For the two pilots it was another confirmation of the decision to follow the ATC instruction, particularly since the other airplane was reported by the controller to be at FL 360. The second instruction of the controller at 21:35:03 hrs coincided with the retraction of the thrust levers. It is the opinion of the BFU that this action was probably carried out by the instructor. The PF held the control column pulled for about two more seconds, before pushing the control column again in order to increase the rate of descent. According to the instructions of the flight operations manual it was not mandatory to follow an RA. In the respective column of table 8.18.3.3 under climb, climb it says literally: " ". Translated into English: "Recommendation to the crew". In the flight operations manual, page 8.18.6 dated 6 December 1999, it is stated under the title ATTENTION, item 3, that it is prohibited to carry out any manoeuvre contrary to the advisory issued by TCAS. ( , .) The traffic information given by the controller at 21:35:13 hrs that there was traffic in the 2 oclock position was incorrect and misleading to the crew. The correct information would have been: 10 oclock position. According to CVR data it can be concluded that the instructor had searched the airspace in front and to the right in vain. The CVR recordings allow the conclusion that the crew kept track of the B757-200 on the VSI/TRA after the TA. As the B757-200 was equipped with strobe lights and the visibility was good, the TU154M crew had established visual contact. Due to a lack of visual references, a safe evaluation of altitudes, flight directions, airspeeds and flight attitudes in dark night is not possible. The RA increase climb issued at 21:35:24 hrs was commented only by the copilot with the words It says: climb!. Apparently, just the copilot had judged the relevance of the RA correctly. The PF started to pull the control column five seconds prior to the collision. This involved a slight forward move of the throttle's position. The TU154M passed the altitude of 35 100 ft at that time. The action of the PF could be considered as the beginning of the transition into level flight. Based on the instruction to descend to FL 350, the manoeuvre started too late and was performed too slow in order to level off at FL 350. The control column was pulled abruptly one second prior to the accident. The BFU considers this to be the attempt of the PF to still avoid the imminent collision with the B757-200 which had been clearly identified by that time.
2.2.3
Avoidance of collisions according to the principle see and avoid The avoidance of a collision according to the principle see and avoid requires the visual identification of the other aircraft, the observation of the flight path and the estimation of a collision risk, the making of a decision as well as the initiation of an avoidance manoeuvre up to the effective change of the flight path. The position of the other aircraft from the view of the respective flight crew On the basis of the data available from the radar recording, the flight data recorder, TCAS and the direction of the traces on the wreckage parts of the TU154M, running on the lower surface of the right wing at an angle of 46, the approach between the aircraft was reconstructed by calculation. The perspective of the TU154M crew: Five minutes before the collision, the B757-200 was in a position of about 315 related to the longitudinal axis, i.e. 45 ahead and to the left. At 21:31:51 hrs the B757-200 started to move to the right, i.e. in the direction of 325 because the TU154M changed its heading. TCAS data shows that the B757-200 was located at 325 one minute prior to the collision. Due to a further change of heading of the TU154M the bearing and the angle at which the other airplane could
AX001-1-2/02
71
BFU
Bundesstelle fr Flugunfalluntersuchung be observed changed slightly (between 329 and 319). 12 s prior to the collision the bearing was 315 (45 left). At 21:35:29 hrs (3 s prior to the collision) a bearing of 314 (46 left) in relation to the B757-200 was recorded. This value corresponds with the measured angle of the collision traces on the lower surface of the TU154M's right wing. The perspective of the B757-200 crew: The TU154M was at an angle of 36 - 39 during the last five minutes prior to the collision. About 30 s prior to the collision, the TU154M moved into the direction of 45. The approach angle at the time of the collision was 44.
Apparent size of an object The apparent object size of an aircraft changes in form of an exponential function during the approach of two aircraft on collision course. This means that the object stays little for a relatively long period of time before it "busts" or "explodes" optically just a few seconds prior to the collision. The speeds of both aircraft were measured and recorded in different qualities by the respective FDR's. Radar data was therefore initially used for the determination of ground speeds. The FDR of the B757-200 recorded a ground speed of 505 kt. This value was used for a second calculation. Data of the TU154M's TCAS computer was the basis for a third calculation. The TCAS computer had, one minute prior to the collision, calculated the slant range to the B757-200 as 11.97 NM. The analysis of the radar data recorded by the German Air Navigation Services (Deutsche Flugsicherung GmbH) resulted in a closure rate of 704 kt. The speed of the B757-200 was 506 kt and of the TU154M 489 kt. The ground speed recorded by the B757-200's FDR was used to calculate a speed of 488 kt for the TU154M and a closure rate of 702 kt. Using TCAS data, the closure rate was 718 kt, the speed for the B757-200 was 516 kt and for the TU154M 499 kt. Taking into account the different sources the closure rate of the airplanes was between 702 kt and 718 kt (361 -369 m/s).
AX001-1-2/02
72
BFU
Apparent size of the B757-200 from the cockpit position of the TU154M (mean closure rate of 365 m/s)
1 80 1 60 1 40 1 20 1 00 80 60 40 20 0 t-0,5s t-1 s t-2s t-3s t-4s t-5s t-6s t-7s t-8s t-9s t-1 0s t-1 5s t-20s t-30s t-36s t-40s t-43s t-50s t-56s t-60s t-70s t-97s Time prior t o t he c ollision (s)
56 seconds prior to the collision, a statement of the commander ( here visually) was recorded which allows the conclusion that visual contact had been established. The B757-200 had, at that point, an apparent size of approximately 1.5 mill radians (mrad). When ACC Zurich instructed the crew of the Tupolev to descend, the apparent object size was approximately 1.7 mrad and at the time of the RA it was 2.3 mrad. Eight seconds prior to the collision when the second RA (increase climb) was issued, the B757-200 amounted to approximately 10.4 mrad. Generally the same conditions apply for the apparent object size seen from the cockpit of the B757-200 because the TU154M being almost equal in size. Conditions at night During the day, the object size resulting from the actual size and the distance of the object and the visual conditions, such as visibility and contrast, are decisive for the detection of another airplane. At higher altitudes contrails may facilitate detection. At night, the aircraft were during a longer period of their approach visually detectable not by their object size but the B757-200 because of its red and white strobe lights on fuselage and wing tips and the TU154M because of its red anti collision lights. The expert opinion of the German Weather Service states that visibility at that flight level and at the time of the accident was 10 km or more. The moon was still below the horizon. At the time of the above-mentioned comment of the TU154M's commander the B757-200 was about 20 km away. It can thus be assumed that the visibility of light was at least 20 km. Owing to the lack of references, particularly at high altitudes and with darkness prevailing, the difference in altitude and the other airplane's flight path and attitude could not be safely estimated visually. As the two airplanes were approaching each other, observers in the TU154M cockpit could judge, by the colour of the position lights, that the other airplane's right wing was facing them and the object was becoming bigger indicating the distance between the airplanes was becoming smaller. This applied similarly to the TU154M as viewed from the B757-200 cockpit. Right-of-way The collision occurred in the airspace of the Federal Republic of Germany. Thus the rules of right-of-way published in the AIP Germany were applicable. A decision concerning a visual avoidance manoeuvre can be made by the crew only after the visual detection of the other airplane and observation of its flight path. By selection of the ma-
AX001-1-2/02
73
BFU
Bundesstelle fr Flugunfalluntersuchung noeuvre the rules of right-of-way and the operating limitations of the airplane are to be adhered to. The analysis of the approach shows that, at the time when ACC Zurich issued the instruction to descend and TCAS generated the RA, the crews could not make a decision regarding a visual avoidance manoeuvre as the flight path of the other airplane and thus the collision risk could not be estimated visually with sufficient accuracy. An estimation whether the manoeuvre (descent) initiated by each of the crews was adequate to prevent a collision solely by means of observing the other airplane was not possible either or was only possible at a time, when the remaining time was not long enough to prevent the collision. The BFU is of the opinion that in this case the right-of-way rules had no practical significance.
2.3
2.3.1
Aircraft
Boeing 757-200 and Tupolev TU154M The collision traces found on the wreckage parts of the TU154M correlated with the calculation based on FDR and radar data. The paint transfer from the B757-200's vertical tail found on the left wing of the TU154M documents the first contact between the two airplanes. The structural damage found on the TU154M's left wing between the slat and the wing root and the high roll rate to the left which the FDR recorded immediately after the collision - despite the aileron-spoiler counteracting the rolling moment - indicate that the left wing (including the centre wing section) had in this phase separated from the airplane. The damage to the fuselage resulted in an explosive decompression. Statements of witnesses, photographs and the distribution of the debris indicate that the TU154M suffered an in-flight break-up at an high altitude and that several pieces of debris caught fire. 40 Occupants fell out of the airplane because of the damage to the fuselage. The wind spread smaller parts of debris depending on their mass into a north-easterly direction. A mixed area with wreckage parts of both airplanes was located west of the village Altheim at a distance of 8 km from the TU154M's forward fuselage section and 3.5 km from the B757-200's main wreckage. In this area parts of the TU154M's wing leading edge and the vertical tail of the B757-200 were found. The parts of both airplanes found in this area showed collision traces. The fact that from the B757-200 only parts of the vertical tail were found at a great distance from the main wreckage indicates that just the B757-200's vertical tail had had contact with the TU154M. After the collision the B757-200 became uncontrolled due to the loss of 80% of the vertical tail. The airplane rolled about its longitudinal axis and lost its engines due to the high lateral forces. The relatively small accident site (approximately 110 m x 30 m) leads to the conclusion that the airplane crashed into the ground at a negative pitch angle of at least 70.
2.4
2.4.1
ATC
ATC Zurich When the controllers reported for duty at 17:50 hrs, they were not aware of the fact that during the night shift extensive sectorisation work on the sectors of the upper airspace was scheduled. Documents concerning the planned work were available for self briefing. They did not seize the opportunity to read them even though the duty schedule and their work contract allow time for such reading. The effects of this omission remain relatively insignificant as the documents did not include a description as to how the planned work would affect the availability of the technical equipment.
AX001-1-2/02
74
BFU
Bundesstelle fr Flugunfalluntersuchung After the sectorisation work had started and the air traffic volume had decreased one of the controllers retired to rest in the lounge. Normally he would have returned to the control room early in the morning when air traffic increases, unless unusual circumstances would require his presence earlier. The spatial distance between the lounges and the control room prevents a quick alert of the second controller in conjunction with an immediate appearance. Thus the remaining radar controller had to assume the tasks of the radar planning controller (RP) and the radar executive controller (RE) and if necessary the tasks of the supervisor (DL) at the same time. Officially this procedure did not exist, but had been in practise at ACC Zurich for many years. This arrangement made the night shifts for the controllers more comfortable. This is a way of proceeding which does not provide any redundancy of human resources so that procedural errors, wrong distributions of attention or the omission of important actions may lead to hazardous situations as nobody is there to notice these mistakes and to take corrective actions. It follows that the breaks prescribed could not be taken. Even though it was an unofficial procedure it was known to and tolerated by the management. For all flights the control strips were available in time. From the control strips it was not apparent that the two airplanes (B757-200 and TU154M) were in a conflict situation. A common reporting point had not been provided. Both airplanes had been cleared for a direct approach to Tango VOR (B757-200) and Trasadingen VOR (TU154M) and thus the control strips did no longer correspond to the actual flight paths. Only in connection with a radar image, the conflict would have been detectable. Whereas the TU154M had already flown at FL 360 for a longer period of time, the B757-200 was cleared at 21:26:36 hrs to climb to this flight level. The B757-200 reached FL 360 at 21:29:50 hrs. The crew did not report when levelling, as it is not a requirement to make such a report. When the TU154M crew contacted Zurich at 21:30:11 hrs for the first time and also reported the flight level, the controller did not notice that the B757-200 had just reached the same flight level and that both airplanes were approaching each other at right angles. The distance between the two airplanes was still approximately 64 NM. If he had noticed the situation he would have instructed the TU154M crew to descend to FL 350. The control strip showed this altitude after Trasadingen VOR anyhow. At the time the controller concentrated on a delayed Airbus A320 approaching Friedrichshafen airport. In doing so, he had to move to the adjacent workstation. He tried to phone Friedrichshafen several times. This was not possible due to a technical defect in the by-pass phone system but was time consuming and bound his concentration. He was not informed about the additional presence of a SYMA and therefore did not consider to involve him even though the SYMA would have been able to suggest an alternative. Thus he neglected the control of the two other airplanes over a certain period of time. He was not alerted of the impending collision risk because the optical STCA was not available. When the controller instructed the TU154M crew at 21:34:49 hrs for the first time to expedite descent to FL 350 the horizontal separation was practically already below 7 NM (exactly at 21:34:56, when the controllers radio message ended). The TU154M should have descended to FL 350 by 21:34:56 hrs to ensure a vertical separation of 1 000 ft in the RVSM airspace. To achieve this it would have been necessary to give the instruction to descend to FL 350 at 21:33:49 hrs at the latest - i.e. one minute before this instruction was actually given. This time is based on a normal rate of descent of approximately 1 000 ft per minute. When the TU154M crew did not verbally respond to the first instruction to descend to FL 350, the controller repeated this instruction at 21:35:03 hrs more emphatically. As in his first instruction to descend he used the term expedite. The addition expedite did not signalise, however, that the separation had already been infringed. The wording I have crossing traffic which he used with his first instruction to descend did not match the urgency of the situation. It would have been better to use the term immediately instead of expedite. A more detailed information about the conflicting traffic, e.g. you have crossing traffic at 360 (or same level) in your 10 oclock position or from left to the right at 360 (or same level) distance: ........... NM would have been more appropriate in view of the short distance between the two airplanes (distance approximately 5.5 NM).
AX001-1-2/02
75
BFU
Bundesstelle fr Flugunfalluntersuchung Furthermore, in his second instruction the controller issued incorrect information regarding the position of the conflicting traffic. He said: Ja, we have traffic at your 2 oclock now at 360. The B757-200 was in fact in the 10 oclock position. He had temporarily unsettled the TU154M crew with this information. The information concerning the flight level of the other airplane (now at 360) was incorrect because the B757-200 was already at FL 356 due to the descent initiated after the RA. However, the controller could not read the new flight level on the monitor, because the descent of the B757-200 was only to be seen after the radar image renewal at 21:35:24 hrs. With the preceding target image renewal at 21:35:12 hrs the FL 359 shown was still within tolerances. When the controller observed on the left monitor (RP) that the TU154M had initiated the descent he considered the problem solved and once again turned to the right monitor (RE). The reason was that the crew of the Airbus A320 approaching Friedrichshafen had just called again on 119,920 MHz. The two airplanes (B757-200 and TU154M) with the pertinent data were displayed on the right monitor as well. Only for radio transmissions on the different frequencies it was necessary to change workstations (between RP and RE). When the controller moved to the workstation RE in order to deal with the A320, he concentrated his whole attention on the Airbus. Thus he neither noticed the descent of the B757-200 nor did he hear the radio message of the crew reporting a TCAS descent at 21:35:19 hrs. When the controller had solved the problem with the Airbus A320, he once again concentrated his attention on the two airplanes. At this time, the collision had already happened and he saw the TU154M being displayed as a red point on the radar monitor indicating that a radar signal was not received any more. His radio calls addressed to the TU154M at 21:36:01, 21:36:23, and at 21:37:17 hrs remained unanswered. The B757-200 was no longer displayed on the radar monitor; it was not called by the controller. If the prescribed separation had been adhered to, the generation of an RA by TCAS and the accident would certainly have been prevented. The controller was solely responsible for the control of the air traffic in the airspace of ACC Zurich. This means that he had to assume the tasks of the radar planning (RP), the radar executive (RE) and the ARFA approach controller. In addition, he had to assume the tasks of the supervisor (DL) and of the SYMA to some extent during the night shift. He did not know that an additional SYMA was present. If he had properly executed the tasks of the RP he could have recognized the conflict between the TU154M and the B757-200 in time and could have initiated appropriate traffic regulatory measures. The tasks pursuant to the ATMM ZC (ATM Manual Zurich) are described in Chapter 1.17.1 (Organisation of the Night Shifts at ACC Zurich) of this report in greater detail. It would have been the task of the RP to continuously analyse and compare the flight data on the control strips with the actual positions of the airplanes, as displayed on the radar monitor. The controller did not have the time necessary for this task, because he concentrated his attention on the approach to Friedrichhafen. Due to lack of time he had not considered to delegate the coordination talks with Friedrichshafen to the CA present at the sector. It is the BFU's opinion that the controller was not in a position to safely execute the transferred and additionally assumed tasks. A reason was the insufficient number of air traffic controllers during the night shift resulting from the duty schedule which did not ensure a continuous staffing of the workstations. It would have been the duty of the management and the quality assurance of the air navigation service company to realize these deficiencies and to take appropriate corrective actions. In addition the above-mentioned institutions tolerated the current practice applied to the conduct of the night shift. Another reason was that priorities had not been evaluated properly. Dividing his attention on two events he found himself in a situation the effects of which he underestimated and ultimately could not control.
AX001-1-2/02
76
BFU 2.4.2 ATC Karlsruhe
The BFU is of the opinion that UAC Karlsruhe exhausted all possibilities to prevent the impending collision. The possibility of transmitting a warning to the aircraft in form of a blind transmission on the emergency frequency 121.50 MHz was not taken into consideration by good reason. This would have been contradictory to the regulations in force, would certainly have led to a confusion of all parties involved. It would not have prevented the collision with a very high probability particularly since it could not be clarified whether in one of the two airplanes this frequency had been selected at all.
2.5
ACAS/TCAS
Fundamental Purpose of ACAS/TCAS ACAS/TCAS was developed as a collision protection system to be rated as the last line of defence. Similar to the stall warning system, the stick pusher and the ground proximity warning system (GPWS), ACAS/TCAS is to interrupt a possible chain of occurrences resulting from human errors or technical malfunctions and which may lead to an accident. As TCAS II, Version 7 is an airborne device and issues resolution advisories to the crew only as visual and aural commands, obligatory procedural instructions for the utilization of and the reaction to TCAS advisories are indispensable. The TA alerts the crew in case of a potential conflict situation and requests their attention for a possibly succeeding RA. The RA has the highest priority, because it will only be issued if other collision avoidance mechanisms, such as vertical separation by a controller, are not sufficiently effective or are incorrect. The manual intervention in the control of the airplane by the pilot must then take place without delay. A coordination with the controller or a clarification of the situation by means of other airborne devices following an RA would question the purpose of TCAS. The time left in such a case could be too short for an avoidance manoeuvre and would increase the collision risk. According to general conviction, TCAS only makes sense if worldwide all crews rely on the system and comply with the advisories. Thus it is the opinion of the BFU that with the system conception of TCAS II, Version 7 only one procedure can be permitted in case of an RA. The crew must comply with the RA without delay and report the initiated TCAS manoeuvre to the controller. Any other procedure which does not sufficiently take into account the priority of an RA would be contradictory to the purpose of TCAS. System considerations and the interface man-machine As the complete TCAS works semi-automatically, the intended purpose of collision avoidance can only be achieved with human assistance. Prerequisite for this is the following division of work between man and machine: TCAS Computer TA: Aural and visual warning Flight Crew
Comprehension of an hazardous situation by means of the display, establishing visual contact, consultation PF/PNF PF: disconnect autopilot, manual control, within RA: Aural command and visual indication of 5 s initiation of climb/descent to the required rate of climb or descent. the rate of climb or the rate of descent PNF: monitoring Evaluation of the Collision Avoidance System Logic (CAS Logic) Prior to the issuance of the RAs the airplanes were in cruise flight with a vertical speed of almost zero and an altitude difference of approximately 50ft.
AX001-1-2/02
77
BFU
Bundesstelle fr Flugunfalluntersuchung Both airplanes reported their altitude in 25ft increments. They tracked an altitude difference of one or two increments, whereas the B757-200 was below the TU154M. Thus the altitude difference was the decisive factor for the selection of the direction of the RAs, CAS logic avoids crossing trajectories. The descent of both airplanes from FL 360 down to the collision point is depicted in Appendix 6. Possible sources of error: TCAS altitude quanta is 128ft TCAS vertical speed values are delayed because of the calculation from altitude quanta of 25ft. TCAS data is sampled every 2 seconds. The error at the abscissa can be 1 sec. The error estimation of the TU154M altitude and vertical speed parameters calculated by IAC cannot be accomplished by the BFU. The FDR recorded the altitude of the B757-200 with a resolution of 1 foot and was used to determine the collision altitude of 34 890ft. Following the RAs and the initiated avoidance manoeuvres the calculated distance at the CPA normally increases until the TCAS computer generates the aural annunciation Clear of Conflict. Due to the contradictory reaction of the TU154M crew the calculated distance to the B757-200 at the CPA did not increase. 14 seconds after the initial RA the CAS logic of the B757-200 generated an RA increase descent (increase the rate of descent from 1 500 ft/min to 2 500 ft/min) in order to resolve the persistent conflict. The CAS logic of the TU154M also generated an RA increase climb (increase the rate of climb from 1 500 ft/min to 2 500 ft/min) 28 seconds after the initial RA. The increase advisories are not coordinated between the TCAS computers of airplanes involved in the encounter. ICAO Annex 10 states that CAS logic computes an extrapolated trajectory instead of using real tracked values. This leads to different times for the issuance of strengthening RAs in the airplanes involved. When the crew of the B757-200 complied with the advisory increase descent the altitude difference between the two airplanes decreased. TCAS II, Version 7 is capable of generating a Reversal RA, i.e. a coordinated RA into a direction contrary to the initial RA. The Reversal is a way out, if during the avoidance manoeuvre an inversion of the original geometrical situation of the flight paths occurred. This situation will arise in particular if the crews respond contrary to the initial RA. A Reversal RA can be issued if the following conditions are fulfilled: The calculated distance at the CPA must be greater in the new direction than in the initial direction and must be greater than 100 ft. The altitude difference between the airplanes must have already exceeded 100 ft in the new direction. A reversal may be generated not earlier than 9 s after the initial RA. Up to the calculated moment of collision a period of at least 4 s must be left. These conditions within the algorithm for the calculation of the Reversal have been introduced in order to preclude frequent reversals of TCAS avoidance manoeuvres. This is necessary in order to maintain the trustworthiness of TCAS. During the descent of the B757-200 and the TU154M a Reversal RA was not generated, because conditions for an RA were not given. Legal basis, procedures and procedural instructions As TCAS II, Version 7 is designed as a semiautomatic system which shall serve as a last line of defence in collision avoidance, clear and unambiguous procedural instructions for the crews are an essential prerequisite. This prerequisite is so important, because the system philosophy of TCAS II, Version 7 provides only one procedure after the issuance of an RA and that is to follow the generated RA.
AX001-1-2/02
78
BFU
Bundesstelle fr Flugunfalluntersuchung The decision to follow an RA without reservation could mean that up to the resolution of the conflict the crew has to divert from other obligatory standards for instance, from instructions for vertical separation issued by ATC and from other general right-of-way rules. Regulations of the International Civil Aviation Organization (ICAO) In view of the international importance of TCAS, the establishment and publication of standardised procedures by ICAO were an essential requirement. TCAS has been mandatory in the USA since 1993 and in Europe and the Middle East since 2000, but is not yet required in other parts of the world. Thus the installation of TCAS was one prerequisite the operator of the TU154M had to fulfil in order to be allowed to fly to European destinations. For domestic flights within the Russian Federation TCAS is not presently required. The publications of the ICAO concerning TCAS are evaluated by the BFU as follows: Annex 2: In Annex 2 (Rules of the Air) procedural instructions for the utilization of TCAS are not taken into account sufficiently. Though the wording, The aircraft that has the rightof-way shall maintain its heading and speed, but nothing in these rules shall relieve the pilot-in-command of an aircraft from the responsibility of taking such action, including collision avoidance manoeuvres based on resolution advisories provided by ACAS equipment, as will best avert collision (Rules of the Air, Chapter 3. 3.2.2 Rightofway), allowed a deviation from the right-of-way rules in case of a TCAS RA. It did not make clear, however, the required consequent action to be taken by the pilot in case of an RA. Annex 10: The note, Contrary pilot response [] was adequate and clear, however, its placement in Annex 10 was unfavourable as this Annex contains mainly technical specifications. A better place for this instruction would have been Annex 2 or Doc 8186. Doc 8186, PANS-OPS: In Doc 8186 the Operation of ACAS Equipment was to be described. These objectives have not been achieved as the descriptions of the procedures were insufficient and unclear. With the statements, assists pilots in operation of the aircraft and Nothing in the procedures shall prevent pilots-incommand from exercising their best judgement and full authority in the choice of the course of action to resolve a traffic conflict ( 3.1.1. and 3.1.2 of Doc 8186) the pilots were given freedom of decision which according to the TCAS philosophy must not be granted. The procedural requirement to comply with an RA and to immediately report the avoidance manoeuvre advised by TCAS to the controller responsible for the vertical separation was not described clearly enough in the Doc 8186. Thus the situation of a coincidence of an RA with an instruction given by the controller had not been dealt with either. Doc 4444, PANS-ATM: With the publication of the Doc 4444 a procedural description (15.6.3.2) has been issued for the Air Navigation Services pursuant to which the controller should not influence the flight path in case the pilot reports a TCAS RA, until the conflict has been resolved. A prerequisite for the effectiveness of this procedural instruction was the timely report of a TCAS RA via radio as an automatic transmission from the aircraft to the ground was not provided. State Letter AN 11/19-02/82: In the State Letter dated 8 August 1997 the procedures to react to an RA and the necessary training procedures were described much more clearly. The wording, however, did not comply
AX001-1-2/02
79
BFU
Bundesstelle fr Flugunfalluntersuchung with the procedural descriptions in Annex 2 and Doc 8186, partially the interpretation was even contradictory. TCAS 2000/TCAS II Traffic Collision and Avoidance System Pilots Guide The specifications of the TCAS manufacturer's Pilots Guide regarding the TCAS system philosophy and the necessary procedures which ensure a safe function were not described distinct enough. The wording TCAS 2000 is a backup to the ATC (Air Traffic Control) system and the see and avoid concept. could be interpreted that ATC takes priority to TCAS and that TCAS is designated to be implemental or a substitute. It was not made clear in the description of the system philosophy that TCAS is exclusively meant as a last line of defence for the avoidance of a collision and that in this stage TCAS advisories must be disconnected from instructions given by ATC controllers. TCAS 2000 Pilots Guide does not state clearly enough that the safe separation accomplished through ATC and the tasks of TCAS are two different functions. It is not clear that TCAS is not part of the conceptual design of ATC. In chapter 6.1 Pilot Responsibilities a sufficient directness is missing. On one hand it talks about Backup for ATC and on the other uses the following wording by contrary instructions of ATC and TCAS. Must not delay in responding the RA. Must not modify a response to an RA. Must follow the RA manoeuvre, unless invoking Emergency Pilot Authority. The descriptions in the TCAS 2000 Pilots Guide were the basis of TCAS trainings within the operator companies and for the procedures in the Flight Operation Manuals. TU154M Flight Operations Manual The passage: For the avoidance of in-flight collisions is the visual control of the situation in the airspace by the crew and the correct execution of all instructions issued by ATC to be regarded as the most important tool. TCAS is an additional instrument which ensures the timely determination of oncoming traffic, the classification of the risk and, if necessary, planning of an advice for a vertical avoidance manoeuvre. made clear that ATC has the highest priority in the avoidance of collision risks. Regulations from Eurocontrol All Eurocontrol publications for TCAS introduction, training and utilisation had a recommending character. All Eurocontrol documents expressed a clear TCAS philosophy and clear rules of action and procedural instructions following the issuance of an RA. Regulation from the JAA The JAA Leaflet No. 11 had not legal significance in the accident as the States of Registry and the States of the Operators of both airplanes were no JAA Member States. National regulations and procedures Aeronautical Information Publication (AIP) Germany The explanations in the Aeronautical Information Publication Germany concerning TCAS were not up to date for TCAS II, Version 7. With regards to contents several terms, e.g. Evaluation of ACAS/TCAS were related to the introduction phase. The procedural instruction for the actions to be taken by the pilots in case of an RA was not worded clearly enough.
AX001-1-2/02
80
BFU Luftverkehrsordnung (LuftVO - Air Traffic Order)
Pursuant to 13 subpara 9 a deviation from the right-of-way rules was possible. With the wording, This also applies to diversionary manoeuvres which are based on recommendations given by collision avoidance equipment on board the pilots are granted a freedom of decision which is not compatible with the system philosophy of TCAS II, Version 7. For the purpose of the TCAS philosophy the use of the term recommendation is inadequate. In case of an RA there can be only one reaction of the pilots: to follow the RA. Furthermore the wording allows two different kinds of interpretation: The paragraph can mean that independent of the right of way rules an RA must be followed in order to avoid a collision. The paragraph can also mean that the pilots have the option to deviate from the right of way rules and the TCAS RA's in order to avoid a collision. In theory it might be possible in reality not really practicable. In principle it is correct to give the pilot the final power of decision, the pilot, however, has no better basis for his decision than TCAS can give. Advisory Circular (AC) by the Federal Aviation Administration (FAA) In the AC which had no legal effect on the airplanes involved, the procedures following the issuance of an TA/RA as well as the responsibilities (for the individual flight crew members) and the training measures were described clearly and unambiguously. The training program of the B757-200 operator was based on this document. TCAS-Equipment in both aircraft Both airplanes had been retrofitted with TCAS. Thus the TCAS indications were integrated in special vertical speed indicators (VSI/TRA). Therefore a display had to be accepted which was very small in relation to airplanes which had already been equipped with TCAS during production and where TCAS is integrated in the navigation display. With the smaller display increased alertness of the crew is required. The display of the intruder by means of symbols changing their forms and colours as well as the indication of the altitude differences and trend information are more likely to be overlooked.
2.6
Human Factors
The investigation covered the three work places (ACC Zurich, cockpit of the B757-200 and the cockpit of the TU154M) including their general conditions.
2.6.1
ACC Zurich For the analysis of the human factors, the recordings of the radio communications, the investigations at the air navigations service company of Switzerland, the statements made by the responsible air traffic controller and other staff members were used. Especially the statements made by the controller who was heard four times and who cooperated readily with BFU staff members and answered all questions fully were an essential basis for the analysis of the occurrences at ACC Zurich.
2.6.1.1
ATC Controller (ATCO) Professionalism and competence The ATCO was considered by his workmates and supervisors to be a competent and knowledgeable controller, with a professional and co-operative attitude. He related well to his colleagues and was extraordinarily team oriented. Throughout his career his professional under-
AX001-1-2/02
81
BFU
Bundesstelle fr Flugunfalluntersuchung standing had been characterised by a pronounced service orientation, i.e. his objective and desire was to offer the optimum air traffic service to the crews. Nothing in the ATCOs records indicated possible deficiencies in his ability. However, in May of 2001 the ATCO was involved in a separation infringement incident. The incident was investigated by the Swiss BFU and attributed, in part, to an error in judgement by the ATCO in evaluating the separation required to safely conduct the altitude crossing manoeuvre. The conflict was recognised but the situation had been compounded by the lack of a second controller to monitor the air traffic situation and backup the ATCO. The company conducted a 30 minute debrief with the ATCO, but the contents of the session were not documented. As a result of the incident a computer generated range scale bar was introduced on the radar monitor at each workstation. The incident did not lead the Swiss Investigation Authority or the company to form any serious concern about the controllers ability. It was considered an isolated incident in an otherwise unblemished career. With this incident and the accident the BFU does not see any reasons which justify casting general doubt on the ATCOs professionalism and competence. However, it is possible to draw a parallel relating to a systemic weakness when comparing this incident and the accident, in that both occurred when a sole ATCO was operating a sector. There was no human redundancy to detect controller error, and the value of STCA as a defence was displayed. The investigation determined that up to the time before the accident, the operational ATC team had worked well together, and had conducted the operation in a professional and competent manner. The ATCOs behaviour was as expected from those around him and oriented toward not only managing the air traffic situation but also working with the team. He used standard ATC phraseology or appropriate language to communicate with flight crews, and communicated effectively with others in the control room (CIR). Task management and distribution The atmosphere in the control room was generally cordial and focused. The staffing at ACC Zurich at the time of the event was not in accordance with the approved roster and due to the technical work the ATM system (air traffic management system) and CIR environment was not typical of a normal night shift duty. The ATCO was working without some standard resources which are utilised to recognise errors in time. The ATCO was without the optical STCA, automatic correlation, and range scale bar, but loss of these features would not necessarily have degraded the safety afforded by the system; as long as processes would have been introduced to defend against their absence: Loss of the STCA was not compensated for through heightened awareness or human redundancy. Manual correlation would have associated the appropriate callsign with the radar symbol. The lack of the range scale bar would not normally introduce a significant problem for an ATCO, but when using two radar screens with different range scale settings the potential for error in judging separation distances was substantially increased. The late and unexpected arrival of an aircraft at Friedrichshafen airport had a further negative impact on the situation. When he released the second controller, both controllers were not aware of the A320 arriving at Friedrichshafen so could not project the need to control the ARFA sector while also controlling the whole airspace of ACC Zurich. Note: The ATM Manual ZC requires the approach controller give unrestricted attention to the radar control of an aircraft on approach; so the situation would have required at least two controllers. In particular, although the controller had assumed some of the DLs tasks he continued to approach the developing situation in the manner that he was most familiar with; as an operational ATCO. He did not consider the situation in terms of the DLs directive:
AX001-1-2/02
82
BFU
Bundesstelle fr Flugunfalluntersuchung Provision of measures due to operational needs and traffic in consideration of pertinent information Decisions on permission to work on technical installations as requested by the SYMA. He had neither been made aware of the additional SYMA and ATCO technical expert appointed to the technical team nor of the technician for his support. So he did not have recourse to their assistance in managing and balancing the nights technical work against his work environment requirements. When the ATCO was approached by technicians to switch his workstation to the fallback mode he was unaware of any factors that would have indicated it was inappropriate. However, the ATCO (as with most interviewed ATCO's at ACC Zurich) was not totally familiar with the features lost in the fallback modes. He could not foresee the evolution of the CIR situation; so did not recognise the potential impact that operating in a fallback mode would have on the management of the air traffic situation. When a technician asked the ATCO if the SWI-02 phone system could be switched off, he initially refused the request as he had an immediate requirement for the system. However, he was approached by the departing SYMA a few minutes later, and again asked to allow the SWI-02 system to be switched off. This time he ceded control of the system to the technicians. The SWI-02 phone system was switched off and adjacent control centres should have been advised. Although this was expressly stated in the ATM Manual ZC, responsibility for this task was not specifically assigned. Adjacent ATS units were not advised the SWI-02 was switched off so the ATCO had lost their potential support. When the ATCO could not contact Friedrichshafen on the Bypass system he asked one of the CAs to find out another phone number. When he had no success with this number he discussed the options of relaying the information via Munich or contacting the technicians, before settling for the option of asking the crew of the A320 to contact Friedrichshafen directly. The Emergency Manual listed the three phone systems available to ATM staff, but the ATCO was not aware of this, so did not consider the use of the mobile phone at DLs suite. Based on his estimation it is understandable that the ATCO did not see a requirement to call his colleague back from his rest break. If he had been aware of the conflict in the upper airspace at an earlier time he would easily have rectified the situation without the need for assistance from another ATCO. Team management When the ATCO released his colleague to take an extended rest break he assumed responsibility for the duties of both the RE and RP, and some of the duties of the DL. He was assisted by one CA. He was neither aware of the potential support available from the ATCO and SYMA assigned to the team of technicians, nor the technical expert assigned to him. Although the ATCO had not received a training as a DL he was aware of these duties. However, he was more familiar with his role at the heart of the operational ATM team and was not so familiar with the subtle differences of supervising the overall CIR ATM system; an advanced sociotechnical system. Normally when the ATCO had a situation requiring support he could call on the DL to assist. Efficient supervision of the system by the DL would ensure the ATCO was afforded the appropriate resources at the sharp end to best manage the air traffic situation. For the operational staff, the management of the CIR resources that was required on the night of 1 July 2002 was not that typically required in the day-to-day execution of their job. Many factors (some foreseeable, some not) combined to change the environment from the designed user friendly, error tolerant work place to one of an increased risk and less error forgiving. It required heightened TRM skills and greater awareness of the many human weaknesses, particularly when exposed to an error-producing environment. When the technical work started the ATCO felt he could handle the situation. However, as the situation developed it became a more stressful and less error forgiving environment. With the radar system in fallback mode, a problem in the phone system, and the late arrival at Friedrichshafen, as a minimum an additional ATCO should have been working at the South Sector. These sorts of decisions would normally have been made by a DL and should have been made in recognition of the lack of safety afforded by the system.
AX001-1-2/02
83
BFU
Bundesstelle fr Flugunfalluntersuchung The ATCO attempted to manage the air traffic situation using the resources that were available and familiar to him. He did not recognise in the deteriorating situation that the system had become less error resistant. Situational awareness and mental workload At the conscious level humans have limited attention resources. When these limited resources are time-shared between multiple demanding tasks, as in the case of the controller, the continuous detailed analysis of all incoming external information is not possible. In such conditions, much of what is consciously perceived may in fact be inferred. What is perceived is a combination of objective information from the outside world and subjective information from memory. This means that under conditions of divided attention, people are more likely to see what they expect to see, or not see what is not expected or not familiar. Situational awareness can be defined as an accurate perception of the factors and conditions currently affecting the safe and efficient operation of the assigned task. Only the sharing of information by team members promotes a common and more accurate mental picture of a situation and allows the future situation to be predicted. A normally effective team may become imbalanced and loose situational awareness when the working environment changes, when a subtle and unnoticed change in required team priorities occurs, or with changes to the dynamics of the team. In these situation it may be that evaluation of the team situation is a higher priority than the immediate focus on what may be the regular duty. Where-as the ATCO may typically remain focused on the traffic situation, communication of an abnormal situation to the DL will allow the DL to become more involved in the evaluation of the operational and personnel requirements to ensure safe and efficient operations. Air traffic situation The ATCO was accustomed to operating as the sole controller for the whole airspace of ACC Zurich during the period of low traffic flow at night. Typically it was not difficult to maintain situational awareness utilising and benefiting from the support of the CA and the normal resources. In this situation the controller was more at risk of losing situational awareness due to the low workload, as opposed to a high workload. During the earlier part of the night the ATCO operated in a fashion that showed he fully understood the traffic situation and the typical evolution of events within his working environment. Once the DL and the other night shift ATCO left the CIR, the situation began to evolve in a fashion that was not typical. The ATCO adjusted his processes to accommodate these developments, as he perceived them, e.g.: When the radar system was switched to the fallback mode the controller remembered that the separation was now 7 NM. When he issued a new transponder code to the B757-200 and lost the automatically correlated callsign data he attempted to manually correlate the information with the radar symbol. When he became aware of the A320 arriving late at Friedrichshafen he set up the ARFA sector at the RE workstation and tried to contact the tower. In evaluating the nights specific air traffic management tasks the ATCO had considered he would have situational awareness at all times. However, he did not recognise at an early stage that a potential conflict could develop between the TU154M and B757-200. If he had recognised this, it would have changed his perception of the air traffic situation. It would have been possible to correct the situation with a simple and timely instruction. At first the ATCO assigned a high priority to the task of handling the A320 arriving late at Friedrichshafen, as evidenced in his preparation for the ARFA sector and attempt to coordinate with Friedrichshafen. This was in accordance with the requirements of the ATM Manual but it distracted from the task of evaluating and planning the upper air situation. As the A320 approached the hand-off point the ATCO was trying to carry out the co-ordination with the tower-controller but the malfunction of the phone system drew his attention for longer
AX001-1-2/02
84
BFU
Bundesstelle fr Flugunfalluntersuchung than intended. The operation of radios at both the RE and RP workstation resulted in simultaneously incoming radio calls and both demanded attention. The use of two radar screens on significantly different scales could have distorted the ATCOs judgement of distances. With regular monitoring of the upper air situation as presented on the radar screen the conflict between the two aircraft at FL360 should have become evident to the ATCO. However, as the situation deteriorated the controllers workload increased subtly and continuously, reducing his ability to maintain an awareness of the upper air situation and be proactive in its control. If the optical STCA had been available, the alert would have been evident on both radar screens. It would have drawn the ATCOs attention to the upper air situation and he could have avoided the separation infringement through an immediate instruction. It would also have prevented an TCAS involvement. The ATCO had become aware of the conflict too late. As the instruction to the TU154M to descend was terminated the separation infringement had already occurred. The instruction would still have averted the collision if TCAS would not have reacted. The ATCO could not know about the TCAS advice at that time. After receiving acknowledgement of the descent instruction from the TU154M crew the ATCO advised Ja, we have traffic at your . two oclock position now at three six zero. Although this call was not addressed to a specific callsign it is assured that it was intended for the TU154M crew as it came directly after the call from that crew. At the time of this call the B757-200 was in the 10 oclock position relative to the TU154M. This erroneous traffic information could have been a simple mistake where the controller reported the mirror image of the situation. However it was also possible that a number of other factors precipitated the making of this error. After the ATCO had noted on the data label of the TU154M the initiated descent so his statement - he moved back to the RE workstation in response to a call from the A320 crew. The A320s call also overlapped the TCAS descent report from the B757-200 crew, and the ATCO did not perceive this report. The ATCO was firm in his belief that the descent instruction to the TU154M had been issued and as he had observed - responded to in time to avert the danger of collision otherwise he would have continued to observe the development of the situation. Even if the ATCO had recognised that both the B757-200 and TU154M were descending it is not certain that he could have formulated an instruction within the remaining time that would surely have averted the collision. Once the TU154M and B757-200 had initiated the descent the outcome was left to chance. The SWI-02 was switched back on at 21:34:37 hrs and from 21:34:44 hrs until the collision three incoming calls from UAC Karlsruhe and one from Friedrichshafen were recorded. None of these calls was answered. During this time he was involved in the upper air situation, until called back to the ARFA sector by the A320 crew. It is furthermore very probable that the ATCO did not react to the ringing of the phone because the phone system had not been reported back to be serviceable. The ATCO considered he could handle the situation in which he found himself. He did not express doubt as to whether he was able to work in the environment that was developing around him. He concentrated his efforts on functioning as an ATCO but did not stop to fully consider whether he had the resources to cope. He was now at the heart of a system that was more exposed to undetected error and was not supported by the well-maintained sociotechnical system he was accustomed to. Note: The ATCO did not receive any Human Factors or Team Resource Management (TRM) training during his training as an ATCO in the early 1990s or thereafter. Without such a training the team skills he developed related to his personality and were cultivated through his own experiences and learning. An understanding of human error developed anyway but without the benefit of structured training. The initial training of ATCOs the way they are scheduled starting November 2003 - now incorporate modules that seek to educate the trainee to the human factors relating to their tasks.
AX001-1-2/02
85
BFU
Bundesstelle fr Flugunfalluntersuchung Consideration is given to the effects of stress on performance and understanding human error and error producing conditions. The concept of TRM is pervasive throughout the whole structure of the training and aims to develop attitudes and behaviour that will contribute to enhanced team performance. Within the training programme the expressed benefits of offering and accepting help should also reveal the profit of asking for help; it can further team understanding of a situation, assist in managing stress, and help reduce the risk of individual or team error. These training objectives aim to equip ATCOs to recognise danger in time. Without such a training, the ATCO concentrated on the air traffic management task and did not recognise he was in an increased error prone environment and needed assistance. CIR work environment The ATCO worked on two work stations using two radar screens of different scale, with two separate radio facilities, with a phone failure, with the distraction of the technicians, but without the full radar system capabilities or the backup of an additional ATCO. He was working under circumstances, he was not accustomed to. As the technical work was planned, at least some elements were foreseeable, but steps were not taken to mitigate the risks created.
2.6.1.2
Other staff Within any team, it is important that the individual understands the teams aim and their responsibility to the team function. The ATM team aims to provide a safe and efficient air traffic service, and should be supported by the human and technical resources of the system. Any individual that may influence the ATM team in achieving its aim must recognise his/her impact on a safety critical function, and his/her responsibility to the ATM team. This responsibility is implicit when an appropriate safety culture exists. The personal dedication and accountability required of the individuals engaged in safety critical functions is recognised. It requires those concerned to not only perceive the safety issues but to match them to the appropriate action. Within the CIR the behaviour of the below listed people had a significant influence on the functioning of the operational team during the time of the events: The second ATCO left the CIR for an extended break soon after the DL had finished his duty. This was in agreement with the remaining ATCO and was usual practice for the night shift. There was no evidence to the second controller that because of special circumstances in the CIR this break may be inappropriate. Both controllers had not read the bulletin board information which mentioned the technical work, and the associated Technical Directive would not have made it evident that two controllers were appropriate for the duration of the work. When briefing the two ATCOs, the DL had not specifically detailed the impact of the Sectorisation work on the system or suggested that both controllers should remain in the CIR. After the second ATCO had left the CIR it was required that he be called before he could become active. Two CAs were in the CIR around the time the technicians started the Sectorisation work. When the problem in the Bypass phone system became evident one of the CAs was asked to get the phone number for Friedrichshafen. The call using the number was unsuccessful. The other CA was subsequently involved in a discussion with the ATCO as to the best option for contacting Friedrichshafen. This CA then left the CIR shortly afterwards. The communications and co-ordination between the ATCO and CAs was effective and suitably dedicated to the perceived priorities of the situation. Effectively it was the ATCO that set these priorities as he was expected to manage the sector team and delegate routine tasks to a CA. Neither CA identified a problem with the controlling priorities set, but a CA is not trained or expected to monitor the air traffic situation. Statements of CAs concerned show that they abstain from an assessment of operational processes because some controllers view this as an overstepping of boundaries of responsibility.
AX001-1-2/02
86
BFU
Bundesstelle fr Flugunfalluntersuchung At least one of the CAs sensed that the ATCO was annoyed when he was dealing with the technicians but it did not prompt any further deliberations. One of the CAs was aware of the Mobile phone at the DLs suite but did not mention it. Neither CA recognised the significance of the increasing pressure the ATCO was under as the environment deteriorated. There was little direct assistance that they could offer, but they did not express concern or ask if he required more qualified assistance. The DL who finished his shift at 21:00 hrs briefed the ATCOs, but he did not highlight any specific requirements relating to the technical work. He considered the SYMA was responsible for this. However, the sectorisation work influenced operational aspects of the CIR systems that related to the DL function. He did not recognise the safety issue and did not suggest appropriate measures to mitigate the risk, e.g., both ATCOs remain on duty while the technical work was in progress. The technical work would have required a more extensive, strategic planning in advance and should not have been left solely to the tactical management of a DL. Neither SYMA took action to ensure the ATCO was fully briefed on the implications of the technical work, and in particular, the functions lost when the radar system was in fallback mode. Before the departing SYMA finished his shift he approached the ATCO with the request to release the SWI-02 phone system for switch off. He assured the controller the system would be available again in about 15 minutes and that the Bypass phone system was available. The SYMAs estimate of the time was correct but he could not know the Bypass system would not function as expected. The actual changes on the systems in the control room regarding the sectorisation work corresponded with the preliminary technical planning. The SYMA and the technical personnel had not been informed that no additional safety measures had been taken to maintain the safety standards. It seems they had not been aware that the controller experienced an increased performance pressure and a higher work load during the technical work. The ATCO technical expert had been assigned a duty within the CIR in association with the technical work as he was the contact for Operations Technical department relationships. It was not planned for him to work as an ATCO as his task was closely associated with the technicians and their work. The inference was that he was assisting the technicians in interfacing with operational systems as opposed to controlling their impact on the operational ATC staff. The technical expert was directly responsible to the director of ACC Zurich and was the contact person between technicians and controllers during the sectorisation work and he stayed close to sector sued. For the controller, the technical expert was just another technician and he had not been informed about the technical expert's precise orders.
2.6.1.3
Defences Defence barriers are measures that are designed to protect the system against the consequences of technical and/or human failure. Humans do not act alone in this system, they are one element in a complex socio-technical system. Modern technology in ATM has allowed the introduction of effective and reliable defences within the hardware and software elements of the system. These defences have been considered for their impact and benefit in terms of human factors, and may be employed at a strategic or tactical level. Flow management allows regulation of the flow of traffic to balance the requirements of the airline operators with the safe capacity of the system. CIR system design helps defend the controller from making errors at the sharp end, but also monitors for these errors, so they can be managed. For continued safe operation of the ATM system it must be maintained not only in technical terms, but also and particularly as a harmonised socio-technical system. The next part of this analysis considers the defences in the system that could have prevented this accident.
AX001-1-2/02
87
BFU Planning and structure
The ATC system aims to integrate humans and technical components in a balanced fashion, recognising the capabilities and limitation of both, thus to sustain safe and efficient flow of air traffic. Degradation of performance in one sub system may impact the safety or capability within another sub system. Foreseeable technical work should be - according to ICAO Doc 4444 ATM/501 - well planned and include an analysis of risk, allowing strategies to be introduced to mitigate identified risk to an acceptable level. Recognising areas of potential system and human failure in day-to-day operations should also be considered in advance so risk factors may be identified. This would allow processes and procedures to be formulated to recover an unsafe situation within minimum time. Operating procedures ACC Zurich allowed a situation where a sole controller, assisted by a CA, was responsible for the control of the low traffic flow within its area at night. The processes and procedures associated with this condition were not documented, nor were the risks considered or defended against. The staffing level eroded the systems defences, particularly in a time of degraded technical system capability. Controllers in the CIR were not provided with clear and readily available guidance in the handling of unusual situations and system degradations. The availability of such guidance would allow an ATCO to contemplate the implications of various situations and the actions required, while also providing a useful reference document during such situations, as time allows. Communication Safety critical information needs to be communicated to the ATM team to allow them the greatest opportunity to prepare for the environment in which they have to work. Regardless of how useful or relevant information is, it cannot serve its function if it is not effectively transferred. The transfer of the duty from the DL to the ATCOs, which includes a briefing provided a standard means aimed at ensuring that controllers were fully cognisant of the operating environment. Such briefings should have included basic information on out-of-the-ordinary scheduled operations, an assessment of operational hazards and highlighting any unusual factors. An additional source of information was the bulletin board. It did not convey the risks in connection with the technical work effectively because it was not sufficiently focused on the operational impact on the control room systems. Even if the pertinent information had existed, it would not have achieved its aim as neither ATCO read the bulletin board. The departing DL used a general statement to inform the night shift ATCOs that there would be technical work carried out on the CIR systems that night. He did not focus on any operational issues. The departing SYMA talked to the ATCO about the SWI-02 Phone system when the technicians wanted the system for their work. However he did not brief the active ATCO (the other controller was on his rest break) on the overall operational impact of the technical work. In summary it can be stated that if the controllers would have been clearly and explicitly informed about the operational impact of the technical work it would have allowed them to better imagine the changed work conditions. It would have allowed them to better estimate the risks and had given them the option to prepare themselves adequately. 2.6.1.4 Warning systems The STCA (Short Term Conflict Alert) is a warning system which alerts controllers of possible separation infringements. This system has been introduced to protect against collisions. The responsibility to correct the situation falls to the controller. Optical STCA If the optical STCA had been available it would have resulted in an alert about 2.5 minutes before the collision and almost 2 minutes before the ATCO started his descent instruction to the
AX001-1-2/02
88
BFU
Bundesstelle fr Flugunfalluntersuchung TU154M. It would have been visible at both the RE and RP radar screen and would have drawn the ATCO's attention to the situation developing in the upper airspace. He would have had ample time to issue instructions to avoid a separation infringement. In this case, TCAS would not have become active. The ATCO was aware that the separation standard was to be increased in the fallback mode. He was, however, not aware that the optical STCA was not available. An appropriate briefing, an automated system alert or readily available documentation for controllers were nonexistent. And although an ATCO should not control a situation differently based on the availability of the optical STCA, his planning and evaluation processes may be adjusted in recognition of its absence and he may be more conservative in his approach to the task of separating traffic. Aural STCA The MV9800 computers released an aural STCA at 21:35:00 hrs, but this was not heard by anyone in the CIR. The aural alert was released 32 seconds before the collision. At the time the two aircraft had a distance of 6.5 NM to each other. As the ATCO had already reacted to resolve the conflict the aural STCA would just have pointed out the urgency of the situation. Even with the aural alert the ATCO would not have been able to recognise the situation was not evolving as he expected until further information was available. The TU154M was already complying with the descent instruction and the ATCO did not know the B757-200 had initiated an RA related descent. He would not have been able to recognise the B757-200 was descending until the screen update at 21:35:12 hrs or if he had heard the crews TCAS descent call a few seconds later. By this time it was unlikely that he could have formulated an instruction that would have averted the collision with sufficient safety. The aural STCA reports the conflict when the proximity boundary (6.5 NM) is penetrated only once with the alert "conflict, conflict". If this call is not heard, there is no further alert to advise the controlling staff the conflict still exists. Here is no action required of the controller to acknowledge the aural STCA. In case of a separation infringement with high closing speeds the aural STCA offers little use. Support staff A SYMA and an ATCO technical expert were provided to the technical team to assist in the sectorisation work. Either of these individuals could have been of assistance to the ATCO in managing the problems of the environment in which he had to operate. Both individuals were sufficiently qualified to recognise that system degradations can affect the operating ATM staff. Because the technical work had been planned long in advance they assumed they were not responsible and did not see any need either. A technical expert was scheduled to support the controlling staff during the technical work. He was prepared to act on behalf of the controller if asked. Since the controller had not been informed about this support person and since he considered the SYMA to be just one of the many technicians he did not utilise his help once he was caught off guard by the problem with the telephone system. As the technical expert wanted to intervene on his own accord with supportive measures the controller had already found another solution and his help did not seem necessary any more. The technical expert was neither a controller nor was he working in the operational environment so that he was unable to assess the prevailing working conditions of the controller under operational aspects. All three staff members did not evaluate the CIR situation against the requirement to be a safe, error tolerant environment. They had not been sensitised for such an approach through a structured training such as "Human Performance" or a "TRM-Training". They did not observe the ATCOs situation and so could not recognise the occurring and increasingly error-prone work conditions as such. This is also why they saw no need to support the controller in minimising his higher risk of work errors which were conditional on the situation.
AX001-1-2/02
89
BFU
Bundesstelle fr Flugunfalluntersuchung Note: ICAO and Eurocontrol currently discuss to include personnel working together with ATCOs into guidelines which are already in existence for ATCOs. These guidelines aim to educate ATCOs in already existing training programmes regarding human performance knowledge and the respective skills through Team Resource Management. Precise programmes once support personnel is included do not yet exist.
2.6.1.5
Organisational factors and safety culture in the company Organisational factors determine how systems are designed, constructed, operated, maintained, managed and regulated. They affect the work environment of people in the system, the character of its defences and how they become operative. Organisational factors can play an important role in aircraft accidents. The following paragraphs deal with the most important organisational and management related factors within the air navigation service company. If necessary other institutions are addressed which had an influence on the air navigation service company. Audits The company was in the process to correct weaknesses and deficiencies identified by various audits. They knew that the staff shortages put a strain on the safe and efficient operation of the system. The problem to recruit and retain staff was one of the biggest challenges the company had to face. It influenced maintenance and desired improvements of systems and the required staffing levels and training. The last independent audit in December 2000 had not produced any critical safety issues due to non-compliance with regulations or directives. It determined that most of the problems identified in the previous audit had been solved. Safety culture and safety management Safety culture in aviation refers to the personal dedication and accountability of individuals engaged in any activity that has a bearing on the safety of flight operations. It is a pervasive type of safety thinking that promotes an inherently questioning attitude, resistance to complacency, a commitment to excellence, and the fostering of both personal accountability and corporate selfregulation in safety matters. (ICAO Human Factors Guidelines for Safety Audits Manual, Doc 9806 AN/763, 2002). Safety culture is both attitudinal as well as structural, relating to both individuals and organisations. It concerns the requirement to not only perceive safety issues but to match them to the appropriate action: The common goal of both the organisation and the individual is safety. An individuals attitude toward safety will be influenced by the organisations demonstrated commitment to safety. By identifying what constitutes a safety-oriented corporate culture and its characteristics, managers can change and improve the existing corporate culture by establishing safety recognisable for all staff members - as a high priority. Feedback and continual reinforcement from the most senior management levels down will help develop the dedication and accountability that is desirable. A Safety Management System and associated management systems are potentially effective tools an organisation can use to influence the safety culture and support the stated priority of safe air navigation. A lasting behavioural change in individuals based on changes in personal attitudes takes a certain amount of time even with a well-structured and well-founded safety system. Safety policy in the company The safety policy of the air navigation service company had been implemented on 23 October 2001 (refer to chapter 1.18.1). The principles were in compliance with the requirements published by ICAO, Eurocontrol and the Bundesamt fr Zivilluftfahrt (BAZL) and included already future requirements which were not mandatory at that time.
AX001-1-2/02
90
BFU
Bundesstelle fr Flugunfalluntersuchung The company was within a developing process to a corporate culture based on these principles in which managers and employees were aware of their critical importance for safe operations. However, some problem areas could be identified: Centre of competence (CoC) When the air navigation service company came into being it was recognised that the informal safety management concept that had served the former organisation would not meet the more structured requirements that were evolving within aviation. As a result, the Centre of Competence was established to meet the forecast requirements and put in place the appropriate structures and accountability. A safety management structure had been established within the CoC. They included the functions of safety, quality, audit, and risk management and responsibilities had been assigned within the structure. The familiar functions of auditing and quality assurance were mature elements brought into the CoC. The CoC included and had access to experienced audit staff. They had an overview of the development of the problems identified by the audit and the measures taken to solve them. Safety and risk management are required for development of a healthy safety culture. They were not present and had to be developed together with the expertise. The air navigation company elected to develop these systems themselves rather than bring in the expertise from outside the organisation. This resulted in a delay while the system was developed. The Safety Policy (please refer to 1.18.1) clearly suggests the CoC should have been formally involved in the planned structure change of the upper airspace which did not happen. Without knowledge of the planned sectorisation work the Risk Manager could not conduct a quantitative risk assessment and mitigation process. Personnel situation It had been clearly identified that staff shortages in certain areas were placing a demand on the remaining staff to increase their workload or on management to reduce the level of services provided. The recruitment of new staff often fell short of the numbers required and made realistic planning difficult. The staff shortage made it difficult to conduct refresher trainings and had resulted in rostering difficulties. It had a negative effect on staff moral and the controllers perceived it as a lack of support from the company. Note: A Eurocontrol publication states that there is an Europe-wide ATCO shortage of around 12%. Operational Internal Reporting The internal reporting scheme for safety-relevant incidents (OIR, Operational Internal Reporting) suffered from lack of acceptance by some of the controllers. They suspected it might be used for punitive action. This is why it was inoperative as a confidential internal reporting system for identifying error sources. ATCO training and advanced training The following deficiencies were determined during the investigation of the accident: Several controllers at ACC Zurich were only insufficiently informed about operating the radar system in the fallback mode. Operation in this degraded mode was not regularly trained, nor had suitable guidance documentation been developed. Although operating in the fallback mode is not overly problematic or inherently unsafe it must be understood how the systems defences are affected. The night shift ATCOs were expected to assume some functions of the DL but were not trained to handle the role. Refresher courses were scheduled every six months. Due to the tight personnel situation they were run on an annual basis only.
AX001-1-2/02
91
BFU
Bundesstelle fr Flugunfalluntersuchung There was no comprehensive training in emergency or unusual procedures in a suitable simulation device included in these courses. The company did not provide specific and suitably detailed material to the ATCOs for the handling of emergency or unusual situations.
Note: Eurocontrol had developed guidelines for Common Core Content (CCC) training of new controllers. The programme seeks to educate the controller on: weaknesses and strengths of the human being the effects that error producing conditions have on conducting a safe operation the concept of TRM and to emphasise the benefit that TRM brings to the safe and efficient management of air traffic The programme was still in the implementation stage and was not to become a requirement for all Eurocontrol member states until November 2003. Night staffing levels and Single Man Operation Procedures (SMOP) There were no written regulations about the night shift beyond the regular roster. The practice of rostering only two ATCOs had developed because of the personnel situation. The former system had scheduled three controllers for the night shift. It ensured that two controllers were always at their workstations and the third took a break. That this controller took a longer break during times of low traffic became unofficial practice. This practice was maintained as the night shift was reduced to two controllers. This procedure existed already as the CoC was established and the Safety Policy formulated. There was one procedure for the operation during the day with just one controller. This operation was laid down in the Single Man Operation Procedures Operational Instruction (please refer to Appendix 9). The night shift for controllers was not a SMOP. In the scope of this analysis, the conditions for SMOP are just a source to compare them with the practised procedures during the night shift at ACC Zurich and to evaluate them. The Operation Instruction states: that two co-located sectors shall not be operated by SMOP at the same time. All sectors were combined and operated from one workstation during the night shift. There were no other open sectors. that the DL is committed to watch the actual traffic load at the SMOP operated sectors frequently. This requirement was not met because there was no DL overseeing the ATCOs situation during the night shift. that if necessary, the ATCO can become support from the DL or from an ATCO of another sector in time.
This was not possible during the night shifts because DL tasks were performed by the controller himself. To consider the resting ATCO in the same terms as the ATCO from a co-located sector is flawed. The resting ATCO was not in the CIR and there would have been a delay in getting his assistance. It is likely that the controller seeking support would have had to overcome a psychological barrier in committing to requesting his assistance and interrupting his rest. It would have been easier to ask support of a controller from a co-located sector. As a result of two Airprox incidents during SMOP at ACC Zurich the procedure had come under close scrutiny of both the Swiss BFU and BAZL. Concern had been expressed by these organisations regarding the use of SMOP. ACC Zurich had reasoned that the practice was common on a European and broader international scale. There was no objective risk assessment and mitigation process. At the time of the accident the different opinions were still being discussed. It was undisputed, however, that SMOP was unsuitable as a long-term planning tool.
AX001-1-2/02
92
BFU
Bundesstelle fr Flugunfalluntersuchung The controllers actual work conditions during the night of the accident did not meet the SMOP requirements as follows: The radar system was being operated in the fallback mode and the optical STCA was not available. The telephone system was not working properly. The technicians working in the control room added to the controller's stress. Operating two workstations with two different sectors from radar screens set to different scales was an additional strain and would probably not have been accepted by a DL although traffic flow was low. The ATCO could not use a headset as he was operating radios of two workstations. The regulatory authority had already voiced concern about SMOP. The general work conditions during the night shift and the additional strains of the night of the accident did not meet the requirements for SMOP. Actual implementation of the safety policy in the air navigation service company The safety policy of the air navigation service company which had been implemented on 23 October 2001 show that a safety culture was to be evolved in which managers and employees were aware of their critical importance for safe operations. The company was in the process of evolving a functioning safety culture which they could not, however, fully realise at that time. This would have required more time for an evolution process in which rethinking and learning processes could have ingrained in the staff a new way of thinking. Organisational processes to create such a safety culture were also still under way. Being new the safety and risk management systems were still at the development stage. Their introduction was basically accepted by all management levels but adequate resources had not been provided.
2.6.2 2.6.2.1
Boeing B757-200 Flight Crew Professionalism and competence The commander was a skilled and knowledgeable pilot, and an experienced Line Training Captain with high standards and a courteous, professional manner. The copilot was formerly a Line Training Captain with the company on the SA-227 Metroliner and was recognized as a skilled and knowledgeable pilot. Company records state he had achieved a good standard during his initial training as a First Officer on the B757-200. The company and colleagues held both crewmembers in high regard. According to the company files both pilots achieved a high standard in their various company checks. Analysis of all available information regarding this flight confirmed the crew conducted themselves professionally, had displayed effective CRM skills, and was proactive in the control of the flight progress. Distribution of tasks Prior to the TCAS event the crew had adhered to the sound practices of a multi crew concept. When the TA warning was issued each crewmember was trained to assume prescribed duties, but the copilot was not at his station, and this had an impact on crew co-ordination. Generally it is acceptable that a crewmember leaves his assigned station temporarily during cruise, but the copilot's absence from his station at the time of the TA had an important influence on the normal crew co-ordination in the unforeseen and rapidly developing situation. His prompt return to cockpit duties shows he recognized the implications of a TCAS TA/RA and understood his responsibilities.
AX001-1-2/02
93
BFU
Bundesstelle fr Flugunfalluntersuchung When the TA was issued the PFs duty was to commence a visual search, but from the CVR it is not possible to establish whether or not he did so. Once the RA was issued the PFs prime task was to manoeuvre the aircraft as guided by the VSI/TRA, which he did immediately. After the TA the copilot re-established himself as PNF without undue delay and, while returning to his seat, conducted a visual search for the intruder aircraft. This is confirmed by his statement: traffic right there, which is considered to refer to a visual contact. The copilot also assumed the standard PNF duties to monitor and backup the PF as was indicated when the increase descent RA was issued and he reinforced the command with the word increase. By this time the PNF was back at his station with his headset on, but he had probably missed the critical calls relating to the TU154M. Both the PF and PNF started a call to ATC Zurich at 21:35:19 hrs, but the call was finished by the PNF only, and advised of the TCAS descent. Company documentation required this call be made as soon as practicable, and the fact the call was started by both pilots is reflective of their awareness of the calls importance. It is also noted that both pilots used the callsign Dilmun Six Hundred, when their callsign on this sector was Dilmun Six One One. This may be explained by the fact that the callsign used was that of the Brussels Bahrain sector that they flew regularly, and is phonetically easier to pronounce. In the strain and urgency of the situation both crewmembers used the easier and equally familiar callsign. Although the TCAS descent call was made 23 seconds after the beginning of the initial RA, and 7 seconds or more after the copilot was back on headset, it was made at the earliest opportunity. Immediately after the RA the Commander was PF and PNF, and was concentrating on the manual flying task to execute the RA manoeuvre, so that at that time the report of the TCAS descent did not have the highest priority. A few seconds after the RA the ATC frequency became busy with communication between Zurich Control and TU154M. The B757-200 crew started their TCAS descent call as soon as the frequency became open. Once a visual contact with conflicting traffic is established the PF is responsible for taking avoiding action. However, at night it is almost impossible to judge the closing speed and relative height of another aircraft. It was only 5 seconds before the impact that the PNF stated descend! and descend hard! (separated by an expletive). The tone used was that of an urgent command made in recognition of the imminent and extreme danger of a collision. The control column was pushed fully forward just prior to impact, but the time available did not allow the avoiding manoeuvre to take effect. Analysis of the actions and limited statements of the crew indicate they were aware of their duties during the TCAS event. Hierarchy in the cockpit On the basis of the CVR evaluation the following can be stated: The crew was well established and familiar with each others behaviour and position within the team. The relaxed cockpit relationship and good understanding of each other allowed a freedom for each pilot to conduct his activities without strict reference to each other. Although the commanders authority was not overtly displayed, it was not in doubt. His behaviour invited participation from the copilot, and allowed him to make use of his skills and professional judgement. Throughout the flight the trans-cockpit authority gradient varied slightly, depending on the actual situation, and had a positive impact on team performance. Situation awareness During the climb phase of the flight the crew demonstrated their situational awareness through various comments and their approach in keeping ahead of the aircraft. Once established in the cruise the crew continued with various flight related duties e.g. collected weather from possible diversion airfields, completed aircraft or personal log book entries. There was nothing to indicate their situational awareness diminished. During the steady state cruise in an automated aircraft like the B757-200, there is a tendency for the crew to become isolated within the cockpit, particularly at night. The reassuring stimulus of ATC radio traffic provides a connection to the outside world, and may sustain a position of fo-
AX001-1-2/02
94
BFU
Bundesstelle fr Flugunfalluntersuchung cus within the pilots consciousness even during the quiet times of a flight. However, the initial call sequence of the TU154M did not elicit a response from either B757-200 pilot, although it included the information that the aircraft was at the same flight level. This is understandable, as there was no other information to indicate a potential conflict. The flight was being conducted under radar control and in an environment where the see and avoid concept has serious limitations. Although there is a general requirement under the rules of the air for the pilot to have a visual lookout, under these circumstances visual lookout cannot be considered an important method for maintaining situational awareness. After the TA, only the commander was able to hear the ATC instructions to the TU154M. Because the RA descend command occurred during the last second of the ATC instruction it was highly probable the commander immediately focused on the urgency of the RA. The RA command became the prime task and demanded his full attention in initiating the descent. The relevance of the ATC instruction to the TU154M was probably not processed to create an accurate mental picture of the developing situation. The copilot was alerted to the developing situation by the TA aural warning at 21:34:42 hrs. He promptly returned to the area of the pilots seats and at 21:35:05 hrs made the statement traffic right there. This demonstrates he had resumed some elements of his duties, although he was not yet seated. Critically, he was not party to the ATC communication addressed to the TU154M. This deprived him of important information required to develop a complete mental picture of the situation. Prior to the onset of the TCAS event the crew had utilized the aircraft automatics and used the various resources available to maintain their situational awareness. There was no indication that they had become over-reliant on the aircrafts automated systems or had become complacent. No evidence was found that the crew's performance was affected by the long shift that day. The crew had demonstrated a willingness to manage the progress of the flight, but as the TCAS event evolved and the stress level increased they could only react to the immediate requirements of the situation. Time and circumstances prevented them to come together to a complete picture of the situation being developed and projected into the future. From that point on the capacity was denied them to be proactive. Decision making Chapter 2.2.1 includes an in depths evaluation of the B757-200 crew's reaction to the TCAS event. It is the BFU's opinion that they have reacted correctly and followed the specified procedures as best as possible given the particular circumstances.
2.6.2.2
Defences ACAS/TCAS As an independent, onboard collision avoidance system, TCAS is designed as a last resort system to assist flight crews in avoiding a mid-air collision. The B757-200 VSI/TRA used for displaying TCAS information had a maximum display capability of 16 NM and holds a prevalent position within the pilots scan. TCAS is an onboard system which normally works in the background and becomes active once a collision risk appears. The interface "TCAS - crew" becomes active with the generation of a TA. In this phase TCAS contributes to the situation awareness of the crew. An input into the control of the aircraft is not intended in this phase. After the generation of an RA the flight crew must take over control of the aircraft. Thereby is essential: Even in consideration of the pilot's final responsibility the TCAS RA must be followed. In this situation the crew has no better basis for a decision. Deviations from ATC instructions must be reported as soon as possible. Visual acquisition of aircraft
AX001-1-2/02
95
BFU
Bundesstelle fr Flugunfalluntersuchung There is much literature about the physiological limitations of the human visual system within the aviation environment and particularly in the context of the see and avoid principle, often dealing with the difficulty in acquiring visual contact with other aircraft. This event exposes the human weakness even further, in that even with a visual contact with the opposing aircraft, neither crew successfully utilised the sensory information to recognise the high risk of a collision in time to successfully take avoiding action. Having detected another aircraft a process of evaluation starts to assess the likelihood of a collision and to consider the need for evasive action. The first step of this evaluation requires that the relative position and relative motion be determined in all dimensions and then the rate of change evaluated. At night and high altitude humans are extremely unsuited to this task. At high altitude, and particularly at night, relative height it is almost impossible to judge visually with certainty, but change in the relative vertical bearing gives an indication of potentially conflicting traffic crossing above or below. The lack of vertical change indicates no height difference at crossing, but does not allow determination as to whether a contact is above or below ones own aircraft. With high closure rates it may remain impossible to assess with certainty the relative height of intruder traffic until just a few seconds prior to the closest point of approach. Change of relative (horizontal) bearing is an indication as to whether a contact is passing ahead or behind ones own aircraft, but in most environments the task of determining the intruder traffics heading still remains extremely difficult. In a potential collision situation the bearing does not change. The third dimension involves the distance between the aircraft, and is assessed based on the apparent size of the contact. The relationship between distance and size is not a linear one, however: size increases exponentially with decreasing distance. At night and high level it is almost impossible to judge the distance between two aircraft based on visual information alone as there is no optical reference. This makes it impossible to assess the closure rate until a contact is at a range that a change in size becomes perceivable. With a low closure rate the point at which a pilot can discern the size of another aircraft, and recognise the separation distance, may allow time to assess the flight trajectory and react to the situation prior to the closest point of approach. However, at high closure rates, by the time a pilot can detect a change in the apparent size of another aircraft, it will already be rapidly expanding in his view. And although he instinctively recognises the high closure rate, even an immediate control input may not give enough time to effectively initiate an avoidance manoeuvre. The visual sensation created by a clear change of relative bearing, vertically or horizontally, conveys a sense that a collision threat is reducing, or does not exist. This perception is strengthened as the rate of change is increased. However, if the rate of change of relative bearing is reduced or is constant the pilot does not sense an increased threat of collision. In this situation the pilot experiences an alarming visual sensation only if distance to the conflict traffic decreases significantly and the object size increases rapidly. The flight paths of the accident flights had the two aircraft at an almost constant relative height and horizontal bearing, but with a closure rate of about 710 knots (about 365 m/s). This closure rate would not have allowed the crew of either aircraft to recognise the shortness of distance between them or their relative velocity till only several seconds before the collision. The remaining time was insufficient to decide on a course of action and affect a change in the aircraft flight path. Note: An examination of these problems regarding visual acquisition is presented in chapter 2.2.3
2.6.2.3
Organization Standard Operating Procedures The SOPs for operating the B757-200 corresponded with the manufacturer guidelines and complied with the requirements of the regulatory authority concerned. The use of the TCAS equipment is covered in the operating procedures, and the response to the system is detailed in the company operations manual and also covered in the training provided.
AX001-1-2/02
96
BFU
Bundesstelle fr Flugunfalluntersuchung The guidelines for crews regarding their reaction to TCAS advisories were in itself free of any obvious contradiction. Detailed scrutiny as a result of this accident investigation determined, however, there was some room for misinterpretation. Flight crew training TCAS operations In assessing the impact of TCAS training as it relates to the human factors element of the crew performance in this accident, Attachment E to the ICAO State Letter AN 11/19-02/82, Proposed Airborne Collision Avoidance System (ACAS) Performance-based Training Objectives has been used as the base document. The company had used the FAA Advisory Circular AC No:120-55B issued on 22.10.01 as the base document for their TCAS training. For the purpose of this investigation the two documents are considered to be comparable in their content. Bahrain Civil Aviation Affairs(BCAA) had approved the company TCAS training programme, and the programme incorporated the objectives of the FAA AC No 120-55B. Both B757-200 pilots successfully completed the TCAS training course, which was a part day classroom session and included a TCAS Training video. TCAS manoeuvre training for the pilots was conducted in a simulator, and was included in the initial type rating, the recurrent training schedule and could also be included in LOFT exercises. The training scenarios were typical of industry practices and did not consider a contradictory situation with an RA conflicting with an ATC instruction. The company TCAS training reinforced the intended priority of the system as a last resort defence only to be disregarded if potentially conflicting traffic has been positively identified and it is absolutely clear no deviation from current flight path is required. It also cautions against manoeuvring opposite to an RA. Crew Resource Management (CRM) in the cockpit ICAO Human Factors Digest 2 - Flight Crew Training: Cockpit Resource Management (CRM) and Line-Oriented Flight Training (LOFT) gives guidance on the principles of CRM, and the preferred training method LOFT. BCAA has invested authority for CRM training to the company and approved the company CRM programme. Several months before the accident flight the company incorporated a new CRM training programme in its OM Part D (Training) and this programme embodied the guidance and objectives of the ICAO Human Factors Digest 2. The training programme recognises the effectiveness of specific techniques within the various CRM training phases, starting with awareness, progressing through to practice and feedback and finally acknowledges the importance of reinforcement. CRM training is internationally accepted as an evolutionary process. CRM is considered in all areas of the company training environment, and although only the copilot had received CRM training with the company, they had both been assessed in this area. The PIC was a B757 Line Training Captain and was also utilised in this role because he displayed good CRM skills himself and was able to recognise and develop the CRM qualities of other pilots. The copilot had been a Line Training Captain on his previous type with the company and had displayed the same attributes. ICAO considers LOFT to be the preferred vehicle for practice and feedback of CRM training, and the high value of simulators and LOFT exercises is recognised by the international aviation community. LOFT is used to develop proper flight deck management techniques that will become inherent, not only during the routine elements of flight operation, but also during more stressful situations. Both pilots were regularly exposed to LOFT exercises and continued to display good CRM skills. Documentation There is a wealth of documentation available on TCAS and its use, but this documentation, in its entirety, would not be familiar to the crew, as any specific information pertaining to their operation will typically be incorporated in company manuals and training material.
AX001-1-2/02
97
BFU
Bundesstelle fr Flugunfalluntersuchung The design of the TCAS system intends its use as a last-resort system. This gives the system priority over most other flight deck inputs except the likes of GPWS, stall warning and windshear warning systems. The system is intended to take precedence over the likes of ATC instructions and the right-of-way rules. However some misunderstandings may arise when documentation refers to the system as a back-up to other systems or concepts. This could be interpreted that TCAS is only used in the absence of other elements of the aviation system intended to provide safe separation. The Company Operations Manual (OM) Part A, chapter 8: Procedures for the use of TCAS (8.3.6), and the Boeing 757 Flight Crew Training Manual chapter 5: Traffic Alert and Collision Avoidance System (TCAS) Page 5.18 ff gave guidance in the use of TCAS and response to advisories. The company used the FAA Introduction to TCAS II Version 7 (November 2000) as part of the course material for TCAS training and it was also carried in the aircraft library. The OM Part A states: manoeuvres should never be made in a direction opposite to that given by the RA, and that RAs should be disregarded only when the potentially conflicting traffic has been positively identified and it is absolutely clear that no deviation from the current flight path is needed. The Boeing Flight Crew Training Manual (FCTM) states: Flight crews should follow RA commands using established procedures unless doing so would jeopardize the safe operation of the airplane or positive visual contact confirms there is a safer course of action. It goes on to state: Maneuvering opposite to an RA command is not recommended since TCAS may be coordinating with other airplanes. The references give guidance to the crew that they should follow a TCAS RA, but do not mandate compliance with the RA, leaving the decision to the PIC. However, all material is consistent in cautioning against a manoeuvre in the opposite direction to a RA, and reinforcing that the RA should be followed, unless it would be unsafe to do so.
2.6.3 2.6.3.1
Tupolev TU154M Flight Crew Professionalism and competence The commander (under supervision), copilot, Navigator and Flight engineer typically operated as a fixed crew and were experienced and competent with good records in the company. The instructor (PIC) was also an experienced and competent pilot and held a senior position within the company. All crew members held the highest performance class (refer to chapter 1.5.2). Analysis of all available information regarding this flight confirmed all crew members were competent in the performance of their standard duties. Distribution of tasks The normal crew structure had been altered by the inclusion of the Instructor, but the crew had restructured and operated in accordance with the normal procedures. The Instructor was in a familiar role as PIC and PNF, while the Commander in the left seat would have been less familiar in his role as PF without the responsibilities of being PIC. The duties of the navigator and flight engineer remained unchanged, while the copilot had no assigned duties. As the conflict situation developed the PNF was responsible for handling radio communications and was to acknowledge the ATC descent instruction. He was initially diverted from this task as he clarified his decision (as PIC) to the flight deck crew to follow the ATC instructed descent. His response to the second ATC descent instruction was immediate. The PNF was also expected to monitor and support the PF in the execution of any flight manoeuvres, including the ATC instructed descent. When the TCAS event started, his duties expanded by the need for a visual search for the conflicting traffic. It is probable that he at least monitored the PF as the descent was initiated, but he then trained his attention on the visual search. He did not advise the PF that they were approaching their
AX001-1-2/02
98
BFU
Bundesstelle fr Flugunfalluntersuchung cleared level of FL350. At this time the PNFs attention was concentrated on the visual search, and was probably centred in the wrong sector. At 21:35:12 hrs the ATC controller passed the erroneous information that the conflict traffic was in the TU154Ms 2 oclock position. This increased the confusion of the situation, and the distress of the crew. The crew was probably affected in their capacity to perform their tasks and distracted from the visual contact with the B757-200 in their 10 oclock position. Nine seconds before the collision the PIC asked where is it? and the copilot replied here, on the left, implying that the PIC had concentrated his search in the sector suggested by ATC, while the copilot had maintained visual contact with the B757-200 on their left. About two seconds prior to the collision, the PF pulled the control column hard back, probably in response to visual contact with the now rapidly expanding B757-200. The time available did not allow the avoidance manoeuvre to take effect. Hierarchy in the cockpit Except for the inclusion of the Instructor, the flight deck crew was familiar with each others behaviour and position within the team. The usual flight deck hierarchy would have seen the Commander as PIC and the copilot next in the chain of command, with the navigator holding a more authoritative position than the flight engineer. For this flight it was prescribed according to NPP (comparable to Operations Manual) that the instructor be the PIC. The copilot was relegated to an uncertain and undefined position, as he had no assigned responsibilities within the crew. When a team works together for an extended period of time, some positive effects in terms of group synergy may be achieved. This can lead to an intimate understanding of fellow team members contributions and actions, thus enhancing crew performance. However, even a subtle disruption of the team composition can diminish the synergy normally achieved and degrade the team performance disproportionately. Conversely, a new team member may bring additional and complementary skills that are beneficial to the team performance. It could not be determined how the TU154M flight deck crews performance was affected in detail by the presence of the Instructor. On the basis of the CVR evaluation the following can be stated: Control of the routine phases of the flight was achieved in a co-ordinated fashion and the crew communicated effectively. The hierarchical structure of the TU154M crew in connection with the perceived atmosphere suggest a reasonably steep trans-cockpit authority gradient. When the PIC committed to the ATC commanded descent, in the presence of a RA climb, and without consultation with the other crewmembers the trans-cockpit authority gradient was observably steep. The autocratic way in which the decision was made could have affected the other crewmembers in their willingness to communicate relevant information or any discomfort they felt with the situation. Situation awareness During the cruise phase of the flight the crew maintained an awareness of the tasks at hand utilising the systems available to them. No evidence was found that the physical performance of individual crew members was affected. The flight was being conducted under radar control and in an environment where the see and avoid concept has serious limitations. Although there is a general requirement under the rules of the air for the pilot to have a visual lookout, under these circumstances visual lookout cannot be considered an important method for maintaining situational awareness. The crew did recognise the other airplane on the VSI/TRA early and was able to identify it visually before the accident. That way they had become aware of a possible conflict which then seemed to be solved through the instruction of ACC Zurich. Note: The BFU is of the opinion that the use of the TCAS display for the development of an own assessment of the air traffic situation and/or of a situation awareness is not compatible with the
AX001-1-2/02
99
BFU
Bundesstelle fr Flugunfalluntersuchung TCAS system philosophy or the system ATC. There are also no procedures in existence in order to use the system in such a way. Decision making A detailed evaluation of the TU154M crews reaction to the TCAS event is included in chapter 2.2.2. The following explanations are restricted to the TU154M crews decision finding process in connection with the instruction of ACC Zurich and the TCAS RA. At 21:34:42 hrs TCAS issued a TA. At 21:34:49 hrs, the ATC descent instruction was received and the PIC immediately commanded a descent, but at 21:34:56 hrs a TCAS climb RA was issued. From the crews point of view the two instructions contradicted each other. The timing and urgency of the contradictory requirements pressured the PIC to make an instant and authoritarian decision. The PICs decision was to descend in accordance with the ATC instruction. His read-back to ATC at 21:35:07 hrs, expedite descent level three five zero, underlined the finality of his decision and was validated by the PFs action to continue the descent. Although a descent was being established in response to the ATC descent instruction and PIC command, when the TCAS issued a RA Climb the copilot immediately repeated the command, stating It says climb (Climb ). When the PIC advised to the crew He is guiding us down ( ), the copilot queried Descend?. The copilots contribution to the discussion about TCAS traffic indicated he probably had a good understanding of TCAS, and it was likely he also had a clear opinion supporting a response to follow the RA. The copilot probably still felt ill at ease, but the PIC had made a clear decision and this was being supported by the PF through his action to descend. When the strengthening RA increase climb was issued at 21:35:24 hrs, the copilot supported the RA stating climb it says (climb ). Afterwards none of the crewmembers questioned the decision or tried to address it again. The copilots contributions were not assertive enough to demand full consideration from the PIC, and the PICs authority over the copilot was not in doubt. The PICs decision may have had the following reasons: The PIC had high expectations of ATC and should not have been very inclined to question instructions by ACC Zurich which he considered to be an appropriate instrument to solve the conflict. He had reservations regarding TCAS and its authorisation to deviate from an ATC instruction on the basis of an RA. He was not sufficiently familiar with TCAS and its system philosophy in order to know that TCAS normally issues a complementary RA in the other airplane. Finally it cannot be evaluated which of the listed possibilities holds true or whether a combination of them all is applicable. The controller had conveyed a considerable urgency by his choice of words and his tone. The twice made reference to the conflicting traffic supported the necessity of his instruction. Considering the decision from the PIC's point of view it can be understood that he regarded it as correct. The collision was left to chance after this decision. The BFU assumes that the crew probably interpreted the ATCOs instruction to initiate a descent to FL 350 because of conflicting traffic foremost to be an avoidance manoeuvre in order to avert an imminent collision and not so much as an instruction to change the altitude within a changed separation. None of the TU154M's crew members reacted to the report of the B757-200 crew about a TCAS "descent" at 21:35:19 hrs. Either the report was not noted because of its bad readability or the stress of the situation did not allow comprehension of its significance.
AX001-1-2/02
100
BFU
Bundesstelle fr Flugunfalluntersuchung The PFs attempt one second prior to the collision to avoid the now visibly recognisable B757-200 by abruptly initiating a climb could not be successful for reasons of time.
2.6.3.2
Defences ACAS/TCAS As an independent, onboard collision avoidance system, TCAS is designed as a last resort system to assist flight crews in avoiding a mid-air collision. The TU154M VSI/TRA used for displaying TCAS information had a maximum display capability of 40 NM and holds a prevalent position within the pilots scan. TCAS is an onboard system which normally works in the background and becomes active once a collision risk appears. The interface "TCAS - crew" becomes active with the generation of a TA. In this phase TCAS contributes to the situation awareness of the crew. An input into the control of the aircraft is not intended in this phase. After the generation of an RA the flight crew must take over control of the aircraft. Thereby is essential: Even in consideration of the pilot's final responsibility the TCAS RA must be followed. In this situation the crew has no better basis for a decision. Deviations from ATC instructions must be reported as soon as possible. Visual acquisition of aircraft The situation with regard to the value of visual information is assessed as being the same in both cockpits, except the situation for the TU154M crew had been compounded by the erroneous traffic bearing information passed by the controller. Note: Consideration of the problems associated with a visual acquisition is given in chapter 2.2.3
2.6.3.3
Organisation Standard Operating Procedures The use of the TCAS equipment was covered in the airline operating procedures, the response to the system was layed down in the company operations manual and also covered in the training provided. It was generally considered that this material gave correct and clear guidance to crews on the expected response to any TCAS activation. The response of the TU154M crew on the collision flight, and detailed scrutiny during this accident investigation suggests however there was room for misinterpretation and uncertainty. Flight crew training TCAS operations In assessing the impact of TCAS training as it relates to the human factors element of the crew performance in this accident, Attachment E to the ICAO State Letter AN 11/19-02/82, Proposed Airborne Collision Avoidance System (ACAS) Performance-based Training Objectives has been used as the base document. The Russian Regulatory Authority has used the ACAS Implementation guidance Document issued by Eurocontrol on 1 July 1997 as the base document for their TCAS training requirements. For the purpose of this investigation the two documents are considered to be consistent in their content. The Training Programme for Cockpit Personnel of Aircompanies, Russian Civil Aviation, to use TCAS/ACAS lays out the skeleton of the training programme, and invests authority for the training to certified State Special Centres with specifically qualified instructors. The State Special Centre training programme incorporates the objectives of the ACAS Implementation Guidance Document issued by Eurocontrol except that the use of a simulator or CBT was not included. Eurocontrols Final Report on ACAS Training Material expressly states that TCAS theory and simulator practice should be complementary and indivisible parts. Simulator or computer based training (CBT) is primarily used to train responses to TCAS as RAs are stressful and require quick and appropriate reactions from the aircrew involved. The
AX001-1-2/02
101
BFU
Bundesstelle fr Flugunfalluntersuchung training is not only to ensure the manoeuvre is accurately flown, but more importantly, the correct response to the RA is made. The use of these training devices also leads to a more effective understanding of the displayed data and gives the trainees a greater awareness of the systems potential. It is this understanding that may allow a trainee the capacity to project a developing situation, and assist in formulating a suitable course of action before the TCAS issues a TA and/or RA. The TU154M pilots and navigators had attended the approved TCAS training course, but had not received associated simulator or computer based training. It was not a requirement for the flight engineer be trained to the same level. Crew Resource Management (CRM) in the cockpit ICAO Human Factors Digest No 2 Flight Crew Training: Cockpit Resource Management (CRM) and Line-Oriented Flight Training (LOFT) gives guidance on the principles of CRM, and the preferred training method LOFT. The Russian Regulatory Authority has invested authority for CRM training to certified State Special Centres with specifically qualified instructors. A comprehensive training programme based on an FAA course has been developed and has incorporated the guidance and objectives of the ICAO HF Digest No 2. The State Special Centre training recognises the effectiveness of specific techniques within the various CRM training phases, starting with awareness, progressing through to practice and feedback and finally acknowledges the importance of reinforcement. Of the TU154M crewmembers, only the two commanders had received CRM training, and the instructor was qualified as a CRM instructor. As coverage increased, it was intended all crewmembers of the operator would receive exposure to CRM training. It was also intended that CRM become a more integral part of the training environment. ICAO considers LOFT to be the preferred vehicle for practice and feedback of CRM training, and the high value of simulators and LOFT exercises is recognised by the international aviation community. LOFT is used to develop proper flight deck management techniques that will become inherent, not only in the routine elements of flight operation, but also in more stressful situations. In the absence of a simulator, ICAO suggests role-playing and group exercises with video feedback as another training technique. These methods were incorporated in the State Special Centre training programme where the availability of simulators was limited. None of the TU154M crew had been exposed to LOFT in the simulator as part of their training development. Documentation Internationally and within Russia, there is a wealth of documentation available on TCAS and its use. This documentation, in its entirety, would not be familiar to the crew, as any specific information pertaining to their operation would typically be incorporated in company manuals and training material. As discussed earlier, the design of TCAS intends its use as a last-resort system, but this can become confused when documentation refers to the system as a back-up to other systems or concepts. Documentation relating to this issue had attempted to give clear guidance to the crew. However, the documentation most likely to be familiar to the crew can be interpreted to create doubt about the priority of an RA, especially in an ATC controlled airspace: The TCAS Pilots Guide used by the State Special Centre for the TU154M crews training was written as a training aid to the operation of the TCAS. It was a generic document and was not specific to the TU154M or Russian Regulations (or the many other organisations world wide that used the document). It states that approved AOMs contain information about specific aircraft TCAS configurations, and that flightcrew must familiarise themselves with any special TCAS operating rules that may be in effect in different countries in which they operate.
AX001-1-2/02
102
BFU
Bundesstelle fr Flugunfalluntersuchung Paragraph 6.1 of the TCAS Pilots Guide states TCAS 2000 is intended as a back-up to visual collision avoidance, application of right-of-way rules, and ATC separation services, and leaves a degree of ambiguity over the interpretation of the term "back-up". This ambiguity is partially clarified later in the same paragraph by the statement: Delayed crew responses or reluctance of a flight crew to adjust their flight path as advised by TCAS 2000 due to ATC clearance provisions, fear of later scrutiny by authorities, or other factors will significantly decrease or negate the protection afforded by TCAS 2000. Even with this statement there may still be doubt as to an absolute authority to follow an RA. The TU154M AOM (Paragraph 8.18.3.1 dated 07/00) contains general recommendations regarding the use of TCAS. Paragraph 1 of the reference lists the means of collision avoidance as being visual separation, adherence to route, and though ATC instruction. Paragraph 2 of the reference states that TCAS is an additional system to indicate intruder traffic, with vertically commanded manoeuvres to be followed, if it is necessary. It rests the final decision to follow the TCAS command with the PIC. The AOM reference draws attention to the fact that manoeuvring opposite to TCAS can lead to a collision. The intention of the reference may have been to inform the pilots to follow TCAS instructions as a last defence against a mid-air collision, but the structure of the reference allows interpretation that the principles stated in paragraph 1 have priority over the content of paragraph 2, i.e. TCAS RA. The TU154M AOM (Para. 8.18.3.2 (4) dated 6 December 1999) stated that manoeuvring opposite to a TCAS RA is prohibited. This is a categorical statement, but does not include reference to the presence of other factors e.g. GPWS. The TU154M AOM (Para. 8.18.3.4 (2)) states: The ATC service to be the basic system for the collision avoidance. Nevertheless, in case of no link with ATC, the TCAS will help the crew avoid a collision. This reference devalues the TCAS systems priority as it indicates the TCAS is a back-up when ATC is not available, and not a last resort defence to aid the PIC in avoiding a collision even in the presence of full ATC services, as intended by design and ICAO guidance. In the event of a TCAS RA communication requirements with ATC and follow up Incident Reporting requirements to the authorities have been detailed in the relevant documents and training material. Reporting from the aircraft crew to ATC is required at the time of the event, and adopts the terminology from ICAO Procedures for Air Navigation Services - Air Traffic Management, Doc 4444. Doc 4444 Section 12.3 ATC Phraseology includes for various TCAS events standard phraseology which are to be used in those situations. The situations covered do not consider the situation of the TU154M crew because according to the TCAS system philosophy an RA takes priority over an ATC instruction. Therefore, there was no need to create standard phraseology.
AX001-1-2/02
103
BFU
2.7
Analysis summary
Following the collision the two airplanes were no longer controllable and the impact on the ground was unavoidable. The accident was non-survivable. Due to the sectorisation work at ACC Zurich and the related operation of the radar system in the fall back mode, the unrestricted technical performance of the complete system was not available to the controller. The controller was not fully aware of the extent of the restrictions, as for instance he remembered only later on that the visual display of the STCA was not available in the fall back mode. For the controllers as the users of the system, a detailed description of the consequences resulting from the system work would have been necessary. It would have drawn their attention to the consequences in respect to the performance of the radar system. The directives issued did not contain such information. However, since on this evening the controllers had not read the instructions presented this deficiency did not have any consequence. The optical STCA would have alerted the controller of the danger approximately 2.5 minutes prior to the collision. Air traffic control, however, must work even where STCA is not installed or is for some other reason not available. STCA is, like TCAS, an additional safety system. Nobody in the control room had noticed the aural STCA generated by the system. It did not influence the course of the accident because it resounds just 6 NM before the calculated point of collision is reached and at that time the controller had already recognised the problem. The BFU has come to the conclusion that the technical capability of the radar system in the fall back mode was sufficient to ensure safe flight operations. According to the duty schedule, two controllers were responsible for the control of the entire air traffic in the airspace of ACC Zurich. This means that they had to assume the tasks of the radar planning controller (RP) and the radar executive controller (RE). Additionally, one controller had also to assume the functions of the chief controller and of the SYMA to some extent. Thus, the continuous presence of one controller at each of the different workstations was not ensured, e.g. when taking the prescribed breaks. The BFU considers this to be an insufficient number of air traffic controllers during the night shift resulting from the duty schedule. The BFU sees a further deficiency in the practice which has been applied already for years, i.e. during periods with decreased traffic flow, all traffic control tasks are accomplished by one controller. This practice was known to the management and also to the quality assurance of the air navigation service company, who, however, had not taken any actions to eliminate the defect. The BFU considers these deficiencies as systemic causal factors having led to the accident. The controller of ACC Zurich was in charge and responsible for the separation of the aircraft controlled by him. It was his responsibility to ensure a horizontal and vertical separation pursuant to the regulations by giving instructions to the flight crews in time, to supervise the compliance with the instructions and thus to ensure the safety of flight operations. Instructions given by air navigation services are on principle binding for the crew of the controlled aircraft. At the time of the accident, the normal horizontal separation of 5 NM was raised to 7 NM due to the fall back mode. This meant that all airplanes flying at the same flight level must have a horizontal distance of at least 7 NM to each other. At 21:34:56 hrs the separation was infringed, i.e. the TU154M should have descended to FL 350 to ensure a vertical separation of 1 000 ft in the RVSM airspace. To achieve this it would have been necessary to give the instruction to descend to FL 350 at 21:33:49 hrs at the latest - i.e. at least one minute before this instruction was actually given. This time is based on a rate of descent of 1 000 ft per minute which is normal at this altitude. The compliance of the prescribed separation would certainly have prevented the accident. A TCAS TA or RA would not have been issued. When in addition to the two airplanes, for which the control strips had already come in, the unexpected approach of a delayed A320 to Friedrichshafen was announced the controller as-
AX001-1-2/02
104
BFU
Bundesstelle fr Flugunfalluntersuchung sumed the task to control the approach also. Hence he now had to fill two adjacent workstations with three functions (RP, RE and approach) and he had to perform the radio communications on two different frequencies. The controller noticed the imminent infringement of the separation too late because he concentrated on this task which was also time-consuming due to the failure of the telephone system (connection to Friedrichshafen). His instructions and traffic information, which he issued from the workstation RP to the crew of the TU154M, were not appropriate to the urgency of the situation or even contributed to the creation of disagreements. The controller considered the problem solved too early and moved to the adjacent workstation. Therefore, he did not notice any more that the B757-200 crew had followed the TCAS advisory and had started to descend as well and that therefore an acute collision risk existed. He felt urged to do so by the Airbus A320 crew who had already called ACC Zurich for the second time on the other frequency. The controller did not hear the message of the B757-200 crew (TCAS descent) issued at 21:35:19 hrs (i.e. 13 seconds prior to the collision). Generally it would have been possible for the controller to safely handle the traffic consisting of three airplanes at the time of the accident. The controller came to the same conclusion and did not ask for support from his colleague in the lounge. This decision was probably based on his experience regarding a smooth course of operation and did not take into consideration possible problems, such as the failure of the telephone system. Once he realized the problem with the inoperative telephone system it was already too late to alert the colleague. The repeated attempt to phone Friedrichshafen about the arrival of the A320 diverted his attention longer than intended from the proactive traffic control of the two other airplanes. He did not utilise the option to separate the two converging airplanes sooner by respective instructions because he did not consider the imminent approach to be crucial. When the controller concentrated again on the two airplanes in the upper airspace and recognized the conflict he immediately issued an avoidance instruction to the TU154M crew, which they realised directly and acknowledged with some delay. He did not know anything about the RA which had been issued immediately after his instruction and was in contradiction to it. Altogether the BFU considers the issued instruction to the TU154M crew as too late and the resulting separation infringement as one of the immediate causal factors having led to the accident. The TU154M crew has attentively observed the development on the TCAS display showing the conflicting traffic and discussed it internally. When the distance between the airplanes was still approximately 10 NM, the commander of the TU154M visually identified the other airplane. Thus the TA was no surprise for the crew. When they received the instruction of the controller to descend to FL 350 and the explicit information about the conflicting traffic it was clear to them that the controller had also realized the situation and had made a decision to solve the problem. They followed this instruction very swiftly because they were in a situation of uncertainty, which now could be considered as settled. After TCAS issued an RA to climb the crew stuck to their decision to follow the controllers instruction. The decision to follow the controllers instruction was even confirmed to be correct by the repeated instruction to descend and the information of the controller about the other airplane being at FL 360. The BFU assumes, however, that the TU154M crew would have followed TCAS if the controller had not earlier instructed an avoidance manoeuvre in the form of a descent. The two avoidance manoeuvre instructions were not discussed by the two pilots, which leads to the conclusion that the decision for the already initiated descent was not questioned. Only the copilot sitting on the rear left but without any assigned function in the cockpit, referred twice to the TCAS and the instruction to climb and thus questioned the descent. But he did not find audience because the PIC had no doubt about the correctness of the controller's instruction. This decision did not take into consideration that an RA is a vertical avoidance manoeuvre where the airplanes involved get complementary advisories for collision avoidance. The flight operations regulations of the TU154M operator and ICAO documents do not include clear directives as to which actions the crew should take, if the instructions issued by ATC and
AX001-1-2/02
105
BFU
Bundesstelle fr Flugunfalluntersuchung an RA contradict each other. They include, however, a clear statement that manoeuvres contrary to an RA are prohibited ( , .). It is to be assumed that the crew considered the instruction to descend to FL 350 more as a manoeuvre to avoid an imminent collision than a normal manoeuvre to re-establish the prescribed separation. This fits the picture of the swift initiated and carried out descent which was not finished early enough to level off at FL 350. After the crew initiated a descent contrary to the RA, the outcome was left to chance. The BFU considers the accomplishment of the manoeuvre contrary to the RA to be one of the immediate causal factors having led to the accident. The B757-200 crew obviously noticed the conflicting traffic not until TCAS generated a TA at 21:34:42 hrs. The copilot as PF decided at 21:34:24 hrs to go to the lavatory and handed over the control of the airplane to the PIC. He probably would not have done so, if the crew had already noticed the conflicting traffic on the VSI/TRA. At this time the distance between the two airplanes was still 13.6 NM and the other airplane would have been displayed on the VSI/TRA provided the resolution had been set to16 NM. The actual setting could not be determined. It is not part of the prescribed and practised procedures to constantly observe the TCAS display on the respective instruments. According to the system philosophy, the attention of the crew is drawn to a potential conflict by the acoustical annunciation of a TA or an RA. When the TA was issued, the copilot was probably already in the rear cockpit area. He heard the TA and returned to his seat. At 21:35:10 hrs he had taken his seat again. During the crucial period from 21:34:56 hrs, when the RA was generated, until the return of the copilot to his workplace, the PIC had to simultaneously accomplish the tasks of the PF and of the PNF. It was his primary tasks to initiate the descent advised by TCAS. Within 12 seconds the required rate of descent of 1 500 ft/min was reached. He also reacted correctly to the TCAS advisory increase descent. The rate of descent provided for this was reached within approximately six seconds. The time span of 23 seconds from the RA until the report to ACC Zurich regarding the initiated TCAS descent generally appears as too long. The reason why may be explained by the particular situation the commander found himself in. He was the PF and had no support from his copilot at that time. Therefore he immediately initiated the TCAS descent which according to the procedure had absolute priority. Immediately afterwards there was no opportunity to transmit the message as the frequency was occupied by the radio communications between ACC Zurich and the TU154M. Not until the copilot had taken his seat in the cockpit again and had put on the headset, the frequency was free and the message could be transmitted. The BFU has come to the conclusion that the B757-200 crew had reacted correctly to the situation. They followed the procedures in the best way possible considering the particular situation. With ACAS/TCAS an additional safety system was introduced into aviation. It works independently of ground equipment and is installed in airplanes. ACAS/TCAS is a system of last resort and works independently of ATC units. Collision avoidance is one of the common tasks of the two systems. The instructions of both systems may command opposite directions. Yet, in case of an RA ACAS/TCAS takes priority, there is no contradiction. ACAS/TCAS as actually implemented apparently comes short of its intended purpose: The Integration of ACAS/TCAS II into the system aviation was insufficient and did not in all points correspond with the system philosophy. The regulations concerning ACAS/TCAS II published by ICAO and as a result the regulations of national aeronautical authorities, operational and procedural instructions of the TCAS manufacturer and the operators were not standardised, incomplete and partially contradictory. The BFU considers these deficiencies as systemic causal factors having led to the accident.
AX001-1-2/02
106
BFU
3.
3.1
CONCLUSIONS
Findings
Airplanes Both airplanes were properly certificated for air transport. The investigation did not determine any technical defects on the two airplanes. Both airplanes were approved for RVSM. Both airplanes had been retrofitted with TCAS II Version 7 (ACSS TCAS 2000). A VSI/TRA indicator was used as optical display. In both airplanes there was no evidence of a TCAS malfunction. The B757-200 TCAS computer was destroyed by impact forces so that an evaluation was not possible any more. It was possible to analyse essential data of both airplanes from the TCAS computer of the TU154M. At the time of the accident visual meteorological conditions at dark night prevailed. Due to the high closure rate of 702 kt - 718 kt (361 -369 m/s) and the darkness, a visual avoidance manoeuvre was for neither of the flight crews a possibility to prevent the collision. The flight paths crossed at right angles. The B757-200 had a northern heading (004) and the TU154M a western heading (274). The collision occurred at an altitude of 34 890 ft. The first contact took place between the vertical tail of the B757-200 and the left wing succeeded by the left fuselage side of the TU154M in the area of the emergency exits. The damage to the fuselage of the TU154M resulted in an explosive decompression. Due to the structural damage, the TU154 was no longer controllable after the collision. It suffered an in-flight break-up and some of the components caught fire. During the collision approximately 80% of the B757-200s vertical tail were destroyed. Afterwards the airplane became uncontrolled and crashed into a forest at a negative pitch angle of approximately 70. The accident was non-survivable for the occupants of the two airplanes. The flight crew members of both airplanes held the required valid licences and medical certificates. The autopsies of all flight crew members did not indicate any impairments of health. The examinations for medicine, drugs and alcohol produced negative results. Both operators had provided training programmes for TCAS and the flight crews had, as far as necessary, completed the corresponding training. Practical TCAS training of the flight crew of the TU154M in the flight simulator was not possible, as the simulators were not appropriately equipped. The flight operations manuals of both operators contained provisions for the handling of TCAS. The flight operations manuals of both operators did not contain detailed descriptions of the tasks of the individual flight crew members in the case of TCAS occurrences. In the operations manual of the TU154M the TCAS description wording was such that ATC had the highest priority in collision avoidance. The accident occurred over German territory. In accordance with a letter of agreement (LoA), ACC Zurich was responsible for the air traffic control in this area. The management of the air navigation service company had implemented a new safety policy dated 23 October 2001. These principles show that a safety culture was to be evolved in which managers and employees were aware of their critical importance for safe operations. Organisational steps to implement these principles were also taken. The process to realise the new safety culture was, however, still under way.
Accident
Flight crews
Flight operations
Air traffic control (ATC)
AX001-1-2/02
107
BFU
Bundesstelle fr Flugunfalluntersuchung Sectorisation work was carried out within ACC Zurich in order to re-arrange the control sectors in the night from 1 to 2 July 2002. During this time the radar system was operated in the fallback mode and the separation minimum had been increased from 5 to 7 NM. In doing so the MV9800 radar computer was not available to the controllers, therefore - no automatic correlation of the flight targets was possible and - the optical STCA was not displayed anymore. The direct phone connections with the adjacent ATC units were not available to the controller of ACC Zurich during the time from 21:23 hrs until 21:34:37 hrs. An automatic change-over of incoming calls to the bypass system was not in existence. At 21:34:44 hrs the first of a total of four calls, three calls from UAC Karlsruhe and one call from Friedrichshafen, was registered. These calls had not been answered. There were written directives concerning the accomplishment of the work, however, they did not include explanations about the effects the work would have on the availability of technical equipment. The CoC did not know about the sectorisation work. An assessment to minimise risks did not take place. Besides the technicians three additional colleagues were present in the CIR. - One of the managers to support the ATCO - One SYMA - One controller to support the technicians The ATCO did not know about the tasks of these colleagues. The sectorisation work had not been coordinated with the adjacent ATC units. According to the duty schedule, two controllers were responsible for the control of the entire airspace of ACC Zurich during the night shift. They had to assume the tasks of radar planning (RP), radar executive (RE) and to a limited extent also the functions of the supervisor (DL) and the system manager. Therefore, a continuous management of the different tasks was not ensured. An assessment to minimise risks during the night shift did not take place. The controllers were obliged to read the directives concerning the accomplishment of the system work. But they did not read them. The supervisor (DL) had merely given them general information about the work. Two assistants were at the disposal of the controllers to support them with routine and coordination tasks, however, they had no authorization to assume any traffic control functions. After the air traffic flow had decreased one controller retired to rest at about 21:15 hrs and approximately 10 minutes later one assistant retired to rest. Normally they would not return to the control room until early in the morning. It had been known to and tolerated by the management and the quality assurance of the air navigation service company for years that during the night at periods of low traffic flow only one controller performed all traffic control tasks whereas the other controller had a rest. Both controllers were qualified and licensed in accordance with the regulations in force. The controller remaining in the control room was examined after the accident for medicine, drugs and alcohol which produced negative result. At the time of the accident the controller had to control three airplanes: - the B757-200 in direct approach to Tango VOR at FL 360 - the TU154M in direct approach to Trasadingen VOR at FL 360 and - a delayed Airbus A320 approaching Friedrichshafen. The Airbus was controlled on 119.920 MHz and the two other airplanes on 128.050 MHz. Therefore they could not hear each other which resulted in simultaneous transmissions. For all flights the control strips were available to the controller in time. From the control strips the impending conflict situation (B757-200 and TU154M) was only recognisable in combination with the radar display. The controller was solely responsible for the entire ATC within ACC Zurich. For this he had to fill two adjacent workstations with different frequencies and worked with two radar monitors. In order to control flights in the upper airspace and the approach in the lower airspace to Friedrichshafen. Radar charts with different ranges were displayed on the monitors.
AX001-1-2/02
108
BFU
Bundesstelle fr Flugunfalluntersuchung The controller was not aware that in the fallback mode the optical STCA was not available. The system did not provide an automatic indication that the optical STCA was not available. During the last five minutes prior to the collision, the controller paid more attention to the Airbus A320 in approach to Friedrichshafen. The bypass telephone system had temporarily a technical defect so that the necessary coordination with Friedrichshafen could not take place by phone. At 21:33:24 hrs the radar controller of UAC Karlsruhe was alerted by his STCA of the conflict situation. His attempts to warn the controller of ACC Zurich by phone were not successful as a telephone connection could not be established. The controller did not notice the imminent separation infringement in time. He instructed the TU154M crew at 21:34:49 hrs (43 seconds prior to the collision) to descend to FL 350 which was too late to ensure the required separation to the B757-200. The phraseology used did not correspond with the urgency of the situation. At 21:34:56 hrs the prescribed separation of 7 NM was infringed. The TU154M crew followed the ATC instruction immediately and initiated the descent. At 21:34:56 hrs (35 seconds prior to the collision) TCAS generated RAs in both aircraft simultaneously. - The B757-200 crew received an RA to descend. The copilot was not in his seat at the time. The PIC followed the RA and initiated the descent. - The TU154M crew had already initiated the descent when they received the RA to climb. The RA did not change the decision and the descent was continued. This decision did not take into account that very likely simultaneously with this RA the other airplane involved would receive a complementary RA. The copilot of the TU154M questioned the continuation of the descent twice. But he could not gain anybodies ear. A comment that TCAS has priority over ATC did not come from any of the crew members. The B757-200 crew reported 23 seconds after the RA the TCAS descent to ACC Zurich. The copilot hat taken his seat again at that time and the frequency was free. According to his statement the controller did not notice the message of the B757-200 crew. The first part of the message was incomprehensible due to the simultaneous transmission of both crewmembers. The second part coincided with a message at the adjacent workstation (RE) transmitted by the A320. At 21:35:00 hrs the MV9800 computer of ACC Zurich released an aural STCA warning to the workstation of the controller. This warning had not been noticed in the control room. Once the controller noticed that the TU154M had initiated the descent he again turned to the A320 whose crew had already called him twice. He did not continue to observe the developing situation. An automatic downlink, integrated in the TCAS equipment, carrying information about issued RAs to the respective ATC units has not been introduced worldwide yet. It was determined that with the prescribed reports via radio delays and loss of information may occur. The ACAS/TCAS related international regulations and national procedures valid on the day of the accident were not sufficiently clear or incomplete and misleading and did not fully correspond to the system philosophy.
ACAS/TCAS
AX001-1-2/02
109
BFU
3.2
Causes
The following immediate causes have been identified: The imminent separation infringement was not noticed by ATC in time. The instruction for the TU154M to descend was given at a time when the prescribed separation to the B757200 could not be ensured anymore. The TU154M crew followed the ATC instruction to descend and continued to do so even after TCAS advised them to climb. This manoeuvre was performed contrary to the generated TCAS RA.
The following systemic causes have been identified: The integration of ACAS/TCAS II into the system aviation was insufficient and did not correspond in all points with the system philosophy. The regulations concerning ACAS/TCAS published by ICAO and as a result the regulations of national aviation authorities, operational and procedural instructions of the TCAS manufacturer and the operators were not standardised, incomplete and partially contradictory. Management and quality assurance of the air navigation service company did not ensure that during the night all open workstations were continuously staffed by controllers. Management and quality assurance of the air navigation service company tolerated for years that during times of low traffic flow at night only one controller worked and the other one retired to rest.
AX001-1-2/02
110
BFU
4.
SAFETY RECOMMENDATIONS
The BFU has released on 1 October 2002 the following Safety Recommendation to ICAO: Safety Recommendation No. 18/2002
ICAO should change the international requirements in Annex 2, Annex 6 and PANS-OPS (DOC 8168) so that pilots flying are required to obey and follow TCAS resolution advisories (RAs), regardless of whether contrary ATC instruction is given prior to, during, or after the RAs are issued. Unless the situation is too dangerous to comply, the pilot flying should comply with the RA until TCAS indicates the airplane is clear of the conflict. The BFU has released on 21 July 2003 the following Safety Recommendations to the Federal Office for Civil Aviation (FOCA), Switzerland: Safety Recommendation No. 01/2003
The Federal Office for Civil Aviation (FOCA) should ensure that the air traffic control service provider issues and implements procedure to undertake maintenance work on the ATC Systems stipulating operational effects and available redundancies. The procedure shall include the following aspects: Stipulating the detailed responsibilities of the Operational Division and the Technical Division. Personnel reserve planning of the operational staff for maintenance work on the ATC Systems. Timely dissemination of procedure to the controllers, in order to prepare them to deal with the situations. Establish and implement the checklists for the maintenance as well operational staff, when maintenance work on the ATC Systems is undertaken, to enhance the safety net. Selection of best possible time from operational aspects for the maintenance work on the ATC Systems. 02/2003
Safety Recommendation No.
The FOCA should ensure that the ACC Zurich is manned with the minimum number of air traffic controllers as follows: There shall be at least two controllers on active duty at all times. There shall be at least two controllers to manage enroute sectors; i.e.: one Radar Planner (RP) and one Radar Executive (RE). When ACC is required to manage the approach services for Friedrichshafen and Altenrhein/St. Gallen, one additional controller shall be assigned to this task. Alternatively, this task should be taken over by APP Zurich. Additional controllers shall be assigned to manage breaks. 03/2003
The FOCA should ensure that the air traffic controllers are imparted with the initial and recurrent training covering the theoretical and practical (simulator) emergency procedures, particularly covering the following aspects: Recognition of potential air traffic conflict and maintenance of aircraft separation in accordance with the international standards. A quick re-establishment of the minimum separation, in an event of having fallen below it. The use of appropriate phraseology, with an emphasis on achieving maximum effects within minimum possible time/radio transmission.
AX001-1-2/02
111
BFU
Bundesstelle fr Flugunfalluntersuchung The BFU has released on 19 May 2004 the following Safety Recommendation to ICAO: Safety Recommendation No. 06/2004
ICAO should ensure that rules and procedures regarding ACAS are uniform, clear and unambiguous. Compliance should be ensured in the ICAO Annexes 2, 6, the PANS and the Guidance Material. The procedure for pilots should include the following elements: In the event of an ACAS Resolution Advisory (RA) to alter the flight path pilots shall: Respond immediately and manoeuvre as indicated, unless doing so would jeopardize the safety of the airplane. Never manoeuvre in the opposite sense to an RA, nor maintain a vertical rate in the opposite sense to an RA. Safety Recommendation No. 07/2004
ICAO should ensure an high level of acceptance and confidence of pilots staff in ACAS by improving education and training. Therefore the Attachment B to State letter AN 11/19-2/82 should be transferred in a PANS (Procedures for Air Navigation Services). Safety Recommendation No. 08/2004
To enhance the performance of ACAS ICAO should initiate the development of down-linking RAs to ATC, using such technologies as SSR Mode S and Automatic Dependent Surveillance Broadcast (ADS-B). Safety Recommendation No. 09/2004
To improve the investigation of future accidents and incidents ICAO should require ATS units in addition to present regulations - to be equipped with a recording device that records background communication and noises at ATCO workstations similar to a flight deck area microphone system. Safety Recommendation No. 16/2004
Utilizing its own mechanism and international resources available ICAO should ensure that all ACAS/TCAS users are consistent in their response to the equipment advice. ICAO auditing processes must pursue compliance with its ACAS SARPs and training objectives at all levels within the aviation industry. The BFU has released on 19 May 2004 the following Safety Recommendations to the Federal Office for Civil Aviation (FOCA), Switzerland: Safety Recommendation No. 10/2004
The Federal Office for Civil Aviation (FOCA) should ensure that the air traffic control units of the air traffic control service provider are equipped with an effective Short Term Conflict Alert system covering the following minimum demands: An appropriate indication of failure or unavailability of STCA at the affected air traffic controller workstation. An adjustment of volume that prevents the controller from missing the acoustical STCA warning. When activated the acoustical STCA warning should sound permanently until acknowledgement at the affected workstation by the ATCO. 11/2004
The FOCA should ensure that the air traffic control service provider equips air traffic control units with telephone systems which in case of a failure or shutdown of the main telephone system reroutes incoming telephone calls automatically to the bypass telephone system.
AX001-1-2/02
112
BFU Safety Recommendation No. 12/2004
The FOCA should ensure that the radar system of the air traffic control service provider is technically equipped in a way that enables display updates within 8 seconds or less in en-route airspace. Safety Recommendation No. 13/2004
The FOCA should ensure that the air traffic control units of the air traffic control service provider are equipped with system recording and replay facilities in accordance to a recommendation of Eurocontrol that enables a complete reconstruction of the surveillance data presentation, display settings and selections at the controller`s display position. Safety Recommendation No. 17/2004
The FOCA should ensure that the air traffic service provider takes appropriate action to assure an effective operation of their safety management system in as much as that international requirements (ICAO SARPs, Eurocontrol ESARRs) are assured, and appropriate safety strategies, management techniques and quality procedures are incorporated and evaluated. Safety Recommendation No. 18/2004
The FOCA should ensure that the air traffic service provider conducts an evaluation of the staffing levels required. The evaluation should not be limited to identifying the number of personnel required but also consider the qualification and experience required of specialist functions. Safety Recommendation No. 19/2004
The FOCA should ensure that the air traffic service provider develops and implements refresher and safety related training compliant with ESARR 5 and adapted to the operating environment. The BFU has released on 19 May 2004 the following Safety Recommendation to the Civil Aviation Authority (CAA) of the Russian Federation: Safety Recommendation No. 14/2004
The Civil Aviation Authority should ensure that the ACAS training for flight crews is in accordance to the requirements and guidelines of Attachment B to State letter AN 11/19-2/82. The following aspects should be covered: Flight simulators equipped with ACAS or inter-active Computer Based Training (CBT) should be utilized for training of ACAS maneuvers. ACAS event scenarios should be included in Crew Resource Management (CRM) and Line-Oriented Flight Training (LOFT) programmes. Safety Recommendation No. 21/2004
The Civil Aviation Authority of the Russian Federation should ensure that exposure to Crew Resource Management training within the airline industry is advanced. The use of flight simulators or appropriate synthetic training devices for Line-Orientated Flight Training should be promoted. The BFU has released on 19 May 2004 the following Safety Recommendation to the Federal Aviation Administration (FAA) of the United States of America: Safety Recommendation No. 15/2004
The Federal Aviation Administration should ensure that the TCAS 2 000 manufacturer rephrases the TCAS 2000 Operating Manual to reflect the ACAS/TCAS system philosophy and the international ACAS/TCAS regulations and operating procedures in a unambiguous and consistent manner.
AX001-1-2/02
113
BFU Braunschweig, 19 May 2004
Bundesstelle fr Flugunfalluntersuchung (Federal Bureau of Aircraft Accidents Investigation) In Commission
Schneberg Investigator in charge The following BFU staff members have contributed to the investigation: Uwe Berndt George Blau Jens Friedemann Hans-W. Hempelmann Eberhard Krupper Heinrich-H. Niebaum Hans Peters Johann Reu Dieter Ritschel Karsten Severin Frank Stahlkopf Axel Thiel within investigation group Site Survey and Aircraft Tupolev for reconstruction of flight path Chairman of investigation group Site Survey and Aircraft Tupolev Within investigation group Flight Recorders Chairman of investigation group Operations Chairman of investigation group Site Survey and Aircraft Boeing Chairman of investigation group ATC Chairman of investigation group TCAS Within investigation group Flight Recorders Deputy chairman of investigation group TCAS Chairman of investigation group Human Factors Within investigation group Site Survey and Aircraft Boeing Chairman of investigation group Flight Recorders
5.
APPENDICES
Reconstruction of flight path according to radar data Events in both cockpits Record of events (last minute) FDR-data (extracts) of the B757-200 (last minute) FDR-data (extracts) of the TU154M (last minute) TCAS- and FDR-parameters (extracts) of B757-200 and TU154M Reconstruction of collision Distribution of main wreckage-parts Regulations of Single Manned Operation (SMOP) Publication of deviating statements
Appendix 1 Appendix 2 Appendix 3 Appendix 4 Appendix 5 Appendix 6 Appendix 7 Appendix 8 Appendix 9 Appendix 10
AX001-1-2/02
114

Uberlingen PDF

Uploaded by

Copyright:

Available Formats

Uberlingen PDF

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Uberlingen PDF

Uploaded by

Copyright:

Available Formats

Bundesstelle fr Flugunfalluntersuchung

German Federal Bureau of Aircraft Accidents Investigation

AX001-1-2/02 May 2004

Type of aircraft: Manufacturer/Model:

Injuries to persons: Damage to aircraft: Other damage: Source of Information:

AX001-1-2/02 May 2004

Type of aircraft: Manufacturer/Model:

Injuries to persons: Damage to aircraft: Other damage: Source of Information:

All times given are in UTC unless indicated differently

BFU 1.5.2 Tupolev TU154M Commander (under supervision) Age: Licenses:

BFU Flight engineer Age: Licenses:

Wreckages and impacts information

ram air turbine without propeller

BFU Additional findings:

Separated top portion of vertical fin and rudder

TU154M fuselage cross-section

Remaining stub of vertical fin on main wreckage

B757-200 damage on vertical tail in relation to cross-section of TU154M

BFU 1.12.2 Tupolev TU154M

overall view forward section of the aircraft fuselage

centre wing section

BFU Tail section

overall view rear fuselage section/tail unit

overall view right wing

lower surface of the right wing with scratch marks

BFU Scattered debris

Fairing of right main landing gear

right wing lower surface with traces of the collision

Red paint and debris of the B757-200

Reconstruction of the collision according to FDR data and collision evidence

Medical and pathological information

Tests and research

Organizational and management information

Control strip for B757-200

Control strip for TU154M

BFU 1.17.3 Operator of the TU154M

Bundesstelle fr Flugunfalluntersuchung The TCAS system consists of the following components:

TCAS system components

BFU Displays in the cockpit

VSI with integrated TCAS

Indications on VSI/TRA of the most important TCAS-Advisories

RA: vertical rate to be avoided

Vertical speed needle

RA: required vertical rate

EFIS navigation display in ROSE-Mode with TCAS information

BFU Collision Avoidance Logic

Dont climb Dont climb > 500 ft/min

V/S < +1000 ft/min V/S < +2000 ft/min

V/S > -1000 ft/min V/S > -2000 ft/min

BFU Publications of ICAO

BFU State letter AN 11/19-02/82

VSI/TRA of the B757-200

Position of the VSI/TRA in the B757-200 cockpit

BFU Tupolev TU154M: TCAS equipment and findings

Position of the VSI/TRA) in the TU154M cockpit

BFU Extraction from TCAS-Data of the TU154M:

There will be no aural message

Useful or effective investigation techniques