If you are interested in the topic please register to the ALIAS network: http://network.aliasnetwork.eu/ to download other materials and get information about the ALIAS project (www.aliasnetwork.eu).

1. ACCIDENTS AND LIABILITIES
Giovanni Sartor | European University Institute
Giuseppe Contissa | European University Institute
Paola Lanzi | Deep Blue
Patrizia Marti | Deep Blue
Marta Simoncini | European University Institute

2. Accidents and liabilities: 4 cases
1. Überlingen
2. Linate
3. Unmanned Aircraft Systems (UAS)
4. Automated Highway System (AHS)

3. Legal analysis: responsible actors I (individuals)
• Pilots:
• criminal liability (e.g, manslaughter);
• fault civil liability (e.g. professional liability);
• disciplinary liability
• ATCOs
• As for pilots
• Managers:
• As for pilots, on ground of organisational
liability

4. Legal analysis: responsible actors II
(final providers)
• Air companies
• strict civil liability (with cap and contributory negligence)
• vicarious civil liability (for faults of pilots and managers),
• corporate criminal liability (in a few cases and systems)
• Air navigation service provider
• strict civil liability,
• vicarious civil liability (for ATCOs and managers),
• corporate criminal liability
• Airport companies
• As for air navigation service providers
• Aviation authorities
• As for air navigation service providers

5. Legal analysis: responsible actors III
(additional providers )
• Technology providers
• Product liability, contractual liability (sale or service)
• Standard-setters
• Fault civil liability
• Maintenance providers
• Fault liability, contractual liability (services)
• Insurance companies
• First party insurance, Third party insurance
• States
• civil liability towards other actors and victims

6. Legal analysis: legal analysis IV
(victims)
• Operators (pilots, crews, on-ground personnel)
• Passengers
• Owners of carried baggage or goods
• Air companies
• Airports
• Third parties on the surface

7. Accidents and liabilities: 4 cases
1. Überlingen
2. Linate
3. Unmanned Aircraft Systems (UAS)
4. Automated Highway System (AHS)

8. ÜBERLINGEN: context
On the night of July 1st, 2002, Bashkirian Airlines Flight 2937 flies over
Ueberlingen (Germany) with 69 people on board
Airspace is controlled by the private Swiss company Skyguide

9. The accident
Bashkirian Airlines Flight 2937 collides with DHL Flight 611
None of the 71 persons onboard the aircrafts survives.

10. ÜBERLINGEN: Accident analysis I
• STANDARD DEVIATION FROM PROCEDURES (latent
condition):
• Only one controller
• TECHNICAL MALFUNCTION (active error):
• As effect of maintenance interventions the ATC system slowed
down, phones were not working and STCA deactivated.
• TECHNICAL MAINTENANCE FAILURE (latent condition):
• no information about update

11. ÜBERLINGEN: Accident analysis II
• HUMAN ERROR (active error):
• Controller did not notice that DHL611 and BAL2937 were both
at FL360 on a collision course.
• HUMAN ERROR (active error):
• Controller cleared BAL2937 to expedite the descent, being not
aware of the TCAS resolution advisory on board.
• INADEQUATE PROCEDURES (active error):
• the BAL2937’s pilot starts descent manoeuvre, although the
TCAS suggest climbing, according to Russian procedures
incoherent with international one

12. Uberlingen legal analysis: responsible actors
I (individuals)
• Pilots (died on the accident):
• fault civil liability (e.g. professional liability), but possibly
exempted for obeying procedures
• ATCOs
• Criminal liability (manslaughter): acquitted by the Swiss judge;
a wise choice?
• Civil liability (only as as ground for vicarious liability)
• Managers:
• Criminal liability (manslaughter): condemned by the judges
• Civil liability (only as as ground for vicarious liability)

13. Uberlingen legal analysis: responsible actors
II (final providers)
• Air companies (Baskyrian Airlines)
• strict civil liability: condemned
• vicarious civil liability: acquitted
• Air navigation service provider (Skyguide)
• strict civil liability
• vicarious civil liability (for ATCOs and managers)

14. Uberlingen legal analysis: responsible actors
III (additional providers)
• Technology providers (TCAS producers)
• Product liability: condemned
• Maintenance providers
• Fault liability (ATSEP manager): condemned
• Insurance companies
• First party insurance
• Third party insurance
• States
• civil liability towards BAL (Germany)
• Standard-setters
• No legal procedures against standard-setters

15. Ueberlingen: general considerations
• No criminal/civil liability for operators.
• Liability for airlines (with recourse against ANSP/State)
• Criminal liability for ANSP managers
• Civil liability for ANSP
• Civil liability for State (with recourse against ANSP?)
• Civil liability for technology producer
• A correct framework? How to share the costs? According to
causality?

16. Accidents and liabilities: 4 cases
1. Überlingen
2. Linate
3. Unmanned Aircraft Systems (UAS)
4. Automated Highway System (AHS)

17. Linate
On the 8th October 2001, Cessna Citation CJ2 business
jet crosses the takeoff lane of Scandinavian Airlines
Flight 686

18. Linate
All 114 people on board the two aircrafts
and 4 persons on the ground are killed

19. LINATE: Accident Analysis I
• LACK OF RADAR SUPPORT (latent condition)
• Old radar dismissed, new radar not operative
• LACK OF PERSONNEL (latent condition)
• Ground controller too busy
• HUMAN ERROR (active behaviour)
• Cessna was allowed to land, although aircraft and pilot were
not licensed to operate in this airport
• TECHNICAL MALFUNCTION (latent condition)
• Due to problems in the R/T, audio was often distorted and
unclear.

20. LINATE: Accident Analysis II
• AMBIGUOUS LIGHTS (latent condition)
• R6 lights were very brilliant, while those of R5 were less
evident.
• INADEQUATE ROAD SIGNS (latent condition)
• S4 was an old sign (written in ICAO standard font) no more in
use at the airport, but still present on the taxilines. S4 is
present only in R6, not in R5, but its meaning was unknown by
both pilots and ground controller.
• INADEQUATE STOP BAR LIGHTS (latent condition)
• The stop bar lights were inadequate and not coherent with the
standards. The pilot did not perceive them as stop bars.

21. LINATE: Accident Analysis III
• UNRELIABLE MAPS (latent condition)
• Pilot and controller were provided with unreliable maps in which
not all the signals available in the airport were reported.
• MISINTERPRATION AND WRONG CLEARANCE (active error)
• When the pilot reported to be at S4, approaching the runway, the
ground controller assumed that the position report was wrong and
that the flight was actually at the crossroad between R5 and R6.
As a consequence the ground controller instructed to flight to
proceed to the North. The ground controller was considering the
flight on R5 while instead it was approaching the runway.
• RUNWAY INCURSION SENSOR DEACTIVATED (latent
condition)
• At the crossing between the taxiline R6 and the runway there was
a microwave sensor intended to alert the air traffic controller in
case of runway incursion. However, the sensor had been
deactivated because of some false alerts it had created before.

22. Linate legal analysis: responsible actors I
(individuals)
• Cessna Pilot (died on the accident):
• Possible fault civil liability (e.g. professional liability)
• Flight 686 Pilot (died on the accident):
• Innocent mistake (no liability)
• ATCOs
• Criminal liability (manslaughter): condemned
• Civil liability (only as as ground for vicarious liability)
• Managers:
• Criminal liability (manslaughter):
- airport director : condemned in first instance, acquitted in appeal
- Head of aviation authority (ENAC): condemned in first instance, acquitted
in appeal
- Head of ATC (ENAV): condemned for manslaughter (no prison for
amnesty)
• Civil liability (only as as ground for vicarious liability)

23. Linate legal analysis: responsible actors II
(final providers)
• Air companies
• strict civil liability to passengers, costs shared according to
responsibility (for CESSNA)
• Air navigation service provider (ENAV)
• strict civil liability
• vicarious civil liability (for ATCOs and managers)

24. Linate legal analysis: responsible actors III
(additional providers)
• Technology providers (map producers)
• Product liability: not addressed
• Maintenance providers
• Fault liability (radar): condemned ENAV for failed maintenance
• Insurance companies
• First party insurance
• Third party insurance
• States
• Not relevant
• Standard-setters
• Acquitted ENAC since not task-responsible for safety

25. Linate: general considerations
• Operator criminally liable, even if working under pressure
• Criminal liability for ANSP managers (through minor
sentence)
• No criminal liability for standard setting body (ENAC)
• Civil liability for technology producer not addressed
• A correct framework? How to share the costs? According to
causality?

26. Accidents and liabilities: 4 cases
1. Überlingen
2. Linate
3. Unmanned Aircraft Systems (UAS)
4. Automated Highway System (AHS)

27. Unmanned Aircraft Systems (UAS)
Aircrafts intended to operate without pilot on board
 Autonomous (AUAS)
 remotely piloted aircraft
systems (RPAS)

28. Regulatory framework for UAS
AUAS are not admitted in civil aviation
 Art. 8 of the ICAO Convention
RPAS are regulated by the ICAO circular 328/AN 190
 segregated airspace
 remote pilot licence
 remote pilot ultimate responsibility
 use of pilot stations
 commercial, scientific and security applications

29. UAS over nuclear plant (I)
Due to a radiation leak in a
nuclear power plant,
national authorities
close the lower
airspace over this region
and
authorise a non-military
security mission to
monitor the emissions of
the nuclear reactor

30. UAS over nuclear plant (II)
RPAS is used in the
mission
2 pilot stations cover
flight trajectory
licensed Remote
Pilot
UAS Operator
scientist in charge of
data collection
BLOS (Behind Line of
Sight) mode of
operations (UA Detect &
Avoid System)

31. Accident
mid-air collision
 A civil flight enters the segregated airspace, to land in the
nearest airport
 The ATCO takes responsibiliy of the separation between the
aircraft, and orders UAS to reduce speed
 The UA Detect & Avoid System suggests descent since
speed reduction insufficient
 Mission Manager chooses speed reduction and pilot
complies
 UAS collides with civil flight

32. Analysis of accident
• LATENT CONDITION
• The air traffic controller does not have precise information about the time
of reaction of the UA and its trajectory.
• ACTIVE ERROR
• The air traffic controller provides the traffic with an ineffective avoidance
instruction
• ACTIVE ERROR
• The remote pilot of the UA does not perceive that the instruction suggested
by the air traffic controller will be ineffective.
• ACTIVE ERROR
• The mission manager evaluates the suitability of the descent manoeuvre
suggested by the UA in the light of the mission objectives, but does not
consider collision risks and requests rejecting it
• ACTIVE ERROR
• The remote pilot underestimated collision risks and instructs to reduce
speed, rather than the maneuver suggested by the UA.

33. Legal analysis: responsible actors I
(individuals)
• Remote Pilots:
• criminal liability (e.g, manslaughter?);
• fault civil liability (e.g. professional liability);
• disciplinary liability
• ATCOs
• As for pilots
• Mission Manager:
• As for pilots (probably not since no responsibility for safety)

34. Legal analysis: responsible actors II (final
providers)
• Air company of the manned flight
• strict civil liability (with cap and right of recourse)
• Fault liability for antecedent malfunctioning?
• Air navigation service provider
• strict civil liability,
• vicarious civil liability (for ATCO)
• Airport companies
• Not applicable
• Aviation authorities
• As for air navigation service providers

35. Legal analysis: responsible actors III
(additional providers )
• Technology providers
• Technology on UAS functioned correctly
• Standard-setters (regulators)
• Not applicable
• Maintenance providers
• Not applicable
• Insurance companies
• First party insurance, Third party insurance
• States
• Fault civil liability (if height inappropriate?)

36. UAS accident in landing
RPASs are integrated in the civil airspace and are
used for commercial purpose

37. UAS accident in landing
Two Pilot stations are employed to control
aircrafts
Remote Pilot
Technical Operator

38. Accident on ground
• Communication failure between UA and the Pilot Station
approaching destination airport (RPAS => AUAS)
 Air Traffic Controller separates the UA from the rest of the
traffic
 The UA automatically follows the flight plan and manages
successful landing
 After landing it maintains a too high speed, and crashes into
airport building

39. Analysis of accident
• TECHNICAL FAILURE (ACTIVE ERROR)
• Failed communication link between Pilot Station and the UA. As a
remote pilot can download aircraft parameters, but not instruct
flight.
• ACTIVE BEHAVIOUR
• The air traffic controller decides to create a buffer around the UA
and to avoid crossings in order to minimise the risks associated to
possible unexpected UA automatic tasks.
• ACTIVE BEHAVIOUR
• The tower ATCO decides to dedicate the runway to the UA,
moving the rest of the traffic to other runways.
• TECHNICAL FAILURE (ACTIVE ERROR)
• The UA lands automatically in a perfect way, but after the landing,
maintains a too high speed, goes out of the runway and finally
stops against an airport building.

40. Legal analysis: responsible actors I
(individuals)
• Remote Pilots:
• Not liable (correct behaviour);
• ATCOs
• Not liable (correct behaviour)

41. Legal analysis: responsible actors II (final
providers)
• Air company of the unmanned flight
• strict civil liability (with cap and right of recourse)
• Air navigation service provider
• No liability (correct execution of task)
• Airport companies
• No liability (correct execution of task)
• Aviation authorities
• No liability (correct execution of task)

42. Legal analysis: responsible actors III
(additional providers )
• Technology providers
• Communication Technology provider: strict liability (product
liability) or fault liability (service liability), contractual liability (right
of recourse of UA provider)
• UA software/hardware provider: as above
• Standard-setters (regulators)
• Not applicable
• Maintenance providers
• If damage due to maintenance, fault liability (service liability),
contractual liability (right of recourse of UA provider)
• Insurance companies
• First party insurance, Third party insurance
• States
• Non applicable

43. Accidents and liabilities: 4 cases
1. Überlingen
2. Linate
3. Unmanned Aircraft Systems (UAS)
4. Automated Highway System (AHS)

44. AUTOMATED HIGHWAY SYSTEM (AHS)
US Department of Transportation (DOT) in 1994 launches
project for limited access roadway of driverless vehicles

45. Not yet!
1997 financial support withdrawn: project technically feasible but not
realistic also because of unsolved legal issues: Product liability,
Insurance, Safety, Standardization, Privacy

46. Why such a failure?
• Safety improvement insufficiently established
• Human machine interaction insufficiently analyses
• Liability transfer to technology producers not addressed
• Uncertainty on possible costs prevent insurance
• Privacy concerns need to be addressed

47. A successful case: airbags
In patented in 1953. Not used until 1973 for technical
obstacles and liability concerns.
Consumers do not want it: stops being offered
Becomes compulsory in the 1980’s

48. Why refuse airbags?
• Why car makers and consumers did not want the safe
technology?
• Rational choice for car makers: air-bags involve additional
costs and additional liabilities (and litigation), costs cannot be
shifted to consumers
• Possibly-rational choice for consumers: Consumer
underestimates risks and overestimates his/her skills

49. Liability transfer
• Before the introduction of airbags:
- many injures from crashes
- user (his insurance) is responsible
(for negligent driving);
• After the introduction of airbags:
- less injures from crashes, some
injuries from airbags
- manufacturer is responsible

50. WHY MANUFACTURERS DID NOT WANT
AIRBAGS?
Solutions:
• Educate consumers;
• Make airbags compulsory;
• Reduce manufacturers’ liability (state
of the art /approval defence, cap?)

51. Task transfer
• Technology induces task transfers
• From humans to technology
• From operators to technology producers-managers
• Between different operators and their companies

52. Liability transfers
• liabilities go with task-responsibilities,
• technology-induced task-transfers induce transfers in
allocation of costs of accidents
• Cost-transfer from victims to providers (non-compensable
damage may become compensable, for strict liability/level of
expected performance)
• Liability transfers from providers of human services to
providers of technology
• Liability transfers between providers of human services

53. ALIAS CONCLUSIONS
• Automation in ATM (and other socio-technical systems)
requires a legal framework
• Liabilities can contribute to safety but also hinder just
culture and the deployment of safety technologies
• We need to manage liabilities so that all useful technologies
are correctly deployed, and the right incentives are
provided
• This is the challenge of the ALIAS project

54. The team
• Giovanni Sartor, EUI - Project Leader
• Liam Bannon, DBL
• Giuseppe Contissa, EUI
• Paola Lanzi, DBL
• Patrizia Marti, DBL
• Anna Masutti, EUI
• Hans Micklitz, EUI
• Marta Simoncini, EUI
Thanks for your attention
Please register to the ALIAS network!
www.aliasnetwork.org/register.html