accidents and liabilities by alias consortium

Accidents and liabilities: 4 cases

1. Überlingen

2. Linate

3. Unmanned Aircraft Systems (UAS)

4. Automated Highway System (AHS)

Legal analysis: responsible actors I (individuals)

• Pilots:

• criminal liability (e.g, manslaughter);

• fault civil liability (e.g. professional liability);

• disciplinary liability

• ATCOs

• As for pilots

• Managers:

• As for pilots, on ground of organisational liability

Legal analysis: responsible actors II(final providers)• Air companies

• strict civil liability (with cap and contributory negligence)

• vicarious civil liability (for faults of pilots and managers),

• corporate criminal liability (in a few cases and systems)

• Air navigation service provider

• strict civil liability,

• vicarious civil liability (for ATCOs and managers),

• corporate criminal liability

• Airport companies

• As for air navigation service providers

• Aviation authorities


Legal analysis: responsible actors III (additional providers )• Technology providers

• Product liability, contractual liability (sale or service)

• Standard-setters

• Fault civil liability

• Maintenance providers

• Fault liability, contractual liability (services)

• Insurance companies

• First party insurance, Third party insurance

• States

• civil liability towards other actors and victims

Legal analysis: legal analysis IV(victims)

• Operators (pilots, crews, on-ground personnel)

• Passengers

• Owners of carried baggage or goods

• Air companies

• Airports

• Third parties on the surface


1. Überlingen

2. Linate



ÜBERLINGEN: context

On the night of July 1st, 2002, Bashkirian Airlines Flight 2937 flies over Ueberlingen (Germany) with 69 people on boardAirspace is controlled by the private Swiss company Skyguide

The accident

Bashkirian Airlines Flight 2937 collides with DHL Flight 611 None of the 71 persons onboard the aircrafts survives.

ÜBERLINGEN: Accident analysis I

• STANDARD DEVIATION FROM PROCEDURES (latent condition):

• Only one controller

• TECHNICAL MALFUNCTION (active error):

• As effect of maintenance interventions the ATC system slowed down, phones were not working and STCA deactivated.

• TECHNICAL MAINTENANCE FAILURE (latent condition):

• no information about update

ÜBERLINGEN: Accident analysis II

• HUMAN ERROR (active error):

• Controller did not notice that DHL611 and BAL2937 were both at FL360 on a collision course.

• HUMAN ERROR (active error):

• Controller cleared BAL2937 to expedite the descent, being not aware of the TCAS resolution advisory on board.

• INADEQUATE PROCEDURES (active error):

• the BAL2937’s pilot starts descent manoeuvre, although the TCAS suggest climbing, according to Russian procedures incoherent with international one

Uberlingen legal analysis: responsible actors I (individuals)

• Pilots (died on the accident):

• fault civil liability (e.g. professional liability), but possibly exempted for obeying procedures

• ATCOs

• Criminal liability (manslaughter): acquitted by the Swiss judge; a wise choice?

• Civil liability (only as as ground for vicarious liability)

• Managers:

• Criminal liability (manslaughter): condemned by the judges


Uberlingen legal analysis: responsible actors II (final providers)

• Air companies (Baskyrian Airlines)

• strict civil liability: condemned

• vicarious civil liability: acquitted

• Air navigation service provider (Skyguide)

• strict civil liability

• vicarious civil liability (for ATCOs and managers)

Uberlingen legal analysis: responsible actors III (additional providers)

• Technology providers (TCAS producers)

• Product liability: condemned


• Fault liability (ATSEP manager): condemned


• First party insurance

• Third party insurance

• States

• civil liability towards BAL (Germany)


• No legal procedures against standard-setters

Ueberlingen: general considerations

• No criminal/civil liability for operators.

• Liability for airlines (with recourse against ANSP/State)

• Criminal liability for ANSP managers

• Civil liability for ANSP

• Civil liability for State (with recourse against ANSP?)

• Civil liability for technology producer

• A correct framework? How to share the costs? According to causality?


1. Überlingen

2. Linate



Linate

On the 8th October 2001, Cessna Citation CJ2 business jet crosses the takeoff lane of Scandinavian Airlines Flight 686

Linate

All 114 people on board the two aircrafts and 4 persons on the ground are killed

LINATE: Accident Analysis I

• LACK OF RADAR SUPPORT (latent condition)

• Old radar dismissed, new radar not operative

• LACK OF PERSONNEL (latent condition)

• Ground controller too busy

• HUMAN ERROR (active behaviour)

• Cessna was allowed to land, although aircraft and pilot were not licensed to operate in this airport

• TECHNICAL MALFUNCTION (latent condition)

• Due to problems in the R/T, audio was often distorted and unclear.

LINATE: Accident Analysis II

• AMBIGUOUS LIGHTS (latent condition)

• R6 lights were very brilliant, while those of R5 were less evident.

• INADEQUATE ROAD SIGNS (latent condition)

• S4 was an old sign (written in ICAO standard font) no more in use at the airport, but still present on the taxilines. S4 is present only in R6, not in R5, but its meaning was unknown by both pilots and ground controller.

• INADEQUATE STOP BAR LIGHTS (latent condition)

• The stop bar lights were inadequate and not coherent with the standards. The pilot did not perceive them as stop bars.

LINATE: Accident Analysis III

• UNRELIABLE MAPS (latent condition)• Pilot and controller were provided with unreliable maps in which

not all the signals available in the airport were reported.

• MISINTERPRATION AND WRONG CLEARANCE (active error)• When the pilot reported to be at S4, approaching the runway, the

ground controller assumed that the position report was wrong and that the flight was actually at the crossroad between R5 and R6. As a consequence the ground controller instructed to flight to proceed to the North. The ground controller was considering the flight on R5 while instead it was approaching the runway.

• RUNWAY INCURSION SENSOR DEACTIVATED (latent condition)• At the crossing between the taxiline R6 and the runway there was

a microwave sensor intended to alert the air traffic controller in case of runway incursion. However, the sensor had been deactivated because of some false alerts it had created before.

Linate legal analysis: responsible actors I (individuals)

• Cessna Pilot (died on the accident):

• Possible fault civil liability (e.g. professional liability)

• Flight 686 Pilot (died on the accident):

• Innocent mistake (no liability)

• ATCOs

• Criminal liability (manslaughter): condemned


• Managers:

• Criminal liability (manslaughter):

- airport director : condemned in first instance, acquitted in appeal

- Head of aviation authority (ENAC): condemned in first instance, acquitted in appeal

- Head of ATC (ENAV): condemned for manslaughter (no prison for amnesty)


Linate legal analysis: responsible actors II (final providers)

• Air companies

• strict civil liability to passengers, costs shared according to responsibility (for CESSNA)

• Air navigation service provider (ENAV)

• strict civil liability

• vicarious civil liability (for ATCOs and managers)

Linate legal analysis: responsible actors III (additional providers)

• Technology providers (map producers)

• Product liability: not addressed


• Fault liability (radar): condemned ENAV for failed maintenance


• First party insurance

• Third party insurance

• States

• Not relevant


• Acquitted ENAC since not task-responsible for safety

Linate: general considerations

• Operator criminally liable, even if working under pressure

• Criminal liability for ANSP managers (through minor sentence)

• No criminal liability for standard setting body (ENAC)

• Civil liability for technology producer not addressed

• A correct framework? How to share the costs? According to causality?


1. Überlingen

2. Linate



Unmanned Aircraft Systems (UAS)

Aircrafts intended to operate without pilot on board

Autonomous (AUAS) remotely piloted aircraft

systems (RPAS)

Regulatory framework for UAS

AUAS are not admitted in civil aviation Art. 8 of the ICAO Convention

RPAS are regulated by the ICAO circular 328/AN 190 segregated airspace remote pilot licence remote pilot ultimate responsibility use of pilot stations commercial, scientific and security applications

UAS over nuclear plant (I)

Due to a radiation leak in a nuclear power plant, national authorities

close the lower airspace over this region and authorise a non-military security mission to monitor the emissions of the nuclear reactor

UAS over nuclear plant (II)

RPAS is used in the mission

2 pilot stations cover flight trajectory

licensed Remote Pilot UAS Operatorscientist in charge of data collection

BLOS (Behind Line of Sight) mode of operations (UA Detect & Avoid System)

Accidentmid-air collision

A civil flight enters the segregated airspace, to land in the nearest airport

The ATCO takes responsibiliy of the separation between the aircraft, and orders UAS to reduce speed

The UA Detect & Avoid System suggests descent since speed reduction insufficient

Mission Manager chooses speed reduction and pilot complies

UAS collides with civil flight

Analysis of accident

• LATENT CONDITION

• The air traffic controller does not have precise information about the time of reaction of the UA and its trajectory.

• ACTIVE ERROR

• The air traffic controller provides the traffic with an ineffective avoidance instruction

• ACTIVE ERROR

• The remote pilot of the UA does not perceive that the instruction suggested by the air traffic controller will be ineffective.

• ACTIVE ERROR

• The mission manager evaluates the suitability of the descent manoeuvre suggested by the UA in the light of the mission objectives, but does not consider collision risks and requests rejecting it

• ACTIVE ERROR

• The remote pilot underestimated collision risks and instructs to reduce speed, rather than the maneuver suggested by the UA.

Legal analysis: responsible actors I (individuals)• Remote Pilots:

• criminal liability (e.g, manslaughter?);

• fault civil liability (e.g. professional liability);

• disciplinary liability

• ATCOs

• As for pilots

• Mission Manager:

• As for pilots (probably not since no responsibility for safety)

Legal analysis: responsible actors II (final providers)

• Air company of the manned flight

• strict civil liability (with cap and right of recourse)

• Fault liability for antecedent malfunctioning?


• strict civil liability,

• vicarious civil liability (for ATCO)


• Not applicable




• Technology on UAS functioned correctly

• Standard-setters (regulators)

• Not applicable


• Not applicable


• First party insurance, Third party insurance

• States

• Fault civil liability (if height inappropriate?)

UAS accident in landing

RPASs are integrated in the civil airspace and are used for commercial purpose

UAS accident in landing

Two Pilot stations are employed to control aircrafts

Remote Pilot Technical Operator

Accident on ground

• Communication failure between UA and the Pilot Station approaching destination airport (RPAS => AUAS)

Air Traffic Controller separates the UA from the rest of the traffic

The UA automatically follows the flight plan and manages successful landing

After landing it maintains a too high speed, and crashes into airport building

Analysis of accident

• TECHNICAL FAILURE (ACTIVE ERROR)• Failed communication link between Pilot Station and the UA. As a

remote pilot can download aircraft parameters, but not instruct flight.

• ACTIVE BEHAVIOUR• The air traffic controller decides to create a buffer around the UA

and to avoid crossings in order to minimise the risks associated to possible unexpected UA automatic tasks.

• ACTIVE BEHAVIOUR• The tower ATCO decides to dedicate the runway to the UA,

moving the rest of the traffic to other runways.

• TECHNICAL FAILURE (ACTIVE ERROR)• The UA lands automatically in a perfect way, but after the landing,

maintains a too high speed, goes out of the runway and finally stops against an airport building.

Legal analysis: responsible actors I (individuals)• Remote Pilots:

• Not liable (correct behaviour);

• ATCOs

• Not liable (correct behaviour)

Legal analysis: responsible actors II (final providers)• Air company of the unmanned flight

• strict civil liability (with cap and right of recourse)


• No liability (correct execution of task)






• Communication Technology provider: strict liability (product liability) or fault liability (service liability), contractual liability (right of recourse of UA provider)

• UA software/hardware provider: as above

• Standard-setters (regulators)• Not applicable

• Maintenance providers• If damage due to maintenance, fault liability (service liability),

contractual liability (right of recourse of UA provider)

• Insurance companies• First party insurance, Third party insurance

• States• Non applicable


1. Überlingen

2. Linate



AUTOMATED HIGHWAY SYSTEM (AHS)

US Department of Transportation (DOT) in 1994 launches project for limited access roadway of driverless vehicles

Not yet!

1997 financial support withdrawn: project technically feasible but not realistic also because of unsolved legal issues: Product liability, Insurance, Safety, Standardization, Privacy

Why such a failure?

• Safety improvement insufficiently established

• Human machine interaction insufficiently analyses

• Liability transfer to technology producers not addressed

• Uncertainty on possible costs prevent insurance

• Privacy concerns need to be addressed

A successful case: airbags

In patented in 1953. Not used until 1973 for technical obstacles and liability concerns.Consumers do not want it: stops being offeredBecomes compulsory in the 1980’s

Why refuse airbags?

• Why car makers and consumers did not want the safe technology?

• Rational choice for car makers: air-bags involve additional costs and additional liabilities (and litigation), costs cannot be shifted to consumers

• Possibly-rational choice for consumers: Consumer underestimates risks and overestimates his/her skills

Liability transfer

• Before the introduction of airbags:- many injures from crashes-user (his insurance) is responsible (for negligent driving);

• After the introduction of airbags:- less injures from crashes, some injuries from airbags

- manufacturer is responsible

WHY MANUFACTURERS DID NOT WANT AIRBAGS?

Solutions:

• Educate consumers;

• Make airbags compulsory;

• Reduce manufacturers’ liability (state of the art /approval defence, cap?)

Task transfer

• Technology induces task transfers

• From humans to technology

• From operators to technology producers-managers

• Between different operators and their companies

Liability transfers

• liabilities go with task-responsibilities,

• technology-induced task-transfers induce transfers in allocation of costs of accidents

• Cost-transfer from victims to providers (non-compensable damage may become compensable, for strict liability/level of expected performance)

• Liability transfers from providers of human services to providers of technology

• Liability transfers between providers of human services

ALIAS CONCLUSIONS

• Automation in ATM (and other socio-technical systems) requires a legal framework

• Liabilities can contribute to safety but also hinder just culture and the deployment of safety technologies

• We need to manage liabilities so that all useful technologies are correctly deployed, and the right incentives are provided

• This is the challenge of the ALIAS project

The team

• Giovanni Sartor, EUI - Project Leader

• Liam Bannon, DBL

• Giuseppe Contissa, EUI

• Paola Lanzi, DBL

• Patrizia Marti, DBL

• Anna Masutti, EUI

• Hans Micklitz, EUI

• Marta Simoncini, EUI

Thanks for your attention

Please register to the ALIAS network!

www.aliasnetwork.org/register.html

accidents and liabilities by alias consortium

Business