2. Pierpaolo Gori, Court of Milan
LIABILITY AND ALLOCATION OF BURDEN
INVOLVING AUTOMATED SYSTEMS IN
AVIATION: RECENT ITALIAN CASE LAW

3. Failure of automated systems and human errors are often enchained
and the same conduct can produce criminal and civil liabilities
QUICK OVERVIEW OF CASE LAW UNDER THE CRIMINAL CORNER
case a) Linate disaster: enchained faults, with a prevalence of lack of organization
(Court of Cassation, judgment delivered on 5 June 2008 n.22614/08)
case b) Tuninter air crash: concurring factors, with overconfidence on automated instrumentation as key factor
(Court of Cassation, judgment delivered on 14 June 2013 n.26239/13)
UNDER THE CIVIL CORNER (lawsuits for damage compensation)
case c) Bird strikes and ineffective remote monitoring: “operating an airport is a dangerous activity”
(Court of Genoa, judgment delivered on 19.2.2007)
case d) Aircraft technical defects of the airplane and inadequate information (failures non detected by automated alarms)
(Court of Milan, judgment delivered on 11.3.2012)
case e) Lack of maintenance of the airport's infrastructure (organizational failures)
(Court of Venice, judgment delivered on 25.7.2008)

4. a) Linate disaster: enchained faults, with a prevalence of lack of organization
(Court of Cassation, judgment delivered on 5.6.2008 No.22614)
Facts:
The accident occurred on 8 October 2001 in the city airport of Milan, Linate, when under low visibility conditions (between 50 and 100 meters),
high traffic volume, lack of adequate visual aids and of a ground radar, an airliner MD-87 collided on take-off with a Cessna business jet crossing
the lane without specific clearance. 118 persons died, in the Country's worst air disaster.
Main provision applicable:
Article 449 § 2 Criminal code (multiple aeronautic manslaughter, culpable conduct).
Burden of proof:
Under Article 40§ 2 Criminal Code, Criminal (and Civil) liability may depend not only upon an action but, under specific obligations, upon a failure
to take an action if necessary to avoid the harmful fact. Following a process of mental elimination, a causal nexus between action and harmful
event is established if it’s possible to answer “no” to the question: “would the event have occurred without such action?” .
Evidence results:
The evidence underlined a chain of situations, procedures, and instruments that failed to ensure the safety of the flight;
• the former head of air traffic control authority ENAV and the former ENAV general manager were held liable for negligent behavior
concerning replacement of the ground radar, out of service from November 1999 and not yet repaired or replaced at the moment of the
disaster, almost 2 years later;
• two former officials with the Airport operator (SEA) were held accountable for facts regarding the maintenance of the markings, which were
considered also the result of protracted negligence, as well as for the general bad management of flight infrastructures, which also continued
over time;
• the air traffic controller, as the last and, therefore, weakest link if there is a lack of adequate support destined to limit the risk of error, was
author of a serious error, his failure to stop the Cessna, but took place in a few seconds, and therefore was judged less harshly than those who
had greater opportunities to ensure flight safety.
Ruling:
Court of Cassation upheld a 7 July 2006 Milan Court of appeal's finding of multiple aeronautic manslaughter as well as negligent disaster, namely:
• for the greater responsibility and related authority, the former head of air traffic control authority ENAV and the former ENAV general
manager were convicted for multiple manslaughter and sentenced respectively to 6 and half years prison and to 4 years 4 months prison;
• the two former officials with the Airport operator were convicted to three years prison each;
• the air traffic controller was sentenced to three-year prison.
• Each convicted was held liable for civil damages (compensation), to be quantified in civil proceedings. However, these proceedings ended with
a settlement.

5. b) Tuninter air crash: concurring factors, with overconfidence on automated instrumentation as key
factor (Court of Cassation, judgment delivered on 5.6.2008 No.22614)
Facts:
A Tuninter airliner ATR-72 on 6 August 2005 ditched into the Tyrrhenian See close to Capo Gallo, 23 nautical miles from Palermo. The aircraft broke into
three sections upon impact and, as result, 18 out of the 39 persons on board died in the air crash.
Main provision applicable:
Article 449 § 2 Criminal code (multiple aeronautic manslaughter, culpable conduct).
Burden of proof:
Under a consistent interpretation of Article 40 § 2 Criminal code, to assess if a non-action establishes a causal nexus with the harmful event, the judge
should make resort to a process of mental elimination, by wondering “would the event have occurred with the prescribed action?” . Such link is anyway
interrupted by unforeseen subsequent circumstances that alone are sufficient to generate the harmful event (Article 41§ 2 Criminal code).
Evidence results:
According to the Court consultant’s technical report, to flight simulation results and to witnesses, several enchained factors lead to the accident:
• Firstly, for a human mistake the relevant fuel quantity indicator on the ATR-72 was incorrectly replaced with a similar but different tool intended for a
smaller aircraft, with smaller tankers, the ATR-42. The correct replacement part was not found, because Tuninter permitted the mechanical foreman to
query parts using software without license, without specific training and adequate IPC’s manual knowledge. As result of this lack of organization, the
inventory database wrongly reported that the ATR-42 part could be used even on ATR-72 airliner. The mechanic incorrectly replaced the fuel indicator
provided by the foreman, without the specific check of suitability prescribed by the manual.
• Secondly, due to the fault indicator device, in Bari airport the aircraft was insufficiently fuelled. The tanks were filled to up to a level where the wrong
indicator showed 2.700 kilograms, but a correct part would have told there were just 1.150 kilograms when the airliner departed. Such amount was
largely insufficient to reach the final destination of Djerba. The pilot and co-pilot overconfidently relied on the fault automated indicator, failing to
check personally the exact amount of the fuel stored. Such operation consisted in asking for the prescribed fuel receipt (not requested in the specific
case), and confronting the receipt data with the indicator data, showing different amounts of fuel.
• Thirdly, after the engines’ stall because of fuel exhaustion, the crew failed to follow the emergency procedures prescribed, namely, feather propellers to
reduce the drag on the curved blades, so the aircraft could be better sustained by updrafts, and plane towards the closest airport, Palermo. Simulation
results showed that, optimally handled the aircraft was still in conditions to land on the standard runaway of Palermo airport. By contrast, witnesses and
voice records acknowledged that both the pilot and the co-pilot succumbed to panic, continuously tried to restart engines, and then began to pray loud
and prepare to ditch close to a ship seeking help. Such, concurring, human error was decisive for the air crash.
Ruling:
• the pilot was sentenced to 6 years 8 months (human error, overconfidence on automated indicator);
• the general manager of the Air company and the company’s top technical manager were held criminally liable for lack of organization and sentenced to 6
years jail each, as well as the co-pilot (lack of organization);
• The head of the maintenance department, the mechanical foreman and the mechanic to 5 years 8 months (organizational and human error).

6. c) Bird strikes and ineffective remote monitoring: “operating an airport is a dangerous activity”
(Court of Genoa, judgment delivered on 19.2.2007)
Facts:
An four-engined Antonov An-124 “Ruslan” transportation aircraft carrying industrial turbines was taking off from the coastal airport of Genoa, scheduled to
reach Karachi, when collided with a storm of sea-gulls (bird strike). This lead to an engine stall and a subsequent emergency landing, with serious
damages to the heavy aircraft.
Main provision applicable:
2050 Civil Code (Civil liability for dangerous activity).
Burden of proof:
Operating an airport can be defined as a dangerous activity, and in the case of a coastal airport close to a landfill the danger is considerably increased. In
such activities, article 2050 Civil code requires the adoption of all suitable methods for preventing incidents, and a just “ordinary” or “average” behavior is
not enough. By contrast, it is required to go beyond normal diligence to be freed of charges.
Evidence results:
The Court expert assessed that the Italian Government had set up a Bird Strike Committee, adopting many actions in respect of airport operators. Given
that the airport is located on the sea and has a very close landfill, elements that increase the risk of a bird strike, at the time of the facts, Genoa airport
was equipped with some of the best dispersal devices and remote detectors for bird strike prevention in use in international airports, with the possible
exception of infra-red detection systems. According to the consultant's conclusions, the impact was to be considered “substantially accidental”.
Ruling:
The Court disregarded its expert's technical report finding that no accidental event occurred. The facts were considered consequence of a lack of
organization and of over-dependence on automated devices. Besides automated resources, to avoid bird strikes upon a coastal airport close to a
landfill it requires first of all a human monitoring. Airport operators therefore have to fill the organizational gap testing and experiencing a joint use of
technical and human remedies, adding to the existing automated tools, human armed patrols close to the runaway (E.g. Copenhagen Airport Kastrup has
a specific patrolling guard for prevention of bird strikes). More, signals of general warning are not enough: controllers need to be instructed and effectively
monitored to look at possible wildlife interferences with aeronautical activities, that could not be detected by remote controllers. Therefore the Court held:
• The Airport Operator responsible for 35% of damage compensation under Article 2050 Civil code, because it failed to adopt suitable harassment
tools, over-relying on automated devices, remote monitoring included, and adopting non effective remedies, like signals of general warning;
• ENAV (Italian ATS Agency) responsible for 35% of damage compensation under Article 2050 Civil code, for not having complied to its duties
concerning flight safety, in particular for not having instructed and effectively monitored its controllers to look at possible wildlife interferences
with aeronautical activities;
• Ministry of Transport responsible for 22.5 % of damage compensation under 2043 Civil code, because of lack of control over its peripheral
structures (Airport Authorities) and subsequent negligent control by these in respect of the Airport Operator and ATS: 22.5 %;
• (- Under 1218, 2043 and 2050 Civil Code, the former Airport Operator responsible for 7.5 % of damage compensation, due to a concurring minor
liability, because sub-contracting an airport by one company to another does not remove from liability in safety issues).

7. d) Aircraft technical defects of the airplane and inadequate information (failures non detected by
automated alarms) (Court of Milan, judgment delivered on 11.3.2012)
Facts:
A two-engined Cessna business jet owned by a Milanese aero-club crashed because of an engine failure, due to lack of fuel. The pilot
survived, but a passenger died.
Main provisions applicable:
The relatives of the victim lodged civil proceedings against both the pilot and the aero-club association under Articles 942 and 947 Navigation
code (contractual liability) and under Article 2043 Civil code (non-contractual liability).
Burden of proof:
According to the line of reasoning of the Court, no contract under Articles 1678 Civil code and 940 Navigation code was signed between the
aircraft owner and the victim, and so there was no room for any contractual liability. Since there was no air carrier in the specific case,
provisions form the Warsaw Convention and the Montreal Convention were not applicable too.
More, the aircraft's owner, an aero-club, was not accountable even under Article 2049 Civil code, since the plane was given in free loan to the
pilot under Article 1803 Civil code and Article 874 Navigation Code, and was under his full control and therefore exclusive responsibility.
Accordingly, there was room for non-contractual liability of the pilot only, with significant additional burden of proof.
Namely, it was upon the damaged applicants to give evidence of any fault on the pilot’s part, of the causal nexus between action and
harmful event and of the measure of the damages.
Evidence results:
The Court expert, in a parallel Criminal proceeding, after a scientific analysis of the wreck confirmed the existence of a technical defect of the
airplane, since the engines below a certain altitude could not be fuelled by the auxiliary tankers. No alarm in the cockpit monitored and
warned the problem, and such failure lead to the stall and fall of the aircraft. Similar accidents for the same defect occurred in 12 cases
worldwide, and in dozens of cases malfunctioning of the fuelling system was reported to Cessna for the interested model of aircraft.
Witnesses underlined that the auxiliary tanks contained a significant quantity of fuel at the moment of the air crash, and that the pilot reacted
promptly and with diligence, finding room for an emergency landing even in a sub-urban and highly populated area.
Ruling:
Pilot free of charges. The Court was not satisfied with the effort of the applicants (relatives of the victim) to give evidence of a culpable
conduct of the pilot, and to establish a causal nexus with the air crash. By contrast there was evidence of a fact interrupting the link between
conduct and event, whereas a serious negligence in the design of the aircraft, because the fuel system of the aircraft was unsafe, and in
the wording used in the accompanying instructions. No specific recommendations in the aircraft’s manual prohibited to use auxiliary tankers
below a certain altitude. The designer and the manufacturer of the aircraft were not part of the proceedings.

8. e) Damages coming from lack of maintenance of the airport's infrastructure
(Court of Venice, judgment delivered on 25.7.2008)
Facts:
The accident took place in Treviso airport, when an airliner was taxiing on the step-way, and part of the surface of the runaway,
under pressure from the landing gears, hit the body of the aircraft. The damage consisted in repairing the airliner for 17 days of
technical stop, and in compensation for many flights that had to be cancelled, and travelers and tour operators indemnified as well.
Main provision applicable:
Article 2051 Civil code (liability for lack of custody), applicable even towards Administrative authorities.
Burden of proof:
It's upon the damaged to give evidence of the fact involving the object in custody, namely the harmful even. If the Court is satisfied
with this burden, it's upon the subject charged of the custody, in the specific case of the whole airport, to show that an unforeseen
occurred by chance, or the accident was due to fault of the damaged itself.
Evidence results:
Wrong horizontal markings lead pilots to believe that the airliner was in a proper position for the back-track; such mistake happened
even due to other concurring reasons, namely the runway surface in poor conditions and reduced visibility for foggy weather. In the
specific case, the general bad management of airport infrastructures was due to negligence of two different operators.
Ruling:
Non-contractual liability of the Ministry of the Defence and of the private Airport Operator, both charged of the custody of the runway
and makings, the first according to the law and the latter in force of a specific contract signed with Administrative authorities

9. CONCLUSIONS
• A Case-law overview shows that failures of automated systems and human errors in aviation accidents and incidents are
often enchained;
• Operating an airport and an aircraft is a complex and dangerous activity, involving a wide number of subjects with different
roles, and this can lead to concurring liabilities;
• Organizational procedures and effective supervisory activity have to provide reliable and adequate support of the final
operators, to limit the risk of human errors from them;
• A relevant conduct, normally a culpable one, is usually not excluded by automation failures and may drive to both civil and
criminal liabilities;
• A causal nexus between conduct and event may involve the chain of command that failed to organize adequately safety
procedures and controls, following a process of “mental elimination” (condicio sine qua non); the nexus is interrupted by
subsequent exclusive circumstances that, alone, generated the event;
• Under the criminal corner, liability is consequence of:
a) law provisions that consider relevant for crimes even culpable conducts (e.g. multiple aeronautic manslaughter, negligent
disaster…)
b) consistent interpretations of causal nexus provisions (Articles 40 and 41 Criminal code) that give relevance to actions, and,
under specific obligations, to non-actions as well; such positive obligations are extensive in air transport regulations
• Under the civil corner, liability is consequence of:
a) contracts were is easy to find un-fulfilled obligations (e.g. Article 942 Navigation code, Conventions of Warsaw and Montreal)
b) non-contractual obligations established under moderate burden due to specific provisions (e.g. Articles 2050 Civil code “for
dangerous activity” and 2051 Civil code “for lack of custody”)