The facts of the incident are simple:

• While climbing to cruise altitude after departure, the aircraft's instruments indicated loss of oil quantity and subsequently oil pressure on both engines.
• The crew diverted to the nearest airport and shut down both engines during the landing roll.
• During the previous night both engines had been subject to Borescope Inspections. The High Pressure (HP) rotor covers, one on each engine, had not been refitted. This resulted in the loss of virtually all of the oil from both engines during flight.
• A serious accident was averted because the Captain (a) was closely monitoring the engine instruments during take-off phase; and (b) demonstrated great skill in landing the aircraft while in a virtual glide.

So why had the HP rotor covers not been refitted? Was it an isolated act of carelessness? Or was it indicative of some deeper problem?

• The Borescope inspection was started by a Line Engineer, but because he was running a shift short-handed he eagerly accepted an offer to complete the job from the Base Maintenance Controller. The Base Maintenance Controller had his own manning difficulties that night, but he nonetheless took the job because his 750 hours borescope authorisation was about to lapse and he knew that Base Engineering would not give him any opportunity to keep it current.
• At that time there was no system within the airline to flag up any anticipated mismatches between available and desirable manning levels at particular points in time.
• The airline's Procedures Manual defined no specific procedure to cover the transfer of a part completed job from Line to Base Engineering.
• In this case it was clear from their statements that the Line Engineer and the Base Maintenance Controller were satisfied, after a verbal exchange, that the existing state of the aircraft and the total requirement of the task were well understood by both. An analysis of the facts during subsequent investigation, however, revealed that the Base Controller did not fully appreciate what had been, or remained to be, done.
• The Base Controller did the job using his own set of Borescope Inspection training notes - which he knew to be an unapproved reference - that: (a) had not been updated, and (b) carried a warning that they should be used for training only. His reason for using these notes was that he had written some information in them to assist him in determining the size of any defect he might find.
• As a result of using a reference source which he knew to be unapproved for a task with which he was not currently familiar, the official investigators concluded that the Base Controller made it virtually certain that he would deviate from the correct practices. In fact, he made a number of serious omissions including failure to fit the HP rotor drive covers and not performing an engine run which would have revealed that omission.
• Although the Controller had attempted to anticipate the difficulties which might arise in the Base Maintenance work that night, he nonetheless had to contend with a series of diversions and interruptions. This was particularly the case because of the depleted Base Maintenance Inspection and supervisory staff that night. The Controller was therefore found to have showed bad judgement in taking on the inspections in addition to his normal work.
• After the incident, the airline conducted an internal enquiry to establish the general practice of its engineers when conducting borescope inspections. This revealed a significant mis-match between the number of inspections conducted and the number of HP rotor drive cover O-rings used, indicating that contrary to the AMM requirements, O-rings were regularly re-used. Likewise, post inspection engine runs were frequently omitted, contrary to the AMM and good engineering practice.
• The survey made it clear that the airline's Quality Assurance department had not identified the frequent deviations from a procedural approach plus failures to observe the requirements of the AMM over a considerable period of time.
• Some of the airline's QA engineers were also identified as having not understood their terms of reference to include a remit to roam the hangars to observe work in progress as a matter of course. They did not, therefore, create opportunities to observe any deterioration in adherence to standards or proper practice and put corrective action in hand.
• During night shifts, which tended to be relatively sparsely manned, it was more likely people would be working in a more isolated manner. There was seldom any QA or Planning available at night and the presence of management was rare. The situation gave rise to the potential for a more relaxed and less procedural environment to develop unnoticed, except by results. The official investigators concluded that it is under these circumstances that the fragility of the self monitoring system is most exposed because the safety system can be jeopardised by poor judgement on the part of one person, and it is also the time at which people are most likely to suffer impaired judgment. .

In light of the above, it is not, perhaps, surprising that the airline was prosecuted and convicted for negligently endangering the aircraft and its occupants in breach of air navigation legislation. For reasons I shall touch frequently during the remainder of my paper, the case is an interesting one in relation to what happened after the airline's negligence was discovered and what might have happened if the pilot had not been so skilful.

Many of you are no doubt aware that civil aviation around the world is regulated by a framework agreement established by a Convention signed by 52 States in Chicago in 1945. At present, the majority of the world's States are party to the Convention. The Chicago Convention deals with a wide range of issues within its 93 Articles.

With regard to accident investigation the Convention says, in effect, that the State in which an accident occurs shall institute an enquiry and that the State of Registry may appoint observers to be present and have access the investigating State's report and findings (Article 26). This provision is given more specific effect in Annex 13 to the Convention, the first edition of which was adopted in 1951. Since then it has been reviewed, developed and amended by ICAO several times, the most recent changes being published in July 1994.

The purposes of Annex 13 are threefold:

• to standardise aircraft accident and incident reporting procedures;
• to establish procedures that ensure participation of experts in accident and incident investigation; and
• to ensure rapid dissemination of important safety and airworthiness information.

The Convention requires Contracting States to notify ICAO of any differences between their national regulations and practices and the international standards contained in Annex 13 (see Article 38 of the Chicago Convention). They are further invited to notify any differences from the recommended practices. Differences are published as supplements to the annexes. Most relate to areas where local law conflicts with Annex 13.

The fact that States are permitted to notify differences between local law and Annex 13 rules means that Annex 13 is, in reality no more than a code of best practice. This shortcoming is compounded by the fact that many States fail to apply its precepts within its express terms. Sometimes this is because of lack of available resources, either human or economic or both.

It is against this background that individual States such as the UK and USA enacted their own national frameworks for accident investigation, which took and built on the Annex 13 code. Likewise, from 1994, European law has required Member States of the European Community to include in their own domestic laws the terms of an European Commission Directive which establishes fundamental principles governing the investigation of civil aviation accidents and incidents (see EC Directive 94/56/EC).

The Directive is very similar in spirit to Annex 13, but very different in its form because of its mandatory nature. It applies to investigations into civil accidents and incidents:

When should an Annex 13 investigation take place and how should it be conducted. The answers to these and other questions can be found in the individual chapters of the Annex.

In this chapter such terms as 'accident', 'accredited representative', 'adviser' and 'serious injury' are defined. The definitions of 'serious incident' and 'State of Design' are new.

'Accident' is defined as "an occurrence associated with the operation of an aircraft which takes place between the time any person boards the aircraft with the intention of flight until such time as all such persons have disembarked, in which:

• being in the aircraft, or
• direct contact with any part of the aircraft, including parts which have become detached from the aircraft, or
• direct exposure to jet blast,

except when the injuries are from natural causes, self inflicted by other persons, or when the injuries are to stowaways hiding outside areas normally available to the passengers and crew; or

• adversely affects the structural strength, performance or flight characteristics of the aircraft, and
• would normally require major repair or replacement of the affected component,
• except for engine failure or damage, when the damage is limited to propellers, wing tips, antennas, tyres, brakes, fairings, small dents or puncture holes in the aircraft skin;

Also worthy of note is the definition of 'serious incident'; namely, "an incident involving circumstances that an accident nearly happened" examples of which are set out in an attachment to Annex 13. The British Midland case mentioned earlier is an excellent example of a "serious incident".

Chapter 2 reflects the most important changes made to Annex 13 in the 1994 edition. The previous edition of Annex 13 limited applicability to accidents concerning two or more Contracting States (in other words 'international accidents') and noted that there was no obligation for States to investigate incidents. Annex 13 now applies to all accidents and serious incidents, wherever they occur.

Chapter 3 defines the objective of the investigation and clearly distances the accident investigation from any judicial process that allocates blame.

This is one of the fundamental principles of Annex 13. It gives the investigators the means to distance themselves from criminal investigations and civil litigation following an accident. It does not, and cannot, however, prevent the investigators from being drawn into those processes, if required.

Chapter 3 also deals with the protection of evidence. It is worth noting the difference between the two standards in paragraphs 3.3 and 3.4; namely, that a request from the State of Registry and the State of the Operator for wreckage to remain undisturbed shall be complied with unless safety considerations are paramount; whereas a similar request from the State of Design or State of Manufacture need not be complied with if it is likely to cause undue delay in returning an aircraft to service.

Chapter 4 lays down the procedures that must be followed by the State in which an accident or incident occurs (State of Occurrence) in relation to notification of certain other States. At this point it is useful to note that Annex 13 deals only with States. The operator of an accident aircraft or other interested organisation has no rights of its own.

Using the quickest available means, the State of Occurrence is required to forward a notification of an accident or serious incident with the minimum of delay to:

• the State of Registry
• the State of the Operator (if not located in State of Registry)
• the State of Design
• the State of Manufacture
• and ICAO if the maximum mass of the aircraft is over 2250kg

The fundamental purpose of the notification procedure is to inform the other States concerned so that the appropriate expertise and skills may be brought together for the investigation without delay. These experts and skills are provided through the system of accredited representatives and advisers.

The Chapter also details the response expected of the other States concerned. If the aircraft concerned is of a maximum mass of over 100,000 kg, the State of Design and the State of Manufacture shall appoint accredited representatives. If the aircraft is of lesser mass, these States are not obligated to appoint accredited representatives (but normally will do so).

States having suffered casualties to their citizens are not listed as addressees for the notification message have certain rights, as listed in Chapter 5. If some or all of these States are known at the time of the initial notification, they may be added to the list of addressees so that they may prepare to assist in the identification of victims.

Where a crash occurs in international waters, the responsibility for notification would normally be assumed by the State whose ATC service was in contact with the aircraft when it was lost. When it received the notification, the State of Registry would assume responsibility for all further action (see Chapter 5).

Chapter 5 deals with

• responsibility for instituting an investigation;
• organisation of the investigation; and
• the conduct and participation of other States in the investigation.

The State in which the accident or serious incident occurred is responsible for the investigation but may delegate this responsibility in whole or in part to the State of Registry or State of the Operator.

There is no provision for delegation of the investigation of an accident to the State of Design or the State of Manufacture but an investigation of a serious incident may be so delegated.

Important provisions are that the accident investigation authority shall have independence in the conduct of the investigation and unrestricted authority over its conduct. The investigator-in-charge shall have unhampered access to the wreckage and full control over it. The need for co-ordination between the accident investigation authority and the judicial authority is discussed.

The obligation of other States to provide information, their participation and the privileges of their accredited representatives and advisers are dealt with in some detail in Chapter 5.

The 1994 edition of Annex 13 extends the rights of accredited representatives of the leading players to participation in flight recorder readouts, tests and simulations. They may also now participate in investigation progress meetings, deliberations on findings and safety recommendations, and they may make submissions during the investigation.

Accredited representatives also have obligations. They are required to provide to the investigation all relevant information available to them and, most importantly, they shall not provide information on the progress and findings of the investigation without the express consent of the State conducting the investigation.

Three types of investigation reports are described in connection with aircraft accidents:

• Preliminary report - If the aircraft is of a maximum mass over 2,250 kg, a preliminary report shall be despatched within 30 days of the accident by the State conducting the investigation. The preliminary report contains brief factual information.
• Accident/Incident Data Report (ADREP) - is completed at the end of the investigation and sent only to ICAO. Attachment B to Annex 13 provides a checklist for notification and reporting procedures.
• Final report - is a detailed report containing all relevant factual information relating to the circumstances of the accident; an analysis of this information leading to an assessment of the causes; and safety recommendations intended to reduce the likelihood of a similar accident occurring in the future.

This report is first circulated in draft form to all States that participated in the investigation and comments are invited. The State originating the report should then take account of the comments and either amend the report or append dissenting comments to it before issuing it in final form.

Having examined the theory of accident investigation under Annex 13, it is pertinent to look at how the activities of the Annex 13 investigators interface with the post-accident needs of:

• police and judicial authorities seeking to establish if anyone with an involvement in the accident has committed a criminal offence; and
• victims of the accident who, through their lawyers, are seeking information which will help them to press their claims for compensation by means of discussions with parties with an involvement in the accident or through the courts.

Armed with the privileges granted by Annex 13, the investigators of an accident are in the best possible position to gather relevant information; for example:

• statements from flight crew, passengers, eye witnesses, ATC controllers, maintenance personnel etc. regarding the circumstances and possible causes of the accident
• medical or private information regarding persons involved in the accident or incident
• cockpit voice recordings and transcripts thereof
• opinions expressed regarding the analysis of gathered information, including flight data recorders

This, of course, is just the sort of information that police authorities and claimants would like to get their hands on. Annex 13 says that the investigators shall not make the information available to those persons "unless the appropriate authority for the administration of justice … determines that their disclosure outweighs the adverse domestic and international impact such action may have on future investigations" (Chapter 5.12). Unfortunately, this requirement conflicts with the local laws of many States and, as a result, is the single most objected to provision of Annex 13 in the differences lodged by States (included in supplement).

The reality, therefore, is often that the police and claimants can look over the investigators' shoulders and, sooner or later, have access to all information in their possession. Theoretically, this fact should make it harder for the investigators to persuade witnesses to be frank with them about their evidence. Whether that is the case is unclear.

The issue of confidentiality recently came into sharp focus in New Zealand where the local Court of Appeal held recently that the police are allowed to use cockpit voice recorders for criminal investigations. The decision arose from the crash in 1995 of an Ansett Airlines Dash-8 which resulted 4 deaths and 14 serious injuries. Not surprising, the local Airline Pilots Association viewed the decision with considerable alarm. In response it told its members:

• not to co-operate with any crash or safety inspectors without a lawyer present
• to "minimise exposure" to cockpit voice recorder by using hand signals, and
• to "avoid like the plague" confidential and anonymous incident reporting systems.

Given that the function of voice recorders is to help investigators reconstruct accidents, it is difficult to avoid feeling some sympathy for the pilot's association views. After all, voice recorders are not used in other work places so that the police can charge employees with criminal offences.

My own view is that what has happened in New Zealand is typical of a trend in many States. More and more, major accidents and serious incidents are being following by criminal investigations and prosecutions. The British Midland incident mentioned at the beginning of this paper is a good example of this: it was, after all, the first prosecution of its type in the UK. Another example is:

In the UK, the range of laws available to prosecutors will be strengthened in the next year or so by the introduction of a new offence of "corporate killing". The new offence of "corporate killing" will hinge on whether there has been a failure in the management of a corporation's activities that constitutes conduct falling far below what can reasonably be expected of the corporation in the circumstances.

If the British Midland incident mentioned at the beginning of this paper had resulted in an accident rather than just a serious incident, it is easy to see that the airline could be accused of a failure to ensure safety in the management or organisation of the corporation's activities, with the result that it could have been guilty of the proposed new offence of corporate killing if anyone had died as a result of the incident. Such a sequence of events would probably have resulted in the permanent demise of the airline.

In view of the general inability of the investigators to keep their information private, it is inevitable that those with an interest to protect after an accident will use the accident investigation process to protect their own position, perhaps to the detriment of air safety. Exactly the same applies in relation to civil litigation started after accidents by victims to obtain damages from those with any possible responsibility for its cause, whether the operator of the aircraft, the manufacturer of an engine or component, an air traffic control authority, maintenance organisation, airport authority and so on.

Already, I have seen cases where a manufacturer has used its position as an expert on the type of an aircraft that crashed to seek to blame the airline for poor maintenance procedures in circumstances where, subsequently, once a commercial deal had been done with the airline to pay-off passenger compensation cases, the manufacturer publicly accepted responsibility for the accident.

In the UK accident investigation rules were changed a few years ago because it was considered that Boeing had abused a procedure which permitted those whose reputations might be adversely affected by an investigation report to make their case at a public hearing. The change comprised the introduction of a rule which permits any party who convenes such a hearing to be required to pay the costs thereof.

In English law, which I understand has many similarities with Cypriot law, flight crew, engineers and air traffic controllers owe a duty of care to those making use of or relying on their services. A breach of this duty of care will be actionable in negligence. The defendant will usually be the airline, maintenance organisation, or governmental agency for whom the flight crew, engineers or air traffic controllers work. This is because it is a rule of law that an employer is vicariously liable for the acts of its employees. It is, of course, also because such organisations have better available resources to meet damages awards than individual employees.

What, however, is there to prevent a claimant from successfully bringing a negligence action against an individual in one of those categories of persons? The short answer is nothing.

For those of you who are unfamiliar with the legal meaning of negligence, the following explanation may be useful. In English law, the most significant and far reaching negligence case was decided in 1932. It concerned a bottle of ginger beer:

• Miss Donoghue was bought a bottle of ginger beer by a friend in a cafι. The owner of the cafι opened the bottle, which was dark brown and impossible to see into, and poured some into a glass. After Miss Donoghue had finished the glass, her friend poured the remainder of the bottle, whereupon the black decomposed remains of a snail fell out. Not only did Miss Donoghue suffer a bad shock but also gastric illness.
• Miss Donoghue sued the manufacturer of the beer, with whom she had no contractual relationship. Ultimately, the case reached the House of Lords, which held that Miss Donoghue was entitled to succeed on the basis of a duty of care owed by the manufacturer to her in the civil wrong of negligence.
• The court said "The rule that you are to love your neighbour becomes in law: You must not injure your neighbour … You must take reasonable care to avoid acts or omissions which you can reasonably foresee would be likely to injure your neighbour."

Since that case was heard its principles have been applied to all aspects of human life. Therefore, rules of negligence apply to flight crew, engineers and air traffic controllers alike. As a result, it is, perhaps, useful to look more closely at the component parts of negligence.

Who is your "neighbour" in law? … "persons who are so closely and directly affected by my act that I ought reasonably to have them in my contemplation as being so affected when I am directing my mind to the acts or omissions which are called into question."

In practice, this means that the "neighbours" of flight crew, engineers and ATC controllers are their customers and the ultimate users of their services and products, whether private or commercial. It is irrelevant whether they are known or complete strangers (bystanders are included as well).

What does "reasonable care" mean? … In many cases it means the care which ought to be taken by an ordinary reasonable man (sometimes called "the man on the Clapham omnibus" by the courts in England).

In areas where the ordinary reasonable man cannot be expected to be knowledgeable the court must assess, by reference to expert evidence, what was the state of knowledge possessed, and the standards of care normally adhered to, by others engaged in the same business before judging whether the conduct of the accused fell below those standards.

In practice, the answer to the question will be clear in some cases. In others, the particular problem may be so novel, or relevant facts may be missing, that no generally agreed standard can be found. If room for legitimate differences of opinion exist, no liability for negligence should arise for following one sensible and reasonable path instead of another.

What is the consequence of failing to take reasonable care? … If the resultant damage was reasonably foreseeable, the wrongdoing party will be liable to pay the compensation even if the extent of the damage was more serious than expected and even if the damage arose in a manner that was not expected.

What, therefore, are the duties of care owed by flight crew, engineers and air traffic controllers. In broad terms they all owe a duty to take reasonable care in their actions. In each category, this means that they must do, or not omit to do, what the reasonable person would do, or not do, in their position (i.e. someone else with the same qualifications, training and experience acting in the same circumstances). Self evidently, this means that applicable rules and regulations must not be broken with the consent or connivance of the person concerned.

With pilots and ATC controllers it is true that in many situations the safety of an aircraft depends upon the proper discharge of their duties by the pilot and the controller, and much litigation arising out of aircraft accidents focuses on the extent to which responsibility should be allocated to one or the other.

In one US case, for example, an aircraft crashed into the side of a mountain. The air traffic controller was held to have been negligent in giving clearance in particular terms for a flight over mountainous terrain, but the pilot was also negligent in making a premature descent.

In every case the court will look at the proximate cause of the loss and whether that involves negligence of one or more parties.

Lastly, it is worth mentioning that flight crew and engineers working for an airline can take some comfort from the Warsaw Convention 1929 (both in its original form, and as amended by the Hague Protocol 1955) which limits the liability of airlines arising out of international carriage of passengers and includes in its limits the liability of a "servant or agent" of the airline.

Originally, that liability was limited to roughly $10,000. In 1955 it doubled to $20,000. In 1966 it increased to $75,000 for carriage touching the USA. For Cyprus Airways, the limit is currently about $135,000. Soon the limit may go entirely as a result of new rules in Europe.

Therefore, the Warsaw Convention system is not, perhaps, as useful to servants and agents of airlines as it once was. For air traffic controllers there is no protection equivalent to the Warsaw Convention system.