Understanding safety concepts

Once again, an air traffic controller had to defend himself before the Zurich High Court last week. It was about an accusation of the public prosecutor's office for negligent disturbance of public traffic. His acquittal by the court is nothing more than a recognition of aviation safety concepts by the judiciary.

Last Friday, the Zurich High Court acquitted an air traffic controller who had been charged with negligently disrupting public traffic. The case dealt with an incident from 2012 in which an unintentional proximity of two aircraft occurred at Zurich Airport. In its reasoning, the High Court followed a Federal Court decision from 2019 in which it acquitted an air traffic controller in a similar case. The reason given in both cases was that the elements of an endangering offense are only fulfilled if there is a concrete danger. Hypothetical possibilities of danger were not to be taken into account.

The fact that the Zurich High Court is now aligning itself with the aforementioned Federal Supreme Court ruling makes one sit up and take notice. Does this ruling impose a new approach to such and similar cases? Can we speak of a new court practice? Whatever the future holds, it is certainly worth taking a closer look at the judiciary's approach, which has now been adopted for the second time.

Safety concepts prevent the risk from taking place

Until now, the events to be judged by the courts have been approached exclusively from the perspective of the fallibility of the accused individual. Inevitably, the question of negligence came into focus. As a result, the administration of justice found itself on its home turf. Whether there was actually endangerment in the cases was not discussed, but tacitly accepted; or rather, simply adopted by the prosecution. That the courts in the last two cases have resisted the superficial view brought into play by the prosecution is a novelty. At long last, the judiciary is beginning to grapple with the processes and principles used in a High Reliability Organization (HRO) to ensure safety. These principles are designed to control the risks associated with the organization's activities. To do this, various and different barriers are built into the operations that do not allow the ever-present hazards to 'break through'. They prevent the occurrence of the risk and lead to the fact that the endangerment of life, material or environment does not take place. In addition to the technical safety systems, man plays a decisive role in this concept of many barriers. He himself is such a barrier and in the vast majority of cases helps to avert the hazards. For the professionals in the HROs, this activity is not understood as a mission, but as a vocation in the true sense of the word.

The effect of technical safety systems must be taken into account.

Many professionals who deal with complex systems in highly engineered work environments are nowadays assisted by technical safety systems. These systems limit human actions in that they do not allow effects that could lead to undesirable outcomes or potential hazards. These can be simple warning functions or highly sophisticated protection systems that, for example, in modern cockpits make it impossible for the pilot to leave a predefined aerodynamic envelope of the aircraft with inappropriate control inputs. Even if he wanted to, he would not be able to bring the aircraft into a spin. Thus, human freedom of action is restricted by technical devices. What is perceived by the working human being as a curtailment of his causality, however, is effectively there to protect him from his own fallibility. Such safety systems prevent human activity from developing into a concrete danger.  

The discussion shows that with the practice now adopted by the courts, such protective mechanisms must now be taken into account in the question of guilt. This is because they prevent the occurrence of a concrete danger. Many of these safety systems have been certified by authorities. In often complex test procedures, they have had to prove that no danger arises if they function correctly. From this point of view, it is regrettable that as recently as September 2019, the Federal Court sentenced an air traffic controller who was responsible for what the prosecution called a dangerous proximity of two aircraft in an airway. His instruction, which was only hypothetically dangerous, to the aircrew he was guiding was initially followed, but was prevented by a safety system in the final execution. In this case, the anti-collision warning system warned of a dangerous approach, and the pilots intervened and defused the situation. In fact, thanks to the warning system, the danger never occurred, the fact of endangerment did not exist. Nevertheless, the controller was still convicted in 2019.

The untenable 'special solution Switzerland'

In Switzerland, the public prosecutor is allowed to use the reports of the accident investigation authority (SUST) contrary to their intended purpose for their prosecutorial activities. According to statements of the public prosecutor's office Winterthur / Unterland, which is responsible for the airport of Zurich, the reports of the accident investigating authority are systematically read. It is obvious that in this scanning those incidents stand out which were classified as dangerous by the SUST. In the case of the proximity of two aircraft in the airway mentioned above, it classified the event in incident category A (Risk of collision. The risk classification of an aircraft proximity in which serious risk of collision has existed"). This is despite the fact that, as explained, there was never a concrete danger. This raises two questions. In view of the new assessment of the courts, would it not be appropriate for the SUST to examine the categorization of the incidents under investigation?  Or would it make sense that, as other states do, the question of guilt be clarified with an independent investigation led by the judiciary. The Swiss practice is objectionable, because it leads to self-disclosure for those involved in incidents together with the mandatory reporting set in place by the authorities.

When normal procedures are blown up into events

In the current case, which had to be judged by the Zurich Superior Court, the takeoff clearance for the passenger aircraft on Runway 28 with simultaneous training operations of a small aircraft on Runway 16 was a normal situation that took an unintended course. Due to the corrective interventions of the air traffic controller and the professionally correct execution of the instructed flight maneuvers by the flight instructor in the training aircraft, the situation was under control. The barriers did their job. The hazard never materialized. If the public prosecutor's office builds a gloomy danger story out of this incident, the question arises whether it wants to cause a sensation or whether it fails to understand the workings of a safety concept.


The court's assessment that there was no hazard is a tribute to the many efforts made in the 'aviation system' to guarantee safety. Hopefully, this heralds an era that clears the view and helps us to take new paths. Ways that do not lead us to posthumously understand an unintended course of events as the fault of an individual. Ways that remove the argumentative basis from a constructed accusation.