Safety 2: Digging deeper than human error to root causes of shipboard incidents

Rather than cutting humans out of the loop
Rather than cutting humans out of the loop

Even if it is not part of any army’s official training regimen, new recruits are well-advised to memorise Murphy’s laws of combat operations, the unofficial, humorous comment on the folly of humans and their best-laid plans. Amid gems such as “No plan ever survives initial contact”, and “friendly fire … isn’t” is perhaps the most important rule of all: “Always keep in mind that your weapon was made by the lowest bidder.”

Even for those of us not currently digging a foxhole, it is easy to see where these rules can overlap with other aspects of life. Martin Shaw, chairman of IMarEST’s Human Element Working Group (HEWG) and a ship manager of many years’ standing, cites Murphy’s Law, and warns that in our rush to automate humans out of ship operation, we could be making a grave oversight.

“Ships are not designed by geniuses,” he pointed out. “In almost all cases, they were designed and constructed by the lowest bidder.”

Humans take the blame

Although the unspoken appeal of unmanned vessels is the assumed cost benefit of having to pay few or no crew, the most commonly given rationalisation is human error. To hear it from the developers of such technology, troublesome humans are identified by insurers as being the cause of nearly all accidents; merely stripping them out would do away with almost all accidents, cyber security breaches, and the cost of a Netflix subscription.

But Shaw and many others argue that, too easily, shipowners, managers, insurance companies, regulatory bodies, and even salvors get caught up in the assumption that vessels and IT systems, as well as the regulations and operating procedures, are all flawlessly designed and would operate trouble-free but for the meddling, accident-prone humans on board. However, while incompetence or outright negligence might be to blame in a minority of cases, in most ‘human error’ scenarios, those humans are merely unfortunate – the last line of defence against a disaster whose seeds were sown long before they came aboard.

“Built into the design of any ship are a vast number of compromises and cost savings,” said Shaw. “Often, there is an assumption that they don’t have to be designed perfectly, because the crew – people the designers have never met – know what they are doing, and can deal with the consequences.”

Shaw’s thinking is part of a new movement in safety known as Safety 2. He pointed out that following the successful implementation of best management practice (BMP), safety on vessels improved considerably. However, he added, rather than completely eliminating ship accidents, the benefits of BMP have tapered off, leaving safety in a better state than it was in the 1980s, but still some way short of ideal. With the maritime industry’s unerring focus on what is going wrong, it is no wonder that crew are found to be at fault in most cases, he argued.

But there might be a bigger problem brewing. As well as helping to make the lives of crew even more pressured and stressful, this blame-game narrative risks detracting from other, very real problems. One of these is the increasing extent to which important tasks are taken away from crew and foisted, instead, on to machines. “The thing about automated machinery is that for the last 40 or 50 years, we haven’t seen the reliability of this machinery improving,” Shaw said. “It is actually getting worse, because of electronic systems, which are sensitive to vibration and heat.

“Vibration and heat aboard ships – who knew?”

As these systems take over more tasks on vessels, the ability to perform them manually in a worst-case scenario becomes much more difficult. Assuming that connected technology will always behave perfectly is a recipe for dangerous oversights, Shaw argued. “There are, of course, many things that can be done to improve safety using technology. The move towards unmanned ships requires a huge number of new systems to be developed, to do with situational awareness, navigation, and such.

“Maersk has bypassed discussion of unmanned ships. It has taken the approach that with all these fantastic new technologies under development for seeing what is around you and improving safety. Why don’t we give those systems to the people on board ships now?”

A better approach

Maersk’s enlightened approach is informed by the principles of Safety 2.

Merely examining safety reactively in the event of something going wrong is not sufficient, advocates argue, and will almost always point to human error as the cause.

But to get a holistic picture, it is necessary to look at ship operations from day to day. Instances may even be found of the ‘meddling humans’ averting disaster by developing ad hoc solutions to shipyard- and OEM-instigated problems, Shaw said.

As an example, Raytheon Anschutz, a manufacturer of integrated navigation systems, claims to have fabricated just such a device – a “user-defined” ECDIS system – taking into account considerations from a huge number of experienced seafarers and ECDIS users.

“We built up a team, from navigators, pilots, maritime experts, trainers, nautical students, and we conducted a two-year development,” said Martin Richter, Raytheon marketing manager. “We are trying to discover the benefits and shortcomings of the existing system. Then we put everything together in a simplified interface design.”

One of the major concerns with ECDIS in recent years has been the extent of the training required to use it. Not only must seafarers demonstrate proficiency with ECDIS systems in general, but manufacturer-specific training must be developed as well. Such is the complexity of individual systems that changing from one employer to another, or even from one vessel to another, will require seafarers to learn a whole new way of performing the same functions, akin to switching from Windows to Mac.

Features trump safety

The problem is that competition among OEMs has led to a race to the top in terms of features – which manufacturers know very well will form the bullet points that will be the basis of their sales. Meanwhile, perversely, human understanding, usability, and ultimately safety have been allowed to become a secondary consideration.

“In the past, these systems were designed by engineers, who have less, or even no experience in how to operate the systems on board,” said Richter. “Raytheon’s software is centred around a human-centred design function.”

He went on to explain that incidents involving human error often arose when the systems crew were using were not clear, if vital information was not able to be found during time-sensitive operations, or where workflows were too complicated for officers to execute correctly.

“We can see that there is a path of adding functionality, but from our point of view this is to do with simplifying the interpretation of the situation and providing decision support to the operator,” said Richter. “We provide them with the support to identify the situation correctly and give them all the information they need to take the right decision.”

Since every manufacturer, naturally, is convinced its own interface is the best and most intuitive, one proposed solution was to develop an ‘S-Mode’ or standard mode, reachable at the press of a button and common to all ECDIS consoles. This would pare back the various overlays and boxes to reveal a basic, functional, standardised ECDIS interface.

But manufacturers cannot agree on how to achieve this, Richter explained. “We are part of the discussions around this, but it’s not yet been defined how S-Mode will be realised. We can easily bring our system back on to a basic display, which certainly could be standardised. But when talking about S-Mode, there is the question of whether this display would or could be identical among the suppliers,” he said.

Until that time, he said there would be a lot of “assistance-type functions” integrated in the next few years, including its own, which can be integrated “without overwhelming the user”.

Well aware of Safety 2 and its principles, Richter believes that concentrating on improving safety in the here and now is more productive. “What we hear from our customers is that autonomous ships are quite far away,” he said. “On today’s ships, we have crews who need to operate the vessel in stressful situations. Our common goal [as ECDIS manufacturers] is to reduce accidents and increase safety.”

Like Shaw, Richter argues that increased automation does not necessarily decrease human stress. It appears that rather than taking the pressure off humans, the humans who have survived culls in manpower are now expected to take on even more duties than before. “We could afford to work on reducing stress and letting navigators concentrate on navigation, instead of administration,” Richter said.

He emphasised the main task as a manufacturer was to design systems that are as safe and secure as they can be, while supporting its customers and the navigators who remain on board.

“As long as customers sail with crew on the bridge, we must focus on simplifying the workload for these people. In this way, we can assist the human being in compensating for whatever mistakes that came before.”