1. INTRODUCTION
Maritime transportation is characterized by a level of safety of the order of 10−5 (1 serious accident per 100,000 movements), which is inferior to that of the field of air transportation (10−6), however it is comparable to the level of safety of rail transportation and much higher than the level of safety of road transportation. Thus, for passenger transportation in Europe, the risk of fatality is estimated at 1·1 for road transportation (for 108 person kilometre) and at 0·33 for ferry transportation (Mackay, Reference Mackay2000).
However, insurance agencies have noted a global increase of partially serious losses (225 in 1998 and 700 in 2006), as well as an increase in ship groundings and collisions as causes of losses (Robertie, Reference Robertie2007). The large number of passengers transported onboard a ferry, the value of the cargoes, and the pollution risk make these types of accidents particularly dreaded events. In Europe, several catastrophic events have remained branded in people's memories: the capsizing of the Herald of Free Enterprise just after leaving the port of Zeebrugge in 1987 (193 deaths), the sinking of the Estonia in 1994 in the Baltic Sea (852 deaths), the sinking of the Erika (1999) and the Prestige (2002) spilling respectively 20,000 tons of fuel oil on Breton coasts and 77,000 tons of fuel oil in Cape Finisterre, the collision between the Tricolor (Norwegian ship transporting 2862 new luxury cars) and the container ship Kariba (Bahamian container ship) in the Strait of Dover causing the loss of the Tricolor and its expensive cargo.
Within this context, the risk of accident, and more precisely, the place of the human factor in the risk of accident, are central issues. The human factor, indeed, seems to be the main cause of incidents at sea (Hetherington, Flin and Mearns, Reference Hetherington, Flin and Mearns2006). Hetherington et al. (Ibid.) describe the factors that contribute to incidents and accidents: factors which cause a decrease in performance (fatigue, stress, and health problems), insufficient technical and cognitive capacities, insufficient interpersonal competencies (communication difficulties, difficulties mastering a common language), organizational aspects (safety training, team management, safety culture). Lützhöft and Dekker (Reference Lützhöft and Dekker2002) take a closer look at the questions of human-machine cooperation and at the role of automation in maritime accidents.
This article first presents the key concepts and models developed in psychology to be able to take the human factor into account in the safety of complex systems. It then shows the incidence of cognitive, interpersonal, and organizational factors in maritime accidents.
2. THE HUMAN FACTOR AND THE SAFETY OF COMPLEX SYSTEMS
As an extension to the definitions of technical reliability, human reliability has long been defined as the probability that an agent accomplishes successfully his/her mission under fixed time and fixed conditions (Rook, Reference Rook1962). Human error has been defined as a measure of human reliability, as breakdowns are defined as the measure of technical reliability. We have, therefore, tried to quantify the probabilities of error to be able to evaluate – a priori – human reliability. This approach considers man as an element of unreliability.
From the 1970s on, ergonomic studies have shown, contrariwise, that man is an element of reliability. Man is, in fact, the only element of the social technical system that can adapt his/her behaviour to eventual variations of situation. The trend that has developed since has insisted on the idea that man makes errors, especially when he is faced with a non-optimal situation. Human reliability is considered as the result of man-task interaction. It depends on the quality of the pairing of the operator's competencies and the work demanded in given conditions. In this approach, which was developed in France, notably by Leplat (Reference Leplat1985), error is considered as a “symptom”. Amalberti (Reference Amalberti1996) specifies that these “symptomatic errors” (or failures), that one should attempt to suppress, are those that cause immediate loss of control of the situation.
2.1. Human failure: active failure and latent failure
It is common to say that 75% of the causes of accidents are due to a human failure. It is of interest to note the trivial character of this claim. As Reason (Reference Reason1997) pointed out, it is not surprising – in fact – that human decisions and actions are involved in accidents as men are the ones to design, build, run, maintain, and manage complex technological systems.
Consequently, it is essential to define what is meant by “human failure”. Here again, the works of Reason bring a great deal of light to the subject, as this author makes a difference between “active failures” and “latent failures”.
“Active failures” are made by first-line operators (pilots, air traffic controllers, or in the maritime field, members of a crew). They are actions that have a direct and immediate impact on system safety. They are seen as the consequences of deeper causes which are “latent failures”. Latent “failures” or “conditions” are comparable to resident pathogenic agents (Reason, Reference Reason1997). They can exist in a system for a very long time without causing harmful consequences. In fact, they need to be combined with a local trigger element and active failures to cause an accident. These failures are made by people who are at a distance – geographically or temporally – from the accident and who can be legislators, system designers, maintenance agents, managers and directors of the organization.
2.2. The path of an accident: the “Swiss Cheese” model
Every organization has two functions: a production function (transporting goods or passengers for the merchant navy for example) and a protection function which is put in place according to the different types of defences and barriers that protect the system against the risks to which the productive function is exposed.
Various authors have tried to categorize the different existing defences and barriers. Reason (Reference Reason1997) defined the functions of the “defences” and explained that they are gradually deployed. A first type of defence is planned so that operators understand, are warned of, and react safely to dangers. If this type of defence fails, alarms or alerts warn the potential victims of imminent risk and help those who are running the system bring it back to a safe state. If this fails, a third level of defence comes into play, which consists in physical barriers that intervene between the dangers and the potential losses. Other defences are used to contain and eliminate dangers. If these defences prove inefficient, evacuation and rescue procedures are then used.
These defensive functions are carried out through the different barriers. Thus, Hollnagel (Reference Hollnagel2006) differentiates between “material”, “functional”, “symbolic”, and “immaterial” barriers.Footnote 1 In an ideal world, these defences should remain intact and should stop the spread of an accident. However, in reality, each level has weaknesses and voids causes by latent and active failures. These voids are similar to the holes in slices of Swiss cheese. They will create, when they are aligned, a “window of opportunity” for an accident chain to continue moving forward (see Figure 1).
James Reason's “Swiss Cheese” model (2000).
3. FROM COGNITIVE FACTORS TO ORGANIZATIONAL FACTORS
This theoretical framework makes it possible to distinguish between the different levels of accident analysis. The faulty action that directly and immediately led to the accident is carried out by an individual within a working group (here the crew); this group acts inside an organization (the company that owns the ship). A given organization is itself part of a system governed by rules.
3.1. Cognitive factors
Cognitive factors are relative to the mental activities of the operators – essentially diagnostic and decision-making activities – and to the mental structures they develop and use within the context of these activities. The mental representation (or mental model) that an operator develops for the situation with which he/she is confronted is one of these structures. It has a function to describe and explain a situation, but also to anticipate its evolution. It is the main forerunner of a decision. If it is faulty or incomplete, it can be the main factor of an accident.
The collision between the Cuyahoga and the Santa Cruz illustrates this type of failure. It has been analyzed by various authors; first of all, by Perrow who relates the accident in the following way (Perrow, Reference Perrow1999, pp. 215–217).
‘On a beautiful night in October 1978, in Chesapeake Bay, two vessels sighted one another visually and on radar. On one of them, the Coast Guard training vessel Cuyahoga, the captain (a chief warrant officer) saw the other ship up ahead as a small object on the radar, and visually he saw two lights, indicating that it was proceeding in the same direction as his own ship. He thought it was possibly a fishing vessel. The first mate saw the lights, but saw three of them, and estimated (correctly) that it was a ship proceeding toward them. He had no responsibility to inform the captain, nor did he think he needed to. Since the two ships drew together so rapidly, the captain decided that it must be a very slow fishing boat that he was about to overtake. This reinforced his incorrect interpretation. The lookout knew the captain was aware of the ship, so did not comment further as it got quite close and seemed to be nearly on a collision course. Since both ships were travelling at full speed, the closing came fast. The other ship, a large cargo ship, did not establish any bridge-to-bridge communication, because the passing was routine. But, at the last moment the captain of the Cuyahoga realized that in overtaking the supposed fishing boat, which he assumed was on a near-parallel course, he would cut off that boat's ability to turn as both of them approached the Potomac River. So he ordered a turn to port. This brought him directly in the path of the oncoming freighter, which hit the cutter. Eleven coastguardsmen perished.’
Burns (Reference Burns2000, Reference Burns, Montgomery, Lipshitz and Brehmer2005) analyzed the mental representation of the captain of the Cuyahoga and showed that this accident was not caused by a faulty decision; the captain's decision was rational within the context of his mental representation. However, his mental representation did not completely reflect reality; it almost gave the opposite image (See the comparison in Figure 2).
The Cuyahoga collision. Top panels depict the captain's mental model and bottom panels depict real world. F denotes freighter and C denotes Cuyahoga. (Burns, Reference Burns2000).
3.2. Interpersonal factors
The Cuyahoga – Santa Cruz collision reveals yet another failure, which concerns the functioning of the crew on the deck of the Cuyahoga. Indeed, one might wonder why neither the lookout, nor the watch officer shared their own interpretation of the situation. Dialogue between the three members of the crew would have certainly helped avoid the accident. But each thought, wrongly so, that they shared the same representation of the situation.
It is necessary in a group activity that all of the members build and maintain a shared representation i) of the external situation, but also ii) of the goals sought, iii) of the developed and chosen plans and iv) of the roles of each agent.
The existence of a shared mental representation is also necessary for the success of a cooperative activity, for which the various players must coordinate their actions. This representation – under the condition that it is correct – indeed makes the actions of the others predictable. These two pre-requisites (shared mental representation and inter-predictability) are essential for anti-collision situations. Common knowledge of International Regulations for Preventing Collisions at Sea should normally be the means.
As noted by Morel (Reference Morel2002), many collisions are caused by a failure to identify the intentions of others. This author points out the harmful role of the heuristic of “implicit agreement”, which can lead to absurd situations. In fact, in many cases, vessels, which would not have collided if they had stayed their course, turned in the same direction to avoid each other or one of them crossed in front of the other to let the other go by… (Morel, Ibid, p. 122, our translation). The detailed analysis of several collision cases led Perrow (Reference Perrow1999) to point out that difficulties of coordination (between two or more vessels or between members of the same crew) are the main causes of accidents. Perrow called these accidents “disconcerting” as the officers onboard both vessels had perceived the risk of collision, they had even – in some of the cases – communicated and agreed upon the manoeuvre needed. After analyzing 59 collisions between merchant vessels, Pourzanjani (Reference Pourzanjani2001) remarked a frequent lack of communication of manoeuvring intentions. Pourzanjani noted that 46% of officers had not clearly indicated their intention to manoeuvre and that 23% of officers had not detected or correctly interpreted the signal although it had been correctly given.
We have pointed out (Chauvin & Lardjane, Reference Chauvin and Lardjane2008) that different systems of rules exist – formal rules (COLREG) on the one hand and informal rules shared between certain types of vessels and specific to certain zones of navigation on the other hand- which could be the cause of these failures. In situations of interaction between people who do not know each other, the co-existence of formal and informal rules is, more often than not, a source of difficulties, uncertainty, and misunderstanding; the co-existence of two systems of different rules can, in fact, be the origin of accidents when two players or two groups of players interact while referring each to a different system.
3.3. Organizational factors
Several tragic accidents have shown the impact of ship owners' choices on the decisions of individuals, and more particularly the impact of trading profitability (production function) for safety (protection function).
Therefore, Perrow (Reference Perrow1999, pp. 182–184) states that production pressure could be an essential cause of the Torrey Canyon accident; a supertanker which shipwrecked in March 1967 between the Scilly Isles and the coast of England spilling 100,000 tons of oil over a 300 kilometre stretch along the British and French coasts. The Captain of the Torrey Canyon chose the most direct and dangerous route to reach Milford Haven as fast as possible and to take advantage of a high tide coefficient that would make it possible for him to go to port; in fact, if he did not seize the opportunity, he ran the risk of lying at anchor for five days before being able to go to bay. Likewise, Rasmussen points out that the capsizing of the Herald of Free Enterprise was not caused by a coincidence of independent failures and human errors, but by a systematic behaviour of the organization to move toward the accident, under pressure for more profit in an aggressive and competitive environment (Rasmussen, Reference Rasmussen1997; p. 189). As for the organization (here the ship-owning company), the safety culture seems to be an essential factor which influences individuals' decisions and behavior.
When, within a given organization, the accident rate remains stable – reaches a plateau – the safety culture becomes, according to Reason (Reference Reason2000), a decisive vector of safety improvement. The safety culture of an organization is the product of the values of the individuals and groups, the attitudes, perception, competencies, and behavioural patterns. These factors determine the management's commitment to health and safety, as well as the style and capacity of management. Those organizations which have a positive safety culture give safety issues the attention they require. They are characterized by communication based on mutual trust, shared perceptions of the importance of safety and trust in the efficiency of preventive measures (ACSNI, 1993, p. 23). The works of Westrum (Reference Westrum, wise, Hopkin and Stager1993) and Reason (Reference Reason1997) have led to the proposition of a model with five steps in safety culture: pathological (denial of risk, errors are punished, responsibilities are avoided, new ideas are discouraged), reactive (there is a reaction after the accident), calculative (systems have been put in place to manage risks), proactive (attempt to anticipate risks before they happen), generative (weak points are actively sought, those who sound the alarm are trained and rewarded, responsibilities are shared, failures lead to radical reform, new ideas are welcomed). The 1994 integration of the International Safety Management (ISM) code in the SOLAS convention, by giving safety management principles and means, aims at placing the merchant navy system at the proactive level. Good comprehension of the spirit of the text is an essential condition to reaching, and even going beyond this step.
4. CONCLUSION
Human and social sciences have provided concepts and models that help us to understand the mechanisms of error. Reason's concepts and models are central to this; they make up a theoretical backbone for the various accident analysis tools which specifically focus on the human factor: HFACS (Human Factors Analysis and Classification System) or HFIT (Human Factor Investigation Tool, Gordon et al., Reference Gordon2005). HFACS was used to analyze accidents in various risk systems (air and rail transportation, medical field). It was adapted to the maritime field by Celik and Cebi (Reference Celik and Cebi2009).
Human and social sciences also offer concrete actions to improve the “work situation – operator” pair. In the maritime field, these actions currently take place in two main directions: the design and evaluation of training programs on the one hand, with auditing and promotion of safety culture for ship owners on the other hand.
Cognitive science puts the emphasis on the importance of the quality of the mental representation in decision making. Various authors have sought to develop “decision-making” exercises (notably Pliske, McCloskey and Klein, Reference Pliske, McCloskey, Klein, Salas and Klein.2001), to train young professionals to analyze a complex situation in such a way so as to be able to make satisfactory decisions. These exercises were put in place and evaluated for 5th year trainee officers (Chauvin, Clostermann and Hoc, Reference Chauvin, Clostermann and Hoc2009).
In the case of a crew or team working together, the shared mental representation is one of the elements at the heart of the performance. The methods developed in cognitive psychology to analyze this mental structure can be used to evaluate the impact of Bridge Resource Management (BRM) on the work of a crew. A study of this type was carried out in Norway by Brun et al. in 2005. However – as is noted by Salas et al. (Reference Salas, Wilson, Burke and Wightman2006) – these studies remain marginal and recent in the maritime field, even though they are numerous and have been developed for several years in the field of air transportation.
Psychologists and sociologists who focus on the safety of complex systems highlight the importance of the safety culture that prevails in a given business. Using works that have been carried out in different industries “at risk”, Havold and Nesset (Reference Håvold and Nesset2009) have developed a questionnaire that is meant to measure the safety culture of Norwegian shipping companies. Nonetheless, as pointed out by Hetherington et al. (Reference Hetherington, Flin and Mearns2006), the research on this issue and applied to the maritime field is only in a preliminary stage.
As in every industry at risk, the human and organization factors constitute the main stakes for maritime safety. Furthermore, several events at sea have been used as objects of analysis by authors such as Reason, Rasmussen, or Perrow to develop or reinforce their models. It is now time for researchers and professionals in the maritime field to use the experiments that have been carried out in other high-risk fields, to design artefacts, training, and organization systems that will help increase the level of safety in the field of activity.
