Kristiansen Svein. Maritime Transportation: Safety Management and Risk Analysis
Подождите немного. Документ загружается.
Ta b l e 13 . 5 . Exxon Valdez ground i ng
Functional error Preventive measures
Latent phase
Inadequately manned
relative to the operational
requirements
Inadequate leadership Alcohol rehabilitation programme
Inadequate manning of the bridge Improve quality of management
Pilot did not report manning irregularity Leadership training
Inadequate planning of the voyage Enforcement of port state control
Modification of behaviour
Summary of events
Vessel leaves port fully loaded. Master under influence of alcohol and away from the bridge most of the time until pilot leaves the vessel.
Voyage planning and adequate manning of the bridge has not been taken care of.
Initiating phase
Inadequate bridge
watchkeeping
Unqualified mate on watch Bridge management training
Watch lacks a second officer required in
Prince William Sound
Inadequate voyage planning
Alcohol rehabilitation programme
Leadership training
Behaviour modification
Summary of events
Vessel leaves Traffic Separation System (TSS) in order to avoid drifting ice. Watch is left to 3rd Mate who is not checked out for this
part of the voyage in Prince William Sound. Exxon requires two qualified officers on watch. Master gives an imprecise sailing order
before he leaves the bridge.
376 CHAPTER 13 AC CID ENT ANALYS IS
Escalating phase
Navigation without full
control and consequent
delayed turn back to
safe waters (TSS)
Inadequate assessment and selection of waypoints Training in coastal navigation
No plotting in chart Electronic chart display system (ECDIS)
Increasing and too high speed Upgrading of VTC facilities
Disturbed by drifting ice Training in VTC operations
VTC did not monitor vessel
Summary of events
Vessel stays on a hazardous course for too long. Mate is unable to keep an updated position fix relative to the shallow water at same
time as he must observe the ice-infested waters. Starts turn too late.
Critical phase
Too late adjustment of
turning radius (rate of turn)
Too late switching to hand steering Training in coastal navigation
Ordered too little rudder Training in ship handling
Maloperation of rudder control Improved ergonomics of control systems
Summary of events
The return to the TSS starts too late and the turning of the vessel is executed with too little rudder. There are some unclarified points
with respect to whether the rudder is operated wrong or too little rudder is ordered. Vessel hits Bligh Reef.
Source: Kristiansen (1995).
13.8 TH E LOSS CAU SATION M ODE L 377
Immediate causes
Immediate causes are defined as those circumstances that immediately precede the
accident. They could also be labelled as unsafe acts or practices and unsafe conditio ns.
Instead of ‘error’, the word ‘substandard’ is preferred by DNV to avoid questions
of blame.
Basic causes
Basis causes are defined as those factors underlying the immediate causes. They are also
referred to as root causes. The followin g taxonomy is used for basic causes: personnel
factors (motivation, lack of skill, lack of knowledge, stress) and job factors (inadequate
leadership or supervision, inadequate maintenance, unsuitable design or purchasing of
equipment and tools, unclear procedures, etc.).
Lack of control
Finally, lack of control is operationalized as inadequate and/or improper regulations.
These are at the start of the even t sequence and produce the conditions for basic causes.
Control is traditionally seen as one of the basic management functions next to planning,
organizing, and leading/directing. Lack of control may originate from:
. Inadequate safety control systems
. Inadequate performance standards
. Inadequate compliance with standards
Managers are encouraged to identify hazards using an appropriate technique such as
HAZOP, fault tree analysis, etc. As well as hazards, means to control them should be
identified. Once identified, a prioritization can be made. Thi s implies that decisions must
be made on the basis of risk and cost estimates. Again, several tools may be used such as
quantitative risk analysis, reliability analysis, etc.
13.8.3 LCM Database
The LCM approach to accident investigation and reporting puts e mphasis on systematic
coding. This allows the user to study trends and analyse correlations between accident
Figure 13.5. Loss Causation Model (after Bird and Germain,1992).
378 CHAPTER 13 AC CIDENT ANALYS IS
factors. The risk manager may thereby monitor the risk picture of the operation. The
approach assumes that the incident is reported both in terms of free text infor mation
and coded data. The main items are summarized in Table 13.6.
The Loss Causation Model in its original form was designed to deal with land-based
industry and did mainly focus on personal injury (work accidents) and economic loss.
It can also be noticed that the database, apart from concrete findings, also contains an
estimate of recurrence and potential seriousness of the kind of accident reported. Although
this is merely subjective data, it is useful for presentation of the risk picture for the system
or operation. This may for example be done in a matrix format showing probability versus
seriousness.
13. 8.4 Taxonomy
A more detailed picture of the code structure is shown in Table 13.7. The different
elements in the taxonomy will be commented upon.
Losses are used to denote the consequences of an accident and focus on personal injury
and property/process damage. Bot h the object involved and the degree of seriou sness are
indicated.
Incidents deal only with personal injur y. It provides a classification of the kind of event
or accident that directly affects the persons involved. It does not provide a description
of the type of event that is related to the property or process involved. This weakness
becomes evident if different accident types happen to be relevant for the system (property/
process) and person. A fire in a building may, for example, lead to a fall accident to a
worker involved. The fall accident may be coded (incident) but there is no coding option
for the fire accident.
Table 13.6. Items in the LCM investigation report
Section Description
Identifying information Company, department, persons, date of incident
Kind of injury and nature of loss, investigator identif.
Risk Evaluation of loss potential: probability and seriousness
Description Describe how the event occurred (text)
Cause analysis Immediate and basic causes (text)
Action plan What has and/or should be done to control the causes listed (text)
Immediate causes Coding of: Substandard actions
Substandard conditions
Basic causes Coding of: Personal factors
Job factors
Personal injury Coding of: Type of contact
Contact with energy, substance or people
Review Assessment of the investigation and report
Site Sketch of site
13.8 TH E LOSS CAU SATION M ODE L 379
Ta b l e 13 . 7. Incident analys is summary
Losses Incidents Inadequate control
Type No. Type No. Programme elements P S C
Injury/illness: Struck against Leadership and administration
First aid Struck by Management training
Medical treatment Fall to lower level Planned inspections
Lost work day Fall on same level Task analysis and procedures
Fatal Caught in Accident/incident investigation
Part of body harmed: Caught between Task observations
Head Overexertion Emergency preparedness
Eye Overstress Organizational rules
Hearing Contact with: Accident/incident analysis
Respiratory Heat Employee training
Trunk Cold Personal protective equipment
Digestive tract Fire Health control
Arm Electricity Programme evaluation system
Hand Chemical–caustic Engineering controls
Finger Chemical–toxic Personal communications
Leg Noise Group meetings
Knee Pressure General promotion
Ankle Radiation Hiring and placement
Foot Purchasing controls
Toe Off-the-job safety
Skin
Property or process:
Minor (less than $100)
Serious ($100–$999)
Major ($1000–$9999)
Catastrophic (over $10,000)
Type of property damaged:
Building Legend:
Fixed equipment P ¼Inadequate programme
Motor vehicle S ¼Inadequate standards
Tools C ¼Inadequate compliance
380 CHAPTER 13 AC CID ENT ANALYS IS
Materials
Materials handling equipment
Immediate causes Basic causes
Type No. Type No.
Substandard practices: Personal factors:
Operating without authority Physical incapacity
Failure to warn Mental incapacity
Failure to secure Lack of knowledge
Improper speed Lack of skill
Made safety device inoperable Physical stress
Used defective equipment Psychological stress
Used equipment improperly Improper motivation
Did not use protective equipment
Serviced equipment in operation Job factors:
Adjusted equipment in operation Inadequate leadership/supervision
Horseplay Inadequate engineering
Under drug/alcohol influence Inadequate purchasing
Inadequate maintenance
Substandard conditions: Inadequate tools/equipment/materials
Inadequate guards Inadequate work standards
Inadequate protection Wear and tear
Defective equipment Abuse and misuse
Congestion
Inadequate warning system
Fire hazard
Explosion hazard
Reactive chemical
Hazardous atmosphere
Noise
Radiation
Illumination
Ventilation
Poor housekeeping
13.8 TH E LOSS CAU SATION M ODE L 381
The explanation of why the incident took place is based on two sets of factors, namely
‘immediate causes’ and ‘basic causes’. The immediate causes are grouped into two:
. Substandard practices: Errors in terms of actions or omissions directly related to the
process involved. These have 12 different categor ies of a fairly crude nature and does
not indicate very precisely what kind of functions or tasks wer e affected.
. Substandard conditions: Deno te inadequate work conditions, extreme environmental
conditions, or acute events that affected the person or operator.
The basic causes are also structured into two subsets as follows:
. Personal factors: Factors that make the operator less competent for the critical task or
function. It may be a permanent or temporary disability or limitation. Another kind of
explanation is lack of competence due to inadequate training. Wrong attitude may also
be relevant.
. Job factors: Shortcomings or weaknesses related to work organization and manage-
ment. This set of factors is mainly structured by management function, namely
leadership, eng ineering, purchasing, etc.
The last element in the causal analys is chain is to pinpoint what the authors
have denoted ‘inadequate control’. This was a fairly innovative idea in the sense
that the method put more weight on the management part than had traditionally
been the case. It is, however, somew hat difficult to see the distinction between job factors
and inadequate control. The main difference is that the controls are more detailed and
specific. Another interest ing aspect is the option to make a distinction between different
kinds of inadequacies: inadequate programme, standards and compliance.
13.8.5 Data Storage and Application
ILCI has been quite concerned about the user aspects of the Loss Causation
Model (LCM). In the publication Practical Loss Control Leade rship (Bird and Germain,
1992), incident reporting is put in a wider scope as an element in safety managem ent.
Incident reporting is seen as one approach that must be supported by other functions
such as conventional inspections and safety managemen t audits. Within the scope
of management it also outlines risk control, task analysis, employee training and
occupational health.
The preparation for incident investigation is discussed thoroughly in terms of
organization, procedure and techniques. Important requirements for performing an
adequate investigation are outlined and the most frequent pitfalls are pointed out.
The LCM is also prepared from a practical point of view by giving forms for reporting,
announcement and major incident review. The report form contains identification data,
textual description of events and causes, and coding of key parameters.
The method also offers a set of checklists for identifying basic causes termed
SCAT (Systematic Causal Analysis Technique). Such factors are not readily visible in
382 CHAPTER 13 AC CID ENT ANALYS IS
an accident investigation and require considerable knowledge and experience in work
psychology and management. The checklist is seen as a help in identifying relevant
basic causes.
13.8.6 M-SCAT
DNV took over ILCI, and thereby the services related to the LCM method which have
been described in previous sections. As DNV has their main activity in the marine and
maritime business, there soon emerged a need for an adaptation of the LCM to these
areas.
As the critical part in accident investigation is often to identify causal factors, it was
decided to develop a taxonomy for marin e operations which was called M-SCAT (marine
version of the original SCAT scheme). The overall structure of the coding scheme was
slightly modified. The new version is shown in Figure 13.6. Apart from tailori ng the
framework to marine accidents, M-SCAT also eliminated some of the shortcomings of
the LCM taxonomy.
The M-Scat taxonomy has the following basic classes:
. Type of contact: Indicates the accident type and now covers both personal injury and
property/process damage.
. Immediate/direct causes : Substandard acts are directly related to maritime tasks.
Substandard conditions are directly related to ship systems and functions. Both
categories are thereby less generic.
The rest of the taxonomy, ‘basic causes’ and ‘control action needs’, is more or less
unaltered. This should also be expected, as they cover fundamental human and
organizational behaviour according to LCM.
13.9 AL TERNA TIVE ACCIDENT MODELS
13.9.1 Systems Orient ation
An important and ch aracteristic aspect of maritime casualties is the involvemen t of quite
large systems. The vessel in itself is a major technical system, the crew may be in the order
Figure 13.6. Marine Systematic Cause AnalysisTechnique (M-SCAT).
13. 9 AL TERNA TIVE ACCIDENT MODELS 383
of 15 persons or more, and the supporting land organization even much larger. Another
typical trai t is the physical interaction with the environment that may have consequences
for both navigation and ship handling. This aspect should therefore be incorporated in the
casualty analysis process.
A simple way to state this is that the taxonomy should incorporate the main systems
elements or resources in line with the SHEL model (Hawkins, 1987). The generic elements
are (Figure 13.7):
. Humans – ‘liveware’ (L)
. Equipment – hardware (H)
. Organization – software (S)
. Environment (E)
Secondly, it is important to acknowledge critical interfaces or interactions between these
elements. Typical maritime problem areas are for instance:
. Seasickness: E on L
. Workplace and ergonomics: H on L
. Lack of planning: S on L
. Lack of co-operation: L on L
. Disturbance on systems: E on H, and so on.
In principle, each system element may have an adverse effect on the performance on any of
the other one s and vice versa.
13.9.2 The Process Aspect
A third productive viewpoint is the information processing aspect of a maritime system.
Humans can be viewed as information processors just as equipment and organizations
can. The main information processing functions of the operator are detection, perception,
analysis, decision, action and communicatio n, as illustrated in Figure 13.8. A more
Figure 13.7. System elements.
384 CHAPTER 13 AC CID ENT ANALYS IS
complete discus sion of this aspect is found in the report on methodological approaches
(Koster et al., 1999).
13.9.3 Organizational Factors
The research of J. Reason (1990, 1997) has had a profound influence in present thinking
on why accidents happen and how they should be managed. A key point is that the
observed unsafe acts should be traced back to workplace factors and organizational
factors, as indicated in Figure 13.9. Reason (1990) has also pointed out that the
management of accidents may be based on alternative feedback loo ps related to the
hierarchical levels in the operation (see Figure 13.10).
Figure 13.8. Mariti me operation as an information processing system .
Figure 13.9. Organizational accidents (after Reason,1997).
13. 9 AL TERNA TIVE ACCIDENT MODELS 385