Preventing marine accidents caused by technology-induced human error

The objective of embedding technology on board ships, to improve safety, is not fully accomplished. The paper studies marine accidents caused by human error resulting from improper human-tech-nology interaction. The aim of the paper is to propose measures to prevent reoccurrence of such accidents. This study analyses the marine accident reports issued by Marine Accidents Investigation Branch covering the period from 2012 to 2014. The factors that caused these accidents are examined and categorised. Analysis shows that 31% of the marine accidents are associated with technology. Poorly designed and/or inadequately trained-for ship systems, as well as changes in job perform- ance requirements and attitudes towards practices and procedures influenced by technology de-feated a safety system, contributed to the occurrence of a human error and lead to accidents. The user-centred design and improvements in training and organisation of the ship’s crew are proposed as preventive measures. This study underpins the importance of effective teamwork in the effort to improve safety on board ships.


Preventing marine accidents caused by technology-induced human error 1 Introduction
Fast technology development has strongly influenced maritime transport.In order to reduce the risk of accidents, simplify handling of vessel's systems and increase efficiency in marine traffic, automated systems such as Integrated Bridge System, IBS, Integrated Navigation System, INS, Central Alert Management Human Machine Interface, CAM-HMI, Electronic Chart Display Integrated System, ECDIS, have been introduced.
However, in contrary to the widespread opinion that increased level of automation means more safety, technology can contribute to the occurrence of accidents caused by human error and hence defeat the purpose for which it was introduced (Lutzhoft and Dekker 2002).An increase of automation level accompanied by reducing manning level could conduce to increased cognitive demands resulting from the necessity to establish and maintain the mode awareness, the ability of a supervisor to track and to anticipate the behaviour of automated systems (Sarter and Woods 1995).The increased capabilities and the high level of autonomy of automated systems present a challenge for monitoring, integrating and interpreting information provided by automation.Additional problem comes from the difficulty of keeping track of the numerous systems simultaneously, particularly in cases when observability is hampered by poorly designed displays and weak feedback.In these cases detriment in performance on one task could occur, resulting in potentially dangerous situations (Hetherington et al. 2006).Complete understanding and working knowledge of functions and options provided by automation for carrying out tasks under various conditions, especially in unusual or emergency situations, are required in order to avoid dysfunctional interaction between operator and technology.On the other hand, a perception of technology as fully reliable and trustful, can lead to underestimating risks and consequently to the change of attitude toward seamanship practices and procedures, thus enabling occurrence of human error (Schröder -Hinrichs et al. 2012).
Human error causes between 80 and 90% of maritime accidents (Ugurlu et al. 2015).An analysis of 100 accidents at sea showed that a large proportion of casualties are caused by multiple errors made by multiple people (Wagenaar and Groeneweg 1987).Furthermore, it was demonstrated that each human error that was made was essential for the accident to happen; in other words, if any of those errors in the chain of events was prevented, accident would not happen.Therefore, examining the role of the human element is the central issue in improving maritime safety.
In this study, we have analysed 55 accidents that occurred from 2012 to 2014 as reported by MAIB 1 (MAIB 2012; MAIB 2013, MAIB 2014).According to our review causes of 31% of the analysed accidents are associated with technology.To determine preventive measures, it is important to identify the error-inducing conditions.Therefore, safety issues related to technology are discussed and examples where they directly contributed to the accident are provided to illustrate the most significant impacts on the occurrence of human error.Some recommendations for fostering safety culture are developed.A closer look at the question of improving the organization of the ship's crew, as an important preventive measure, is taken.

Inadequate equipment design
A comprehensive understanding of the working environment on board is necessary to design equipment that fit the actual needs of seafarers under all conditions.Otherwise, the design of technology can present a challenge for working safely and efficiently.For example, layout of workspaces and arrangement of controls and displays may be inadequate or brightness and loudness of important alarms and displays may not be enough to warn the operator about important changes, such as automatic or inadvertent mode transition.In 8 out of 55 analyzed accidents, one of the main contributing factors was a poor equipment design.
To illustrate an impact of poor design on human performance, several examples are provided.Control console ergonomics was one of the factors contributing to heavy contact of ferry Sirena Seaways with the berth at Harwich (MAIB 2014a).The master and officer of the watch were not in full command of the vessel's propulsion system, partly due to the layout of the propulsion control consoles.Two buttons on the bridge central console were positioned closely, and one of them, starboard controllable pitch propeller (CPP) back-up control button, not fitted with a protective cover, was most likely pressed inadvertently together with 'lights up' button.Unaware of the fact that the back-up control system is activated, the master thought that he transferred full control of the vessel to the port bridge wing.The transfer of the combinator le-1 MAIB -Marine Accidents Investigation Branch ver control between consoles was confirmed by 'in-command' lamp.However, combinator levers had not control of the CPP, because once activated, the back-up control systems` commands overrode those from the combinator levers.The facts that 'in-command' lamp was lit regardless whether the back-up control system was active and that was hard to see the glow of the back-up control lamp on the bridge wing console enabled misunderstanding over which the system had control.
The importance of designing equipment considering under what circumstances it could be used is illustrated by the case when the master was not able to warn the passengers and crew of the impending contact of the vessel Millennium Diamond with the London Tower Bridge (MAIB 2015).The mate, who was at the helm, became distracted while replaying an unexpected VHF message from London VTS about the closure of the Tower Pier, the vessel's destination.The mate was not able to maintain a proper lookout and monitor the rudder angle indicators while operating the VHF set due to the layout of wheelhouse equipment and he did not notice that the vessel was heading towards the south pier of the Tower Bridge.Immediately before the vessel struck the bridge, the master used the public address (PA) microphone in an attempt to instruct the passengers to sit down and brace themselves.However, ergonomic deficiencies of the arrangement and settings of the PA system, which were not significant during routine operation of the vessel, became crucial in emergency situation because they disabled broadcasting of the master's message.Namely, the PA system was set to the river guide mode and activating the microphone did not automatically take priority over pre-recorded broadcasts.In a situation of an inevitable contact, the master forgot to change the selector switch before approaching the microphone.Later, when he was standing by the microphone, located on the starboard, he could not reach the selector switch, located on the port side.
On the other hand, ergonomically efficient bridge design was one of the contributing factors to the grounding of the general cargo vessel Fri Ocean due to the unaccompanied officer on the watch who felt asleep (MAIB 2013b).The bridge layout was designed to enable a watchkeeper to monitor the vessel's position and adjust the vessel's course while seated in the port bridge chair.An opportunity to conduct much of the watch sitting down increased the potential for a fatigued officer to fall asleep.

Poor knowledge of own ship systems
Maritime education and training must enable the crew members to use equipment properly under various and changing conditions.An operator must have an adequate knowledge on the device operation, its abilities and limitations in order to avoid mishaps.However, new, more complex automated systems are constantly introduced on board vessels and it is difficult for a seafarer to keep pace with rapid changes.Additionally, equipment design is not standardized, and it can differ even on board vessels op-erated by the same company.For example, over 30 different designs of the interface user of ECDIS equipment exist (MAIB 2014b).The International Maritime Organization (IMO) mandates generic ECDIS training, but decision on the necessity and form of the type specific training is made by Flag States and owners.Therefore, seafarers have often to familiarize with their own vessel systems and devices, which they have not used before, immediately after embarkation.They have to do that as soon as possible, simultaneously with familiarization or refreshment with company rules and procedures.Furthermore, operating manuals are often extensive, sometimes written without full insight into user requirements and it could be difficult to extract the most important information within a limited time.Furthermore, there are cases when some equipment is completely renewed but old usage instructions and maintenance manuals are not replaced.That can be dangerous, especially when the equipment breaks down and needs to be repaired quickly for safety reasons.These issues contribute to stress and fatigue, factors that cause maritime accidents (Berg 2013).
The introduction of a new technology sometimes requires delivering of a type specific training in a short period of time.Therefore, it could be difficult to provide effective and sufficient training.Poor knowledge of the own ship systems contributed to 15% of the analysed accidents.
A grounding of the oil/chemical tanker Ovit on the Varne Bank in the Dover Strait, England, is an example of accident caused by an insufficient level of knowledge about the ship equipment (MAIB 2014b).Ovit's primary method of navigation was an ECDIS.All of Ovit's deck officers had attended a generic ECDIS course and a type specific ECDIS training.However, they were not able to safely navigate using it.The intended route through the Dover Strait, prepared by inexperienced and unsupervised junior officer, contained errors including passing directly over an area with shallow waters.The route was not properly checked for navigational hazards using the ECDIS check-route function.ECDIS safety settings were not appropriate.The scale of Electronic Navigation Charts in use, selected by the chief officer, was unsuitable for the area and the ECDIS 'auto-load' feature was switched off.It had not been reported that the system's audible alarm was not functioning, indicating that the crew members were unaware of the significance of the system's alarms.The accident investigation revealed that ECDIS training undertaken by the ship's master was not effective due to the fact that it was delivered to ship's officers of varying ranks and experiences.That prevented the ship's master to reveal his lack of knowledge and ask questions.

Complacency
Along with the increased computerization and automation on board vessels, the role of the seafarer has changed considerably, from the main operator in control of the systems to more or less passive observer.Since traditional knowledge and skills are not needed to perform passive control actions, there is a possibility of losing such knowledge and skills (Bielić et al. 2011).Simultaneously, dependence on and trust in technology is growing, giving rise to new error sources and risks.
The highly automated systems of modern vessels may foster complacency, a feeling of self-satisfaction accompanied by a loss of awareness of potential dangers.As a result, the operator's vigilance decreases.A complacent behaviour can be manifested as a failure to closely monitor and check instruments, relying on one source of information instead utilizing all navigational aids, overlooking procedures, resorting to incorrect practices, missing important signals, misinterpreting signs.Consequently, detection of potentially dangerous situations can be delayed or missed.
One of the factors that may lead to complacent behaviour is over reliance on new technology (Parasuraman and Manzey 2010).Operators are lulled to thinking that the system will not make a mistake, and that it is safe to shift alertness to other tasks.This false sense of security develops especially if technology has been operating acceptably for a long period.As a result of the substandard monitoring and checking of the technology functionality, a malfunction, anomalous condition or failure passes unnoticed.Furthermore, information provided by technology could be trusted completely and not verified by alternative sources.There are cases where seafarers misinterpreted or ignored information obtained by visual lookout because it differed from those expected and based on automation (Schager 2008; Schröder-Hinrichs et al. 2012) For example, as previously mentioned, the vessel Ovit approached the Varne Bank, the assigned lookout was on the bridge and was looking through binoculars.However, he did not identify the lights from the cardinal buoys marking the Varne Bank or report the sighting to the officer of the watch (OOW) (MAIB 2014b).A complacent behaviour contributed to 11% of the analysed accidents.
Complacency nurtured by automation was one of the factors contributing to accident and involving the cargo vessel Rickmers Dubai, unmanned crane-barge Walcon Wizard and tug Kingston (MAIB 2014c).The collision happened while Rickmers Dubai was overtaking Kingston and Walcon Wizard due to Rickmers Dubai's OOW, who did not notice Kingston and Walcon Wizard until it was too late to avoid a collision.Several facts indicated that OOW was relatively idle during his watch.The Rickmers Dubai was fitted with X-band radar and the radar targets of Kingston and Walcon Wizard were on display for almost one hour.However, OOW did not use ARPA or visual lookout to determine if a risk of collision had existed.Therefore, it could be concluded that he was not monitoring the radar display or looking out of the window.Instead, he relied solely on the AIS information displayed on the ECDIS, ignoring inherent limitations of AIS which include the possibility that a complete picture of situation may not be obtained.Furthermore, the content of two safety broadcasts issued by the Coastguard advising of Kingston and Walcon Wizard's position passed unnoticed.Similarly, a compla-cent behaviour of OOW caused a grounding of the general cargo ship Douwent on Haisborough Sand in the North Sea (MAIB 2014d).In this case, he relied solely on the global positioning system (GPS) to monitor the vessel's position and therefore he did not notice that Douwent departed from the intended route.Namely, the waypoint selected as the destination in the GPS receiver differed from those detailed in the voyage plan.Furthermore, the ease of monitoring the information available from GPS contributed to a lack of stimulus which led to him falling asleep.The facts that he told to an able seaman that he was not required to remain on the bridge and that the bridge watch alarm was switched off indicated that he underestimated risks and ignored the need for following rules on bridge watchkeeping practice.

Preventive measures
To determine appropriate preventive measures, a holistic and systematic approach to safety is required (Kim et al. 2016).All components in complex socio-technical systems such as maritime transportation can have a role in promoting errors and accidents.Therefore, it is important to analyse all links in the human chain error, not only the mariners.Safety-critical decisions are also made on other levels: shipbuilding companies, ship-owning companies, classification societies, industry associations and government regulatory authorities.
An answer to the problem of poor ergonomics of equipment design is the application of user-centered design, in which the needs, wants and limitations of operators are taken into account at each stage of the design process.Equipment designers should be completely familiar with all tasks performed by mariners in plenty of situations that can exist on board and around the ship in order to be able to design equipment which will cooperate with its human operator under all circumstances (Lutzhoft and Dekker 2002).Otherwise, maritime equipment is designed for work-as-imagined not for work-asdone which could lead to significant safety issues because there is a considerable difference between them even during routine operations on board ships and particularly in unexpected or emergency situations.In addition to general technology acceptance variables: perceived ease of use and usefulness, an impact of technology on decision performance (such as situation awareness, threat avoidance, situation monitoring, voyage plan monitoring) and decision process (stress, confidence, satisfaction, mental and physical effort, vigilance and fatigue) should be considered in order to improve safety and aid human decision making (Dhami and Grabowski 2011).As technology becomes more complex and autonomous it is crucial to design it in a way that it complements humans and becomes an effective team player in order to avoid misassessments and miscommunications (Lutzhoft and Dekker 2002).A number of improvements in design can be made to sustain this task.For example, activities of automated systems should be observable, not just available and rep-resentation of automation behaviour would have to be event-based, future-oriented and pattern-based.Because a ship is a specific working environment, a feedback from end-users is necessary to improve design.Therefore, it is important to stimulate all mariners to report possible issues or problems with technology which occurred without consequences.All crew members should be involved in the process because users with different roles and responsibility could experience significantly diverse technology impacts over time (Dhami and Grabowski 2011).
One of the important steps to prevent the occurrence of accidents caused by insufficient level of knowledge of the own ship systems is the improvement of training.Generic and type specific trainings should focus not only on working knowledge of the functions of the automation in routine situations, but also in unusual or emergency situations.Furthermore, planning and deliverance of the training should take into account differences between attendees involving not only previous knowledge and experience with technology, but also cultural influences and possible issues arising from the perception of ship organization as a strong hierarchical structure.A special attention should be paid to emphasizing capabilities and limitations of equipment in order to provide an understanding that it is necessary to get information from all available sources and to prevent a complacent behaviour.The usage of simulators during shore-based trainings can improve the seafarers' complacency awareness and equip them with practical knowledge on the systems they will use on board.If simulators, used during trainings, exactly represent systems and equipment that seafarer will use on board, it will shorten the time needed for familiarization and enable on board teams to function efficiently even when a new member embarks on board a vessel.The shipping companies should ensure that all instruction manuals as well as procedures and work instructions given in the safety management system correspond to actual equipment on board and actions to be taken in emergency situations.Crews should be encouraged to report situation on board and ask for more precise instructions or more adequate manuals from the company or equipment manufacturers.Equipment standardization would diminish hazard of poor design and reduce the length of the operator cross training between ship types.
Effective teamwork is essential for optimizing safety on board vessels.Productive interactions among crew members can preclude accidents caused by deficiencies in technology design, inadequate familiarity with systems and overreliance on technology.However, traditional relations on board ships with steep authority gradient may be difficult to overcome.For example, in the previously described case of Sirena Seaways the engineers noticed that back-up system was activated in time to prevent an accident, but they did not ask or inform the bridge team (MAIB 2014a).The master has the most important role to play to facilitate effective communications among crew members.Achieving and sustaining a positive safety culture is not possible if the master is not able to maintain a balance between his authority and the crew members' initiative.He has to consider reasonable challenges from crew members and acknowledge positively and explain his decisions during briefings to encourage crew members to speak up if they spot an error.To motivate crew members to report equipment deficiencies, weaknesses in safety and/or near-misses, it is important to avoid attributing the blame whenever it is possible.Instead, the role of supplying safety-related information as useful preventive measure should be emphasized.

Conclusion
Despite the efforts of a global maritime community, maritime accidents caused by human error still occur.In order to reduce their number, it is vital to understand which human and organizational factors determine how the work on board a ship is carried out.Our analysis of the accident reports confirms that ineffective relationship between human and technology remains one of the factors that contribute to the development of human error.Inadequately designed, baffling and insufficiently understood technology created error pathways that lead to accidents.On the other hand, perception of technology as fully reliable resulted in an inadequate crew members' performance.
To decrease the likelihood of an occurrence of human error related to technology, several actions are necessary.Because bridge standardization is a huge challenge and it will probably not happen in the near future, it is important to conduct trainings using same or very similar systems to those installed on board ships.Furthermore, a favourable learning environment should be created and all trainees should be encouraged to participate in confirming understanding and to be sure that training was effective.During delivering training courses, it is essential to accentuate that human operator should use technological aid critically and obtain information from as many sources as possible.All crew members should provide safety-related information.To establish and maintain an effective safety culture, it is necessary to abandon old-established methods of ship organization and regard crew as a team with the master as a leader.