HRO 9L Collision at Sea
This post applies James Reason’s model for organizational accidents the collision of the USS JOHN S MCCAIN (DDG 56, JSM) with Motor Vessel ALNIC MC (ALNIC) on 21 August 2017 in the Straits of Singapore. Reason’s model is one way of thinking about accident causality that I find useful.
I abbreviated the reference details to conserve space. Refer to the original post for the complete information.
References
(a) Navy Report of the Collision https://www.doncio.navy.mil/FileHandler.ashx?id=12011.
(b) National Transportation Safety Board (NTSB) Report of the Collision https://www.ntsb.gov/investigations/accidentreports/reports/mar1901.pdf
(c) International Rules of the Road https://en.wikisource.org/wiki/International_Regulations_for_Preventing_Collisions_at_Sea.
With more knowledge of the context of the collision, what it’s like to be Officer of the Deck on a U.S. Navy warship, the sequence of events, and the additional data provided by the accident reports about the qualifications, experience, equipment condition and operating mode, training, technical documentation, procedures, and Navy oversight, it is useful to review what we know. Not what we can learn. That comes later.
There are still gaps in what we would like to know to improve learning, but the real world is messy that way. You don’t always have all the information you want even after reading *two* independent accident reports. You do the best you can with what you *do* know, avoid over generalizing from minimal data, and resist the temptation to think you can read people’s minds.
Returning to Reason’s (1994) model for organizational accidents discussed in my first post of this series, organizational accidents can be thought of as having three connected parts:
Latent conditions that include management decision practices, oversight, system knowledge of key participants, and cultural influences. The way Reason described them, latent condition are problems that existed before the collision, but were invisible to the actors involved or they had flawed understandings related to them. These set the stage for the collision.
Local triggering events are things such as darkness, entering a congested Traffic Separation Scheme (TSS), Sea and Anchor Detail not set, and the experience of participants just before the collision. These are facts that set the accident sequence in motion or really complicated it (like darkness).
Active failures such as errors, miscommunication, and procedural violations committed by participants after triggering events form the core of the sequence of events, culminating in the collision. I’m not going to use Reason’s term, active failure, to describe the actions of participants. My reason is that it is only possible to label an action as an error or failure after you know how things turned out. That kind of hindsight judgment a) gets in the way of learning (making it too easier for people to read a report and say “Well, just don’t be stupid like they were.”) and b) isn’t knowable by participants at the time. Because something wasn’t known or knowable by participants at the time, how could they have chosen to act differently (Dekker, 2004)?
* Reason, J. (1997). Managing the risks of organizational accidents. Routledge.
* Dekker, S. W. A. (2004). The hindsight bias is not a bias and not about history. Human Factors and Aerospace Safety, 4(2), 87-99.
It can be a challenge to classify some of the conditions or decisions related to the collision as latent, triggering, or action. They are all related to decisions that human actors made either in the crucial moments before a collision or years earlier. What could be classified as an active failure in writing a technical manual or operating procedure can also be a latent condition years later. Latent conditions typically don’t just “show up.” People make decisions or omit actions or use flawed processes that reveal them. They can show up without a collision between two ships, but that’s the only way outsiders learn about them.
Latent Conditions
There were many latent conditions that contributed to the collision. For the purposes of this analysis, I consider a condition that existed before the watchstanders came on duty to be latent.
Bridge watchstanders and others in key supervisory roles “did not appear to understand the steering system, both normal operating modes and casualty response” (ref (b),p 33). We know this now, but they didn’t when they came on watch. We also know that this lack of understanding was not confined to the crew of the JSM. Unfortunately, it took a particular set of circumstances to reveal them.
Most of the Bridge watchstanders were sleep deprived. Just because this might be part of surface warfare culture doesn’t make it less true or mean that it had no impact on the decision-making ability of the watchstanders. Was this an active failure by senior leaders on the ship or a latent condition? Even though I have classified it as a latent condition, it could be considered both. Expecting people to act contrary to their prevailing culture (worrying about crew rest) is a tall order.
The technical documentation and procedures for the Integrated Bridge and Navigation System did not cover the transfer of control to other stations and the ship had no written procedures for doing it.
The most reliable mode of Steering Control System (SCS) operation was recommended, not required, by EOSS. The typical configuration of the SCS on the JSM was backup manual mode, which enabled After Steering to take unilateral control of the system at the worst possible moment.
Finally, the OOD assigned to the watch entering the TSS, one of the most challenging ship control tasks, was inexperienced. She was qualified three weeks prior to the collision.
Every one of these conditions resulted from a human decision or a process followed by humans years or hours earlier. Does that also make them active failures because we know those decisions didn’t turn out well for the crew of the JSM? This is the problem inherent with all classification schemes and not a defect inherent in Reason’s model. I think Reason’s model is useful for thinking about organizational accidents, but it is important not to mistake the map (the classification scheme) for the actual terrain (reality).
Local Triggering Events
The local triggering events were
Entering the Traffic Separation Scheme (TSS) at night with an inexperienced OOD and Conning Officer at high speed without the Sea and Anchor Detail set. The JSM was traveling twice as fast as the ALNIC. This wasn’t necessarily a problem, but it reduced the time available to recover from a problem.
The CO’s order to change the means of steering and rudder control as the JSM was entering the TSS and overtaking the ALNIC. This order initiated the series of actions that led to the collision. I am not labeling the button pushing at the Integrated Bridge and Navigation System (IBNS) control station as the triggering event because that happened while carrying out the CO’s order.
Actions Leading to the Collision
The actions (not “local failures”) that led to the collision were:
Deciding to carry out the CO’s order in the middle of the maneuver to enter the TSS at high speed ahead of the ALNIC.
More than one person pushing buttons on the IBNS. This was associated, in a way that no one will ever understand completely, with the inadvertent transfer of rudder control. This caused the Helmsman to make a report that was interpreted as a loss of steering. Control of steering was never “lost.” Bridge watchstanders didn’t know where it was. That’s bad.
No one supervising the transfer of engine control.
Not slowing the ship to bare steerageway in accordance with the JSM’s Loss of Steering Standing Order.
The delay in noticing the disparity in shaft RPM, a disparity that caused the ship to veer toward the ALNIC.
After Steering taking control of the rudder when Bridge watchstanders were attempting to maneuver away from ALNIC.
Both investigation reports note that the OOD did not ensure that the JSM was displaying the required lighting for a vessel not under command (ref (c), a vessel not able to control its movement) nor communicate its problems to the ALNIC as required. I put this in the True, But Useless bin. Recall that only four minutes elapsed between the reported loss of steering and the collision. These four minutes were punctuated by frantic efforts to understand the problem, regain control of the rudders, uncontrolled changes in control stations, and attempts to avoid collision by maneuvering away from ALNIC. To expect that the attention of Bridge watchstanders would be anywhere but on rudders and engines beggars belief.
In my next post, I will to return to the five principles of High Reliability Organizing (Weick and Sutcliffe, 2015). I will briefly analyze the collision between the JSM and the ALNIC in 2017 to consider the strengths and weaknesses of the Weick and Sutcliffe perspective for understanding an event such as this.
* Weick, K.E., Sutcliffe, K.M. (2015). Managing the unexpected: Assuring high performance in an age of complexity (3rd ed). Jossey-Bass.
