DMAIB: Risk Assessment that Facilitated Taking Risks (MÆRSK SEARCHER and MÆRSK SHIPPER Sank Undertow)
The Danish MAIB have published their report on the loss of two Maersk Supply vessels being towed for breaking. Key staff being made redundant, a risk management system that facilitated risk prone operations and a perception of being “industry frontrunners, capable of solving difficult and novel tasks” all feature in this accident. The DMAIB say:
The DMAIB regards the foundering…as a systemic accident. This means that local and technical circumstances unfolding on board MÆRSK BATTLER during the voyage cannot be isolated from the preceding organisational events and circumstances taking place months earlier.
The Accident Voyage
DMAIB explain:
On the night between 21 and 22 December 2016, the Danish offshore supply ships MÆRSK SEARCHER and MÆRSK SHIPPER capsized and sank in the Bay of Biscay approximately 65 nm off the French coast while being towed by another offshore supply ship, MÆRSK BATTLER, en route to Aliaga, Turkey [to be broken up].
MÆRSK SEARCHER capsizing and sinking alongside the still afloat MÆRSK SHIPPER on 22 December 2016, just past midnight. (Credit Private Photo via DMAIB)
MÆRSK SEARCHER and MÆRSK SHIPPER were configured in a side-by-side towing setup during the voyage. During the passage of the English Channel, the fenders between the ships on tow failed, and the ships started to interact. This caused damage to the ships’ superstructure, which eventually compromised MÆRSK SEARCHER’s watertight integrity and led to water ingress.
The crew on MÆRSK BATTLER did not realise that the ships were at risk of being lost due to loss of stability until 10 minutes before the capsizing of MÆRSK SEARCHER, though both ships had suffered significant structural damage
MÆRSK SEARCHER capsized and sank, and subsequently MÆRSK SHIPPER was pulled under by MÆRSK SEARCHER. The crew on MÆRSK BATTLER carried out a controlled breakage of the towing wire and came loose of the foundered towage.
DMAIB Analysis: The Towing Plan and Redundancies
In early September 2016, a Management of Change (MoC) meeting was arranged as a kick-off for the planning of the MÆRSK SEARCHER and MÆRSK SHIPPER’s voyage to Aliağa.
Significantly the tow was originally planned with a less well-equipped ship, with only one winch (and so incapable of a double tow). This necessitating a higher risk side-by-side tow configuration to avoid the cost of crewing one of the towed vessels in a serial tow configuration.
In October 2016 the superintendent who started the towing plan was laid off in a round of dismissals. He was not given time to hand over his work as the redundant employees were all required to leave work on the day the redundancies were announced.
Most of the work documents were saved on the individual employee’s personal work computer, and the company did not have a system in place for securing such documents during dismissals. Therefore, the knowledge of the ongoing operations possessed by the individual employee was lost.
The DMAIB make no mention of any MoC or risk assessment of the staff changes even though…
According to the company’s own definition, the Management of Change meeting has the purpose of ensuring that “changes are managed and that the risk of failure is minimised without jeopardising people, the environment, our property and our organisation.”
Furthermore:
Later in October, the company underwent a second organisational change, which imposed a large-scale rotation among the employees as a result of the merging fleet teams. As a result of the merging, the employees in the operations team managing the vessels based in Europe were moved to other sections.
The new operations team continued the preparation of the towing operation. The preparations were mainly handled by a shipping trainee, who was supervised by an operations manager.
The new operations team did not evaluate the towing setup as this was considered approved months ago.
At the handover during the organisational change, they had been [incorrectly] informed that the preparation of the towing setup had been concluded and approved, and that the towing operation was ready to be executed.
When a more capable ship, the twin winch equipped MÆRSK BATTLER, was substituted in early December 2016 the towing method was not reconsidered. The towing procedures were not complete either:
A review of the document reveals that it can be characterized as a working paper for planning the towing operation rather than an operational procedure describing how the towage was to be carried out, as it did not contain vital characteristics of a procedure.
The towing procedure showed visible signs of not having been completed. These consisted of the draft watermark and notes about certificates that needed to be compiled. The document did not indicate whether entire chapters or sections were missing.
While the trainee tried to forward this draft to the MÆRSK BATTLER an internet connection failure occurred. The Captain of the MÆRSK BATTLER however had the plan for a previous tow to Turkey by MAERSK CHANCELLOR towing MÆRSK BEATER albeit with a different, simpler tow configuration.
The crew on MÆRSK BATTLER were aware that the side-by-side towing method was untraditional for this type of voyage. However, the crew strongly identified themselves with the company’s image of being industry frontrunners and capable of solving difficult and novel tasks. Therefore, the crew did not question the towing method, but relied on their professionalism to manage the situation.
DMAIB Analysis: Risk Assessment
The company had a risk management system in place, which was used continuously throughout the preparation of the towing operation. The system was conventionally designed and…each identified risk was assigned a certain risk value based on an assessment of its probability and the severity of consequences. This value could then be adjusted by introducing risk mitigating efforts so that the risk would be reduced to an acceptable level. If an identified risk exceeded the acceptable value, the chosen method would have been abandoned and the operation reconsidered.
The only version of the risk assessment preserved was that including in the draft towing procedure dated 7 September 2016 when MAERSK CHANCELLOR was still expected to be conducting the tow (a risk assessment carried out independently on MÆRSK BATTLER on 7 December 2016 was also not preserved):
The risk assessment available contained 15 ‘risk factors’ established at the 7 September 2016 MoC meeting. Three risk factors of particular interest concern the risk of collision of the towed ships, loss of fenders and the risk of flooding on the unmanned ships under tow.
The risk of collision was given the highest risk value for probability (5) and second highest value (4) for severity in the event of interaction between the ships.
As a counter measure against this risk, fendering by Yokohama fenders and a chain connection between the vessels as well as a connection by mooring ropes were put in effect. These measures were considered to reduce the residual risk to one third of the original risk value.
The probability and the severity of the event of the fenders being lost or failing were both given the second highest risk value. To mitigate this event, the control measures put in effect were to fit the fenders with back-up securing and to visually inspect the fenders. The control measures were considered to reduce the residual risk to less than half of the original risk value.
Flooding on board the unmanned towed ships was identified in the risk assessment, but this item was not given a risk value and no control measures were introduced (Figure 10). The reason for the absence of a risk value and control measures might be that the risk assessment had not been concluded.
In the risk assessment for MAERSK BEATER, the probability and consequence of this risk factor was given the risk value 12. The control measure to mitigate the risk was to close the unmanned ships’ watertight/weathertight doors prior to departure. This reduced the original risk value to a residual risk of 4, with a probability value of 1, which corresponded to the definition “remote or unheard of in the industry”.
The DMAIB say:
When the towage was confronted with swell and waves causing increased motions of the ships, they did not behave as one unit, but as two individual units interacting.
They comment that there was underestimation of acting between the ships under tow (“mooring ropes and tyre fenders are not able to withstand this type of forces”). They also highlight an absence of mitigating strategies for acutely emerging incidents…
…as each risk factor was handled separately, the risk assessment did not address the fact that the risks could be connected, e.g. that the failing fenders could lead to collision and subsequent flooding.
Hence, the preventive control measures did not correspond to the acute potential of the consequences of the residual risks coming into effect and the interaction between the risk factors.
In contrast:
The crew on board expected that the fenders would fail during the tow and that the towed ships would interact, causing damage to mainly the bridge and accommodation of the ships.
However, they considered this acceptable as long as the damage was above the waterline. This perception was shared by some persons in the shore organisation.
DMAIB noted that Maersk Supply had used industry-standard tools to evaluate the risk:
The risk management system offers to handle risk as an objective value and to provide a structure for handling risk. However, there is no aid or control of what is put into the system . . .The numeric risk value is based solely on how imaginative the involved persons are.
The assessment of the risk reduction is highly sensitive to one or more individuals’ subjective risk perception, which will be strongly influenced by the desire to make the operation possible. Thereby, the risk management system will rarely limit activities prone to risk.
In fact, the risk management system instead tends to facilitate the carrying out of risk prone operations.
It is also noticeable, though the DMAIB don’t comment, that the risk assessments only appear to have commenced after the towing method was chosen (thus ‘locking-in’ considerable risk into the project) and the risk of different options were seemingly not compared or understood (although the cost implications were).
DMAIB Analysis: Approvals
The Danish Maritime Authority (DMA) had been asked by the company to approved the side-by-side unmanned tow configuration.
The operations manager and the nautical inspector interpreted the DMA letter [received in response] as confirming that DMA, based on a qualified evaluation, approved the towing method and setup and that the operation was considered safe. However, DMA’s approval letter only informed that an unmanned tow was in accordance with the regulations in general. The letter did not discuss, evaluate or approve the specific towing setup.
The company also sought a Fitness to Tow Survey from a maritime classification society which:
…was strictly an assessment of the individual ship and its fitness to be towed and was mainly focused on the watertight integrity of the ship. The survey and certification process did not include factors relating to the towing setup
However, all persons in the operations team and on board MÆRSK BATTLER were of the belief that the class inspection evaluated and approved the entire towing setup, including the towing method, fendering and voyage planning….
DMAIB Conclusions
The cause of the capsizing and foundering of MÆRSK SEARCHER and MÆRSK SHIPPER might seem simply to be the result of two ships being allowed to collide multiple times and a wrong choice of towing method.
However, this assumption is oversimplified.
Instead, this accident calls for understanding the complex circumstances of the lengthy preparation process during a period of organisational changes, which resulted in the decision to use an unconventional towing method.
In this case, the choice of towing method was made on the basis of the limitations of another tug than MÆRSK BATTLER, and there was no reason to change the towing setup to the setup recommended by external experts as the risk connected to the side-by-side tow had been handled in the risk management system and was thereby reduced to an acceptable level.
However in this case that reduction was illusory:
The DMAIB concludes that the risk mitigating strategies were mainly focused on preventing risk factors in isolation and left little or no contingency for acute interaction between the risk factors.
Safety Actions Taken
The investigation team identified the following measures implemented by Maersk Supply Service (mostly in the spring and summer 2017).
- Management of change training programmes: As a follow-up to the incident, Maersk Supply Service has conducted thorough training programmes of all key personnel on- and offshore in management of change procedures. When changes to a plan occur, these need to be reflected in the entire plan and within the relevant operations. A change, such as change of vessel, time of an operation, or change of key personnel, is likely to impact other aspects of an operation.
- Improved risk assessment procedures and mitigation actions: Maersk Supply Service decided to upgrade its risk management system, and in addition implemented improved tools and training for on- and offshore personnel to better assess risks when they occur in operations. This includes identifying where different risks might impact each other and create a ripple effect to form an even larger risk, and ensuring that the right mitigation for potential risks is in place.
- Review of operations by 3rd party experts: In all operations where Maersk Supply Service is handling its own vessels, 3rd party experts are to validate the planning, processes and procedures. This is to ensure the highest standard and confirm that the plan is the best possible for the specific operation.
- Clear responsibilities and accountability: A revised process with updated guidelines and defined responsibilities has been implemented for when Maersk Supply Service is handling its own vessels. Every marine job where Maersk Supply Service carries the overall responsibility of the operation is to be approved by a member of the senior management team.
- Intensive training programmes of key personnel: To ensure a thorough understanding of the new procedures and processes across the organisation, seminars for all Captains as well as key onshore personnel have been completed. Parts of the training programmes were facilitated by Maersk Training.
Maersk Supply Service will inspect the wrecks and monitor any potential environmental impact twice a year until 2019.
Safety Resources
The report is discussed in these articles:
- DMAIB: Inefficient risk assessment caused Maersk supply ships to sink
- Repeated Collisions Led to Maersk PSV Sinkings
We discussed a similar topics here:
- Regulatory Reflections & Resisting the Seduction of the Risk Management Process
- Audits Highlighted Risk Assessment Weaknesses Prior to Ro-Ro Fatality
- Solent Hoegh Osaka Car Carrier Accident
Aerossurance will be presenting at the Royal Aeronautical Society (RAeS) Human Factors in Aircraft Maintenance conference on 2 November 2017 in London. Our topic is: Helicopter Flying Control Maintenance HF Accidents: A Human Centred Design Opportunity
Aerossurance is also pleased to be supporting the annual Chartered Institute of Ergonomics & Human Factors’ (CIEHF) Human Factors in Aviation Safety Conference for the third year running. We will be presenting for the second year running too, this time on the subject of the FSF‘s Maintenance Observation Programme concept.
This year the conference takes place 13 to 14 November 2017 at the Hilton London Gatwick Airport, UK with the theme: How do we improve human performance in today’s aviation business?
Recent Comments