The ISM code becoming mandatory introduced a new era in ship operations, where safety was systemised and terms like LTI (Lost Time Injury), RCA (Root Cause Analysis) and KPI (Key Performance Indicators) became commonplace both on board and ashore.

A Master now had to regularly report to the new established Designated Person function on his ships safety performance, and the latter then determined the company’s overall safety level by calculating whether they were in line with the safety KPIs. Safety was then defined as – the lesser the accidents the higher safety standard.

However, as ship operations have become more complex is this approach still adequate?

Defining safety based on the an absence of accidents and incidents, or as an acceptable level of risk, has been common within most industries since being introduced in the 1960s.  This  theory, also termed as Safety-I[1] is based on a reactive approach, where accidents are investigated in order to identify a root cause and contributory factors that then can be eliminated or mitigated in the hope of preventing similar accidents. The reason things go wrong is viewed as either due to technical (equipment malfunction), organisational (safety culture) and perhaps most significant human factor (error, fatigue etc.) causes. A safety system is regarded as functioning when no accidents occur over a certain period of time and malfunctioning when an accident does occur. The purpose of safety management is to maintain the efficient functioning of the system by reinforcing compliance audits and eliminating any variability through additional procedures.

While Safety-I still is useful in order to review and learn from past events it has some limitations. Developed at a time where ships were less advanced, support systems for the master fewer and simpler, and performance requirements less demanding, it was adequate to view systems as either being functional or non-functional. However as ships have become more advanced and operations more complex it has become increasingly important to understand why some operations and actions result in an accident but most similar operational practices are completed without any problems, and the associated human influence. This resulted in the development of the Safety II[2] theory. While more commonly used in aviation than in shipping it been adapted to some extent by the oil & gas and the cruise industry.

Where Safety-I looks at why things go wrong Safety-II looks at why things go right. Whereas Safety-I predominately considers the crew to be a liability and a reason that errors (accidents) can occur, Safety-II sees the crew as a necessary resource in order to achieve flexibility, with the ability to adapt to different situations – also  referred to as resilience or variability. The purpose of an accident investigation, beside identifying the root cause, would be to try and understand how and why things usually go right in order to understand and explain why things occasionally go wrong.  Furthermore it does not consider the lessons learnt from an accident being equal with its severity, instead noting that the basic lessons can be learned from all accidents and exploring trends is of higher importance.

A simplified example on the use of Safety-I versus Safety-II can be a ship that sustains heavy weather damage. Investigations identify the root cause as the Masters failure to reduce speed and thereby reduce the impact of the sea, resulting in ship being damaged. Preventive action will be to reduce speed when passing heavy weather. However reviewing similar cases of ships passing areas of heavy weather where no damaged has been sustained reveals that they did not decrease speed either but they used the available weather information service in a different more proactive way, hence avoiding the worst weather and subsequent damage to the ship. This would be an even more important lesson  learned, and preventive measure that may have been overlooked if we only focussed on the isolated damage accident.  For a root cause analysis to be valid and preventive action to be effective, it is necessary to look at how equipment is used when an operation is successful in order to understand why it goes wrong when used differently.

Many everyday task are often a combination between the two approaches, and existing practices can therefore continue to be used in conjunction with Safety-II, albeit with a different or added emphasis. As Safety-II focuses on the human factor as a source of variability instead of a potential source of error, the role of the Master and crew is central. It is often assumed that due to the Masters education, training and experience he is able to adapt to all situations. However most Masters can go through their entire career without experience severe accidents, so in companies with a Safety-II approach to training the use of simulators plays an important part. This is also relevant when training in bridge management, where the key is the ability to work as a team and it is essential to ensure that the master is given the support needed.

Many companies have introduced navigational audits, usually carried out by the master. These are often focused on the watch keeping officer’s ability to comply with company navigation procedure, however they should also allow time for the master to assess the officer using the principles of behaviour based safety. Similarly for near miss reporting, company procedures should include the option to report on good practices.

Safety committee meetings should be used to discuss accidents but equally importantly, the daily routines. Although they may be currently working well, could any of these routines be improved?

Reviewing VDR recordings when transited an area of concern is a good way to draw both positive and negative lessons to be shared. These routines are likely already in place in many companies but should now  have a different emphasis – try to understand what goes right.

Applying Safety-II is not meant to be more time consuming for the crew. When implemented fully it should give the master and crew more freedom to act in accordance with their training, based on the human ability to adapt to different situations, and not be constrained by too many procedures. It is important to emphasise that Safety-I and Safety-II represent two complementary views of safety and are not incompatible. Safety-I is still to some extent necessary for compliance. Low frequencies of accidents might still indicate a high safety standard – or maybe not? Without looking at how things are done when an operation went  well it is difficult to know what needs to be addressed. In today’s shipping it is not enough to only look at the past. By understanding why things go right companies can achieve the proactive approach needed to bring ship safety to a new standard.

[1] Erik Hollnagel – Safety I and Safety II, ISBN 9781472423085

[2] Erik Hollnagel – Safety I and Safety II, ISBN 9781472423085