[Peetwo]

Will the real Investigative authority please stand up

Herr Batt said;

"development of the Australian government Indonesia Transport Safety Assistance Package (ITSAP).
ATSB Manager International Richard Batt says the main elements of the ATSB's contribution to ITSAP is to deliver training and support for investigators from the NTSC. (insert Alan Stray, 2008-2010).
“This includes the ATSB providing staff dedicated to various capacity building projects, funding ATSB training courses in Indonesia and Australia (insert Alan Stray, 2008-2010), and opportunities for aviation, marine, and rail investigators to work with their ATSB counterparts for extended periods,” Richard said.
“Our Indonesian colleagues learn much from us (insert Alan Stray, 2008-2010). But it’s not all one way. The programs that we develop are mutually beneficial. Cooperation between the ATSB and the NTSC is a key element in ensuring lasting transportation safety for the people of Indonesia and Australian travelers to Indonesia.”

The only reason ITSAP came about is because after the 2007 Garuda crash the Europeans banned the Indo's and so did the FAA. Australia tried to jump on the band wagon but the Indo's threatened to ban us from using their airspace if we put them on our blacklist. Our Government (and Murky) panicked. Can you imagine the political fallout for our then serving Politicians, not to mention the implications for the Red Rat and other international carriers flying to and from Australia? Hence ITSAP was born. In other words, 'if we are lacking the balls to ban them, we better at least provide them with some safety assistance before they kill someone on Aus soil'. The rest as they say, is history, and Garuda continued to fly to Aus and we weren't forced to fly around their airspace. Oh and by the way, you won't read any of this in any online documents and minutes! All out of Gobbledocks collection of secrets.

So, regardless of how the program came about, the fact is that Indonesia's standard of air safety investigations is at the level it is today due to the hard work of one man, Alan Stray. This man found a 'home' amongst the Indo's after being pineappled by hungry political shysters within the ATsB. The result was twofold - the ATsB in Australia basically lost the skills and expertise of the valuable Mr Stray which put a huge dent in its overall ability. But the Indo's gained a gem in Alan Stray and as a result they have seen their investigative capability rise above Australia's now shambolic piss-poor standard!

Can you believe it? Australia gets Beaker and the Indo's get Alan Stray! Unbelievable.
Mention Alan's name amongst many in the DGCA and particularly the NTSC and you will only hear comments such as 'gentleman', 'skilful', 'dedicated and passionate', 'highly respected'.

#bringbackalan ? You got that bloody right!

AI & SMS in the 21st century - Have we digressed?


Gobbles your excellent post spotlights perfectly the rise and humiliating fall of our ATSB, while the Indon's progress we digress...

This rapid digression I believe can be directly attributed to hiring of Beaker as the CC and to his subsequent role as the top-cover specialist of all potentially embarrassing and revealing inadequacies of the State (ICAO Annex 19) SSP or SMS. Beaker was also responsible for overseeing the ATSB adopted philosophy, contrary to the rest of the World, of BASR (beyond all sensible Reason).

Ironically, as the following excellent blog article will show, the James Reason model is fundamental to the functioning of any successful 'Safety Management System', or in Australia's case the SSP. Therefore if you don't uphold the principles of Reason then the SSP is merely a box ticking exercise to placate our obligations as a signatory to ICAO.

Read & absorb   :  

Light bulbs, red lines and rotten onions
1 September, 2016 Nippin Anand 3 Comments


In January 2015, the pure car and truck carrier (PCTC) Hoegh Osaka developed a severe list on departing from Southampton, and was left stranded outside the port for more than 19 days. The official investigation revealed how decision making became the victim of production pressures. The vessel sailed from port without determining accurately the stability conditions upon completion of cargo. It was a routine practice to leave this task to be carried out once the vessel was out at sea; a practice that appears to be common within the PCTC industry.  The weights of the cargoes declared at the time of loading were significantly different from the actual weights; a practice that extends even beyond the PCTC industry. The port captain never felt the need to involve the chief officer in the preparation of the stowage plan. The chief officer, on the other hand, did not feel he had the authority to question the pre-stowage plan.

The preventive actions that followed from the accident should not surprise anyone. A volley of plans, presentations and questionnaires were sent off to the entire fleet reinforcing the importance of compliance with procedures and checklists, and warning the crew against being influenced by perceived commercial pressure. But would such actions mean anything to improve safety?

Safety Management System

During the 1980s a number of very serious accidents including the Herald of Free Enterprise led to the introduction of the International Safety Management (ISM) Code, based on the principles of the ISO standards, and taking a structured, systematic and documented approach to the management of safety and quality. A key requirement of the Code was for every organisation to formally adopt a safety management system (SMS).  
And what exactly is the purpose of the SMS? It can be illustrated using the ‘Swiss Cheese’ model of accident prevention, where several slices of cheese are lined up against each other. The cheese slices represent organisational barriers to prevent accidents. The barriers typically include crew competence and training, emergency preparedness, maintenance of safety equipment, analysis and reporting of accidents, documentation control, effective control and monitoring from the shore side etc. The holes in the cheese are termed as noncompliances; instances where rules, regulations and procedures are not followed. When an accident happens the conventional explanation is that because rules and procedures were not followed the barriers were holed. The purpose of the SMS is to ensure a systematic identification, detection and follow up of holes so that the organisation is better prepared to manage safety risks.

If the capsize of the Herald for Free Enterprise led to the introduction of safety management system, the stranding of the Hoegh Osaka has surely reaffirmed that we need more of it. More rules, procedures and checklists to plug those holes! But the existing approach to safety management has proven deeply flawed and dangerously misleading. For the rest of this paper I will illustrate some myths about safety management systems, and then debunk these myths by offering a new view about safety management system.

SAFETY MYTHS

Light bulbs and the myth of compliance

Light bulbs either light up or they do not. There is no middle way to determine whether they work or not. The underlying philosophy of a safety management system is similar to the working of light bulbs – bimodal and absolute (yes and no), with the sole aim of establishing whether rules, regulations and industry standards have been complied with or not.

But if we apply this bimodal approach to the Hoegh Osaka, there are not many instances of non-compliance. The vessel complied with all the statutory requirements and was manned by competent crew who were adequately rested at the time of the accident. The loading computer program was ‘approved’ and would have worked accurately if the correct cargo weights had been fed into the computer. The remote gauges for tank sounding were not operational at the time of the accident – but this was not necessarily a non-compliance, as long as tank soundings could be obtained manually. It appears that in the absence of compliance risks, the company  regarded rectifying the fault in the remote gauges as a low priority. The official accident report stated that: ‘In light of the low priority given by the company to repairing the gauges, a similar low priority was assumed by Hoegh Osaka’s chief officer, who resorted to estimating ballast tank quantities.’  A defective ballast sounding system that was otherwise compliant with regulations was encouraging ‘unsafe practices’ onboard.

Crossing the red line

At a maritime symposium on ‘safety culture’, the importance of following the rules and procedures came up, as one would expect. An elderly gentleman stood up and said, ‘Ladies and gentlemen, we are in the business of transporting flammables, remember you must never cross the red line’. What he meant was that the workers should under no circumstances dare to breach rules and procedures. The crew on board the Hoegh Osaka had crossed the red line on numerous occasions. The Master did not hold a pre-load meeting with the deck crew and officers. The chief officer underestimated the importance of accurately calculating the stability condition before departure. Instructions on the use of loading computer were not part of the chief officer’s familiarisation checks. The heavy lift cargoes were not secured in accordance with the CSS Code 2011, IMO Resolution A.489 (XII), IMO Resolution A.533 (13), IMO Resolution A.581 (14), IMO Resolution A.581 (14), as amended by MSC.1/Circ.1355, MCA publication Roll-on/Roll-off Ships:
Stowage and Securing of Vehicles Code of Practice (and add to this a raft of regulations, circulars and industry standards that even the experts specialising in cargo securing plans may be unaware of).

All of this would have played its part in the accident. But pick a routine cargo operation on any PCTC and chances are that you may find an even more comprehensive list of rule violations. A seafarer with whom I recently discussed this issue stated: ‘If you go to this level of detail, you will find problems in everything I do’. A dozen experts analysing split second decisions influenced by intense production pressures will no doubt establish numerous instances where rules were violated and procedures were not followed. But is this approach really effective in managing safety?

The proceduralisation of everything

The accident investigation report into the Hoegh Osaka found that there were a total of 213 checks to be completed by the chief officer for cargo operations alone. This exemplifies a ‘rotten onion’ style of management;   one where multiple layers of procedures and checklists can cover up  the core issues. These procedures (referred to as ‘objective evidences’ in the language of SMS) make it extremely difficult for an outsider (i.e. regulator) to gain insight into the core practices and culture of an organisation. I am reminded of a fire damper that was found fully corroded and inoperable during a survey, despite maintenance management plans indicating fully operational firefighting systems in ‘excellent condition’. No amount of processes, procedures and checklists can solve core problems of this nature. If anything, they only make core issues more inaccessible.

To a large extent the problem lies in how safety audits are conducted. The auditor finds a few non-conformances and the company addresses them by adding a set of procedures and half a dozen checks to the SMS. The quest for paperwork to prove safety generates even more paperwork for managing safety. Everything from starting the main engines to turning on the kettle is ‘proceduralised’ and ‘risk assessed’ and the SMS eventually becomes a monster to manage. There is very little foresight and thinking in this mundane ‘check-do’ process.

The Hoegh Osaka’s two hundred or so checks for cargo operations alone are a true reflection of this contagion. While the company was busy creating the checks, the chief officer was busy ticking the boxes on the checks, the Master was too busy to verify the checks, the regulator was kept busy assessing the checks, the investigator was busy counting the checks –  and with these multiple layers of protection, the safety management system was drifting into failure beneath all these checks. The imaginary world of procedures and checks had drifted too far away from the real world of practice.

“No blame” myth

Most accident investigations reports and safety audits start by stating that the purpose of the exercise is not to apportion blame or find faults with individuals. In practice, this is far from achievable with our current approach to managing safety. Within the 83 page Hoegh Osaka incident report, the term ‘chief officer’ appears  132 times, and Master 89 times. By contrast, the organisation responsible for the safety management system appears in the report only on 60 occasions. Of the two dozen conclusions drawn from the report, sixteen are centred on the vessel and the crew on board. It is obvious that the focus of the report remains on the behaviour and actions of those proximally closer to the scene of accident. Research in accident studies views this tendency of focusing excessively on the actions of those physically closer to the accident as ‘proximity bias’.

It is interesting to see how a highly ambiguous and uncertain situation is captured and presented as a structured and systematic report. In an attempt to present an official narrative, the report illustrates a one-sided construct of the entire ordeal. The report suggests the problem begins with an erroneous stability condition and ends with an extremely tender vessel that capsizes just after departing from the port. There is no mention in the report of the last safety audit, management onboard visit, charterer’s inspection, or QHSE plans and reports. How could so many entities have missed so many unsafe practices that were so common on board? The voices from the control room and wheelhouse are lacking. The inability to calculate final stability conditions prior to departure is considered a ‘drift from fundamental principles of seamanship’. Under these circumstances, how can we preach the mantras of ‘no blame’, ‘just culture’ and ‘safety first’ to anyone involved in an accident?

A new view of safety management system

Having summed up the four popular myths of SMS, there are several questions to be answered.

• First, we place so much faith in compliance with regulations in managing safety  – but is compliance really as straightforward (yes & no) as it appears on its face? And if not, can we still  make effective use of compliance in managing safety?
  
• Second, can we think beyond the punitive language of “rule violations” in managing safety?
  
• Third, can we ever manage safety genuinely without shaming and blaming our workers?  
  
• And finally, if excessive procedures and checklists are taking us away from our core problems, what can we do to bridge this gap?
  

The answers will offer an alternative approach to the safety management system (and hopefully debunk  some myths).

Purposeful compliance

Technology moves far faster than our ability to control and regulate it. When compliance with ‘rigid’ regulations conflicts with operations, owners may seek ‘alternative compliance’ through risk assessments, waivers, and exemptions and even threatening to transfer their vessels to ‘business friendly’ flag states. The bottom line is ‘to comply’ and there is not much incentive in making the system any safer than ensuring minimum compliance. Perhaps, the reason why the management of the Hoegh Osaka had decided not to repair the sounding gauges. What appears a matter of absolutes on the surface is in fact imperfect, convoluted, interpretive, and open to abuse. Many high risk industries have realised the limitations of compliance with rules and regulations and resorted to requiring a duty of care and responsibility from the operators even if this requires undertaking measures beyond compliance. (Of course, this approach is not without its own problems).In the case of the Hoegh Osaka, it surely made sense to use all available Codes, Circulars and IMO Resolutions to verify compliance with cargo securing when compiling the accident report – except that this was undertaken in hindsight and with ample time (the official report took more than a year to publish). The knowledge surely existed when the vessel was being loaded, but could it ever be applied as a means of preventing accidents, rather than just identifying noncompliances in the wake of an accident? This is an important question that we need to ask in designing and implementing our SMS.  Compliance must have a meaning and purpose, not be something demanded for its own sake.

Approximate adjustments

In many societies, even the thought of breaching the rules can be intimidating (just as in other societies it is a way of life). After all, rules and procedures are there to assist us. It is unthinkable for many of us to imagine that a vessel could ever sail from port without obtaining final stability calculations. And how could the chief officer tick off checks that were never really carried out? Why, despite clear instructions in the SMS, were tank soundings not obtained on a daily basis? Is this really a case of unreliable seafarers ‘falsifying records’ and crossing red lines?

Far from unsafe practices and a drift away from seamanship, this is exactly how work is performed. If the chief officer had diligently followed the rules and performed all the two hundred or so checks, the vessel may not have departed from the port in time. In many countries with strong unionised labour workers deliberately follow the rules to the letter as a form of protest to cause delays and disruptions to work. (Note: this behaviour is commonly termed as ‘unofficial’ or ‘zeal’ strike and under international laws workers do not forfeit their pay when they work to rule, unlike when they strike.)

When the chief officer was selective in following the checklist, it could well be that he was indeed applying seamanship (using his professional judgment, prioritising and making adjustments when faced with time constraints) rather than ‘drifting away’ from it. What we consider as ‘red lines crossed’ are approximate adjustments required to succeed at all levels within the organisation. They are approximate because we cannot write precise rules and procedures for every single task, procedures demand certain resources that may not always be available (for example ample time, competencies), procedures involve terms such as ‘apply good seamanship’ that do not specify what is expected from an individual in a given situation, procedures are underspecified and so on. .  Approximate adjustments have to be made to get the job done. This is how we succeed in everyday work despite demanding deadlines and budget constraints.

The equivalence of success and failure

Do we always need someone to blame in the wake of an accident, or is there an alternative? Let us examine the fine details of the Hoegh Osaka accident: a last minute change that made Southampton the first call in the port rotation plan rather than the last; a historical trend of guessing ballast quantities rather than obtaining actual tank soundings; a routine practice of declaring less than the actual weights in cargo manifests; a metacentric height (GM) marginally short of the required stability standards; a mere 0.6 metres bow trim that led to a high rate of turn; and a righting moment that brought the vessel back upright when she developed a heel while turning at a speed of 10 knots, but which became insufficient at a mere two extra knots speed at the next turn in the channel. Note the dynamic nature of certain variables and how the routine practices and approximate adjustments came together. Where is the root cause of the accident? This shows how approximate adjustments and routine practices can sometimes emerge as disproportionate, non-linear outcomes.

Change any one of those variables and there is a good chance that the Hoegh Osaka would have safely exited the channel just as do most PCTCs and many merchant vessels each day. None of us would have noticed the ‘deep rooted’ problems so pervasive within the industry. On the contrary, the management would have rewarded the employees in their next performance review. Who would not wish for a workforce that could balance safety with quality so well? Is this not how competitive organisations are meant to operate in an aggressive market? It does not help to explain why we should blame people who exhibit a ‘can do’ attitude and are willing to go that ‘extra mile’. Granted, there are negligent behaviours and unsafe practices – but the boundaries between what counts as success and failure seem to have diminished.

Business is safety

It does not make much sense to react to ‘unsafe practices’ by replacing a handful of seafarers and introducing more checks, controls and barriers. When something goes wrong, it has usually gone well many, many times before. That is why people do it! So without understanding why it was done in this way and why it went well, we have no hope of understanding why it went wrong. It pays to observe a successful routine operation with an open mind.

Recall the last minute changes to the port schedule of Hoegh Osaka. This is a usual problem for many ships (it was also an issue in the case of the Herald of Free Enterprise). Therefore, we should begin by looking at the usual and normal actions in this case. How do crew members adjust to last minute changes to port schedules? When time is limited, how does the crew meet deadlines when getting their jobs done?  How does the vessel still manage to depart from the port on time despite a late arrival in port?

Pay close attention to whether crucial decisions are made based on incomplete, incomprehensible knowledge and poorly written procedures. Observe how work is performed when not all crew members are adequately experienced in handling key operations. Find out how shortcomings in apparently certified equipment are compensated for in everyday work. It is here that we start to appreciate human performance. It is here that we realise the need to remove the unnecessary checks and barriers that impede rather than facilitate decision making. It is also here that we start to realise that we cannot write procedures and checks for every conceivable situation. And it is here that procedures and checklists start to mesh with the messy world of operations. Here lies an opportunity to genuinely promote a ‘no blame’ culture and reduce the administrative burdens that are helping neither safety nor businesses.

After more than two decades of futile attempts to implement a ‘structured, systematic and documented approach’ in managing safety, it should be clear that it does not exist. The case discussed here was chosen not because it was unique or one-off. It only serves as a recent example available in the public domain to expose the fatal fallacy that we call safety management system. Perhaps the time has come to leave behind the light bulbs, red lines and rotten onions and embrace a new view of safety management system. Safety is not a crime against business. Business is safety.

Effective SMS in the 21st century is a work in progress and our mob are still back in the pack contesting 'Reason' - FDS!   

MTF...P2

Tim Tam quality post.