Costa Concordia
Anatomy of an organizational accident Jayvee M. Fernandez Maritime Law Midway Maritime Foundation

ABSTRACT
This paper analyses the grounding that occurred on the 13th of January 2012 to the cruise ship Costa Concordia. The analysis is carried out only on the conduct of navigation – and not on the emergency response - at three different levels: the errors of the bridge team, the error-inducing conditions of their workplace (the bridge), and the organizational processes behind them – following Reason’s (1997) model of organizational accident. An organizational accident is a rare, but often catastrophic, event that occurs within complex organizations as a product of technological innovation. Working under a hypothesis built on publicly available data till July 2012, the grounding of Costa Concordia appears to be an organizational accident. The paper aims to provide official investigators with a framework for the understanding of its development, which is considered critical to limit the re-occurrence of other such events. Moreover, it aspires to be the starting point for future examination of error inducing conditions across the cruising industry and the wider maritime domain. Overall, it is an attempt to address systemic issues, rather than accusing or defending individuals and organizations involved.

INTRODUCTION
About 21.42 (UTC+1) on January 13, 2012, the cruise ship Costa Concordia grounded on the rocks Le Scole, near Giglio island, Italy. The ship, operated by Costa Crociere – a subsidiary of Carnival Corporation – was on route from Civitavecchia to Savona, carrying over 4200 people on board. 32 lost their lives and 60 were injured. With its gross tonnage of 114.000, 13 decks, 290 meters of length, 35 meters of beam and 8 meters of draught, Costa Concordia was launched in 2006, and at the time it was the largest Italian cruise ship ever built.

Fig.1 – Costa Concordia Fig.2 - Rocks “Le Scole”, near Giglio Island, Italy
\

The ship left Civitavecchia in the late afternoon of January 13th, 2012, sailing along the passage plan prepared by the 2nd Officer and approved by the Captain. However, the plan included a deviation from the standard route to Savona, which usually takes the ship through the channel - 7 nautical miles wide - between Giglio Island and the mainland (fig.3). The deviation was meant to carry out a sail-past Giglio Island and it was decided by the Captain upon request of the restaurant manager, native of the island. The Captain’s consent was allegedly given also as a sign of respect for his mentor, a retired Costa Captain who lived on the island. The deviation was discussed with the 2nd Officer, who was responsible for drawing the new route on nautical charts

Fig.3 – Standard route from Civitavecchia to Savona, and deviation planned on the 13th of January 2012

The safety margin initially established by the Captain was of 0.5 nautical miles (about 1 kilometer) from the furthermost point of a group of small islands (Le Scole), just south of the main port (Giglio Porto) of Giglio Island. From that point on, a touristic navigation should have gone parallel to the coast, saluting the islanders and sounding the ship’s horn. However, the Costa Concordia got as close as 100 meters from the furthermost point taken as reference by the Captain, striking an underwater rock with a charted depth of 7,3 meters (fig.4)

Fig.4 – Le Scole Islands and the possible point of impact with an underwater rock at 7.3 meters of depth. Screenshots captured from paper chart IIM 74 (left) and Electronic Navigation Chart IT50074B (right).

The safety margin initially established by the Captain was of 0.5 nautical miles (about 1 kilometer) from the further most point of a group of small islands (Le Scole), just south of the main port (Giglio Porto) of Giglio. Island From that point on, a touristic navigation should have gone parallel to the coast, saluting the islanders and sounding the ship’s horn. However, the Costa Concordia got as close as 100 meters from the furthermost point taken as reference by the Captain, striking an underwater rock with a charted depth of 7,3 meters (fig.4).

Fig.4 – Le Scole Islands and the possible point of impact with an underwater rock at 7.3 meters of depth. Screenshots captured from paper chart IIM 74 (left) and Electronic Navigation Chart IT50074B (right).

The analysis stops at this point, not taking into consideration the emergency occurred after the impact with the rock, which eventually caused the partial sinking of the ship just 500 meters north of Giglio Porto. The analysis is based on public sources of information, and on the official nautical charts of the island. The analysis stops at this point, not taking into consideration the emergency occurred after the impact with the rock, which eventually caused the partial sinking of the ship just 500 meters north of Giglio Porto. The analysis is based on public sources of information, and on the official nautical charts of the island.
A lot has been said by media and professionals about the errors of the bridge team. However, the error-inducing conditions of the workplace (bridge), and the organizational processes behind them, have not been addressed yet. This is due to the latent and multidimensional character of these conditions, which requires context specific knowledge of human, technical and organizational factors
The analysis presented in this paper uses the human errors of that night as a starting point to explore deeper systemic issues. The model of organizational accident (Reason, 1997) suits the scope of such analysis, and it will be described in the following paragraph.
Reason (1997) defines an organizational accident as a rare, but often catastrophic event that occurs within complex organizations, as a product of technological innovation. It involves multiple causes and many people operating at different levels of the organization. Organizational accidents - as opposed to accidents happening to individuals – can seriously affect uninvolved populations, assets and the environment.
Under the hypothesis that the grounding of Costa Concordia is an organizational accident, the aim of the paper is twofold: * To provide investigators with a framework to be used for the understanding of the pathways followed by errors and error-inducing conditions in its generation; * To stimulate a close examination of error-inducing conditions across the whole cruising industry, and the wider maritime domain.

METHOD
Model of organizational accident (Reason, 1997) The nature of organizational accidents has evolved in recent times under the pace of technological innovations, which have radically altered the relationship between systems and their human elements. The concept of organizational accident applies to technological, highly hazardous and well-defended systems. Indeed an organizational accident entails the breaching of the defenses that separate hazards from vulnerable people and/or assets (losses). See fig.5.

Fig.5 – Hazard, defenses and losses Was the grounding of the Costa Concordia was an organisational accident? To start with, the nature of defences has to be understood in the context under study. Whereas defensive functions such as the guidance on how to operate safely are universals, their modes of application vary between organisations. The defensive functions are implemented through hard and soft defences. To protect the safety of navigation of a cruise ship, hard defences generally include Integrated Navigation Systems (INS), alarm management systems centralized on the bridge, redundancy of sensors and steering modes, automated track control systems, and Electronic Charts Display Information Systems (ECDIS). Soft defences are a combination of paper and people. They include policies, procedures, training, certification, familiarization and - most important of all - front line operators. Their role has changed dramatically with increasing level of technology. In fact, on a modern cruise ship, bridges more closely resemble airplane cockpits, as opposed to a standard cargo ship. The officers responsible for the conduct of navigation, known as Officers Of the Watch (OOW), act as controllers of largely automated systems. Whether or not they should keep their traditional navigation skills or move towards renewed competences based on the control of automation, is still an open debate at the International Maritime Organisation (IMO, 2010). The defences are a form of protection put in place by organisations, to ideally counterbalance productive pressure. Whereas productive processes are usually transparent and measurable, protective processes are often opaque and difficult to be monitored. This is because the increased level of complexity due to the introduction of defences, widens the distance between managers and the productive systems they control.
This allows the creation of the so called latent conditions, that together with active failures contribute to breach the defences. Active failures are the errors committed by humans at the sharp end of the system they operate. They can potentially reduce the safety margins of the whole system, and lead to negative consequences. But it is widely recognized that front line operators make errors for reasons that go beyond the scope of individual psychology. These reasons are called latent conditions. Latent conditions are to technological organisations what resident pathogens are to the human body (Reason, 1997, p.10). Like pathogens, latent conditions can lie dormant for many years before combining with active failures or external hazards, and eventually breaching the defences. In the model of organisational accident, they are present at the workplace and at the organisational level. They arise not only as a consequence of organisation’s decisions, but also as a by-product of top-level decisions of governments, regulators and equipment manufacturers. However, the stop rule (upper limit) for the analysis of organisational accidents is at the level over which the organisation can exercise control and change things - that is the senior management level. In the specific case of the Costa Concordia accident, the workplace is the ship’s bridge, and its latent conditions include sub-standard design of bridge equipment, unworkable or missing procedures, shortfalls in training, and language differences. At the organisational level, latent conditions may be identified in various managerial processes, such as human resources management, the acquisition of technology, the delivery of training, and – most critically – the engineering of a safety culture. It is important to note that latent conditions are always present in complex systems. Like in a chess game, organisational decision makers cannot foresee all the possible patterns of latent conditions caused by the implementation of their strategies, both at the workplace and organisational level. So, why is it important to investigate both latent conditions and active failures in an organisational accident? Because latent conditions might be the same for a number of different accidents, as opposed to the chain of active failures which tends to be unique to a specific event. Trying to act only on active failures might be as difficult as catching mosquitos in a swamp. Whereas detecting and mitigating the latent conditions would be like draining the swamp. The model in fig.6 presents the elements described above. Starting from the top, a horizontal arrow represents the accident trajectory breaching the defences. The lower part links the various contributing elements into a sequence that runs bottom-up in causation, and top-down in investigation, thus translating the idea that human error is a consequence rather than a cause. Fig.6 – Reason’s model of organisational accident

Threats and error management
The active failures occurred on the bridge of the Costa Concordia, have been analyzed by: * Embracing the concept of error management, and;

* Applying the University of Texas Threat and Error Management (UTTEM) model.

According to the error management concept, errors are an inevitable expression of the human nature, and safety management strategies should aim to create error-tolerant systems in order to avoid their negative consequences. Therefore, when analyzing human performance, the question to be posed is not only why
Errors occurred, but also how they failed to be corrected. As well as human errors, latent conditions are always
Present as expression of the organizational life of a system. Hence, not only front line operators’ errors, but also shortfalls in operating procedures, training, and equipment design, need to be managed to improve system resilience. The University of Texas Threat and Error Management (UTTEM) model was applied in civil aviation to identify threats to safety and pilot errors by means of observations during normal operations, and to implement measures to manage human error in operational contexts (ICAO, 2002). The model is being applied also in the maritime domain as part of the Maritime Operation Safety Analysis (MOSA), a methodology to analyze how bridge teams manage threats and errors during normal operations. MOSA defines threats as events or hazards which happens or exists outside the influence of the bridge team, and they have to be managed in order to maintain established safety margins. The definition of human error adopted by MOSA is the one given by Reason (1997): the failure of planned actions to achieve their desired ends, without the intervention of some unforeseeable event. According to flow diagram in fig.7, both threats and errors can be managed or mismanaged, potentially leading to Undesired Ship States (USS), defined as situations of unnecessary risk and reduced safety margin. When mismanaged, undesired ship states are considered precursors of incident and accidents. Fig.7 – The Threat and Error Management model adopted for MOSA observations during normal operations.
Simply counting threats and errors is of limited value without a deeper understanding of the conditions under which these errors and threats were managed or mismanaged. To achieve this understanding, MOSA follows the logical path proposed by Reason in his definition of human error. If the plan is adequate, but the actions fail to go as planned, errors are considered unintended, attention or memory failures of execution – alsoknown as slips and lapses – and as such, they are likely to be at the skill based level of performance (Rasmussen, 1986). If the actions are consistent to the plan, but the plan is inadequate, the error is at higher levels of performance: rule based or knowledge based. When performing at the knowledge based level, expertise and improvisation come into play, dramatically increasing the likelihood of making errors. This usually happens when dealing with novel situations not covered by procedures and formal training. When performing at the rule based level, the errors - also known as violations – can take many different forms. Therefore, for each error observed, MOSA aims to identify which is the prevailing level of performance involved (skill, rule or knowledge based) by noting whether or not: * the task or situation is covered by policies and/or procedures; * the task or situation is covered by formal training; * any informal and routine practice is followed: * the deviations are functional to the specific task or situation, and – most importantly - to organizational goals
The last point is the most critical, as humans tend to optimize non-functional goals making them part of their performance style (Reason, 1997). In fact, successful actions – with respect to personal goals – are not necessarily correct actions – with regard to the accuracy of risk assessment. Things are complicated by the fact that compliance is not automatically correct, as it depends on the adequacy of procedures and on other latent conditions of the workplace. In summary, the methodology used for the analysis of normal operations is also adopted for the analysis of the Costa Concordia accident. MOSA is used for the investigation of the errors (active failures) that occurred on the bridge of the Concordia. This paves the way for the understanding of the specific error-inducing conditions present both at the workplace (bridge) and at the organizational level.

Sources of information
The investigation of active failures and the analysis of possible latent conditions are based on publicly available information. This is because at the time of writing (July 2012) the official investigation is still ongoing, and no anticipation has been released yet.
The following sources of information have been used: * the official transcripts of the interrogations and depositions of the ship’s officers and of the Captain’s mentor (who was not on board); * the official nautical charts of the Italian Hydrographic Office; and * the navigation data (times, positions, speeds and courses) from web-based Automatic Identification * Systems (AIS) databases, and from the Video Data Recorder (VDR) clip available on internet.
-------------------------------------------------
With regard to the top-down sequence of the model of organizational accident (fig.6), the events are consistently described in the officers’ depositions, and afford a sufficiently detailed picture of what happened on the bridge before striking the rock. However, the bottom-up causal analysis is beyond the scope of the paper, as only hypotheses can be made on latent conditions. Whenever the analyses refer to depositions or statements, the original transcript in Italian language are reported as footnotes. Reading through the lines of the depositions, useful clues arise for further analysis of cultural issues and other latent conditions at the organizational level. Where depositions are not considered enough to sustain the hypothesis on active failures and latent conditions, only questions are raised.
1 - Every error involves some kind of deviation. In the case of skilled based errors, actions deviate from current intentions. In the case of rule based, and knowledge based mistake, the departure is from some adequate path towards the desired goal (Reason, 1997)
RESULTS and DISCUSSION
Hazards (threats) and defenses On the 13th of January 2012, Costa Concordia left Civitavecchia, bound to Savona. The voyage plan prepared by the Planning Officer and approved by the Captain was to navigate with north-westerly routes through Tyrrhenian Sea and Ligurian Sea (fig.3). There were no significant navigational hazards in the vicinity of the traditional routes from Civitavecchia to Savona, and no other threats to safety of navigation. The traffic2 was regular, and the meteorological conditions 3 were favorable, with gentle breeze from North East and smooth sea. At about 9pm the ship deviated from its original plan, following a new route decided by the Captain a few hours before. The intention was to carry out a sail-past keeping at a distance of 0.5 nautical miles from Giglio Island. On the new route, a small group of underwater and awash rocks known as Le Scole, represented a navigational hazard for the Concordia, whose draught was approximately 8.2 meters. In fact, the furthermost underwater rock has a shallowest depth of 7.3 meters4 (see fig.4).
There were six defences involved in the conduct of this particular coastal navigation: * the Integrated Navigation System (INS), used as an aid to navigation (the paper charts still being the * Primary means of navigation). The INS includes functionalities which guarantees continuous GPS
Positioning on an electronic chart overlay, and various alarms and indications to be managed by the Officer of the Watch (OOW); * The automatic track keeping system associated to the INS. It is called Track Pilot and it can steer the ship along the legs of a predefined track, within the limits established by the OOW, and based on the intrinsic accuracy of the navigation sensors; * the procedures to carry out route planning and route monitoring; * the Bridge Team Management (BTM) procedures, including best practices for team work,
Leadership and communication; * the INS type-specific training for deck officers; * the training in specific Bridge Team Management (BTM) procedures.

Active failures (errors)
In order to analyze the active failures of the bridge team, the above mentioned threat and error management (TEM) model is used. For each error, a series of questions are posed. Some of the answers can be extracted by the official depositions made by the deck officers. When not possible, the questions posed and the hypothesis advanced might be still important for those who will carry out official investigations. The value of the paper remains in the method, which is functional to the understanding of the development of the organizational accident.
The first error
The first error was made by the Captain, when he decided to change his original voyage plan without the agreement of the Company and local authorities 5. The former mentor of the Captain 6, living on the island, describes the concept of “touristic navigation”, as a company’s practice which, in other occasions, was included in the travel program made available to passengers. The Captain’s mentor also explains that sail-pasts are usually conducted at low speed (5 knots) and agreed with local authorities. This suggests that the sail-pasts are regulated, if not by formal policies and procedures, at least by informal practice. Hence the decision made by the Captain has a rule based character. The next question to be posed is whether or not the deviation from the standard voyage plan (from Civitavecchia to Savona) was functional to organizational goals. Considering that touristic navigation may well be part of the business – in terms of brand promotion for those ashore, and enjoyment for passengers on board - that night it was probably not the case, given the season (winter), the time of the day (late evening), and the lack of previous arrangements to publicize the event both ashore and on board. Most likely, the rule based error was not functional to organizational goals.
This initial error and the lack of challenge by the planning officer, led to an Undesired Ship State (see fig.7). In the specific case, the situation of unnecessary risk is determined by planning a sail-past with a safety margin of 0.5 nautical miles (about 1 km). Moreover, given the intrinsic limitations of the ship in term of list (as a function of course alterations with high rate of turns), the approach almost perpendicular to the coast would have not left room to recover from ship handling errors. The undesired state was recognized by the Senior Officer of the Watch (SOOW)7, who tried to alter course to starboard (fig.8), but five other significant errors were made, exacerbating the situation until all the available defenses were breached. Fig.8 – Costa Concordia position at 9.37pm, extracted from the presentation of the Italian Maritime Investigative Body at the 90th IMO Maritime Safety Committee (MSC) meeting in May 2012. The course alteration meant by the SOOW has been simulated on a Sam Electronics INS NACOS (Chart Radar mode, night display, display category “standard”), with a radius of turn of 2 nautical miles, at a speed of 15.4 knots. It results that at 9.37pm it would have been still possible to keep the safety margin within the established limit of 0.5 nautical miles. The straight line represents the ship’s heading during the hypothetic turn, whereas the curved line represents the projected path of the ship if the alteration had been carried out. The circle around the ship is a Variable Range Marker (VRM) of 0.5 nautical miles.
The second error
The second error was a shortfall in voyage planning. According to the Safety Officer 8 - who arrived on the bridge just after the impact with the rock – only the original route was drawn on the paper chart, a few miles off the island. Most likely, he saw the paper chart n.6 (scale 1:100.000) of the Italian Hydrographic Office (fig.9), which seems to be the one used to plan the deviation towards Giglio Island (Italian Ministry of Infrastructure and Transport, 2012). He also noticed an isolated position fix placed well south of that route, which confirms the improperly planned navigation towards Giglio Island. Even though the new route was uploaded on the Integrated Navigation System (INS)9, the voyage plan had to be reported with priority on all relevant paper charts10. In fact, chart n.119 (scale 1:20.000) and chart n.74 (scale 1:5.000) were available for detailed planning. This is a specific duty of the planning officer, who follows the Captain’s directives on the subject11. They met before departure from Civitavecchia to discuss about the sail-past, but the intentions were not translated into a formal route planning on all available paper charts. During that meeting, the safety margin of 0.5 nautical miles was established by the Captain, under suggestion of the planning officer12. Its definition is a critical decision for each route of the voyage, especially in proximity of navigational hazards. The events demonstrated that the safety margin was not established from the limit of the no-go area - the 10 meters bathymetric line – and not even from the furthermost emerged rock, but from a generic point of Le Scole Islands, barely visible on the 1:100.000 scale chart. The voyage plan is regulated by specific guidelines of the International Maritime Organisation (IMO, 1999), and most likely by specific company’s procedures. But was the lack of planning on all relevant paper charts a routine practice? If so, the error would be at the rule based level of performance. It would also be non-functional to organisational goals and not correct with respect to risk assessment. Fig.9 – Chart n.6 IIM (scale 1:100.000) used for voyage planning
The third error
The third error relates to route monitoring, a specific task of the Officer Of the Watch (OOW). The bridge team was composed of a Senior OOW, a Junior OOW, a deck cadet, and a seaman with either lookout or helmsman functions. The SOOW was in charge of the conduct of navigation, with regards to conning orders, collision avoidance and route monitoring on the INS. The JOOW was assisting him fixing the ship’s position on paper charts, which has to be considered with priority over the INS route monitoring. The JOOW could not correctly monitor the approach to Giglio Island, firstly because there were no routes drawn on larger scale charts than 1:100.000, and secondly because she left the chart table to assist the helmsman when the Captain took the command of navigation13. From that moment on, no primary route monitoring was carried out on the bridge. Assisting the helmsman instead of monitoring the route at the chart table was probably an informal practice, but functional to overcome the language barrier existing between the helmsman and the rest of the team 14.
Yet, the rule based error was not correct with respect to risk assessment, given the importance of monitoring the ship’s position at close distance from shore.

The fourth error
The fourth error also relates to route monitoring. In contrast to the third error, this involved the INS, to be officially used only as an aid to navigation. The equipment was operated by the SOOW, who used the radar distances and the electronic chart overlay to monitor the approach to the island. The error consisted in assessing the distance from the furthermost radar echo of Le Scole rocks, and not from the limit of the no-go area, that is the 10 meters bathymetric line. Such line is also known as a safety contour, and the INS provides a functionality to set a warning zone ahead of the ship’s bow in order to generate a chart alarm (fig.10). Nobody within the team realised that between the furthermost echo radar used as reference, and the limit of the safety contour, there were two significant navigational hazards not detectable by the radar: a small rock about 1 meter above the sea level, and an underwater rock with a shallowest depth of 7.3 meters (fig.11). The dry rock was sighted by the Captain only when it was too late.

Fig.10 – Chart Alarm settings on Sam Electronics Fig.11 – Safety contour value of 10 meters shown on Sam Electronics
INS “NACOS” (ref. Multipilot operator manual) INS “NACOS” (Multipilot in Chart Radar mode) at 0.25 range, display category “ALL”, ENC cell IT50074B.
Was route monitoring by means of INS the object of Company’s specific procedures and/or training? Was the safety contour alarm routinely not used by the OOWs? In this case no elements are present in deck officer’sdepositions to answer these questions. However, given that the sail-past was not a novel situation to deal with, and assuming the lack of use of safety contour alarm as an informal practice, the overall erroneous route monitoring on INS might be considered at both rule and skill based level. The rule based component might concern the mismanagement of chart alarms, whereas the skill based component might refer to an attentional slip in overseeing the mentioned navigational hazards on the electronic chart overlay. If the hypothesis of informal practice were true, the rule based component would be both non-functional to organisational goals, and not correct with regard to risk assessment.
The fifth error
The fifth error is in the area of Bridge Resource Management (BRM), and it can be attributed to the Captain, as team leader. Indeed the effectiveness of BRM practices - essentially aiming at optimizing team work – depends heavily on the leadership skills of the Captain. That night, since the Captain arrived on the bridge at about 5 miles from Giglio Island, a series of erroneous BRM practices can be extracted from the depositions. These shortfalls are of a non-technical nature, involving mainly lack of team briefing, and lack of formal handover. In short, the Captain did not share intentions and expected outcomes of the decisions made, both before and during the manoeuvre. The presence on the bridge of hotel department personnel might have contributed to distract the Captain from his role of team leader. In fact, he took the control of navigation only in the final stage of the approach to Giglio Island. He did not take the time to carry out a proper handover with the SOOW, whose situation awareness could not be shared. In fact, despite his incorrect route monitoring, the SOOW seemed to have perceived the increased level of risk, trying to alter to starboard. But the Captain apparently stopped him and decided to take the control of navigation, cutting half of the initial safety margin, from 0.5 to about 0.25 nautical miles15. Until that moment, the Captain had spent his time entertaining the guests and holding a telephonic conversation with his mentor ashore, who advised on the depths around Giglio Porto 16. However, whether or not the SOOW should have challenged the Captain decision is not the point (Tyler, 2012). The point is that if a Captain wants to avoid the resistance of his officers to highlight his errors, he has to clarify beforehand and as quantitatively as possible, the conditions beyond which he wants to be warned. This aspect, in conjunction with autocratic leadership, diminishes the chances that his officers will speak up. Were BRM practices regulated by Company’s policies and procedures? Were they supported by formal training? Were the attitudes assumed by the bridge team the result of informal practices? The Captain’s deposition does not mention any of these BRM practices, suggesting that the erroneous attitudes were routinely assumed, hence being of a rule based character. If so, such attitudes were also non-functional to organisational goals, and not correct with respect to risk assessment.
The sixth error
The sixth error is of a shiphandling nature. It was the one breaching the last available defence: the human expertise. The error consisted in failing to maintain the newly established safety margin of about 0.25 nautical miles. Even though the reference for such margin was erroneous (furthermost radar echo instead of safety contour limit), 0.25 nautical miles would still have been enough to avoid the furthermost underwater rock (fig.12). The turn was initiated too late, giving rudder orders rather than rate of turn orders to the helmsman (controlled turn). During the turn, the Captain and the SOOW observed that the radar distance went down to 0.28 nautical miles17. At 9.44pm – one minute before the ship was turning with a safety margin reduced to less than 0.25 nautical miles (fig.13). The Captain probably relied more on his visual perception than on INS information, and initially altered course with a too small rudder angle. Only when he sighted the furthermost rock of Le Scole on his port bow, he ordered the rudder hard to starboard. The stern sectors of the hull most probably struck the underwater rock with a charted depth of 7.3 meters (see fig.4). As a result of a tight coupling of all the previous errors, and of a number of latent conditions, the underwater rock was never taken into consideration, neither in route planning nor in route monitoring. This is confirmed by the interview released by the Captain the morning after the accident, who considered the possibility of an uncharted rock 18.

Fig.12 – Reduction of safety margin from 0.5 to 0.25 Fig.13 – Simulation of ship’s position at 9.44 pm, Course
Nautical miles , still enough to pass clear of Le Scole island. Over Ground (COG) 323, speed 16 knots, on Sam Electronics INS “NACOS” (range 0.5 NM, safety contour 10m). The blue Variable Range Marker (WRM) shown in blue is set to 0.28NM, which is the value mentioned by the Captain

Were controlled turns regulated by Company’s policies and procedures? Were SOOWs trained for controlled turns? Were informal shiphandling practices followed by the Captain and his officers? There are no elements in the depositions to answer all these questions. However, hypothesizing that sail-pasts were fairly rare events, and that no informal rule was established to execute them other than the shiphandling style of the Captain, it is likely that the shiphandling error made was predominantly at a knowledge based level of performance. At this level, improvisation comes into play, increasing the likelihood of committing errors and recovering from them. Summary of active failures (errors)
Table 1 summarizes the hypotheses put forward for the errors described above, all contributing to turning the initial Undesired Ship State into an organisational accident. The elements associated with each error in the table are not meant to establish causal relationships. As discussed, and according to the model of organisation accident (fig.6), the analysis of the active failures is only the first step of the top-down path towards latent conditions.

Latent conditions in the workplace (bridge)
The predominantly rule based character of the six errors imposes an investigation on the local workplace conditions promoting non-functional and incorrect informal practices. For each error, a series of questions should be possibly answered by the formal investigation: * Were bridge procedures (if any) adequate to the task, situation and bridge layout? * Were there design and usability issues in hardware and software interfaces of both the Integrated
Navigation System (INS) and the automatic track keeping system (Track Pilot)? * Did deck officers attend equipment specific training?
Bridge procedures, design of navigation equipment and specific training are the focus of the following sub-paragraphs. However, other latent conditions might be uncovered by investigators by seeking answers to other questions, such as: * Were there issues of reliability and/or long standing malfunctioning of bridge equipment? * Were there fatigue issues due to excessive off-watch administrative burden? * Were there language barriers among team members?
Whereas it seems that there were no malfunctions related to the conduct of navigation, the remaining two questions are worthy of explanation. Off-watch administrative burden in particular, may drive some of the non-functional goals at the basis of routine violations. For example, the least effort is likely to become a prominent motivational goal for overburdened operators. Only an in-depth analysis of formal task and job design, along with informal practices followed, can reveal the extents to which usual off-watch administrative work contributed to the non-functional rule based errors committed that night on board Costa Concordia. Language barriers seem to have played a role especially in the case of the 3rderror, when route monitoring on paper charts was disregarded to support the helmsman during the final stages of the approach to the island. Both JOOW’s and Safety Officer’s depositions seem to confirm that the helmsman was not able to speak Italian, although it was the official language in use on board. The fact that only conning orders were given in English, might have been useful to prevent critical rudder related misunderstandings, but it certainly did not help to include the helmsman as an active member of the bridge team.

Bridge procedures
Whereas it is relatively easy to build hypotheses on events, it is more difficult to uncover why it made sense to deck officers to opt for non-functional and incorrect actions (or inactions). Although the analysis of the adequacy of Company’s procedures is not possible from officers’ depositions, an important clue to consider is the adoption of informal and routine practises. Such deviations, also known as violations, can be of different types. Their classification is proposed with respect to the functionality to organisational goals - functional and non-functional - and with respect to the accuracy of risk assessment - correct and incorrect. Reason (1997) argues that non-functional violations reflect the fact that human actions serve a variety of motivational goals, and that some of these are quite unrelated to the functional aspect of the task. Among these motivational goals, the least effort, and the sense of thrill are particularly critical. The tendency to opt for non-functional goals can be become part of an individual’s performance style. A functional violation is considered by the operator as essential “to get the job done” or more effective in some way, but in accordance with organisational rather personal goals. Functional violations are likely to be the symptom of inadequate or missing procedures for the task or situation. However, it is important to highlight that in all hazardous operations, the variety of all possible unsafe behaviours is much greater than the variety of required productive behaviours. Thus, it has to be accepted that wholly safe behaviours can never be controlled entirely by prescriptive procedures. An incorrect violation occurs when the action (or inaction) is not accurate in terms of risk assessment. On the contrary, a correct violation reflects an accurate risk assessment. A subset of incorrect violations comprises those successful in terms of outcomes. Incorrect but successful violations are the most significant for the analysis of the Costa Concordia accident, given a number of previous sail-past carried out by the Captain. Having always been inconsequential, they might have contributed to build a sense of underestimation of risk. Often accidents breed from successful violations, which have the peculiar power to make operators forget to be afraid. Most likely that night the Captain forgot to be afraid.
Design of navigation equipment
Since 2005 the international maritime community agreed that the proliferation of navigation equipment should have been coordinated in order to avoid different levels of reliability and effectiveness. IMO took the lead of e-navigation, an initiative designed to drive technological innovation towards enhanced navigation safety (IMO, 2009). IMO has recently acknowledged the importance of guidelines for usability evaluations of navigation equipment (IMO, 2011). In particular, Integrated Navigation Systems (INS) are expected to play a dominant role for the development of e-navigation on board ships. Indeed integration and presentation of information will be crucial in order to manage deck officers’ workload and to support decision making. The bridge of Costa Concordia is fitted with an integrated navigation system named NACOS (Navigation and Command System), which integrates data from radar scanners, GPS receivers, the Automatic Identification System (AIS), gyrocompass, echosounder, speed log, anemometer, and engine Power Management System (PMS). NACOS can be operated in three main modes: * radar: only radar image and plotting functionalities (ARPA); * chart radar: same functionalities of radar mode with an additional electronic vector chart overlay; * Electronic Chart Display Information System (ECDIS): a full screen display of electronic charts (both raster and vector) with an additional radar overlay (image and plotted targets).
In ECDIS mode, and in combination with a dedicated planning workstation (Chart Pilot), the INS meets the IMO carriage requirements for nautical charts. This combination of units is therefore equivalent to the paper charts required by SOLAS V/20 of 1974, as long as they are operated with official electronic vector charts (ENCs). This was not the case of the Concordia, where only unofficial vector charts were loaded on NACOS. As a result, the primary means of navigation remained the paper charts, and the NACOS INS in chart radar or ECDIS mode had to be considered an aid to navigation. Under these circumstances the ECDIS mode should be called Electronic Chart System (ECS) mode, to highlight the non-adherence to ECDIS requirements, and to avoid mode confusion for operators. Mode confusion reveals the irony of automation, which removes the possibility of attentional slips or memory lapses (such as plotting GPS positions on paper charts), but introduces higher level errors. Such errors might have a rule based nature in the case of tasks or situations covered by formal procedures or informal practices, and a knowledge based nature in the case of novel tasks or situations. Were the Captain and the SOOW of Costa Concordia fully aware of the mode operated on the INS used to approach Giglio Island? If the two hypotheses of mismanagement of chart alarms and of unawareness of the underwater rock off Le Scole were confirmed by the official investigation, it would be interesting to evaluate to which extent the usability of the NACOS induced the route monitoring error described above (the 4th). With regard to chart alarms for example, a potential usability issue might arise from the guard sector defined by the operator. The guard sector opens out from the ship’s position in direction of the ship’s actual course (fig.14), and once it intersects particular cartographic features – such as safety contours, land areas, and objects of interest with a depth value less than the selected safety contour – it triggers an alarm. But once defined, the guard sector is not displayed on the screen – differently from the guard sectors for automatic radar target acquisition – making it difficult for operators to remember its parameters, especially when many others have to be kept in mind. Fig.14 – Invisible guard sector of chart alarms for Sam Electronics “NACOS” (Multipilot and Chartpilot)
Correct chart alarm management may have alerted the SOOW to the presence of both the 10 meters safety contour and the 7.3 meters spot sounding off Le Scole. Another potential usability issue might have contributed to “hide” the underwater rock to the eyes of the officers (fig.15a and 15b). This relates to the clarity of electronic vector charts on navigational display. Spot soundings overlapping with depth contours and other cartographic features are the norm on ECDIS and ECS, and the dynamic customization of the various layer of information at best requires a considerable cognitive effort. In the worst cases important features becomes unreadable, compromising the situational awareness of the OOWs. Comparing the paper chart with the vector chart of Giglio Island (fig.16 a, b), it appears evident that the art of cartography got lost in translation from paper to vector charts. Aesthetics plays a functional role in design (Norman, 2002) and aesthetic integrity is also one of the fundamental principles behind the most successful software interfaces of main stream packages. However, it is important to highlight that equipment manufacturers are constrained by international display standards, and that finding the optimal balance between aesthetic integrity and compliance to regulations might be a daunting task for software engineers.

Fig.15a – Chart IIM 119 (Italian Hydrographic Office), Fig.15b – ENC cell IT400119 displayed on Sam scale 1:20.000. The chart is used as a source for the display category “ALL”, range 0.75NM
(correspondent to a compilation scale of 1:12.000) Electronics NACOS (Chart Pilot), in night display, (correspondent to a compilation scale of 1:12.000).

Fig.16a – Chart IIM 119 (Italian Hydrographic Office), Fig.16b – ENC cell IT400119 displayed on Sam . scale 1:20.000. The chart is used as a source for the Electronics NACOS (Chart Pilot), in night mode, compilation of the ENC cell IT400119 (compilation display category ”ALL”. scale 1:12.000)

Other design issues might also arise when analysing the reason why manual shiphandling was preferred to the automatic track keeping system. The system is named Track Pilot and is integrated to NACOS, with three modes of operation: heading, course and track. In the first two modes the ship follows set heading and course whereas in track mode the ship follows a track - uploaded beforehand from the planning workstation – within the limits defined by the operator and the accuracy of the selected sensors. So, why was manual shiphandling preferred to Track Pilot in track mode? Was the track mode routinely used on board Costa Concordia? If not, why not? To which extent usability issues might have been involved in preferring manual shiphandling over the Track Pilot? In order to address specific usability issues of human machine interfaces, a sound understanding of automation is required. Civil aviation started to cope with automation much earlier than the shipping industry. Early research on the impact of technology on “glass cockpit” showed that flight management systems designed to ease the pilot’s mental workload tended to be most enigmatic and attention-demanding during periods of maximum workload. This feature, named “clumsy automation”, concurs – along with lack of training, experience and digital literacy - to build operators’ distrust towards the system meant to ease their job. A number of other human factors related to automation have been identified by research over the years. Among them, increased demand on operators’ memory and difficulties in sharing the same situational awareness might be relevant to automation built in maritime track keeping systems. Complex menu structure to access settings, unpredictable behaviours, and a general lack of transparency of functionalities, might constitute the more problematic aspects.
Back to the Costa Concordia, a usability analysis of Track Pilot functionalities can reveal to which extent automation related issues might have promoted distrust of the Track Pilot. However, usability evaluation constitutes a challenge for the industry, as no specific testing is currently required for the IMO type-approval certification of navigational equipment. The only tests carried out involve the existence of functionalities listed in IMO performance standard, and the electro-technical reliability of hardware components.

Specific training
In a recent report about safety in shipping (Allianz Global Corporate & Specialty, 2012), the increased level of technology poses training challenges for the industry of the new millennium. Despite the presence of well established international standards of competence for seafarers (STCW), training regimes are sometimes not consistent and may lead to variations in crew and officer competence. Indeed, the growing complexity of tasks and the increasing level of technology on board ships, it makes it necessary for shipping companies to train their officers for specific safety procedures and specific bridge equipment. In light of these considerations, the lack of specific training, or shortfalls in its assessment, may well turn into downstream latent conditions for ship’s bridges.
No information on the subject can be extracted from the depositions released by the officers of the Costa Concordia. Whether or not the officers were trained in the specific BRM procedures or in the use of the specific INS and Track Pilot, it has to be ascertained by the official investigation. Going even further than formal type specific training, in the near future INS-ECDIS type specific training could not be enough. Information technology and automation could lead to a totally new concept, named automated navigation, a paradigm shift from current integrated navigation. In the near future the use of automatic track control systems on board ships might not be an option anymore, as they will constitute the basis of a “shared route monitoring” with coastal control stations. In this scenario, renewed training concepts will be required to meet the new opportunities but also the risks of automated navigation. The maritime industry is going through challenges already faced by civil aviation a few decades ago, with the introduction of flight management systems and integrated Air Traffic Control operations. In general, the introduction of automation has changed the very essence of the pilot’s profession, bringing about new opportunities as well as a new breed of errors unknown before (Kern, 2001). How will it be possible to address the demand for a renewed human-system integration driven by automation? Certainly training will play an essential role in building not only an appropriate set of technical skills, but also a deeper understanding of automation. Although the idea of automated navigation might seem too advanced for certain sectors of the industry - currently engaged with the challenges brought about by ECDIS - this might not be the case for cruise ships, whose deck officers are already dealing with automated navigation. The lack of deeper understanding of automation might be among the reasons why they distrust the highest level of automated control of their ship. The Track Pilot in track mode may be considered as such.

Summary of latent workplace conditions
Table 2 summarizes the latent conditions described above, and associates them to the errors listed in table 1. It is worth to point out the table does not establish causal relationships between errors and latent conditions. The association is meant to identify what type of latent conditions might have combined with erroneous human behaviours. We are still in the top-down descend of fig.6, and only once the latent conditions at the organisational level are examined as well, the causal bottom-up ascend can be undertaken.

Organisational conditions The analysis of organisational factors constitutes the last step of the top-down path of an accident investigation. Such analysis might be based on the examination of organisational processes potentially able to generate error inducing conditions in workplaces. If these processes remain unchanged, the efforts to counteract active failures and latent conditions are likely to be in vain. That is why Reason (1997) recommends that latent organisational conditions represent the priority area for an organisation committed to system safety. In table 3, four clusters of organisational processes are identified (management, technology, training and culture) and associated to possible process measures relevant to safety of navigation.

There are many possible ways to measure organisational processes, and the list proposed offers just an example. However, it is essential that a principled approach is adopted, keeping in mind that the purpose of process measures is twofold:

* to identify the most urgent ones at a certain point in time;

* to track the effectiveness of remedial actions taken.

Hence, the first principle to embrace could well be that measurements that are not used to guide the system safety are not worth taking. Although listed as a stand-alone, culture pervades all the other organisational process. Reason (1997) argues that whereas national cultures are shaped largely by shared values, organisational culture is shaped largely by shared practices. Identifying and assembling safety related practices into a working whole, equals to engineer a safety culture, whose ideal nature is expressed by a continuing attention towards all the threats, errors, and latent conditions that can breach the system’s defences. In order to pay this continuing attention, both operators and managers should not forget to be afraid. In the specific case of the Costa Concordia, did the Captain forget to be afraid when he took the decision to carry out the sail-past, and later on to cut half of his safety margin from 0.5 to 0.25? If so, what are the cultural aspects behind these decisions?
Perrow (1984) writes that the error inducing character of the maritime industry lies: * in the social organisation of the personnel on board ships, and

* n the economic pressures operating.
Assuming that economic pressure was not present that night, was the incorrect decision (with regard to risk assessment) of the Captain influenced by a sort of pressure put on him by hotel department personnel19? And most importantly, might that pressure be the expression of the informal power hotel departments have on board cruise ships? If so, could the first error (incorrect and non-functional planning of touristic navigation) be correlated to the cultural obligation the Captain felt towards hotel department personnel? At the basis of the last error (shiphandling) there was the decision to cut half of the safety margin (from 0.5 to 0.25 nautical miles). Were any cultural factors behind it? Reading through the Captain’s, his mentor’s and the Safety Officer’s depositions, shiphandling is mentioned many times20. This suggests that another important cultural factor might have played a role: it is the prominence of shiphandling for Captains’ reputation. Indeed, demonstration of outstanding skills in manual shiphandling – and not in automated shiphandling by means of track keeping systems – might be the cultural driver shaping a chronic, risk taking performance style. The answer to this and to other “cultural questions” might constitute the key for the understanding of why non-functional decisions were made, and consequently, the key to systemic improvements.

CONCLUSIONS
In his seminal book “Normal Accident” (1984), Perrow argued that in an error inducing system, the tendency to attribute blame to operator error is particularly prominent. Almost three decades after, the Costa Concordia accident suggests that the maritime industry is yet to learn this lesson. This paper does not provide all the answers, but it does focus on the importance of the error inducing conditions under which seafarers work. Such conditions are generated by complex interactions between organisational processes and other external factors to the organization. However, for the purpose of the understanding of an organisational accident, a stop rule is defined: the investigation cannot go beyond the limits of the manageable by the organisation. According to this principle, national culture, and regulatory aspects have not been discussed. Having analysed the publicly available data the grounding of Costa Concordia does indeed appear to be an organisational accident. The model of organisational accident (Reason, 1997) has also served the two main aims of the paper: * to provide investigators with a framework to be potentially used for the understanding of the pathways followed by active failures and latent conditions in its generation;

* to stimulate a close examination of error inducing conditions across the whole cruising industry, and the wider maritime domain.

Are organisational accidents really necessary before organisations realize that fighting the last fire might be not enough to improve system safety? A possible alternative to avoid these costly improvements is the regular analysis of human performance under normal operations, as well as the assessment of the organisational processes related to safety management. Human errors and latent conditions are present now, and always will be in complex systems. It is not necessary to wait for accidents to find out what they are. But they cannot be f ixed all at once. Safety management needs a principled way of identifying their most urgent process issues, in order to deploy their limited resources in the most efficient and timely manner. Reason’s famous quote, “we cannot change the human condition, but we can change the conditions under which humans work”, well translates the overall aim of the paper, which poses questions on systemic issues, rather than accusing or defending individuals or organizations involved in the Costa Concordia accident.

REFERENCES
AGCS 2012. Allianz Global Corporate & Specialty, Safety and Shipping 1912-2012. From Titanic to Costa
Concordia. An Insurer’s perspective from Allianz Global Corporate & Specialty.
Dicovery channel asia http://dsc.discovery.com/tv-shows/raising-concordia/about-the-show/about.htm wikipedia.com en.wikipedia.org/wiki/Costa_Concordia‎ Google.com en.wikipedia.org/wiki/Costa_Concordia_disaster www.bbc.co.uk/news/world-europe-16646686‎ www.cruisecritic.com › Cruise Reviews‎

MARITIME LAW

Submitted to: Mr. Nicanor Estrera Submitted by: Jayvee Fernandez