Marine Accident Investigation - Improving Evacuation Systems' Safety
Stuart Withington
Principal Investigator, Maritime Accident Investigations Branch, UK (MAIB)

1. Introduction

"I didn't evacuate passengers using lifeboats simply because I was afraid that people would get injured. Instead, they were transferred through the car deck shell door into waiting tugs."
Quotations by masters in discussion with accident investigation inspectors.

Such lack of confidence in lifeboat launching equipment among ships' masters and crews is widespread. They have a right to be.

Scrutiny of data held by MAIB suggests that anyone using a lifeboat, be it in a drill or genuine evacuation, runs the risk of being injured or even killed. The lifeboat launching and recovery operation is the one activity that posses the highest risk to crew safety.

The MAIB database shows that over a 13-year period, 13 people were killed and 138 injured in 125 lifeboat accidents. Most accidents occur during the launching and recovery operation. The 13 lives lost represent 15% of all those killed in reportable accidents to the MAIB. These figures reflect only a small proportion of total accidents that have occurred worldwide. A global perspective indicates that more than 100 seamen were killed operating lifeboats during the 1990's.

This is an alarmingly high proportion of accidents. It is hardly surprising that an atmosphere of fear of lifeboat drills exists: a situation that does not contribute to the promotion of safety at sea.

The concern for safety in the lowering of lifeboats during emergency drill is clearly illustrated with the call to IMO for a change in the SOLAS requirement that specifies that during drills the lifeboat crew must be lowered with the lifeboat.

It is thought that the master should have the option to lower the lifeboat empty. This concern is a sad reflection on a system considered satisfying SOLAS requirements, yet is too risky to operate fully for training purposes.

The reality is that the removal of crew during launching benefits the master and management in their efforts to reduce risk to crewmembers being killed and injured. But the fact remains that, should a real emergency occur, passengers would be exposed to the same risk. Life-saving equipment, or installations, are tested to ensure fit for purpose. The risks to people should be no different, whether it is being tested or being used for real in an emergency.

There is equal lack of confidence of masters and crews involved in the launching and operation of fast rescue crafts (FRCs) and a reluctance to test them in the severe environment expected.

Incidents investigated show an extreme reluctance of masters to launch the craft in heavy weather. Masters are equally concerned with the safety of retrieving the craft back on board.

Over the last three years 24 accidents involving FRCs and injuries to crewmembers have been reported to MAIB Accidents. The number of accidents with these craft is much less than with lifeboats. However, this is probably because they are operated far less frequently than lifeboats.

Scepticism that emergency escape and embarkation systems can be tested safely is not confined to lifeboats and fast rescue craft.

The operation of suspending, inflating, people loading and lowering of liferafts is often avoided by surveyors and crews simply because they think the operation is too risky.

What underpins this lack of confidence in these systems? The maring industry, including IMO, sides with Jim Reason and others, who advocate that an accident is not caused by a single factor. It is caused by a variety of reasons.

They decry the past tendency to blame the accident on operator error. Controlling factors, which are often outside the operator's control, influence the operator's error.

Lessons learned from accident investigation show that operator error with emergency disembarkation and recovery systems is reduced significantly by better training, maintenance, procedures etc. The lessons also tells that good design is the barrier most likely to succeed to prevent accidents.

Deficiencies in design are the handicap that hinders masters' endeavours to ensure crew safety and to instill confidence in emergency embarkation and recovery drills.

The purpose of this discussion is to show that for these systems to operate safely and with confidence, they must be designed with the aim of making them inherently safe.

To achieve this, the design process must be managed effectively to ensure that the human factor is considered at design conception, and throughout all the design stages, including final installation and testing.

Emergency evacuation systems must be designed to support the people who are expected to use them.

2. Investigations that have identified design related root causes of accidents

The design made it hard for people to carry out reasonable tasks and vulnerable to predictable human failings.

.1 Ergonomic principals have not been properly considered in the design is highlighted by the difficulties experienced in bowsing and tricing operations of lifeboats.

.2 In one accident investigation, modifications to the operation were made using a band bowsing system (BBS), designed to replace an existing conventional method of tricing and bowsing. During installation tests of the system two crewmen were killed.

.3 The two men were stationed in the forward and after hatches of the lifeboat. They attempted to release the BBS brakes. The intention was to move the lifeboat away from its embarkation position to its lowering position. During the operation, the aft end of the lifeboat swung suddenly away from the ship's side. Progressive collapse of the davit followed.

.4 Post accident investigation tests found that the brake was sensitive to incorrect operating procedure. The seamen found it difficult to simultaneously operate the brakes in a controlled manner when the lifeboat was fully loaded. Brake operation required a level skill not recognised at the time of the accident.

.5 The investigation also found that the wearing of lifejackets restricted the seamen's movements compounded their difficulties in operating the BBS brake from the lifeboat hatch openings.

.6 Davits, lifeboats, rescue craft and winches are often supplied by a diverse number of sources, resulting in a fragmented approach to system design development. Once installed on board, geometrical mismatches are uncovered, making launching and retrieval of a rescue boat or lifeboat difficult and dangerous.

.7 The irony of this situation is that the BBS has global acceptance as an alternative to traditional bowsing tackle and tricing penitents to avoid the hazard create by this geometrical mismatch.

.8 The BBS was also designed to overcome the difficulties for seamen overcoming the heavy loading applied to bowsing tackles as they reposition a fully loaded lifeboat from embarkation position to vertical lowering position of the falls.

.9 The consequence of using the BBS is the replacement of old hazards with new ones. In the accident described above, two seamen lost their lives.

The design was vulnerable to predictable human failings.

.10 Simultaneous operated on-load release lifeboat hooks have been mandatory since 1st July 1986. Lessons learned from the accident on the offshore platform, Alexander Kieland, in the North Sea in 1978 was the spur that brought about the requirement. Because of rough seas, lifeboats were prevented from becoming waterborne long enough to enable release of the fixed hooks of the lifeboat from the lifeboat falls. Consequently, lives were lost as lifeboats crashed against the platform, with one lifeboat ending up side down in the sea.

.11 The first design of on-load release hook did not have any interlock to prevent unintentional release of the lifeboat when not water-borne. Indeed, SOLAS did not recognise the need for such an interlock until recently.

.12 The consequence of not having an interlock has resulted in numerous accidents due to inadvertent release of hooks. These accidents could have been prevented had an interlock been fitted.

.13 Investigations have found that on-load release systems can be complex and difficult to understand. Consequently, to maintain and operate release mechanisms safely requires in-depth knowledge, specialised skill and relevant, clear and unambiguous operating instructions.

.14 Often the lifeboat hooks have not been located properly in their reset position. As the lifeboat is retrieved and landed on the davit stoppers, the consequent jerking of the lifeboat opens the hooks resulting in the lifeboat falling down causing serious injury and fatalities.

.15 Hook mechanism have been found to be susceptible to failure given small changes in tolerances due to operational wear, corrosion and fretting, machining deviations during manufactured and deteriorating effect of salty air, weather and vibration.

.16 Such unsafe conditions are difficult to detect by seaman during their normal routine inspections. Seamen need to be constantly aware of the complications of on-load release hook mechanisms, and assured that the hooks are properly secured, and that the release and interlock systems work effectively.

.17 Given wear on the reset mechanism, interlock indicating lights and hook reference marks on the hooks have been found to give a false impression that hooks and locked when they are not. The user is given a false sense of security as a result.

The design was inadequately specified for the required duty.

.18 From lessons learned of the loss of the Estonia, IMO's panel of experts suggested that ro-ro ships should be equipped with a means of rescuing (MOR) people from the water. In this accident, the vessel's escape chute was used as a MOR when rescue boats could not be launched. Consequently the new SOLAS regulation 26.4.3 confirms that the ship's own evacuation slide can be modified to make it easier to pick up people from the water.

.19 The intention of IMO's panel of Experts was that, in the case of a disaster, a ro-ro ship could use a fast rescue craft to collect people from the water, and bring them to the MOR. The MOR would then be used to embark the survivors.

.20 However, the regulation permits the FRC to be used as a MOB. Since the FRC can carry only a small number of people, the craft would have to be retrieved on board many time over in the case of a major accident with many people in the water. The delay in retrieving survivors from the water could be considerable.

.21 Given the difficulties of launching and retrieving FRCs in stressful conditions of heavy weather, procedures are prone to errors when releasing painters and suspension hooks. Exercises, which can be conducted safely, are so far proving to be impractical.

.22 Concerning vertical chute marine evacuation systems, during one evacuation drill an evacuee became stuck in the "piked position" in one of the cells of the chute. The evacuee was rescued from the chute, but later died.

.23 The riding up of the lifejacket worn by the victim probably contributed to her becoming stuck in the chute. Designers had not accounted for this possibility. No proper account had been made of the means of preventing undue delay in the evacuation should a blockage of the chute occur.

3. Action taken to prevent accidents

A better understanding of why accidents happen has resulted in IMO's Design and Equipment Sub-committee proposing significant changes in operating and servicing requirements for lifeboat installations.

One proposal calls for specific guidelines for periodic servicing and maintenance of lifeboats, launching appliances and on-load release gear. As important, is another proposal to use the manufacturer's representative, or persons properly trained and certificated to carry out inspections, maintenance and repairs.

The proposals reflect what is, already, good practice of a number of outstanding companies. Global acceptance of them would be an important step towards improvement of safety of seamen and passengers.

For training purposes, companies have put on board ship; working models of on-load release and marine escape systems. Crew-members, port State and flag State inspectors have reported that these models are useful in helping significantly their understanding of the systems' operation and maintenance needs.

There is a strong mandatory case for such models and related specialised equipment to be placed on board ship for training purposes.

Where ships are fitted with emergency vertical escape chutes, management is reducing risk of injury to crew and passengers by selecting those people who can use chutes safely based on their age, fitness and physical build.

Some companies are starting to standardise lifeboat launching systems and equipment throughout their fleet, thus improving crew familiarity and confidence with their use.

IMO advocates medium to long term consideration of alternative technologies, such as "safe-haven" refuge, comprising parts of the ship that may float free in the even of a casualty. Alternative types of survival craft and under consideration.

It is proposed that any alternative system developed should be capable of being routinely exercised by the crew.

4. An inherently safer design is good for us

A human factor approach to design is a perquisite to good design. Good design has an impact on preventing the initiating event of an accident. This view is reflected at IMO whose work plan is committed to examining measures to avoid accidents by better design of emergency escape systems.

There are several definitions of human factor. One that is relevant to the design function is:

"Human factor is a professional discipline concerned with improving the integration of human issues into the analysis, design, development, implementation, and the operational use of works systems"

With this approach to design, health and safety considerations are integrated into the design process, from the initial design concept to installation and testing.

The present tendency is to focus on the safety need for people once the system has been made, rather than during the design process leading up to the product's final installation and use. The design process offers the opportunity to ensure that the end product is inherently safer than emergency installations now in use.

Such an approach can ensure that risk reduction measures adopted to address one hazard do not disproportionately increase risks due to others. Such an approach could have identified the safety problems with the concept of on-load release hooks when considered against the lessons learned from the Alexander Kieland accident.

To achieve an inherently safer design, the human factor must have central role in design development thinking. It should be at the heart of the design process. It is in the design process, leading from design concept to final product testing where key human factor safety issues can be addressed.

The greatest opportunity to reduce risk is during the initial design concept stage. This is the best time to identify hazards. This is the time to make informed choices, either to design hazards out of the system or to identify realistic control measures to mitigate the hazards.

The ability to change a design decreases with time as design concepts are selected and design details are finalised. The vertical escape chute accident involving incompatible lifejackets, and the BBS accident, are examples of many where difficulties of operation have been uncovered only after the system has been installed and tested.

Safety problems such as these could have been avoided if careful attention had been given to ergonomic design of systems during the design process.

The consequence of not addressing the issues of human factor is the probability that inherent safer design will not be achieved. Risks associated with human activity addressed as an afterthought increases the demand for more exacting operating and maintenance skills and a higher level of knowledge. The likelihood of operator error is increased, and the confidence of the user to operate the system decreased.

5. A Safety Management System Code for Inherently Safer Design

Following the Cullen report into the Piper Alpha disaster, the offshore industry has recognised that risk reduction at the design stage is one of the most effective means of achieving safety of personnel.

The UK's Health and Safety Executive, for example, has placed duties and principles on designers and design teams to have a key role in ensuring that a human factor approach is taken throughout the design process. The aim is to achieve an inherently safer design.

Linked to this, is an offshore industry initiative to improve safety performance of the design process by developing useful performance indicators. The indicators will measure the effectiveness of management and application of health and safety in the design process.

These initiatives for achieving inherently safer designs could be applied to emergency escape systems.

In its focus on the safety and effectiveness of emergency escape systems, IMO is well placed to develop a safety management system code for inherently safer design, aimed to ensure that human factor issues are an integral part of the design process, and that the design process is managed effectively. The Code could emphasis the importance of a holistic approach to design.

When integrating human factors throughout the design process, the following domains could be considered.

• Manning: How many people are required to operate the system?
• Personnel: What experience aptitudes and other human characteristics are necessary to operate the system?
• Training: How to develop and maintain the requisite knowledge, skills and abilities to operate and maintain the system.
• Ergonomics: How to integrate human characteristics into design to optimise performance within the human/machine system.
• Health hazards: What are the health hazards resulting from normal operation of the system?
• System safety: How can safety risks be avoided due to humans operating or maintaining the system abnormally.

With its work programme to review emergency escape systems, IMO's Design and Equipment Sub-committee is best placed to develop such guidelines.

6. For the future

IMO is well placed to develop a safety management system code for inherently safer design of emergency evacuation systems.

A Code could encourage a well managed and structured human factor design process which follows well-defined principles to achieve an inherently safer design.

The effectiveness of the design process could be monitored and audited by a competent authority.

Confidence in the design process will facilitate effective evaluation of equipment and system maintenance practices, policies and procedures.

Inherently safer designs will reduce the number of accidents to seamen and instill confidence in their use.

Acknowledgements
I want to thank ship management colleagues, colleagues at the MAIB, MCA, HSE and IMO, for their contribution to this discussion about the safety of emergency evacuation systems.

Stuart Withington, Principal Investigator MAIB
Carlton House, Carlton Place,
Southampton SO15 2DZ
United Kingdom