1 Introduction

From 2008 to 2014, the Japan Transport Safety Board (JTSB) investigated more than 1000 marine accidents and incidents every year (JTSB 2014a, 2015). Marine accidents occur all over the world and result in loss of lives and property as well as damage to the environment and the reputation of the company that is responsible for the accident. Therefore, it is vital that the number of marine accidents is reduced. The study aims to determine the relationship between latent conditions and the characteristics of holes based on the Swiss cheese model and thereby reduce the number of accidents.

The study observed the safety management system (SMS) in an organization which originates from the product quality management system and the risk management system at a local workplace, considered the SMS and risk management system as the defensive layers of the Swiss cheese model, and applied the process approach that is used in managing product quality. Heinrich (1959) states that controlling the quality and quantity of products has much in common with controlling the frequency and severity of accidents. In many cases, the same faulty practice is involved, and the reason for the existence of the fault is similar. Therefore, it is considered that the methods for correcting the faulty practice are identical in both fields. Rasmussen (1997) emphasizes that risk management is necessary at all levels of modern dynamic societies. Manuel (2011) concludes, after extensive research into ship officers and shipping companies, that achieving continual high safety standards and performance is based on management commitment and a greater consideration of all potential risks, particularly by operators. In the UK, risk management is required in workplaces to ensure the health and safety of operators and others who may be affected by what the operators do or do not do under the Health and Safety at Work etc. Act 1974 (The Health and Safety Executive 2006).

With regard to the definition of a hole, the study applied the concept of risk management. ISO/IEC Guide 51 (ISO/IEC 1999) states that safety does not mean absolute freedom from risk but freedom from unacceptable risk. The opening of a hole in a defensive layer is defined as an unacceptable risk that exists in an organization or a local workplace. To find the locations of holes, the study focuses on each process of the plan–do–check–act (PDCA) cycle in an organization and risk management at a local workplace at the time of the accident.

The following 10 latent conditions that can cause the opening of holes are defined by modifying such concepts as the software-hardware-environment-liveware (SHEL) model and the IMO/ILO process for investigating human factors (IMO 2000a), in addition to the result of my previous study (Fukuoka 2015a), and causal factors relating to the marine accidents investigated by the JTSB (JTSB 2012a, 2013a, 2014b): (1) inadequate passage planning, (2) inadequate procedures, (3) inadequate rules or deviations from rules, (4) inadequate human–machine interface, (5) inadequate condition of equipment, (6) adverse environment, (7) inadequate conditions of operators, (8) inadequate communication, (9) inadequate team work at a local workplace, and (10) inadequate management in an organization. The general failure types in the Tripod–Delta model (Hudson et al. 1994; Reason 1997) are not used because they were developed for offshore installations and for identifying weaknesses in the SMS (Mearns et al. 2003).

Eighty-four serious marine accidents from 2008 to 2014 that were investigated by the JTSB were analyzed using these definitions and methods.

2 Background

To understand how accidents occur and to develop preventive measures against accidents, various kinds of accident models have been developed. An accident model involves a stereotypical way of thinking about how an accident occurs and is divided into three categories: sequential accident models, systemic accident models, and epidemiological accident models. The sequential accident model is represented by domino theory, and is applicable to accidents that have clear cause–effect links. However, this model is not suitable for explaining accidents in complex systems in modern society. The systemic accident model is represented by the functional resonance accident model (FRAM), which rejects cause–effect links and regards the accident as an emergent phenomenon (Hollnagel 2004). However, the FRAM is not widely used in practical (Hollnagel et al. 2006). The Swiss cheese model (Reason 1997) is categorized as an epidemiological accident model, which explains accidents in complex systems and is used in the marine, aviation, railway, road transportation, and medical fields (McNair 2007; Dell 2007; Landre 2007; Salmon et al. 2007; Davis et al. 2007). Using the marine and aviation fields for the theoretical background, the SHEL and Reason hybrid model, which combines the SHEL model with the Swiss cheese model, was developed and has been used by national safety investigation authorities (International Maritime Organization 2000a). In addition, the Tripod–Delta model, a sociotechnical system model that is based on the SHEL model (Grech et al. 2008), and the human factors analysis and classification system (HFACS) (Wiegmann and Shappell 2003), which is based on the Swiss cheese model, have been developed as accident models. During on-site accident investigations, marine and aviation safety investigation authorities use the SHEL model (Hawkins 1987) to collect evidence (IMO 2000a; International Civil Aviation Organization 1993).

According to the Swiss cheese model, a number of defensive layers and associated holes exist between hazards and potential losses. These holes are in continuous motion, moving from one place to another, and opening and shutting. Holes are caused by latent conditions and active failures. Latent conditions can serve both to promote unsafe acts and to weaken defensive mechanisms. No one can foresee all possible accident scenarios. Therefore, some holes in defensive layers will either be present at the time of system establishment or will develop in an unnoticed or uncorrected manner during system operation. When such holes line up in a number of defensive layers, hazards come into direct contact with potential losses and an accident occurs.

In the context of the Swiss cheese model, potential accidents and losses can be avoided by preventing holes from lining up. This means that when holes that have been lined up as a result of latent conditions are shut, accidents and losses do not occur. Therefore, to take effective and efficient preventive measures, it is important to determine the relationship between latent conditions and the characteristics of holes caused by those conditions. If holes can be visualized and the relationship between holes and latent conditions can be made clear, it is possible to control the occurrence of holes and thereby reduce the number of accidents. However, the Swiss cheese model, the SHEL and Reason hybrid model and the HFACS do not consider the location of holes and the relationship between holes and latent conditions. Using the Swiss cheese model in marine accident investigations as an investigator while being aware of these omissions is what has motivated this study.

3 Methods

3.1 Methodology

3.1.1 Selection of samples

Organizational accidents have many causes involving many people at different levels, and the Swiss cheese model aims to provide a better understanding of these accidents. Individual accidents are those that involve a single person who is both the agent and victim of the accident (Reason 1997). All of the 84 serious marine accidents examined in this study are characterized as organizational accidents involving organizations such as a ship management company, a pilot association, a manufacturer of equipment, or a cargo-handling company. Individual accidents include accidents involving the captains of fishing vessels, recreational fishing vessels, angler tender boats, pleasure boats, and personal water craft (PWC), but do not involve the organizations mentioned above. Collisions between merchant vessels and fishing vessels were included in this study because of the involvement of merchant vessels. However, accidents occurring on fishing vessels, recreational fishing vessels, angler tender boats, pleasure boats, and PWC that did not involve merchant vessels were excluded from this study because the Swiss cheese model is only applicable to organizational accidents.

This study addresses serious marine accidents, which are defined as very serious marine casualties by the Casualty Investigation Code and which result in the total loss of the vessel, death, or severe damage to the environment. The investigation report of a serious marine accident must contain detailed circumstances of the accident, analysis, and comments on the causal factors including mechanical, human, and organizational factors (IMO 2008). In addition to this definition, the JTSB regulations categorize a marine accident from which important lessons are learned for preventing accidents or mitigating loss and damages as a serious marine accident. A serious marine accident differs from a marine accident in terms of the severity of the outcome, but the causal mechanism is the same: the defenses do not work.

This study does not address marine incidents, which are events other than a marine accident that would endanger the safety of the vessel, people, or the environment if not corrected (IMO 2008). An incident differs from an accident with regard to the causal mechanism. In an accident, the defenses do not work, and loss or damage ensues, whereas in an incident, the defenses work (ICAO 1993; Hollnagel 2004). The IMO and the ICAO both use the same definition for an incident and an accident.

From 2008 to 2014, there were 6974 marine accidents and 1089 marine incidents involving 10,759 vessels, of which 5083 were classified as other than fishing vessels, recreational fishing vessels, angler tender boats, pleasure boats, or PWC. Approximately 10 % of these 5083 vessels, i.e., 508 vessels were involved in marine incidents according to the statistics (JTSB 2012b, 2013b, 2014a, 2015). Therefore, the remaining 4575 vessels were considered to have been involved in organizational accidents. The 84 cases included in this study are regarded as a representative sample of these organizational accidents.

3.1.2 Selection of local workplaces and organizations

In this study, a local workplace is characterized as a vessel that was involved in a marine accident and an organization is characterized as a ship management company. In the case of a collision, two vessels are involved; hence, a collision is considered to involve two local workplaces. Other types of marine accidents involve one vessel, i.e., one local workplace.

When accidents occurred in organizations other than ship management companies, such as pilot associations, equipment manufacturers, and cargo-handling companies, these organizations were also studied in terms of holes and latent conditions. When there was a pilot or berth master on board a vessel, there were two defensive layers of risk management at that local workplace: the pilot or berth master and the master of the vessel. Holes and latent conditions were studied in relation to each pilot or berth master and vessel master.

When the marine accident investigation reports did not contain any local workplace factors or organizational factors, the study could not analyze any holes or latent conditions.

3.2 Definition of a hole

Holes are caused by latent conditions and active failures. No one can foresee all possible accident scenarios. Therefore, some holes in defensive layers caused by latent conditions will be present from the time of system establishment or will develop unnoticed or uncorrected during system operation. Holes caused by active failures are triggered by operators’ unsafe acts and appear immediately. An unsafe act is an error or a violation committed in a hazardous or potentially hazardous situation (Reason 1990). According to ISO/IEC Guide 51, safety does not mean absolute freedom from risk, but rather freedom from unacceptable risk. Unacceptable risk is that which exceeds the limit of the tolerable region defined by as low as reasonably practicable principle (IEC 2009). Safety is achieved by reducing risk to tolerable levels. In this study, the opening of a hole in a defensive layer is defined as an unacceptable risk in an organization or at a local workplace.

When defining a hole in this study, hazardous situations that could result in an accident were considered. A hazardous situation is one in which there is exposure of people, property, or the environment to one or more hazards as defined by ISO/IEC Guide 51.

The following are definitions of unacceptable risk situations at a local workplace: in collisions, a situation in which two vessels approach within the maximum advance of a give-way vessel; in grounding, a situation in which a vessel enters a no-go area; in occupational casualties while entering an enclosed space, a situation in which a crew member enters an enclosed space without checking the atmosphere.

An SMS in the marine domain is established in accordance with the requirements of the ISM Code (IMO 1993), which is based on the quality management systems of the International Standards (ISO 2008a, 2008b). Section 1.4 of the ISM Code outlines the functional requirements for an SMS. In this study, an unacceptable risk situation in an organization is defined as one in which the functional requirements related to accident prevention as prescribed by the ISM Code were not satisfied.

3.3 Analytical methods to locate opening and moving holes

To locate opening and moving holes in defensive layers, I concentrated on SMS and risk management processes that were observed in an organization or at a local workplace at the time of an accident. At a local workplace, prior to system operation, risks associated with the system must be reduced until they fall within the tolerable region by taking protective measures and considering the priority order described in ISO/IEC Guide 51. When risks were not reduced to within the tolerable region, this situation was considered equivalent to holes opening in a defensive layer during one of the processes and then moving through the risk management process until an accident occurred. In an organization, when the functional requirements related to accident prevention as prescribed by the ISM Code were not satisfied, this situation was considered equivalent to holes opening in the SMS defensive layer during one of the processes of the PDCA cycle and then moving through the cycle until an accident occurred.

With regard to the risk management process, terms defined by International Standards 31000 (ISO 2009) and 31010 (IEC 2009) were used. In this study, risk management was considered to be embedded in the procedures for not only collision avoidance but also passage planning and enclosed space entry. In the following section, the relation between risk management and procedures is explained. In addition to these procedures, risk management was directly applied to procedures used at the time of accidents in accordance with the definitions given in International Standards 31000 and 31010.

3.3.1 Procedures for collision avoidance

Procedures for collision avoidance are based on the Convention on the International Regulations for Preventing Collisions at Sea, 1972 (COLREGs). In this study, it was considered that Rule 5 covered risk identification; Rules 7 (a), (b), and (c) covered risk analysis; Rule 7 (d) covered risk evaluation; Rules 8 (a) and (b) covered risk treatment; Rule 8 (d) covered monitoring and review. In the case of restricted visibility, the first paragraph of Rule 19 (d) covered risk analysis and Rules 19 (d) (i) and (ii) and 19 (e) covered risk treatment.

The pertinent sections of COLREGs are as follows: (1) Rule 5 states that every vessel must always maintain a proper lookout to enable a full appraisal of any collision risk. (2) Rules 7 (a), (b), and (c) state that every vessel must use all available means to determine whether any collision risk exists. Radar equipment, including long-range scanning, must be used properly to obtain early warnings of any collision risk and to undertake systematic observation of detected objects. Assumptions must not be made on the basis of insufficient information. (3) Rule 7 (d) states that a collision risk exists if the compass bearing of an approaching vessel does not change appreciably. (4) Rules 8 (a) and (b) state that any collision avoidance action must be taken in accordance with this rule and in ample time with good seamanship. Any alteration of course and/or speed to avoid collision must be large enough to be apparent to the other vessel. (5) Rule 8 (d) states that the collision avoidance action must result in passing at a safe distance. The effectiveness of the action must be carefully monitored until the other vessel is past and clear.

The first paragraph of Rule 19 (d) states that in the case of restricted visibility, a vessel that detects the presence of another vessel by radar alone must determine whether a close-quarters situation is developing and/or any collision risk exists. Rules 19 (d) (i) and (ii) state that when a vessel detects the presence of another vessel by radar alone, it must not alter its course to port if the other vessel is forward of the beam except to overtake the vessel; moreover, it must not alter its course toward a vessel abeam or abaft. Rule 19 (e) also states that every vessel must reduce its speed to the minimum at which it can maintain its course when it receives the fog signal of another vessel forward of its beam or cannot avoid a close-quarters situation with another vessel forward of its beam.

3.3.2 Procedures for passage planning

Passage planning consists of appraisal, planning, execution, and monitoring (Swift 1993; IMO 2000b). In this study, it was considered that the appraisal stage covered risk identification, the planning stage covered risk analysis and risk evaluation, the execution stage covered risk treatment, and the monitoring stage covered monitoring and review.

A summary of passage planning is as follows: (1) During the appraisal stage, the risks involved in the contemplated passage should be examined by gathering all relevant information, such as navigational charts, sailing directions, climatic information, draft of the ship, and personal experience. (2) During the planning stage, a passage plan should be prepared on the basis of the appraisal stage. This plan should cover the entire voyage from berth to berth. When it becomes necessary to approach an area of potential danger, there are several minimum rules that should be followed. The ship should always remain in safe water, sufficiently distant from any danger to minimize the possibility of grounding in the event of a machinery breakdown or navigational error. This part of the planning stage is considered to be risk analysis. Risk evaluation is as follows: (A) No-go areas where the ship cannot travel as a result of the relationship between the ship’s draft and charted depths should be marked on charts. (B) Safe water, the limits of which are bounded by margins of safety around the no-go areas, should be identified. (C) Tracks should be marked in the areas of safe water on the charts. (D) In tidal areas, time periods during which it is safe for the ship to travel with sufficient clearance should be shown. (E) In addition to tracks, abort positions where the ship cannot return to, as well as contingency plans should be shown on charts. (3) During the execution stage, the voyage should be executed in accordance with the passage plan. (4) During the monitoring stage, the progress of the ship should be closely and continuously monitored to discern whether the ship is proceeding in accordance with the passage plan. Any changes to the passage plan should be consistent with these stages and clearly marked and recorded.

3.3.3 Procedures for enclosed space entry

Procedures for enclosed space entry are based on the revised recommendations for entering enclosed spaces aboard ships issued by the IMO (2011). In this study, it was considered that Sections 4.1 and 4.2 covered risk identification and risk analysis, Section 4.3 covered risk evaluation, Sections 4.4 and 4.5 covered risk treatment, and Section 8.1 covered monitoring and review.

A summary of the revised recommendations for entering enclosed spaces on board ships is as follows: (1) Sections 4.1 and 4.2 state that the company should ensure that a preliminary assessment is conducted to identify all enclosed spaces on board the ship, and that the preliminary assessment should determine the potential for the presence of oxygen-deficient, oxygen-enriched, flammable, or toxic atmospheres. (2) Section 4.3 states that the procedures for testing the atmosphere and for entry should be decided on the basis of the preliminary assessment. In this section, risk is divided into three categories: minimal risk to health or life, no immediate risk to health or life, and a risk to health or life. (3) Sections 4.4 and 4.5 state that when the preliminary assessment indicates minimal risk to health or life, the precautions described in Sections 5, 6, 7, and 8 should be followed. Additionally, when the preliminary assessment indicates a risk to life or health, the additional precautions described in Section 9 should also be followed. Section 5 describes authorization of entry, Section 6 describes general precautions, Section 7 describes testing the atmosphere, Section 8 describes precautions during entry, and Section 9 describes additional precautions for entry into a space where the atmosphere is known or suspected to be unsafe. (4) Section 8.1 states that the atmosphere should be tested at regular intervals while the space is occupied and people should be instructed to leave the space if conditions deteriorate.

3.4 Definitions of latent conditions

Reason (1997) states that latent conditions include poor design, insufficient supervision, unworkable procedures, and lack of training. To define latent conditions in this study, in addition to the results of my previous study and causal factors in relation to the marine accidents investigated by the JTSB, the concepts of the SHEL model (Hawkins 1987), the IMO/ILO process for investigating human factors (IMO 2000a), the human factors analysis and classification system (Wiegmann and Shappell 2003), and the sociotechnical system model (Grech et al. 2008), as well as the concepts provided by Reason (1997), Swift (1993), Adams (2006), and Parrott (2011) were modified. In accordance with the IMO/ILO process for investigating human factors, software includes organizational policies, procedures, manuals, checklist layouts, and charts. Hardware includes the design of workstations, displays, and controls. The environment includes the internal and external climate, temperature, visibility, regulatory climate, and other factors that constitute conditions in which people are working. Central liveware includes the capabilities and limitations of the operator. Peripheral liveware includes management, supervision, crew interactions, and communications.

In this study, the following 10 latent conditions are defined: (1) inadequate passage planning; (2) inadequate procedures; (3) inadequate rules or deviations from rules; (4) inadequate human–machine interface; (5) inadequate condition of equipment; (6) adverse environment; (7) inadequate condition of operators, which includes physical limitations, physiological conditions, psychological limitations, and individual workload management, as well as knowledge, skill, experience, education, and training; (8) inadequate communication, which includes communication among the bridge team, between a pilot and the bridge team, or between the bridge and vessel traffic services (Adams 2006; Parrott 2011); (9) inadequate teamwork at a local workplace; and (10) inadequate management by an organization.

Of these conditions, (1), (2), and (3) are liveware–software interactions; (4) and (5) are liveware–hardware interactions; (6) is a liveware–environment interaction; (7) is the central liveware; and (8), (9), and (10) are central liveware–peripheral liveware interactions.

With regard to software, Adams (2006) states that standardized procedures include governmental regulations, checklists, station bills, voyage plans, standing orders of captains, and company rules. When investigating various types of marine accidents in this study, it was found that operators at local workplaces were using different kinds of procedures at the time of accidents. In cases involving a collision, the procedures for collision avoidance were being followed; in cases involving grounding, the procedures for passage planning were being followed; and in cases involving occupational casualties during cargo operations, the procedures for loading or unloading operations were being followed. In addition, Adams (2006) and Parrott (2011) explain causal factors in relation to grounding by using passage planning. Therefore, the standardized procedures were divided into three categories: passage planning, procedures, and rules. Because of this classification, the regulatory climate was categorized into liveware–software interactions. In this study, procedures were defined as the standardized procedures defined by Adams, excluding passage planning and rules (governmental regulations). The definitions of passage planning were based on the concepts provided by Swift (1993) and the IMO (2000b), which consist of the appraisal, planning, execution, and monitoring stages. Rules included COLREGs, International Convention on Standards of Training, Certification and Watchkeeping for Seafarers, International Convention for the Safety of Life at Sea, and local navigation rules. Deviations from the rules were considered in this study because the collision avoidance action prescribed by COLREGs is clear and comprehensive.

With regard to hardware, a distinction was made between an inadequate human–machine interface and inadequate condition of equipment. An inadequate human–machine interface included poor design of work stations, displays, and controls. Inadequate condition of equipment included lack of maintenance of equipment.

The environment included traffic density and geographical features of waters such as narrow channels because entry to these waters is decided by organizations. When berth facilities were unfit for vessels and presented the possibility of an accident, this was included in adverse environment.

With regard to central liveware, the sociotechnical system model states that an individual includes their physical limitations, human physiology, psychological limitations, individual workload management and experience, skill, and knowledge. Education and training were included in this study because skill and knowledge are closely related to education and training (Hawkins 1987).

With regard to peripheral liveware, teamwork referred to the roles and responsibilities of the crew, pilot, and other people involved in an accident (Adams 2006; Parrott 2011). Inadequate management was defined as a situation in which the functional requirements related to accident prevention as prescribed in the ISM Code were not satisfied. In addition, management included the safety culture defined by Reason (1997).

3.5 Order of analysis

First, 84 investigation reports of serious marine accident were reviewed, and locations of holes at local workplaces and in organizations were identified using both definitions of holes and analysis methods to determine the opening and moving of holes. The locations of holes were determined by the processes of the PDCA cycle and risk management embedded in the COLREGs, and the procedures at the time of the accidents. Then, latent conditions that caused the opening of holes and led to the accidents were identified and classified into 10 groups in accordance with the definitions of latent conditions. Finally, the study made an abstract generalization about the situations in which holes were likely to open in relation to different types of marine accidents by combining the characteristics of holes and latent conditions based on the findings.

4 Results

4.1 Number of defensive layers in a local workplace (vessel)

Six vessels or local workplaces had four defensive layers; four vessels were operated by the pilots or berth master who was on board in cases involving collisions or contacts, while the other two vessels were associated with an equipment manufacturer or a cargo-handling company in addition to a ship management company in cases involving occupational casualties. In this category, a contact included that a ship struck a breakwater or a quay.

Two vessels had three defensive layers: one vessel was operated by the pilot in case involving a collision, but a pilot association was not included by the marine accident investigation report, while the other vessel was associated with a ship management company and a cargo-handling company in case involving occupational casualties, but local workplace factors on the part of crew members of the vessel were not included by the marine accident investigation report.

Forty-four vessels had two defensive layers: an SMS and risk management. Fifty-seven vessels had one defensive layer, namely risk management; they did not have an SMS because the marine accident investigation reports did not include organizational factors.

Ten vessels did not have a defensive layer; nine of these were fishing vessels, and local workplace factors were not included owing to the death of the captain after collisions. The other vessel was a passenger vessel, for which organizational factors were not included and there was no active failure on the part of an operator (Table 1).

Table 1 Number of defensive layers in a local workplace (vessel)
Full size table

4.2 Locations of holes in organizations

Sixty-two organizations were analyzed in this study: 28 cases involved collisions, five contact, two grounding, 23 occupational casualties, two fire, one explosion, and one involved sinking. In this category, sinking was not preceded by any other accident.

In eight of these organizations, the SMS defensive layer had two holes. These eight organizations had another defensive layer of risk management at their local workplaces. In the other organizations, the SMS defensive layer had one hole.

The most frequent hole in the SMS defensive layer opened during the “do” process of the PDCA cycle and accounted for 46 % of the total number of holes. The second most frequent hole opened during the “plan” process and accounted for 41 % of the total number of holes. Therefore, holes that opened during the “do” and “plan” processes accounted for 87 % of the total number of holes (Table 2).

Table 2 Locations of holes observed in 62 organizations and at 119 local workplaces involved in 84 serious marine accidents
Full size table

4.3 Locations of holes at local workplaces

The total number of local workplaces analyzed in this research was 119: 70 cases involved collisions, seven contact, eight grounding, 25 occupational casualties, four fire, two explosion, two sinking, and one involved capsizing.

In two cases involving occupational casualties, two involving fire and one involving sinking, the defensive layer of risk management did not have any holes because active failures were not committed by operators. In one of the two cases involving fire, the SMS defensive layer was not studied because the marine accident investigation report did not include organizational factors. These five cases all had the same latent conditions: inadequate condition of equipment.

In one case involving grounding, the defensive layer of risk management had four holes. This case also had an SMS defensive layer in the organization. In one case involving contact and two cases involving grounding, the defensive layer of risk management had two holes. Moreover, the case involving contact also had an SMS defensive layer in the organization. In the two cases involving grounding, organizational factors were not included in the marine accident investigation reports.

In all other cases, the defensive layer of risk management had one hole.

The most frequent hole in the defensive layer of risk management opened during risk analysis and accounted for 50 % of the total number of holes. The second most frequent hole opened during risk identification and accounted for 30 % of the total number of holes. Therefore, the holes that opened during risk analysis and risk identification accounted for 80 % of the total number of holes. In one case involving sinking, a hole opened during risk identification, and in the case involving capsizing, a hole opened during risk analysis. The most frequent hole in the defensive layer of risk management was not necessarily the same for different types of accidents (Table 2).

4.4 Latent conditions

A total of 502 latent conditions were analyzed and categorized into 10 groups. Inadequate condition of operators was the most frequent latent condition that caused holes to open and accounted for 19 % of the total number of latent conditions (Table 3). Psychological limitations were the most frequent subdivision in inadequate condition of operators (Table 4). Adverse environment was the second most frequent latent condition and accounted for 16 % of the total number of latent conditions. Traffic density was the most frequent subdivision in adverse environment (Table 5). The most frequent latent conditions were not necessarily the same for different types of accidents. In some cases, multiple subdivisions of inadequate condition of operators and adverse environment were selected. With regard to fires or explosions, the latent conditions were almost the same, but the accident sites on the vessels differed. Fires occurred in the cargo hold of a car carrier, an accommodation room, and engine rooms, while explosions occurred in enclosed spaces such as a cargo hold.

Table 3 Number of latent conditions observed at 119 local workplaces involved in 84 serious marine accidents
Full size table
Table 4 Subdivisions of inadequate condition of operators
Full size table
Table 5 Subdivisions of adverse environment
Full size table

5 Discussion

5.1 Locations of holes

In organizations, the most frequent hole in the SMS defensive layer opened during the “do” process of the PDCA cycle, indicating that established procedures designed to avoid accidents were not executed at local workplaces (Fig. 1). The second most frequent hole in the SMS defensive layer opened during the “plan” process, implying that procedures designed to avoid accidents were not established in organizations. However, the most frequent hole was not necessarily the same for different types of accidents. In cases involving occupational casualties, the most frequent hole opened during the “plan” process and accounted for 52 % of the total number of holes. In one case involving sinking, a hole opened during the “check” process, indicating that procedures in relation to audits and reporting accidents and non-conformities were not carried out. These findings indicate that holes in the SMS defensive layer tend to arise during the early stages of the PDCA cycle, except for cases involving sinking.

Fig. 1
figure 1

Location of the most frequent hole (red circle) and its movement in the PDCA cycle (ISO 2008a)

Full size image

At local workplaces, the most frequent hole in the defensive layer of risk management opened during risk analysis (Fig. 2). The second most frequent hole in the defensive layer of risk management opened during risk identification. However, the locations of the most frequent holes in the defensive layer of risk management were not necessarily the same for different types of accidents. In cases involving collisions, the most frequent hole opened during risk analysis; in cases involving contact and groundings, it opened during the monitoring and review process; in cases involving occupational casualties, fire, or explosion, it opened during risk identification. These findings indicate that holes in the defensive layer of risk management tend to arise during the early stages of the risk management process in cases involving collisions, occupational casualties, fire, or explosion and that they tend to arise later during the process in cases involving contacts. In cases involving grounding, they arise during all stages in the process, but mostly during the monitoring and review stages.

Fig. 2
figure 2

Location of the most frequent hole (red circle) and its movement in the risk management process (ISO 2009; IEC 2009)

Full size image

5.2 Relationship between latent conditions and the characteristics of holes and abstract generalizations

With regard to latent conditions, inadequate condition of operators was the most frequent latent condition that caused holes to open. However, the most frequent latent conditions were not necessarily the same for different types of accidents. Here, frequent latent conditions are defined as those that account for 80 % of the total number of latent conditions for a particular type of accident. The relationship between latent conditions and the characteristics of holes and an abstract generalization about the situation in which holes tend to arise in relation to different types of marine accidents are presented in the following sections.

Abstract generalizations drawn from the results of this study are compatible with the common patterns of causality for both collisions and grounding examined by Macrae (2009). Macrae concludes after analyzing 30 marine accidents investigation reports published by the Australian Transport Safety Bureau that collisions often involved a fishing vessel and a cargo vessel and resulted from both a problem identifying the existence or speed of the other vessel, while grounding resulted from an inadequate passage plan, coupled with either a problem locating the vessel or communication problems on the bridge.

5.2.1 Cases involving collisions

The most frequent hole opened during risk analysis and accounted for 72 % of the total number of holes. This result indicated that when following the procedures to avoid a collision, most vessels did not use all of the available means to determine whether any collision risk existed; radar equipment was not used properly, and assumptions were made on the basis of insufficient information. In organizations, the most frequent holes opened during the “plan” and “do” processes in the PDCA cycle, and these accounted for 86 % of the total number of holes. Inadequate rules or deviations from rules, inadequate condition of operators, adverse environment, inadequate communication, and inadequate management were the most frequent latent conditions and accounted for 80 % of the total number of latent conditions. Psychological limitations accounted for 88 % of the total number of subdivisions in inadequate condition of operators. Traffic density and geographical features such as a narrow channel accounted for 86 % of the total number of subdivisions in adverse environment. With regard to collisions, my previous study shows that assumptions accounted for 82 % of psychological limitations (Fukuoka 2015b).

These findings indicate that holes tend to open when operators mostly make assumptions during risk analysis regarding the risk of collisions while vessels are navigating in congested waters or waters that have geographical features such as narrow channels, and that operators lack communication with the bridge team or other people on safety issues. Procedures regarding the safe operation of ships in these types of waters are either not established by organizations or, where established, are not followed by operators.

5.2.2 Cases involving contact

The most frequent hole opened during monitoring and review, and these accounted for 67 % of the total number of holes. This result suggested that during the monitoring stage of passage planning, a ship’s progress was not closely and continuously monitored. In organizations, the most frequent hole opened during the “do” process. Inadequate passage planning, adverse environment, inadequate condition of operators, and inadequate management were the most frequent latent conditions and accounted for 79 % of the total number of latent conditions. Psychological limitations accounted for 63 % of the total number of subdivisions in inadequate condition of operators. Traffic density and geographical features such as a narrow channel accounted for 50 % of the total number of subdivisions in adverse environment.

These findings indicate that holes tend to open when operators’ psychological limitations become evident during monitoring and review of a ship’s progress while vessels are navigating in congested waters or waters with geographical features such as narrow channels. Procedures on the safe operation of ships in these waters that are established by organizations are not followed by operators.

5.2.3 Cases involving grounding

The most frequent hole opened during monitoring and review, and the second most frequent hole opened during risk analysis. These holes accounted for 64 % of the total number of holes. This result indicated that the ship’s progress was not closely and continuously monitored. Moreover, during the passage planning stage, the master did not observe the minimum rules that a ship should always remain in safe water, sufficiently distant from any danger to minimize the possibility of grounding in the event of a machinery breakdown or navigational error. In organizations, the most frequent hole opened during the “do” process. Adverse environment, inadequate passage planning, inadequate condition of operators, and inadequate communication were the most frequent latent conditions and accounted for 73 % of the total number of latent conditions. Psychological limitations accounted for 60 % of the total number of subdivisions in inadequate condition of operators. Geographical features such as a narrow channel accounted for 80 % of the total number of subdivisions in adverse environment.

These findings indicate that holes tend to arise when operators are subject to psychological limitations during monitoring and review of a ship’s progress while vessels are navigating in waters with geographical features such as narrow channels and that operators do not engage sufficient communication with the bridge team or other people on safety issues. During the passage planning stage, the master does not observe the minimum rules for the safe operation of the ship. Procedures established by the organizations regarding the safe operation of ships are not followed by operators in these waters.

5.2.4 Cases involving occupational casualties

The most frequent hole opened during risk identification and accounted for 72 % of the total number of holes. This result suggested that during work such as loading and unloading cargo or entering cargo tanks, most operators did not identify hazards at local workplaces. In organizations, the most frequent holes opened during the “plan” and “do” processes, and these accounted for 93 % of the total number of holes. Inadequate procedures, inadequate management, adverse environment, inadequate condition of operators, and inadequate teamwork were the most frequent latent conditions and accounted for 80 % of the total number of latent conditions. Knowledge, skill, experience, education, and training accounted for 65 % of the total number of subdivisions in inadequate condition of operators. Conditions in which people were working, such as the atmosphere in cargo tanks, accounted for 47 % of the total number of subdivisions in adverse environment.

These findings indicate that holes tend to arise when operators work in variable conditions, for instance, in cargo tanks where the atmosphere can deteriorate, and procedures relating to entering the cargo tanks are either not established by the organizations or, where established, are not used by the operators. There is inadequate teamwork and the operators are unable to identify hazards at local workplaces mainly because of lack of appropriate knowledge, skill, experience, education, and training.

5.2.5 Cases involving fire or explosions

The most frequent hole opened during risk identification and accounted for 75 % of the total number of holes. This result indicated that while working, most operators did not identify hazards at local workplaces. In organizations, the most frequent holes opened during the “plan” and “do” processes. Inadequate procedures, inadequate condition of operators, inadequate condition of equipment, adverse environment, and inadequate management were the most frequent latent conditions and accounted for 86 % of the total number of latent conditions. Psychological limitations and knowledge, skill, experience, education, and training were the most frequent subdivisions in inadequate condition of operators. With regard to explosions, the conditions in which people were working, such as the atmosphere in cargo tanks, were the most frequent subdivisions; with regard to fires, the conditions in the cargo hold of a car carrier, an accommodation room, and engine rooms were the most frequent subdivisions in adverse environment.

These findings indicate that holes tend to arise when operators work in an adverse environment while subject to psychological limitations or they lack appropriate knowledge, skill, experience, education, and training. Procedures related to working in an adverse environment are either not established by organizations or, where established, are not followed by the operators. Fires occurred in the cargo hold of a car carrier, an accommodation room, and engine rooms, while explosions occurred in enclosed spaces such as a cargo hold. In these cases, proper maintenance of equipment related to the accident was not carried out. Operators were unable to identify hazards at local workplaces mainly because of psychological limitations or lack of appropriate knowledge, skill, experience, education, and training.

5.2.6 Cases involving sinking or capsizing

In one case involving sinking, a hole opened during risk identification. In an organization, a hole opened during the “check” process. In one case involving capsizing, a hole opened during risk analysis. Inadequate procedures, inadequate condition of equipment, adverse environment, and inadequate condition of operators were the most frequent latent conditions and accounted for 73 % of the total number of latent conditions. Sea and weather conditions were the most frequent subdivisions in adverse environment. Psychological limitations and lack of relevant knowledge, skill, experience, education, and training were the most frequent subdivisions in inadequate condition of operators.

These findings indicate that holes tend to arise when operators are subject to psychological limitations or lack the relevant knowledge, skill, experience, education, and training on how to maintain the ship’s stability while navigating under adverse sea and weather conditions. In these cases, proper maintenance of equipment related to the accident was not carried out. In cases involving sinking, the operators could not identify hazards at local workplaces mainly because of psychological limitations or lack of appropriate knowledge, skill, experience, education, and training. Auditing of the procedures followed by organizations and the reporting of accidents and non-conformities to the organizations by operators were not carried out properly.

5.3 Application of the Swiss cheese model to the marine domain

It was found that four explanations of the Swiss cheese model are applicable to the marine domain. First, the findings support the existence of in-depth defenses between danger and accidents. In this study, 44 local workplaces or vessels had two defensive layers at the time of the accident. When a pilot or berth master was on board, a local workplace had four defensive layers. Fifty-seven local workplaces or vessels had only one defensive layer, that of risk management, because organizational factors were not included in the marine accident investigation reports. If organizational factors are investigated and included in marine accident investigation reports, it is considered that a local workplace or vessel has at least two defensive layers, the SMS and risk management, at the time of the accident.

Second, the findings support the dynamic movement of the holes. Table 2 indicates that the locations of holes that opened differed. However, trends were evident in the locations of holes. In organizations, except for one case involving sinking, the holes tended to open early in the SMS process. In local workplaces, except for cases involving contact and grounding, they tended to open early in the risk management process. In cases involving contact, they tended to open later in the process, while in cases involving grounding, they arose at all stages of the process.

Third, the findings mentioned above support Reason’s statement that no one can foresee all possible accident scenarios and that some holes in defensive layers will be present right from the time of system establishment or will develop in an unnoticed or uncorrected manner during system operation.

Finally, the findings support the latent condition pathways. Reason (1997) states that unsafe acts are not a necessary condition for organizational accidents and that on some occasions, the defenses fail simply as a result of latent conditions, as in the Challenger Space Shuttle and King’s Cross Underground fire disasters. He refers to these situations as latent condition pathways. In two cases involving occupational casualties, two cases involving fire, and one case involving sinking, the defensive layer of risk management did not have any holes because there were no active failures on the part of operators. In this study, latent condition pathways were seen to occur owing to the inadequate condition of equipment.

5.4 Shortcomings of the application of the Swiss cheese model

It was found that three explanations of the Swiss cheese model are not applicable. First, there is, on some occasions, more than one hole in a defensive layer of the Swiss cheese model in the real world. In this study, the manner in which holes in defensive layers lined up to enable an accident to occur could not be clarified. The opening of a hole is defined as an unacceptable risk that exists in an organization or a local workplace. Furthermore, a hole must lead to an accident. In eight organizations, the SMS defensive layer had two holes. At four local workplaces, the defensive layer of risk management had two or more holes.

Second, the findings suggest that the accident trajectory is not necessarily straight. According to the Swiss cheese model, the accident trajectory passes through all the aligned holes. However, if one defensive layer has two holes, the accident trajectory cannot pass through both holes. The study indicates that an accident occurs when the accident trajectory passes through all the defensive layers. Therefore, if an SMS and risk management are defensive layers in the Swiss cheese model, this suggests that an accident trajectory that passes through all holes is not straight (Fig. 3).

Fig. 3
figure 3

Model showing the integration of the SMS and risk management defensive layer

Full size image

Finally, all the holes in a defensive layer need to be closed to prevent an accident from occurring. According to the Swiss cheese model, when the holes in defensive layers are lined up, the accident trajectory passes through all the holes, and the accident occurs. In other words, only one hole in each defensive layer is related to the accident, and the accident can be prevented when one hole in each defensive layer is closed. However, the findings indicate that all holes in a defensive layer need to be closed to prevent an accident because the accident trajectory is not straight.

5.5 Limitations of the study

There are three limitations of this study. First, some of the marine accident investigation reports did not include organizational factors, and even when they were included, they focused on compliance with the established procedures and the SMS. Therefore, the findings of this study, especially in relation to organizational factors, were not comprehensive, and the importance of inadequate management might have been underestimated. The aspect might have an effect on both the locations of holes and the number of defensive layers of an SMS. If these organizational factors were investigated thoroughly, it might be possible to explore the effect of inadequate management in more detail.

Second, few cases involving fire, explosion, sinking, or capsizing were analyzed in this study, and the sample size in relation to these cases was small. This might have had an effect on the results in relation to the locations of holes in the SMS and risk management defensive layer and on the frequency of all latent conditions in these types of accidents. If the number of marine accident investigation reports containing causal factors including mechanical, human, and organizational factors for these types of accidents was increased, then the accuracy of analysis and abstract generalization regarding the situations in which holes tend to arise would improve.

Finally, the study assumes that the SMS and risk management defensive layers provide in-depth defenses and do not address hard defenses. Defensive functions are achieved through a mixture of hard and soft defenses, where hard defenses include technical devices (Reason 1997). Hard defenses such as the electronic chart display and information system (ECDIS) are produced and supplied by manufacturers. The quality management system originates from and is applied by these manufacturers (ISO 2008b; Iizuka 2009); thus, the locations of holes can be identified because manufacturers are required to use the PDCA cycle. However, marine safety investigation authorities are limited in terms of their ability to thoroughly investigate the quality of technical devices and the functioning of each process in the PDCA cycle implemented by the manufacturers mainly because the manufactures are often located in different countries. This might have an effect on the number of the SMS defensive layers, the locations of holes in the SMS defensive layer, and latent conditions related to the manufacturers. In the aviation field, airplane manufacturers can participate in investigations in accordance with Annex 13 to the Convention on International Civil Aviation. Although the elements and structures of maritime industries are different from those in aviation, if the IMO applied the same regulations, it would be possible to address this issue.

5.6 Reliability of the study

I did not carry out an assessment of the reliability of the methods used by employing multiple assessors to obtain a reliability index. Therefore, I am unable to confirm whether the results showed an acceptable level of reliability among assessors. With regard to identifying the locations of holes, risk perception by operators is rather subjective (Manuel 2011). Therefore, ambiguity is possible, and reliability becomes arguable. To avoid this situation, some of the procedures that the operators used were compared with and tied to each of the risk management process outlined in Section 3.3. It was found that operators used a variety of procedures in cases involving occupational casualties. To eliminate ambiguity, every procedure related to prevent accidents has to be tied to the risk management process. When marine accident investigation reports refer to these procedures, it helps to increase the reliability of the location of holes.

6 Conclusions

To enhance safety, full compliance with the SMS and procedures such as the COLREGs, passage planning, enclosed space entry, and other work procedures has been stressed whenever accidents occurred. Furthermore, the results of accident investigations conducted by marine safety investigation authorities have been mainly provided to organizations such as ship management companies, ship owners, and maritime associations to address safety issues (IMO 2008); therefore, their effectiveness in reducing the number of accidents in this high-risk industry has been limited. The findings of this study indicate that the statistics acquired from marine accident investigation reports in combination with established methods for closing holes can be utilized to systematically reduce the number of accidents in the future. Furthermore, people can be made aware of the locations of holes and the reasons for the opening of holes that lead to accidents, enabling them to effectively and efficiently direct more efforts toward reducing the number of accidents. Although this study addresses marine accidents, if marine incidents are analyzed using the same methods, people will be able to obtain clear understanding of the difference between an accident and an incident.

Organizations are obliged to investigate and analyze accidents by Section 9 of the ISM Code. To find the locations of holes, they should concentrate on each stage of the SMS and risk management defensive layers by applying the process approach outlined in this study. Therefore, it is important for organizations and marine safety investigation authorities to observe accidents from the viewpoint of a process approach in addition to the guidelines of the IMO/ILO process for investigating human factors.