Keywords

1 Introduction

The maritime world entered the world of electronics more than a century ago with Marconi and the radio telegraph. With the sinking of Titanic the radio became an important safety device and soon it became evident that it could also be used in navigation (Radio Direction Finding). From there on RADAR, autopilot, DECCA, GPS, ECDIS, and AIS has become familiar maritime acronyms on the road to safer shipping. Presently the International Maritime Organization (IMO) is working on what has been termed an “e-Navigation” concept defined as “the harmonized collection, integration, exchange, presentation and analysis of maritime information onboard and ashore by electronic means to enhance berth to berth navigation and related services, for safety and security at sea and protection of the marine environment” [1]. The development of advanced computerized navigation has for many years keep a discussion about the “navigating navigator” versus the “monitoring navigator” alive, up to a point where IMO’s Sub-Committee on Radio Communications and Search and Rescue (COMSAR) in 2011decided that the navigator should be kept in the loop as a “navigating navigator” [2].

Deskilling is, as in many other walks of professional life, a companion to modern development. Few mariners would today be able to handle astronomical navigation should the automated satellite systems go down. The accident with Air France 447 that crashed in the Atlantic Ocean in 2009 because the automatic flight management system failed and handed the aircraft over to an unexperienced pilot that could not fly - to put it bluntly [3].

How can we ensure that modern technology is used for safety improvement while still keeping the navigator in the loop, practicing skills that allow him or her to step in and perform professionally in times when automation fails? Hollnagel [4] called “the intrinsic ability of a system to adjust its functioning prior to, during, or following changes and disturbances, so that it can sustain required operations under both expected and unexpected conditions,” for Resilience Engineering.

This paper presents the development of “route exchange”, a decision-support function for ship navigation, within two EU projects. However, let us first give an example of the problem.

1.1 The Trans Agila Accident

In the dark hours of the morning the 29 November 2012 the Antigua registered container vessel Trans Agila grounded in the Strait of Kalmar on the Swedish east coast. The second mate was alone on the bridge at the time of grounding as the lookout had gone down to prepare for embarking the pilot, who was shortly due. As he negotiated the final turn before the stretch down to where the pilot boat waited he passed on the wrong side of Bredgrund lateral red light-buoy, failing to enter into the white sector of Masknaggen sector light, instead approaching in the green sector and passing it on the ship’s port instead of starboard side, subsequently grounding. The grounding resulted in a flooded engine room and a total loss of the hull, however no personal injuries.

The accident investigation reported that the track of the voyage plan that had been entered into the Electronic Chart Display and Information System (ECDIS) was wrong, leading right over Bredgrund buoy and on the wrong side of Masknaggen light, bringing the ship with a draught of 4.8 m over several shallow areas (see Fig. 1). On a paper chart carried onboard the crucial waypoint had been correctly marked, but in the electronic chart system the way-point had been misplaced. Voyage plans are mandatory parts of the preparations for a voyage by regulations from the IMO. The second officer, who was the watch officer this nigh, was also the one responsible for the voyage planning onboard.

Fig. 1.
figure 1

Top. Trans Agila with flooded engine room is re-floated and moved to safety. Bottom: Planned track, actual route as well as the correct waypoint (WP) from the paper chart.

Full size image

The accident report [5] suggest considering moving the mandatory pilot pick-up point further out to make sure ships get assistance also for the section of the fairway where the accident occurred. But the accident report leaves several questions unanswered: How could an obviously faulty voyage plan remain unnoticed? And during the actual voyage, why did the watch officer not notice that the ship was sailing on the wrong side of both the buoy and the sector light into waters that was obviously too shallow for the ship?

This was a minor accident, leading to economic loss, but no loss of lives. But we could continue to list accidents with fare worse outcomes. The Exxon Valdes and the Sleipner ferry accident, both belong to this category of accidents. I have chosen this accident because it is recent; it occurred in waters well-known to Scandinavian mariners and happened under normal, almost perfect conditions: darkness, but good visibility in well-lit fairways and calm weather. It is an illustration of an accident that, when we ask for the reason, we get the unsatisfying answer: human error.

1.2 Human Error

In 1997, IMO adopted a resolution setting out the organizations vision, principles and goals for what it called the human element. “The human element is a complex multi-dimensional issue that affects maritime safety, security and marine environmental protection involving the entire spectrum of human activities performed by ships’ crews, shore based management, regulatory bodies and others” [6].

Working with the human element often means working with imprecise and varying behaviour, with mistakes, slips and lapses. In short: working with human error. But it also means working with human ingenuity, with creativity and miraculous recovery, in short; with human error resilience. And one has to remember that while human error is always recorded in accident statistics, human recovery is seldom mentioned, let alone accounted for in statistics.

Most accidents are the result of a chain of minor mishaps. James Reason [7] introduced the “Swiss cheese model” and the notion of safety barriers that would prevent a potential unsafe act to promulgate into an accident. Examples of such barriers in the accidents mentioned above would be the pilot which brings experience and second pair of eye on to the bridge, or the mandatory look-out during dark hours – both of these barriers was missing in the aforementioned accident.

But even if the accident can be seen as a chain of events where safety barriers have been breached, there is most often an unsafe act somewhere that triggers it all. It could be a technical breakdown, but as technology becomes more and more robust, it is ever so often a human operator in what is called “the sharp end” of the accident pyramid; and many studies indicates figures from 60–90 % of major accidents and incidents in complex systems such as process industries, medicine or transportation systems such as aviation and shipping have human error as a primary cause [8–11].

A variety of taxonomies for human error has been proposed. One example is the simple dichotomy between errors of omission and errors of commission [12]. Errors of omission mean: not doing anything when something should have been done. Error of commission, on the other hand, means: doing the wrong thing, as in the example of Trans Agila when the watch officer actively steered the ship on the wrong side of the lighthouse.

A more elaborated taxonomy developed by Norman [13] and Reason [7] involves mistakes, slips and lapses. Mistakes are when the operator has not fully understood the situation and acts intentionally. Maybe the second mate of Trans Agila had not understood the fact that he was heading into danger, in such a case the mistake was due to lack of situation awareness.

Slips, on the other hand, are when the intention is right but the action is carried out wrong. Maybe the wrong button is pressed although the intention was to press the right one. Because humans monitor their own actions, slips are often noticed and corrected before any harm has been done.

Lapses, finally, are a failure of making any action at all, i.e. an error of omission. Often they are lapses of memory, forgetfulness. Humans forget, we become distracted or think about other things. This is all part of the human condition; the abovementioned accident could have a laps. Lapses are sometimes easy to prevent by technical solutions.

1.3 Technical Solutions

A common solution for lapses is technical solutions, e.g. checklists: whenever we start a procedure that involves many steps, and where forgetting to execute a step might be hazardous, a checklist can be used. A common example is the checklists pilot’s use when doing the pre-flight checks of the airplane’s systems.

Technical checks can also be built into systems to prevent faults to be made. In the case of the Trans Agila above a waypoint had been placed on the wrong side of a lighthouse resulting in a track that went over areas too shallow for the ship. Most ECDIS has technical provisions to make sure the planned track is validated against a set depth value. And without such validation the ECDIS should not be able to feed the ship’s autopilot with the course from the chart system. If such a system was properly used and the draught of the ship was correctly fed into the system, the validation procedure should have warned about the lack of under keel clearance. The accident report does not give any answer to whether a validation had been done before the ship left port, or not. Most ECDIS also allows the operator to set a cross-track-error, a distance the ship is allowed to deviate from its planned track before an alarm is triggered. Many times there are also some kinds of “safety sector” function, a sector that is stretched out in front of the ship and which sets off an alarm if the water in front of the ship becomes too shallow. Unfortunately both of these functions is often deactivated by bridge officers during transits in confined waters because the alarm go off constantly because of narrow passages and close turns.

Technical solutions like this can, and are, constantly developed by equipment manufacturers. The problem is only that they are context insensitive and “stupid” giving frequent false alarms and therefore often disconnected by the mariners. If they even know they exist, because elegant technical solutions often tend to make systems even more complex (known as the problem of complexity creep), and one big problem in shipping is the lack of standards in ECDIS and other complex systems. An officer trained in one system might get very little for free when encountering another system at another ship.

So how can we deal with this situation? One way is to make use of human adaptivity and resilience. By sharing intentions with other actors, the chance is that a shared effort discover anomalies missed on the own ship. One such feature is the proposed route exchange.

1.4 Route Exchange

As mentioned before, every ship is by regulations forced to do a berth-to-berth voyage plan before leaving port. This intended route resides in the navigation system of each ship. By enabling vessels to send and receive each other’s routes, and display them on their own ECDIS, other eyes in the maritime domain might detect anomalies. The pilot boat waiting further down the fairway for Trans Agila in the example above might have noted the faulty intentions and warned the watch officer. Such show of intentions could be made by transmitting a few waypoints ahead of each ships present position using the ships transponder system. And the track could, on request, be made visible on the ECDIS of ships within range.

A more elaborate system could involve sending the entire voyage plan from berth to berth to a coordination centre where a second validation for under keel clearance could be made. With careful consideration of the planned time schedule, dynamic separation like in air traffic control could be achieved, making sure no two ships are at the same place at the same time.

The same system of transmitting routes might further make it possible for shore-based services to send routes to vessels. Pilots and VTS operators could then assist ships by sending out route suggestions when they notice that bad route choices have been made. In this way it might be possible to create greater system resilience by integrating ship and shore teams through information sharing.

2 Method

In three recent and on-going EU projects, EfficienSea (2009–2013) [14], MOANLISA 1 + 2 (2011–2015) [15] and ACCSEAS (2012–2015) [16], the route exchange idea has been investigated. The E-navigation Prototype Display (EPD), an ECDIS-like chart experiment platform, has been developed by the Danish Maritime Authority. This prototype display have the ability to show other ships route intentions and to send entire voyage plans to a shore-based Ship Traffic Coordination Centre for checks and optimization.

2.1 Intended Route

Tactical route exchange (route intentions and route suggestions) was developed in the EfficienSea and ACCSEAS projects. In the prototype system a configurable number of waypoints ahead of the ships present position were transmitted. The intended route could then be received and displayed on other ships with the same prototype software (see Fig. 2).

Fig. 2.
figure 2

A screen dump from the prototype software. By right clicking on the target ship Targale and choosing “Show intended route” in a context menu the green dotted line becomes visible (Color figure online).

Full size image

2.2 Route Suggestion

The EPD exists as a ship-side and a shore-side platform. From the shore-side platform route segments can be created and send to addressed vessels (see Fig. 3).

Fig. 3.
figure 3

A route segment (yellow backdrop) has been sent from shore to the own vessel (black circle top center). It appears together with a text message from the VTS and gives the watch officer an option to reject or accept the suggestion, or start a text message conversation with the VTS (Color figure online).

Full size image

A route suggestion could for instance have been sent out from the pilot boat to Trans Agila if the pilot had spotted the intention to pass on the wrong side of the beacon. Every year there are dozens of occasions where the Sound VTS have to call up ships on a faulty course in the Sound between Sweden and Denmark asking them to check their navigation (personal communication with VTS operators).

2.3 Route Coordination

In the MONALISA project the idea of strategic route exchange has been investigated. In this project ships approaching a coordination area sends their voyage plans to a Shore Traffic Coordination Centre (STCC). The centre checks the routes for under keel clearance, violations of NoGo areas and for separation to other ships. The route is then either “recommended” or “not recommended.” If the route is recommended the captain on the ship has the final word on whether to accept or reject the route. If he accepts the route it becomes a “green” agreed route (see Fig. 4).

Fig. 4.
figure 4

The ship has sent the route to the STCC and got it back as a “recommended” route. Accepting the route then makes is an agreed, “green” route, signifying that this route will be used for coordination with other ships’ routes (Color figure online).

Full size image

If the STCC finds some problems in the route sent in by a vessel, they may “not recommend” the route and send a suggested change, which then in turn can be accepted or taken as a starting point for a new round of negotiations with the STCC.

2.4 User Tests

The EPD with the abovementioned functionality has been tested with cadets and experienced navigators in the full mission bridge simulator it Chalmers University of Technology in Gothenburg, Sweden in May and September 2013, as well as with cadets and experienced Korean navigators in a live ship test with two training vessels from Mokpo National Maritime University and Korean Maritime University in Busan in Korea in April 2014. In the Swedish simulator tests participated 12 experienced officers, 11 maritime academy 4th year cadets, and 5 VTS operators. This gave a sample of subject matter experts: 25 male, 3 female; ages 27–66, mean age 42; professional experience from none (cadets) to 40 years, the mean being 15.7 years of professional experience (cadets excluded). In the Korean test participated 9 experienced navigators (mean experience as navigators 11.3 yrs.) and 10 4th year cadets (12 male and 6 female). The collected mean age was 28 years. In both the Swedish and Korean tests the participants where a sample of convenience selected by volunteering cadets and navigators available at the time of the experiment.

On all occasions the users were asked to make a voyage plan, send the voyage plan to the STCC for validation and then accept the returned route. They were also asked to make changes to an already accepted route, and also to accept changes initiated from the shore centre.

The studies were explorative and qualitative. Users were asked to think aloud and afterwards interviewed on four levels: conceptual, procedural, functional and details of the user interface. The users were also asked to grade the concept on an acceptance scale.

3 Results and Discussion

In early stages of testing design concepts for new navigational services the question of professional acceptance becomes very crucial. If the professional users does not accept, or see any benefits with the suggested concept, the designers need to make a new approach. Therefore the tests so far have used qualitative methods. Also the prototype software has been in constant development why close comparison between results should not be made.

3.1 Conceptual Level

The hypothesis was that ship-board participants should be negative to the route exchange concept (based on earlier experiences of ship masters being negative because of surrendered sovereignty) but instead all participants were in general positive to the concept of voyage plan coordination; younger somewhat more than older (this was true also for the Korean participants). But even if older participants were more concerned with issues like deskilling they still accepted the system. A pensioned Swedish captain with 40 years of experience said: “I don’t like this, but I see it coming, and I guess it is all right.”

For the Korean study we expected to find cultural differences but found instead a similar high degree of acceptance.

The most discussed issue in the Swedish tests was about control; if voyage plan coordination would lead to control being shifted from the ship to the shore. Most bridge officers pointed out that it was important that the captain still had the last word, being on the scene and experiencing the situation first hand. Several participants saw a likelihood of conflicts between the STCC and vessel on the issue of control, and between the STCC and ship owners on the issue of costs [17].

From a VTS perspective, the ability to check routes and see vessels’ intentions was welcomed but concerns were raised about the workload when dealing with several vessels in a heavy traffic or emergency situation. On the question of whether a route exchange system has a future, comments ranged from that it is inevitable, to that it may have a positive effect on the quality of navigation if captains can learn to trust it, to that it will never be accepted by captains and ship owners. The Korean participants were more positive that the Swedish.

3.2 Procedural Level

Participants in both vessel and STCC felt that new routines were involved in operating the system, but within a familiar environment so that once they understood what was expected of them and how to do it, it was easy to get accustomed.

With regard to work load, some of the Swedish participants felt that an extra person may be needed on the bridge in heavy traffic situations to leave the watch officer free to navigate and avoid collision. It was also felt by some that, depending on the degree of freedom allowed to deviate from the planned course, implementation of such a system would result in extra workload for the captain, who would be required to approve all changes made. The Koreans participating in the sea trial also made this comment on that the need for keeping close look-out was compromised by the need for working the computer system.

3.3 Survey

In a survey that was sent to the Swedish participants several weeks after they participated in the study the question “What is your opinion about the tested route exchange concept?” was asked. 18 answers where received out of 28 and from them 14 were “positive” or “very positive” and 4 “did not know”. No one was negative. On the question “Do you think a similar route exchange concept will become reality in the future?” 17 answered “probably” or “most probably” and only 1 answered “probably not”.

The same survey was put to the Korean participants after the sea trials. It gave that result that all 19 of the participants gave a “positive” or “very positive” answer to the question: “What is your opinion about the tested route exchange concept?” On the question “Do you think a similar route exchange concept will become reality in the future?” 18 answered “probably or most probably” and 1 answered “I do not know”.

3.4 Validity

The validity of these tests is of course limited due to the low number of participants. However, the professional background and, particularly in the Swedish case, the long experience, gives some credit to the results. It is also interesting to see the similarity in opinions of both Swedish and Korean mariners.

4 Conclusions

The example in the beginning illustrated a “monitoring navigator” slavishly following the programmed track, bypassing the technical barriers that the system engineers had added to avoid accidents. The idea by the proposed new inventions presented in this paper is that by widening the system definition to include not only the human-computer interaction on the individual bridge, but also fellow mariners and shore services in the area, resilience will increase. By sharing intentions, the chance that someone will detect anomalies and warn will increase; technical barriers turned off onboard might still be working elsewhere, thus avoiding so called “single person failures”.

The result of this process has been the concept of tactical and strategic route exchange. The concept was prototyped and tested both in simulators and at sea trials with good results, showing professional acceptance to the concept.

Continued work within several is ongoing projects to further refine and test the concept and to work with the regulating authorities to make the concept come true.