INTRODUCTION
On 6th March 1987, at 19:05 local time, Townsend-Thoresen’s prize cross-channel RORO ferry, the Herald of Free Enterprise, departed from Zeebrugge, Belgium, en route to Dover. Within minutes, the ship had capsized. Owing to a cut-price ticket deal, the ship was operating at almost full capacity, with 539 people on board in total. 193 people died in the disaster. The cause was found to be that the bow door had not been closed by the assistant bosun, causing the main vehicle deck to rapidly flood, but later, a coroner’s inquest jury famously found that ‘from top to bottom, the body corporate was infected with the disease of sloppiness’ (Department of Transport, 1987). It is clear that there is far more contributing to this disaster than simple negligence. This essay aims to explain the myriad factors that allowed this to happen, using widely-held theories of safety management, and to evaluate the lessons learned and industry actions in response to it. To best understand this, we must first take a close look at the events leading up to the disaster;
HISTORY OF THE HERALD
The Herald of Free Enterprise, Hereafter referred to as the Herald, was launched on 12 Dec 1979, and was delivered to Townsend Car Ferries Ltd in 1980. Townsend Car Ferries was a subsidiary company of European Ferries Ltd (EFL), and had commissioned 3 new, fast, and modern ‘spirit class’ vessels to compete in the channel crossing routes. The competition was high in the early ‘80s due to hoverspeed’s introduction of the channel hovercraft ferry in 1981, and the anticipation of a channel tunnel being constructed. The spirit class vessels were unique in that they could unload from 2 decks at once (G-deck and E-deck) upon arriving at their specially-constructed RORO berths, effectively halving turnaround time. They were also very fast for their time, the Herald having set the record for a crossing at 54 minutes and 53 seconds (Yardley, 2014, p. 12). In 1985, P&O sold all their cross-channel assets to EFL, and in 1986, assumed de facto management of the fleet. The new, less experienced management then changed the Herald’s operating route from Dover-Calais to Dover-Zeebrugge (Yardley, 2014, pp. 13-14).
The Herald’s berths at Dover and Calais were both fitted with double-deck ramps, allowing two decks to be loaded or discharged at once. Zeebrugge, however, only had one ramp, which could not reach both decks. To compensate for this, the vessel took on ballast about two hours before arrival at Zeebrugge to trim it by the head, loaded E-deck upon arrival, and then discharged that ballast to bring G-deck level to the ramp. This dramatically increased turnaround time (Department of Transport, 1987, p. 5), and the investigation found that staff was pressured to rush their duties as a result of this. An internal memorandum sent by the operations manager at Zeebrugge is cited by the investigation:
“There seems to be a general tendency of satisfaction if the ship has sailed two or three minutes early. Where a full load is present, then every effort has to be made to sail the ship 15 minutes earlier . . . . . I expect to read from now onwards, especially where FE8 is concerned, that the ship left 15 minutes early . . . . . put pressure on the first officer if you don’t think he is moving fast enough. Have your load ready when the vessel is in and marshal your staff and machines to work efficiently. Let’s put the record straight, sailing late out of Zeebrugge isn’t on. It’s 15 minutes early for us.” (Department of Transport, 1987, p. 11)
THE INCIDENT
The assistant bosun, Mark Stanley, had opened the bow doors of the Herald during departure, and, during the turnaround, had directed the deck crew in cleaning and maintenance of the ship until he was relieved by the bosun, Terence Ayling, at 1850hrs. Stanley returned to his cabin, intending to rest for a few minutes before the call to harbor stations. During this time, he fell asleep and was not woken up by the tannoy announcement for harbor stations.
The Chief Officer, Leslie Sabel, arrived on G-deck around 15 minutes before departure to relieve the Second Officer, Paul Morter, of his duties as loading officer. Sabel’s duty as loading officer, according to company instructions, was to make sure the bow doors were “secure when leaving port” (Department of Transport, 1987, p. 8). Before leaving G-deck to go to his harbor station, the bridge, he reported that he saw a man about 20 feet away, moving towards the bow door controls, and assumed this was Stanley. The investigation found that this was likely not the case and that Sabel failed in his duty to make sure the doors were closed, attributing the falsehood to his fragile mental and physical state at the hearing.
Ayling believes himself to have been the last crewmember to leave G-deck. His duty, after loading, was to put a chain across the deck between the vehicles and the bow doors, giving the all-clear for the doors to be closed. Ayling left G-deck, assuming that Stanley would arrive later. When asked at the investigation why he had not taken it upon himself to close the doors, he replied; “It has never been part of my duties to close the doors or make sure anybody is there to close the doors.” And “At that stage it was harbor stations so everybody was going to their stations.” (Department of Transport, 1987, p. 8).
At this point the ship began to leave the berth with the doors open. Zeebrugge was different from Dover and Calais in that the bow doors could be closed at the berth (Department of Transport, 1987, p. 5). Sabel and the Herald’s Master, David Lewry, were on the bridge at this time directing the maneuver. General practice was for the Second Officer to stand by at the bow and monitor the bow spade to make sure it does not dip into the water. If this happens, he will radio the Master, and the Master will slacken speed, reducing the effect of squat, and bringing the bow spade up and out of the water. Of course, since the bow doors were open, any water flowing over the bow spade would flood directly into G-deck. The investigation found that Lewry and Sabel both underestimated the speed that the Herald could do for a given telegraph setting. Their estimates for speed at combinator 6 setting were 15-16kts and 12kts respectively. Sea trials of the spirit class vessel found that the true speed was 17½-18kts. In addition, contrary to Lewry’s testimonial of the general practice, upon leaving Zeebrugge, he set the telegraph immediately to combinator 6 setting, with the investigation finding that this would put the bow wave at 2m above G-deck (Department of Transport, 1987, p. 7).
This ultimately caused water to rush into G-deck and create a free-surface effect within the ship, putting it at a 30° port angle of loll, putting the port side of G-deck under the waterline. More water poured into G-deck, causing the ship to finally capsize to 90°. This sequence of events happened in just 45 seconds (Whittingham, 2004).
ROOT CAUSE ANALYSIS
To accurately pinpoint the cause of the capsize, a proper root cause analysis must be undertaken. A root cause is defined as “that most basic reason for an undesirable condition or problem which, if eliminated or corrected, would have prevented it from existing or occurring.” (Dettmer, 1997, p. 359). So not only will we examine the active error which immediately caused the capsize, but the surrounding errors which allowed such a simple mistake to spiral out of control. Robert Whittingham, in his case study of the Herald, splits the errors into 4 distinct categories; active, management, cultural, and design (Whittingham, 2004, p. 123). All of these played roles in the disaster.
The first major factor in the Herald starts with the decision to change the operating voyage from Dover-Calais to Dover-Zeebrugge. This, in itself, is not inherently unsafe, as the Herald is perfectly capable of loading and unloading at Zeebrugge, albeit slowly. The issue in this instance is the management error in putting pressure on Masters to complete the loading operation 15 mins early. This is an example of ‘groupthink’, defined by Irving Janis as ‘the mode of thinking that persons engage in when concurrence-seeking becomes so dominant in a cohesive ingroup that it tends to override realistic appraisal of alternative courses of action’ (Janis, 1971). The cohesive ingroup, in this case, is the shore-based management, and the realistic appraisal is the Masters’ repeated calls for safety improvements. The shore management’s ignorance as to the pressure they were putting on staff to cut corners in safety for speed is a major influence on the poor decisions taken by all parties which led to the capsize. For example, the investigation corresponded that, had the Chief officer stayed on G-deck for just 3 more minutes, this accident would have been averted (Department of Transport, 1987, p. 12). As Turner puts it, setting goals is a ‘self-conscious’ method to improve an organization, but ‘members of organizations can never be sure that their present actions will be adequate for the attainment of their desired goals’ (Turner, 1976).
The next cause of the accident was the most recognizable one, Mark Stanley’s failure to close the bow doors before departure. This can be attributed to his accidentally falling asleep before the call for harbor stations, and not being woken by the tannoy. Some have called into question the management of work/rest hours on board, with fatigue having been recognized as having a strong association with maritime disasters, and 37% of seafarers agreeing that their working hours sometimes pose a danger to the safe operations of their ship (ITF, 2007). The Herald was also operating on a lower level of manning, owing to the supposition that, due to the long voyage and less time spent in port, the workload would be more manageable (Yardley, 2014, pp. 17-18). This choice could have been the result of more groupthink from fleet management. That said, some personal responsibility still rests with seafarers to manage their own fatigue, so accusations of negligence against Stanley are not without substance.
The Chief Officer, Leslie Sabel, failed in his duty to ensure that the bow doors were closed by Stanley, in what is known as a ‘double-bind’ situation. A double-bind, according to Gregory Bateson, requires an injunction in ‘a context of learning based on avoidance of punishment rather than a context of reward-seeking’ and ‘A secondary injunction conflicting with the first at a more abstract level, and like the first enforced by punishments or signals which threaten survival’ (Bateson, 2000). What this boils down to is being given two seemingly contradictory orders with no explanation, and the threat of reprimand if either of those orders is failed. Bateson goes on to say that the ‘victim’, in their attempt to make an impossible compromise, experiences ‘a breakdown in an individual’s ability to discriminate between logical types’, resulting in disorientation and confusion, such that would impair anyone’s decision-making ability. It is for this reason Sabel left G-deck early, as his duty was both to make sure the bow doors were being closed, and to be on the bridge for harbor stations. He could not be in two places at once and was forced to make a decision to which there was no right answer. It should also be noted that, at full manning, there would have been two Chief Officers on board (Yardley, 2014, p. 18).
The Master’s choice of speed is also a direct cause of the capsize, as it caused the bow wave to flow over the bow spade. This was due to both the Master and Chief Officer’s misunderstanding of the combinator speed setting, and the Master’s unusual choice to select combinator 6 as soon as the Herald had left Zeebrugge. The latter is almost certainly a choice influenced by the time pressure from shore management, as the Master testified that the procedure was to ‘restrict the Combinator settings, until the bow tank had been pumped out fully, to levels at which water did not come over the spade’ (Department of Transport, 1987, p. 7). The Herald was running 5 minutes late upon departure, which likely led Cpt. Lewry to bypass the procedure. It is also notable that he too is caught in a double-bind scenario between two obligations, the first being to SOLAS ch.V reg.34-1; ‘The owner, the charterer, the company operating the ship as defined in regulation IX/1, or any other person shall not prevent or restrict the master of the ship from taking or executing any decision which, in the master’s professional judgement, is necessary for safety of life at sea and protection of the marine environment.’ and the second obligation being his orders from the shore management memo implying that speed should be prioritized over safety, under threat of reprimand.
The Bosun, Terence Ayling’s decision not to close the bow doors himself had, as he put it, ‘never been part of his duties’ (Department of Transport, 1987, p. 8). This is not necessarily a danger in and of itself, the bosun not having failed in an assigned duty, but it could be categorized as a cultural failure. The report noted ‘He took a narrow view of his duties and it is most unfortunate that that was his attitude’ (Department of Transport, 1987, p. 8). A commonly accepted gauge of good safety culture is the DuPont Bradley curve, which promotes an ‘interdependent’ culture (DuPont Sustainable Solutions, 2018). This involves individuals not only taking responsibility for their own safety but working as a team and taking responsibility for the safety of those around them. Promoting a strong safety culture is the only way to achieve this, and it is clear from the actions of Ayling that the safety culture that may have motivated him to close the bow doors was nonexistent.
The architecture of the Herald, although not so much an error of management, was also of note in the capsize. The low freeboard below G-deck, and the lack of longitudinal subdivisions presented a dangerous free-surface effect when water entered it, which is what caused the vessel to lose stability so quickly. Many RORO ferries in preceding years had capsized due to this characteristic, including Townsend-Thoresen’s own European Gateway, just 6 years earlier, in a disaster that killed 6. This has been an issue raised by naval architects for many years (Whittingham, 2004, pp. 121-122).
AFTERMATH
The investigation of the Herald could be regarded as a ’change in the functional adequacy of certain cultural artifacts’, the realization, upon examination, that this disaster could have been diverted easily by changing factors which, now, appear obvious (Carr, 1932). On 4th November 1993, the IMO, mainly in response to the poor management surrounding the Herald case, adopted the International Safety Management (ISM) code, arguably the most important development in the wake of the Herald. The structure of the code can quite clearly be related to the management theories of James Reason, most notably his ‘swiss cheese’ model, the idea that each ‘slice of cheese’ is a safety measure, each with their own ‘holes’ for accidents to slip through. The key to establishing safety is to implement more safety measures for redundancy and to make the ‘holes’ smaller by improving each measure. Although not outright calling it a ‘swiss cheese model’, Reason emphasizes the importance of implementing these safety measures at every level of management (Reason, 1990). The ISM code requires a safety management system (SMS) to be developed by each company, which outlines policies and procedures for work, audits, emergencies, grievances, and communication, forming a legislative basis for including ‘slices’ in all levels of each company’s management.
Fig.1 – Reason’s ‘swiss cheese model’ illustrated in terms of all levels of management
The ISM code also mandates a designated person ashore (DPA), who is a ‘person or persons ashore having direct access to the highest level of management’ and also requires the SMS to provide ‘procedures for reporting accidents and non-conformities with the provisions of this code’ (IMO, 2015). These follow Reason’s principle of providing feedback loops to provide ‘an effective safety information system’ (Reason, 1990, p. 33). This is the beginnings of creating a safety culture, a noted deficiency in the case of the Herald. It also effectively combats the groupthink effect, by mandatorily exposing the ‘cohesive ingroup’ of managers to feedback and criticism from an outside group. Feedback procedures such as these also allow risk to be identified early on, preventing a ‘failure of intelligence’, the lack of knowledge that could have averted a disaster, which was readily available before its occurrence. Although the ISM code is itself reactive to a disaster, the primary aim is to prevent the necessary conditions for disasters to arise, pre-emptively (Turner, 1976).
With regard to RORO ferry design, the minimum freeboard under SOLAS was raised in 1990 from 76mm to 1.25m, scuppers on car decks were mandated, and bow door open/close indicators were mandated on the bridge. Many ferries operating today, however, were constructed before the implementation of these measures, and can still legally operate in contravention of them. Lloyd’s register estimate that the ‘appropriate ingredients’ for another Herald-style capsize still arise once every 5 years (Whittingham, 2004, pp. 121-122).
CONCLUSION
The Herald, at first glance, appears to have been a simple slip-up on the part of the assistant bosun, which could have happened to anyone. Upon closer examination, however, the myriad factors surrounding the incident point to a failure of a whole system of safety management and gives us an awareness of the vastly hidden benefit that comes with an efficient system of accident prevention. The ISM code was the acknowledgment of this impact and provided the first legislative basis for it’s widespread implementation. With successive amendments adopted in 2000, 2004, 2005, 2008 and 2013 it is clear that there is a continual struggle for responsible management, and it is down to companies’ recognition of this struggle to prevent a catastrophe such as the Herald from ever occurring again.
REFERENCES
Bateson, G., 2000. Steps to an ecology of mind: Collected essays in anthropology, psychiatry, evolution, and epistemology. 1st ed. Chicago: University of Chicago Press.
Carr, L. J., 1932. Disaster and the sequence-pattern concept of social change. American Journal of Sociology, 38(2), pp. 207-218.
Department of Transport, 1987. MV Herald of Free Enterprise: Report of Court No. 8074 Formal Investigation, London: Her Majesty’s Stationery Office.
Dettmer, H. W., 1997. Goldratt’s Theory of Constraints: A Systems Approach to Continuous Improvement. 1st ed. Milwaukee: ASQ Quality Press.
DuPont Sustainable Solutions, 2018. The DuPont™ Bradley Curve™. [Online] Available at: https://www.dupont.com/products-and-services/consulting-services-process-technologies/brands/sustainable-solutions/sub-brands/operational-risk-management/products/bradley-curve.html [Accessed 12 December 2018].
IMO, 2015. International Management Code for the Safe Operation of Ships and for Pollution Prevention. London: International Maritime Organisation.
ITF, 2007. Seafarer Fatigue: Where Next?. [Online] Available at: https://www.nautinst.org/filemanager/root/site_assets/forums/fatigue_forum/itf_-_fatigue_where_next.pdf [Accessed 7 12 2018].
Janis, I. L., 1971. Groupthink. Psychology Today, 5(6), pp. 43-46.
Reason, J., 1990. The Contribution of Latent Human Failures to the Breakdown of Complex Systems. Philosophical Transactions of the Royal Society of London. Series B, Biological Sciences, 327(1241), pp. 475-484.
Turner, B. A., 1976. The Organizational and Interorganizational Development of Disasters. Administrative Science Quarterly, 21(3), pp. 378-397.
Whittingham, R., 2004. The Blame Bachine: Why Human Error Causes Accidents. 1st ed. Abingdon: Routledge.
Yardley, I., 2014. Ninety Seconds at Zeebrugge: The Herald of Free Enterprise Story. 1st ed. Stroud: The