Title: The Torrey Canyon's Last Voyage



Aerial view of the Torrey Canyon: broken amidships and spilling oil

Details about the ship

The  details of importance to this story are:

The ship

The ergonomics

The 'Torrey Canyon' was built in the USA, in 1959, with a cargo capacity of 60,000 tons.

Later, she was expanded to twice that capacity in Japan; 63,000 tonnes for the ship and 120,000 for the cargo

Many disasters have in their past some large-scale changes; the problem is that the engineers who make the changes are usually different to the original engineers, with different cultures and interpretations of engineering data. Cross-cultural work patterns are of increasing importance in Ergonomics

Cruised at 17 knots (= 17 nautical miles per hour.  A nautical mile is a bit longer than an ordinary mile)


  • single engine and propeller
  • travelled 500 metres and took about 1 minute to turn through 20 degrees
  • it took 5 miles to stop from cruising speed

In other words, the ship was almost unmanoeuverable. In open waters this is not a problem, but as you approach coastal waters and harbours, it's a problem. So you also need to think about the provision of tugboats, etc. in harbours; it's not enough just to think about the design of the ship.  Also, if you are in charge of the ship you have to think a long way ahead, and then hope that nothing suddenly upsets your plans. Taking a complete systems view of things is a defining characteristic of Ergonomics

Sperry autopilot:

  • 3 modes:  auto (autopilot in charge), manual (you are in charge), disconnect (steering from somewhere else in the ship) 
  • in auto, you can still change course +/- 3 degrees 
  • autopilot clicks for every degree of change, in auto or manual 

This is significant in the rest of the story; in the open sea, the clicking autopilot is the best way to tell that you are turning, because the turn rate is so slow. You will learn about the provision of job aids like this to make working life easier. Note also that there was no GPS system up in the skies in those days; you navigated by old-fashioned means

  • Owned by a subsidiary of Union Oil 
  • Registered in Liberia 
  • Italian crew 
  • Chartered to BP 

So who's responsible for what? Contracts will state this, but do the real people who provision the ship, and make sure it is properly equipped for any journey know this, and who checks there is no mistake? Ergonomics is concerned with issues of responsibility and authority, and the design of processes and procedures to get to your goals


Setting the scene

The ship

The ergonomics

Left Kuwait, 19 February 1967 with full cargo of oil, bound for the Atlantic ocean


Reached Canary Isles 14 March 1967
Informed of destination - Milford Haven, by 18.3.67

They tell the captain here because it's efficient for business; they can wait for a month to look at the oil market, then tell the captain "left for the USA, right for the Mediterranean, or ahead for Europe". Note that this way of running the business means that the boat has to have a full set of navigation charts for wherever it might be sent, before it leaves harbour.

Because of the size of the ship, they had to catch the high tide at 11.00 p.m., or wait 6 days more.  They had to be at the entrance by 6.00 p.m. on 18 March.

They had 5 days to steam nearly 2,000 miles. This put some time pressure on the captain; he didn't have much room for any errors or mishaps. How stress affects the performance of jobs is something you will study.

Navigated by autopilot, using classical navigation techniques (no GPS satellites in the skies); they aimed for Scilly Isles as their first landfall (standard practice)

Problem: they had only 1 chart of Scilly Isles/Land's End, with insufficient detail for close navigation. However, the captain had sailed through those waters 18 times before, so he had some experience for interpreting the chart.


At the Scilly Isles, 18 March 1967

We pick up the story with the 'Torrey Canyon' approaching the Scilly Isles on the morning of the disaster. The first map below (probably loading slowly) is a map of the south-western end of Great Britain and shows the position of the 'Torrey Canyon' when this part of the story starts. The gap between the Scilly Isles and Land's End is about 20 miles; the gap between the Scilly Isles and Milford Haven is about 200 miles.


We continue the story, with comments on the ergonomics issues, as before.


The ship

The ergonomics

Captain went to bed the night before at 03.30 a.m., with instructions to be woken at 6.00 a.m. Scilly Isles not in radar range. 

Note that he has given himself only 2.5 hours of sleep, with a busy day ahead. Almost certainly he was tired the next day; you lose efficiency when you are tired.

Captain woken at 06.00 a.m., Scilly Isles still not in radar view (the radar had a range of 40 miles). Captain decides to sleep some more.

A wise move.

Captain woken again at 06.30 a.m., Scilly Isles now on the radar scope, but on left side, not right (see map above). After short discussion, captain orders "continue course"

This was the fateful decision that triggered the accident. Why did he decide to go through the gap? Probably because he was 12 hours from Milford Haven, withalmost no time to spare before final preparations to go into the harbour. If he had taken the safe option and gone round the Scilly Isles, he would have added about 40 miles, or 2 hours, to his journey time. He would have known from the (small-scale) chart that there was a deep-water channel about 7 miles wide that he could sail through. Maybe he thought that a gap that wide would be enough even for a boat as unmanoeuvrable as his.

07.00 a.m., Captain on bridge


0800 a.m., Changeover of the watch: captain, junior officer (1st trip), experienced helmsman now in charge on the bridge.

0800 is a standard time for a sea-watch to change over.

Junior officer assigned navigation duties; because the ship is on autopilot, helmsman is on watch at side of bridge

In dangerous waters, why was the Junior Officer doing the navigation? Because you have to get experience in your trade somehow, and that includes difficult situations. Besides, he had the Captain looking over his shoulder to help him.

08.15 a.m. Torrey Canyon is now passing the Scilly Isles, 30 minutes to Seven Stones reef (see map below for more detail). Captain orders a change of direction while on autopilot (clicks)



The seas between the Scilly Isles and Land's End

These seas are very dangerous, and many ships have come to grief over the ages. There are reefs all round Land's End and round the Scilly Isles (look at all the lighthouses). Two particularly dangerous ones are 'Wolf Rock', and 'Seven Stones'. 'Wolf Rock' has a lighthouse; 'Seven Stones' has a lightship.

The Captain planned to sail between the Scilly Isles and the 'Seven Stones'. This channel is 7 miles wide. Note that at the time the tide was running left to right, and the reef was submerged.

Position of Seven Stones reef, and its lightship


Positioning the ship for disaster

At this point, the 'Torrey Canyon' is level with the Scilly Isles, and is turning into the gap between the Scilly Isles and the Seven Stones reef.

The ship

The ergonomics

Junior Officer uses 'bearing & distance' method to plot position on the chart 

Everybody uses this method. You take a bearing on a landmark, and calculate the 'back-bearing'. Then you plot this line on the chart, from your landmark back towards where you are. Then you look at the radar scope to see how far away the landmark is, then measure back along the plotted line, and that's your position.

 But if you make a mistake, there's no check. The 'safe' method is to take bearings on 3 landmarks, then plot the back bearings from each. Where they intersect is where you are. If they don't intersect, there's a mistake somewhere.

Why didn't they use this method? Because it takes time, and there are more calculations. Think of it in evolutionary terms; we are adapted to cave-dwelling, and if you conserve effort you can wait longer for your next meal. This applies to mental effort as well; if there's an easier way to do things, people will use it.

 So, when you design work for people to do, make sure it's the most efficient way for people to do it.

Fishing ships in channel; captain moves ship to right of channel (closer to the 'Seven Stones' reef) to avoid the nets. 

The captain knew how hard the fishing life is, so he steered well clear of their nets.

08.40 a.m. They discover a plotting error; quickly, they re-plot their position; now, they discover they are only 2.8 miles from the edge of the reef 

The ship is still moving at 17 knots; it can't stop in time. The captain would now be very worried.

Helmsman at the wheel; hurried course change to North:

  • autopilot switched to manual steering
  • steer new course
  • back onto autopilot to listen for the clicks

Actually, 'North' would not get the ship out of trouble. It isn't clear why they did this; probably tiredness had a part to play

Re-plot position; still heading for reef

The captain would now be extremely worried. Probably there is only 2 miles or less to the reef

Emergency course change to 340 degrees (about North-west):

  • autopilot off, manual on
  • replot position

The captain is now making a desperate attempt to clear the reef. Knowing the slow rate of turn, he must have been anticipating disaster


The End-game

The ship

The ergonomics

Captain goes into the chartroom at the back of the bridge to look again at the chart. Helmsman shouts that he can't hear the clicks; the captain doesn't hear him.

 Then the captain realises he can't hear any clicks. Captain decides that the fuses have blown (this had happened before); opens fuse box and checks them.

When people are under real pressure, they tend to make lightning decisions, based on past experience, rather than carefully worked out logical ones.

Because of this, it is important to make sure that people are trained for emergency situations so that they are more likely to behave correctly.

Fuses OK; therefore the oil pumps that move the rudder must be at fault (this too had happened before)

Again, experience provides the answer, rather than cold, careful thought.

We all do this when we are close to panic, which is why training should be repeated frequently, to try to make sure people will do the right thing.

Captain rings the engine room to get the pumps checked; by mistake, he dials the wrong number and gets the galley. The cook picks up the phone and says, "Oh, captain, your breakfast is ready."

An example of "More haste, less speed." Emergencies greatly increase the probability of this kind of error.

There is a good book about this; 'Human Error', by James Reason, Cambridge University Press, 1990, ISBN 0-521-30669-8. Your local library may have a copy.

Captain glances at the autopilot control lever; realises what the problem is; moves the lever to manual, changes course

At this point, most people would have realised there was nothing more that they could do, and in these circumstances, people can 'freeze'. However, the captain didn't; he kept thinking. He glanced down, and saw that the control lever, by the wheel, had been knocked into 'Disengage'.

How had this happened? Because the design of this control was not good enough. 'Disengage' came between 'Manual' and 'Autopilot', and an inadvertent knock could move it from one position to the next.

Ergonomics is very concerned with the design of controls and displays, because that's how you communicate with systems.

Too late. At 17 knots, Torrey Canyon hits Pollard's Rock in the Seven Stones reef, and rips open 6 tanks.

Over the next few weeks, all the oil escaped and spread along the shores of the south coast of England and the Normandy coast of France, laying waste to the sea biology of the region. There were no plans to combat this; it was the first of the big oil disasters, and what was attempted was either too late, too small in scope, or made matters worse. But much was learnt from this disaster.


An important part of ergonomics is learning from the past, and making sure the lessons are made available to designers and engineers, so that mistakes are not repeated.

This requires the design of appropriate procedures for knowledge capture, its restructuring, and its dissemination to those who need it.  Ergonomists have a big part to play in this.










A summary of the causes of the disaster

The main message that comes from this story is that disasters are due to a number of events, none too serious on their own, that come together in an unfortunate combination.  Then there is usually a final, triggering event that sets the whole accident in motion.  We think that the accident is due to a combination of the following things in the story above (remember, you need to read the official report for a complete picture):