Details about the ship
The details of importance to this story are:
|
The ship |
The ergonomics |
|
The 'Torrey Canyon' was built in the USA, in 1959, with a cargo capacity of 60,000 tons. Later, she was expanded to twice that capacity in Japan; 63,000 tonnes for the ship and 120,000 for the cargo |
Many disasters have in their past some large-scale changes; the problem is that the engineers who make the changes are usually different to the original engineers, with different cultures and interpretations of engineering data. Cross-cultural work patterns are of increasing importance in Ergonomics |
|
Cruised at 17 knots (= 17 nautical miles per hour. A nautical mile is a bit longer than an ordinary mile) |
|
|
In other words, the ship was almost unmanoeuverable. In open waters this is not a problem, but as you approach coastal waters and harbours, it's a problem. So you also need to think about the provision of tugboats, etc. in harbours; it's not enough just to think about the design of the ship. Also, if you are in charge of the ship you have to think a long way ahead, and then hope that nothing suddenly upsets your plans. Taking a complete systems view of things is a defining characteristic of Ergonomics |
|
Sperry autopilot:
|
This is significant in the rest of the story; in the open sea, the clicking autopilot is the best way to tell that you are turning, because the turn rate is so slow. You will learn about the provision of job aids like this to make working life easier. Note also that there was no GPS system up in the skies in those days; you navigated by old-fashioned means |
|
So who's responsible for what? Contracts will state this, but do the real people who provision the ship, and make sure it is properly equipped for any journey know this, and who checks there is no mistake? Ergonomics is concerned with issues of responsibility and authority, and the design of processes and procedures to get to your goals |
Setting the scene
|
The ship |
The ergonomics |
|
Left Kuwait, 19 February 1967 with full cargo of oil, bound for the Atlantic ocean |
|
|
Reached Canary Isles 14 March 1967 |
They tell the captain here because it's efficient for business; they can wait for a month to look at the oil market, then tell the captain "left for the USA, right for the Mediterranean, or ahead for Europe". Note that this way of running the business means that the boat has to have a full set of navigation charts for wherever it might be sent, before it leaves harbour. |
|
Because of the size of the ship, they had to catch the high tide at 11.00 p.m., or wait 6 days more. They had to be at the entrance by 6.00 p.m. on 18 March. |
They had 5 days to steam nearly 2,000 miles. This put some time pressure on the captain; he didn't have much room for any errors or mishaps. How stress affects the performance of jobs is something you will study. |
|
Navigated by autopilot, using classical navigation techniques (no GPS satellites in the skies); they aimed for Scilly Isles as their first landfall (standard practice) |
Problem: they had only 1 chart of Scilly Isles/Land's End, with insufficient detail for close navigation. However, the captain had sailed through those waters 18 times before, so he had some experience for interpreting the chart. |
At the Scilly Isles, 18 March 1967
We pick up the story with the 'Torrey Canyon' approaching the Scilly Isles on the morning of the disaster. The first map below (probably loading slowly) is a map of the south-western end of Great Britain and shows the position of the 'Torrey Canyon' when this part of the story starts. The gap between the Scilly Isles and Land's End is about 20 miles; the gap between the Scilly Isles and Milford Haven is about 200 miles.
We continue the story, with comments on the ergonomics issues, as before.
|
The ship |
The ergonomics |
|
Captain went to bed the night before at 03.30 a.m., with instructions to be woken at 6.00 a.m. Scilly Isles not in radar range. |
Note that he has given himself only 2.5 hours of sleep, with a busy day ahead. Almost certainly he was tired the next day; you lose efficiency when you are tired. |
|
Captain woken at 06.00 a.m., Scilly Isles still not in radar view (the radar had a range of 40 miles). Captain decides to sleep some more. |
A wise move. |
|
Captain woken again at 06.30 a.m., Scilly Isles now on the radar scope, but on left side, not right (see map above). After short discussion, captain orders "continue course" |
This was the fateful decision that triggered the accident. Why did he decide to go through the gap? Probably because he was 12 hours from Milford Haven, withalmost no time to spare before final preparations to go into the harbour. If he had taken the safe option and gone round the Scilly Isles, he would have added about 40 miles, or 2 hours, to his journey time. He would have known from the (small-scale) chart that there was a deep-water channel about 7 miles wide that he could sail through. Maybe he thought that a gap that wide would be enough even for a boat as unmanoeuvrable as his. |
|
07.00 a.m., Captain on bridge |
|
|
0800 a.m., Changeover of the watch: captain, junior officer (1st trip), experienced helmsman now in charge on the bridge. |
0800 is a standard time for a sea-watch to change over. |
|
Junior officer assigned navigation duties; because the ship is on autopilot, helmsman is on watch at side of bridge |
In dangerous waters, why was the Junior Officer doing the navigation? Because you have to get experience in your trade somehow, and that includes difficult situations. Besides, he had the Captain looking over his shoulder to help him. |
|
08.15 a.m. Torrey Canyon is now passing the Scilly Isles, 30 minutes to Seven Stones reef (see map below for more detail). Captain orders a change of direction while on autopilot (clicks) |
|
The seas between the Scilly Isles and Land's End
These seas are very dangerous, and many ships have come to grief over the ages. There are reefs all round Land's End and round the Scilly Isles (look at all the lighthouses). Two particularly dangerous ones are 'Wolf Rock', and 'Seven Stones'. 'Wolf Rock' has a lighthouse; 'Seven Stones' has a lightship.
The Captain planned to sail between the Scilly Isles and the 'Seven Stones'. This channel is 7 miles wide. Note that at the time the tide was running left to right, and the reef was submerged.
Positioning the ship for disaster
At this point, the 'Torrey Canyon' is level with the Scilly Isles, and is turning into the gap between the Scilly Isles and the Seven Stones reef.
|
The ship |
The ergonomics |
|
Junior Officer uses 'bearing & distance' method to plot position on the chart |
Everybody uses this method. You take a bearing on a landmark, and calculate the 'back-bearing'. Then you plot this line on the chart, from your landmark back towards where you are. Then you look at the radar scope to see how far away the landmark is, then measure back along the plotted line, and that's your position. But if you make a mistake, there's no check. The 'safe' method is to take bearings on 3 landmarks, then plot the back bearings from each. Where they intersect is where you are. If they don't intersect, there's a mistake somewhere. Why didn't they use this method? Because it takes time, and there are more calculations. Think of it in evolutionary terms; we are adapted to cave-dwelling, and if you conserve effort you can wait longer for your next meal. This applies to mental effort as well; if there's an easier way to do things, people will use it. So, when you design work for people to do, make sure it's the most efficient way for people to do it. |
|
Fishing ships in channel; captain moves ship to right of channel (closer to the 'Seven Stones' reef) to avoid the nets. |
The captain knew how hard the fishing life is, so he steered well clear of their nets. |
|
08.40 a.m. They discover a plotting error; quickly, they re-plot their position; now, they discover they are only 2.8 miles from the edge of the reef |
The ship is still moving at 17 knots; it can't stop in time. The captain would now be very worried. |
|
Helmsman at the wheel; hurried course change to North:
|
Actually, 'North' would not get the ship out of trouble. It isn't clear why they did this; probably tiredness had a part to play |
|
Re-plot position; still heading for reef |
The captain would now be extremely worried. Probably there is only 2 miles or less to the reef |
|
Emergency course change to 340 degrees (about North-west):
|
The captain is now making a desperate attempt to clear the reef. Knowing the slow rate of turn, he must have been anticipating disaster |
The End-game
|
The ship |
The ergonomics |
|
Captain goes into the chartroom at the back of the bridge to look again at the chart. Helmsman shouts that he can't hear the clicks; the captain doesn't hear him. Then the captain realises he can't hear any clicks. Captain decides that the fuses have blown (this had happened before); opens fuse box and checks them. |
When people are under real pressure, they tend to make lightning decisions, based on past experience, rather than carefully worked out logical ones. Because of this, it is important to make sure that people are trained for emergency situations so that they are more likely to behave correctly. |
|
Fuses OK; therefore the oil pumps that move the rudder must be at fault (this too had happened before) |
Again, experience provides the answer, rather than cold, careful thought. We all do this when we are close to panic, which is why training should be repeated frequently, to try to make sure people will do the right thing. |
|
Captain rings the engine room to get the pumps checked; by mistake, he dials the wrong number and gets the galley. The cook picks up the phone and says, "Oh, captain, your breakfast is ready." |
An example of "More haste, less speed." Emergencies greatly increase the probability of this kind of error. There is a good book about this; 'Human Error', by James Reason, Cambridge University Press, 1990, ISBN 0-521-30669-8. Your local library may have a copy. |
|
Captain glances at the autopilot control lever; realises what the problem is; moves the lever to manual, changes course |
At this point, most people would have realised there was nothing more that they could do, and in these circumstances, people can 'freeze'. However, the captain didn't; he kept thinking. He glanced down, and saw that the control lever, by the wheel, had been knocked into 'Disengage'. How had this happened? Because the design of this control was not good enough. 'Disengage' came between 'Manual' and 'Autopilot', and an inadvertent knock could move it from one position to the next. Ergonomics is very concerned with the design of controls and displays, because that's how you communicate with systems. |
|
Too late. At 17 knots, Torrey Canyon hits Pollard's Rock in the Seven Stones reef, and rips open 6 tanks. Over the next few weeks, all the oil escaped and spread along the shores of the south coast of England and the Normandy coast of France, laying waste to the sea biology of the region. There were no plans to combat this; it was the first of the big oil disasters, and what was attempted was either too late, too small in scope, or made matters worse. But much was learnt from this disaster. |
An important part of ergonomics is learning from the past, and making sure the lessons are made available to designers and engineers, so that mistakes are not repeated. This requires the design of appropriate procedures for knowledge capture, its restructuring, and its dissemination to those who need it. Ergonomists have a big part to play in this. |
A summary of the causes of the disaster
The main message that comes from this story is that disasters are due to a number of events, none too serious on their own, that come together in an unfortunate combination. Then there is usually a final, triggering event that sets the whole accident in motion. We think that the accident is due to a combination of the following things in the story above (remember, you need to read the official report for a complete picture):
- Ship design
- Manoeuvrability problems. The slow response of the ship means that when you get into coastal waters, basically you have to hope that everything else gets out of your way, including the land.
- Autopilot design. The autopilot itself worked well; however the design and placement of the lever could lead to the wrong control mode being selected, and did in this case.
- Company issues
- Operational scheduling of ships. Waiting until the Canary Islands before telling the Captain his final destination is probably good business practice; however, if it leads to time pressure on the people in charge, it is not so good. Time pressure always increases the probability of errors and bad decisions.
- Equipping ships for schedules. If you wait to tell the ship where to go, you must ensure that someone puts all the right charts on board before it leaves port. The link between scheduling and resourcing doesn't seem to have worked well in this case.
- Responsibilities for competence. The Junior Officer made a navigational mistake, which took a while to become evident. But you can't become competent in a classroom; you gain real experience by doing the real job, with the risk of making mistakes.
- Operational issues
- Alertness problems. Perhaps the Captain was a little slow to realise what was happening becuase he didn't have enough sleep the night before. Tiredness is known to increase the probability of errors.
- Time pressures. In many disasters, time pressure will be found to play a part. It often means that the safe alternative in a decision is discarded, because it needs more time. We should always try to ensure there is enough time for a job to be done properly.
- Junior Officer navigating. On the other hand, he has to get experience somehow, including dangerous waters. Besides, he had the Captain looking over his shoulder, so there was a check. Unfortunately, the error took a while to be found.
- Short-cut navigation procedure. Short-cuts are a part of human nature; what we need is efficient procedures that don't need short cuts.
- Sub-optimal decision-making. None of the Captain's decisions, by themselves, were bad ones (except perhaps for the one where he decided to go through the channel with an unmanoeuvrable ship); it was the combination of several of these sub-optimal decisions that led to the disaster. Even then, if the ship had been more manoeuvrable, he might have escaped.
- Sub-optimal control operation. Finding yourself without any steering control in a dangerous situation is never a good idea.