1
ENHANCING U.S. NAVY NAVIGATION SAFETY: APPLYING STAMP
PROCESSES TO PREVENT SURFACE SHIP COLLISIONS
Chapter 1: Introduction
On June 17, 2017 the USS FITZGERALD collided with the ACX CRYSTAL off the coast of
Japan, and on August 21, 2021 the USS JOHN S MCCAIN collided with the Motor Ship
ALNIC MC in the Singapore Strait [26, 27]. Both incidents resulted in the deaths of 17 sailors.
The U.S. Navy has seen an increase in the volume of collisions, with four occurring in 2017 and
eight more from ten years ago to 2007 [5]. This thesis applies a systems theory approach using
the System Theoretical Accident Model and Process (STAMP) for the causes of accidents to
prevent future accidents.
Research Questions + Motivation
As a Surface Warfare Officer (SWO) in the U.S. Navy, the increase in accidents across the fleet
has led me to ask a lot of questions. Could it be my ship? Why is there an increase in the number
of ship collisions? What's missing?
While participating in MIT's Systems Design and Management program, I took a class by Dr.
Nancy Leveson on "System Security." Further research found that the U.S. Navy does not
currently use STAMP-based methods in the analysis process. Part of the motivation of this paper
is to help others in the U.S. Navy understand that systems thought processes using STAMP can
add value to our organization. To reach the vast majority of people, these reports use only
publicly available information. This process allows more readers to see the value of CAST
analysis. Future work may include entering confidential documents to show
The U.S. Navy leads the total value of this method.1
The U.S. Navy recognizes the need for a more thorough analysis. In addition to the typical
accident investigation reports for both collisions, the Deputy Chief of Naval Operations assigned
a 33-member team to review the operations of the surface fleet over the past decade [5].
2
FITZGERALD and MCCAIN Report released on October 23, 2017, and the Latest
Comprehensive Review
The Surface Force Incident on October 26, 2017. The crash report uses root cause analysis, and
the fault is assigned to several individual actors for the part that caused the collision. The
purpose of this report is not to blame a single individual but to identify changes in the system
that lead to a more risky environment in the navigation system on board U.S. Navy ships.
Then, based on an understanding of why such changes occur, the study proposes a new set of
recommendations that establish a control structure focused on continuous improvement and
accident prevention. The focus of the U.S. Navy's investigations tends to swing toward legal
investigations for wrongful assignments; This type of traditional analysis does not prevent
future accidents but analyzes the causes of a particular chain of events.
This research and realization answers the following research questions:
What unique insights were not previously uncovered through the traditional analysis provided by
the STAMP-based CAST analysis of the 2017 USS FITZGERALD, and USS MCCAIN collisions
for U.S. Navy surface ships? What value does this STAMP-based approach provide to the U.S.
Navy?
Organization
The rest of this thesis is arranged as follows:
Chapter 2 reviews the literature on STAMP-based approaches.
Chapters 3-5 provide the full FITZGERALD CAST Analysis.
Chapter 6 summarizes the MCCAIN crash analysis.
Chapter 7 discusses comprehensive recommendations.
Chapter 8 concludes and offers suggestions for future
research. The attachments are broken down into four separate
attachments:
Appendix A provides FITZGERALD's recommendation.
Appendices B and C provide the full MCCAIN CAST Analysis.
Appendix D provides more details about the U.S. Navy's traditional
3
findings and recommendations.
4
Chapter 2: Literature Review
This section introduces the traditional thought process of the event-based causality model and
compares it to a systems approach to safety. The System Theoretical Accident Model and
Process (STAMP) and Causal Analysis based on STAMP (CAST) were introduced as a guiding
framework for the thesis work in understanding the two ship collisions. This introduction will
establish a framework for a separate analysis of each collision and a comparison of the resulting
findings.
Event-Based Causality Model-
The traditional causality model process is a chain of events in which one event immediately
precedes another and ultimately leads to an accident [19]. The goal in the traditional
causality model is to determine the root cause of an accident in order to attribute it to
guilt or its probable cause. The accident reports reviewed fall under this classification
because they characterize conclusions as findings and probable causes. They characterize
the purpose of the investigation as determining the fault associated with the accident. In
this sense, the report appears short from an engineering perspective to understand
accidents and how to prevent future events. These event-based models usually blame
human error. A common form of analyzing system failures is to use the James Reason
Swiss Cheese Model to explain why the accident occurred.
This model, however, is nothing more than an event-based victim model under the lens of
risk management. A more detailed analysis of CAST versus the Swiss Cheese Model is
found in a separate MIT Thesis applying CAST to the U.S. Coast Guard Flight Accident
by Jon Hickey [8].
Problems with Traditional Event Chain-Based Causality Models
Dr. Leveson summarizes the difficulties in applying event-based victim models to complex
sociotechnical systems such as navigation systems on board U.S. Navy ships, and the
assumptions that such insecurities exist under current models as: [19]
5
1) Confuse security with reliability – Security and reliability are two different traits. The
assumption that improving the reliability of a component or system will improve security
is a commonly held misconception. A system is reliable while insecure, secure while
unreliable, and has a conflict to resolve between security and reliability. An example is
that a component works reliably but executing at the wrong time will cause an unsafe
condition. Separately, humans are often considered safe but unreliable. These examples,
as well as others, show that systems that have high reliability do not meet safety
requirements. [19]
2) Model the cause of the accident as a chain of events. - This false assumption abstracts the
specified details insignificant and focuses on certain key factors. These models assume
that accidents follow patterns. The models have taken many forms, including the Swiss
Cheese Model from Reason and the Domino Model from Heinrich. They establish a
cause-and-effect relationship where an accident will not happen if the chain breaks. This
is too simplistic in their analysis because they isolate individual events without looking at
how different conditions can cause these events to occur. In addition, the system of
labeling as a subsequent event misses important factors to understand systemic factors
that are unlikely to be included in the chain of events. These factors lead to the
conclusion that event chain models do not describe the process effectively because they
eliminate the reason why the event occurred. [19]
3) Limitations of Probabilistic Risk Assessment (PRA). - The assumption states that a
probabilistic risk assessment in a chain of error effectively assesses security. The initial
assumption in PRA is that the events that initiate are mutually exclusive. This assumption
makes modeling easier but may not reflect reality. Some events in the event chain
construction may be set as low probability. However, when events depend on each other,
it can lead to coincidences to cause accidents that are not predicted in the model. In
addition, PRA only checks for physical failures and may miss design errors in the
operation of the system. An example is if there is a component failure, but the system
does not notify the operator, the operator is unaware and therefore cannot take action.
However, the PRA will show that the next procedural step has
6
probability of failure. In essence, such probabilistic judgments assume independence
between events and causes of events, which is rarely true. [19]
4) The Role of Operators in Accidents. - This assumption states that most incidents are
caused by operator error, therefore assuming that safe human action reduces accidents.
The assumption fails to take into account the flawed design of the system. In a flawed
system, operators may have unrealistic expectations. In retrospect, after an accident, it's
easy to criticize the operator's decision and point out there are better options. This
criticism is a hindsight bias. Hindsight bias is a common weakness in analysis because
those who do the exploration know the accident happened. Meanwhile, the operator
model adjusts over time as a result of training and changes to the physical system.
Therefore, the operator's mental model can be different from the designer's mental
model. This ability of the operator's mental model to adapt makes humans valuable in the
system. The assumption of blaming the human operator fails to consider why the
operator performs the action. [19]
5) The Role of Software in Accidents. - The software is assumed to be secure if it is
reliable. This logic is flawed because the software comes from the requirements. When
the requirements are incomplete, the software is not secure. Therefore, software can be
written to perform requirements reliably, while remaining insecure. In this way, the
wrong assumption is that the correct software as per the requirements will not affect the
security of the system. [19]
6) Static versus dynamic system view. - An accident is assumed to occur through the
interaction of events that cause losses. The problem with this assumption is that the
system is considered static. However, a system is a dynamic process and the only
constant is that nothing remains constant. Systems adapt as they respond to changes in
the environment. As the system responds, they move towards an unsafe condition. The
correct assumption is to anticipate migration to higher risk conditions and prevent them
through system design and detection. [19]
7
7) Focus on fault identification. - This assumption is that blaming allows for learning and
prevention of future accidents. Faulty assignments lead to finger-pointing and a lack of
real progress in safety engineering. The correct assumption is that blaming does not
result in salvation. Safety results from understanding the behavior of the system and
why it results in accidents. [19]
Systems Approach to Safety
When taking a systems approach to safety, it is important to first define what constitutes a
system. We define a system as a set of things (components) that work together to achieve
a goal or goal [16]. A deeper discussion of the definition of a system is in Dr. Leveson's
recent work titled, Introduction to System Safety Techniques. Systems theory views
systems as objective, holistic, contextual, interdependent/interrelated, dynamically
complex, non-linear, and hierarchical [16]. An important element of systems theory is
that the properties that emerge result from the interaction of parts [16]. The focus is on
the system, not the individual components.
The approach to system security is summarized as: [16]
1. The display system hierarchically allows for an understanding of the level and
relationship between components and operators, and the control mechanisms inherent
in the system. These interactions are social and technical.
2. The system has non-linear communication and feedback mechanisms, which leads to
non-linear causality. Change requires feedback to observe how systems and components
respond.
3. The system has an overall purpose so that all the individual parts work together to
achieve the desired emergent nature. This requires an analysis of emerging safety
properties.
4. The system is treated as a whole, with a focus on relationships and interactions, which are
viewed from multiple perspectives.
5. The system needs to be understood based on the environment. Environmental
context drives human behavior. In addition, human perceptions of context
increasingly adjust to individual performance.
6. The interdependence of components results in changes in how the system functions or
8
how each component interacts, which may have unintended consequences.
7. Effective system control requires four conditions:
a. Destination Conditions: The controller must have a defined goal or objective.
b. Action Conditions: The controller must have the ability to influence the system
country.
c. Observability Conditions: The controller must be able to determine the current
system state.
d. Model Condition: The controller must understand how the system works.
According to Dr. Leveson, "Accidents result from inadequate controls or enforcement of
safety-related constraints in the development, design, and operation of systems." [19].
Taking these principles into account, system safety views safety as a matter of control
rather than a problem of failure.
STAMP Overview
STAMP is a new accident causality model that addresses the shortcomings of the previous
model. The goal is [19]:
1) To expand accident analysis beyond components and human error.
2) To provide a scientific way to examine why accidents occur and how to prevent future
accidents.
3) To include system design errors and unsafe system interactions to better understand why
accidents occur.
4) To enable a new hazard analysis coupled with a risk assessment that can include the role
of software and humans in the system.
5) To shift the focus to understanding human decisions by examining the goals and
contextual factors that influence actions.
6) To emphasize the reason why the accident occurred.
7) To investigate the processes associated with the accident.
8) To allow for various viewpoints of the process that leads to accidents.
9) To define operational metrics to understand when a system is moving towards a safety
constraint breach.
9
STAMP was derived by Dr. Leveson to address this goal in a systems thinking framework.
This model emphasizes "enforcing behavioral safety constraints" instead of focusing on
accident prevention [19]. This focus stems from previous discussions about how
accidents result from such changes, and those changes tend to migrate to higher risk
conditions. Thus, the focus of STAMP is to control the behavior of the system by
enforcing the principles of safety [19]. This model focuses on the concept of safety
constraints, hierarchical control structures, and process models:
1) Security Constraints. - Safety constraints are restrictions placed on the system that, if
enforced, prevent unsafe events. STAMP builds on safety constraints and events, and
highlights that events occur due to inadequate controls. This control has two common
forms: passive and active. Passive control aids safety with its presence and is items such
as interlocks, barriers, and fail-safe devices. Active control requires commands through
monitoring, diagnosis, and response. The application of safety constraints helps in
managing active and passive control in large complex systems. There are many ways to
use controls as a practical security constraint. Overall system modeling helps discover
how those controls affect system performance and unintended consequences. [19]
2) Hierarchical Control Structure. - STAMP relies on systems theory, and thus incorporates
a hierarchical structure in which each level imposes constraints on the levels below it.
Constraints dictate behavior at the sublevel through control or lack of control. Within
each level of lost control can come from missing constraints, inadequate safety control
commands, commands that are not executed correctly at a lower level, or inadequate
feedback that affects the implementation of constraints. Feedback is just one element of
communication between levels; others involve initial communication reference channels
from a higher level to a lower level. Higher levels communicate policies and constraints
to a lower level, providing feedback on operational experience to ensure the appropriate
level of detail to be implemented. The control structure changes over time; Therefore,
incorporating changes when analyzing and designing safety constraints is necessary to
keep the safety structure effective. Hazards must be identified in
10
top-down structure (not bottom-up approach) to determine safety constraints that meet the
requirements of the overall system objectives. [19]
3) Process Model. - Controllers (human or automated) require a controlled process model.
Accidents can occur when the process model in the controller does not match the system
being controlled. In this case, the controller will issue an unsafe control action.
Controllers need accurate process models to effectively control processes. Every level of
hierarchical control structure requires an accurate process model. In understanding the
process model, it is possible to understand why accidents occur and why inadequate
control is given. Process models can also help design more secure systems by
understanding the system models used by developers. If a designer misunderstands the
laws of physics that limit the system, it will result in defects in the system that the tests
will not capture. [19]
In summary, safety constraints, hierarchical control structures, and process models form the
foundation of STAMP. Dynamic interactions that result in the violation of safety
constraints cause accidents. By using STAMP, accidents can be understood by
identifying why controls are inadequate in enforcing safety constraints [19].
Why STAMP for U.S. Navy Accident Analysis?
This thesis analyzes collisions involving U.S. Navy ships in 2017, the USS JOHN S MCCAIN
(August 21, 2017) and USS FITZGERALD (July 17, 2017). The U.S. Navy's findings in both
accidents resulted in changes to the career path of the U.S. Navy Surface Warfare Officer
(SWO) and a more careful analysis of the work-break cycle on board [26, 27]. The U.S. Navy
summarized its findings under training and leadership/culture [26, 27]. The U.S. Navy and the
National Transportation Safety Board (NTSB) are both investigating the accident. Both analyses
apply event chain-based model analysis to arrive at a conclusion where possible event-based
causes are determined. In both traditional reports, no systems theory or control theory-based
approach is taken.
11
When utilizing a STAMP-based (CAST) accident analysis, the results did not find a single causal
factor. Instead, it examines the entire sociotechnical system design to find weaknesses in the
safety control structure to identify changes that will not only eliminate symptoms but also
causative and systemic factors. CAST's focus is to focus on why the accident happened and not
to blame. This analysis eliminates hindsight bias and aims to understand why people act the way
they do. Hindsight bias is defined as how after an accident has occurred, it is easy to see what
went wrong and it is easy to judge that avoiding such actions will prevent the accident [18]. The
elimination of retrospective bias forces the analysis to look at the environment through the lens
before the accident [18]. Retrospective bias is usually seen in reports when "should", "could", or
"would" appear [18].
The U.S. Navy recognizes the need for a thorough review of surface force navigation controls, as
evidenced by a 33-member review team appointed to conduct a comprehensive review of recent
surface force collisions [5]. In addition to the two collisions analyzed in this report, two other
accidents occurred in 2017 involving a U.S. Navy ship, USS Lake Champlain (CG 57) colliding
with NAM YANG 502 on May 9, 2017, and USS ANTIETAM (CG 54) landing on January 31,
2017 [5]. Eight additional incidents have occurred since 2007 [5]. Ships involved include: USS
TORTUGA (LSD 46), USS TAYLOR (FFG 56), USS GUARDIAN (MCM 5), USS PORTER
(DDG 78), USS ESSEX (LHD 2), USS EMORY S. LAND (US 39),
USS PORT ROYAL (CG 73), USS HALYBURTON (FFG 40) [5]. These ships have a wide
range of crew experience, ship type, home of origin, and circumstances that led to their
accident. The accident report criteria used to analyze these vessels are similar to those used in
reports on FITZGERALD and MCCAIN. This significant volume of accidents over the past ten
years demonstrates the need for a different approach to determining accident victims. The
collision of FITZGERALD and MCCAIN was chosen for this study because of the loss of life
and the amount of information available to the public.
Appendix A of Dr. Leveson's CAST Handbook provides a valuable list of historical CAST
analyses performed on other accidents and the insights of STAMP-based CAST analyses
provided from a historical perspective [18]. The research covers applications for aviation, U.S.
Coast Guard accidents, missile systems, medical, and many other safety-critical devices. Given
12
As a result of this proven result, it is clear that there is a need to perform CAST on incidents
involving surface ship collisions. The collision of FITZGERALD and MCCAIN in 2017 serves
as the latest application in which CAST can be applied. The advantages of using a STAMP-
based approach include [19]:
1) STAMP allows for the separation of factual data from interpretation. Interpretation
often leads to hindsight bias.
2) The STAMP model proved to be a more complete analysis of accident reports. The
STAMP report highlights the factors as well as their relationships.
3) STAMP imposes an evaluation of every part of the sociotechnical system that contributes
to the loss. This allows learning to occur to prevent accidents in the subdivisions of
technical, managerial, organizational, and regulatory fields. The focus becomes on why
the behavior occurs, and not just on who is responsible.
4) STAMP provides hazard analysis techniques starting from the obstacles needed to
maintain safety. This provides a way to implement a safety-guided design instead of
focusing on adding redundancy to reduce risk.
5) STAMP's step-by-step process creates a systemic approach to modeling accidents that
eliminates subjectivity. This model focuses on design to enforce safety constraints.
CAST Process
CAST is the application of STAMP for accident analysis. There are nine steps to a structured
CAST analysis. The CAST analysis was carried out on FITZGERALD and MCCAIN to
demonstrate the completeness of the analysis and the uniqueness of the findings. The thesis
contains three segments: FITZGERALD CAST, MCCAIN CAST, and a combined conclusion.
The following nine steps come from Dr. Nancy Leveson's Engineering a Safer World. These
guiding principles are used in this work and provide a framework for future exploration [19].
1. Identify the systems and hazards involved.
13
2. Identify the constraints and system safety requirements associated with each
hazard.
3. Diagram the safety control structure related to hazards and annotate safety
constraints. This structure includes the roles and responsibilities of each
component and control. Controls carry out their responsibilities, and relevant
feedback is provided to them to help them do this.
4. Determine the nearest event that caused the accident.
5. Accident analysis at the level of physical systems. Identify the contribution of
each event: physical and operational controls, physical failures, dysfunctional
interactions, communication and coordination weaknesses, and unaddressed
disruptions. Determine why physical controls are inadequate in preventing harm.
6. Determine how and why each of the higher levels in a row allows or
contributes to inadequate control. The reason could be that the responsibility to
enforce it is never assigned or adequate controls are not issued. All control
actions need to be analyzed as to why information is not available, the
mechanisms for forming the behavior underlying the decision, and the
weaknesses in the process model.
7. Check the overall coordination and communication of the loss contributors.
8. Determine the dynamics and changes in safety control systems and
structures related to the loss and weakening of safety control structures over
time.
9. Make recommendations.
14
Chapter 3: Description of the FITZGERALD Accident and the Proximity Chain
of Events
At 0130 hours on June 17, 2017, the USS FITZERALD collided with the Motor Ship ACX
CRYSTAL; The impact caused damage to the hull of the FITZGERALD and flooded several
compartments resulting in the deaths of seven U.S. Navy Sailors. FITZGERALD is a U.S. Navy
Flight 1 Arleigh Burke-class destroyer stationed in Yokosuka, Japan, as shown in Figure 3.1.
The comparison of the size of the two ships is shown in Figure 3.2. Under the International
Maritime Organization's (IMO) International Road Rules, FITZGERALD was in a crossing
situation with CRYSTAL and was required to maneuver to avoid a collision. If FITZGERALD
cannot prevent a collision alone, CRYSTAL is responsible for maneuvering if there is a risk of
collision [26]. As per Rule 15 of the International Road Rules, the CRYSTAL is on the right
side of the FITZGERALD, which means the FITZGERALD must change course to avoid the
CRYSTAL as the ship giving way [26]. Figure 3.4 in this chapter is an illustration of the
collision process provided by the U.S. Navy [27]. In figure 3.4, FITZGERALD is a white dot
with a blue line, and CRYSTAL is a yellow dot.
Table 3.1 provides a proximal chain of events. In Table 3.1, all times shown are listed in
Japan Standard Time (JST) unless otherwise stated. The U.S. Navy includes a detailed
timeline of events leading up to and through the collision. The chain of events is
summarized below to highlight the sequencing and combine findings from other reports.
Although this is the fourth step of CAST, it is included before the analysis to provide context
for the accident.
15
Figure 3. 1 USS FITZGERALD (DDG 62)[5]
Figure 3. 2 Comparison of the USS FITZGERALD (DDG 62) and ACX CRYSTAL Ships for size
[1]
16
Proximity Chain of Events:
Time (24
hours)
Event
0001 June 16, 2017 FITZGERALD moored in Yokosuka, Japan
0600 The crew returned to FITZGERALD to prepare for departure
1130 FITZGERALD is ongoing
1210 FITZGERALD anchors for the delivery of ammunition to ships
1624 FITZGERALD is on its way from the dock
1736 - 2111 FITZGERALD performs helicopter deck landing for qualification and
certification
2200 The supervisors at FITZGERALD during the collision started their watches,
which were scheduled for 2200-0200
2300 - 2305 After completing the operation of the small boat to return personnel to the beach,
the Commanding Officer (CO), Executive Officer (XO), and Navigator (NAV)
left the bridge
June 17, 2017
0001 - 0100 Observers did not report any other ships within two nautical miles (NM) of
FITZGERALD to CO (Navy, 24-25). On board the FITZGERALD, the CO has
a standing order that any incoming vessel within 3 NM (6000 yards) of the
FITZGERALD be reported to him, no matter what time of day
0110 The FITZGERALD surveillance team noticed CRYSTAL and tried to start
the CRYSTAL motion radar plot, and CRYSTAL was 11 NM away from
FITZGERALD's right side (right)
17
0117 The Officer of the Deck (OOD) reached the radar plot on what the bridge team
recognized as CRYSTAL with the nearest point 1500 yards on the right side of
FITZGERALD
0122 Junior Officer of the Deck (JOOD) makes a recommendation for
FITZGERALD to slow down
0125 Supervisors recognized three ships in the vicinity where they tracked
CRYSTAL. The risk of collision was determined to exist, and no report was
made to CO. OOD considered a right turn (240T)
0127 OOD ordered to change direction to 240T (originally 190T), within one minute,
commanded full left steering and all engines forward full (original speed 20
knots); These commands are not executed
0129 Boatswain Mate of the Watch takes over the wheel to carry out orders.
CRYSTAL tries to signal to FITZGERALD through a signal light
0130:34 CRYSTAL bow hits FITZGERALD
Table 3. 1 Proximity Chain of Events [9, 26]
18
Figure 3. 3 Map of the Accident Operation Area [27]
Figure 3. 4 Map of the Sequence of Events That Led to the Accident [27]
19
Figure 3. 5 NTSB map of the collision path between the USS FITZGERALD and ACX
CRYSTAL [13]
20
Figure 3. 6 Image of USS FITZGERALD after docking in port after collision [13]
Figure 3. 7 ACX CRYSTAL after a collision [1]
21
Discussion of the series of events:
The U.S. Navy claimed the weather did not contribute because it was "unlimited visibility:
night" [27]. Additional details contained in the sequence of events include:
Time (24
hours)
Event
2350 No contact reports are made to the CO for delivery as per reporting requirements
0000 Watchteam misses three additional contact reports
0034 The first contact report from the team for the ship at the nearest approach point
1500 yards.
The monitoring team never determines the direction and speed of other ships.
Question asked: Why?
0058 Three additional vessels that passed the reporting criteria without notifying the
CO
0130 Neither FITZGERALD nor CRYSTAL attempt to establish radio
communications, use collision alarms or provide hazard signals
Table 3. 2 Summary of Additional Factors in the Proximal Chain of Events [27]
Events Missing from the Chain of Events:
Three different accident reports (Navy, Japan, and NTSB) on the accident each cover a separate
chain of events that led to the collision. This combined sequence helps to illustrate the image of
the events that led to the accident. The level of detail in Table 3.1 when FITZGERALD first
identified CRYSTAL can be trusted as accurate given the quality of the report. However, the
typical communication flow of the supervisory team cannot be collected from the existing
information. A verbatim report on the communication of the FITZGERALD Bridge team and a
transcript of the communication between the CIC and the bridge will help in understanding what
information is being conveyed by observers. The information in the three reports allows for the
performance of CAST analysis with reasonable accuracy.
22
Chapter 4: Traditional Findings of the FITZGERALD Accident
This section discusses the U.S. Navy's findings about the cause of the FITZGERALD accident.
This is presented prior to the CAST analysis to help understand the traditional findings, which
will allow for subsequent comparisons with the results and recommendations of the CAST. The
U.S. Navy uses the cause-and-effect method to determine root cause findings. The goal is to
determine the root cause of the accident in order to associate it with guilt or possible causes.
USS FITZGERALD US Navy Accident Findings
The U.S. Navy summarized the five "failures" that led to the collision between the USS
FITZGERALD and the ACX CRYSTAL: "safety plan," "adhering to good navigation practices,"
"practicing basic precautionary practices," "using available navigation tools correctly," and
"responding intentionally and effectively when in extremes." [27]. These causative factors are
outlined below, with associated contributing factors. A link to the U.S. Navy's report on the
accident can be found in the references section of this report.
Causal Factors and Contributing Factors
The U.S. Navy determined that many failures occurred on the part of the leadership and supervisors
as follows:
Causative Factor #1 – Failure to plan for safety. FITZGERALD's plan of movement to go south
does not take into account the long days of previous operations, the distance required to travel,
the time for travel, or typical traffic density, nor does it take into account typical traffic flows
around the Traffic Separation Scheme. The operations that FITZGERALD achieved on the
previous day included a successful start from the dock, helicopter operations, and small boat
operations with onboard certification teams from regional training commands.
Related Contributing Factors: poor assessment of risk management and supervisor fatigue
23
Causative Factor #2 – Failure to adhere to good navigation practices. FITZGERALD did not
take the necessary navigational measures to avoid the accident. A series of mistakes led to the
accident. Related Contributing Factors: poor logging, lack of proper reconnaissance, and lack
of Combat Information Center (CIC) navigation performance procedures
Causative Factor #3 – Failure to carry out basic precautionary practices. These failures include
members of the supervisory team who do not maintain proper situational awareness, do not
perform the necessary procedures within the courtroom, and are not in the correct location for
part or all of the watches.
Related Contributing Factors: ineffective training on board, ineffective implementation of
oversight bills, ineffective coordination between bridges and CICs
Causative Factor #4 – Failure to use the available navigation tools correctly. Radar operators do
not adjust the scales appropriately to eliminate clutter and ensure sufficient time to track nearby
ships. Related Contributing Factors: lack of use of Automatic Identification Systems (AIS)
Causative Factor #5 – Failure to respond intentionally and effectively when in extremes. The
bridge crew failed to act when the situation was recognized and failed to use proper sound
signals and alarms, and the rest of the crew was not warned of an impending collision.
Related Contributing Factors: supervisor fatigue
Note that all of these causative factors emphasize what is wrong but not why. Understanding why it
is necessary to prevent similar accidents in the future and to go beyond simply blaming.
HINDSIGHT BIAS
As stated earlier, an important drawback of traditional analysis is that it institutes a retrospective
bias in what the organization could, should, or will do differently to prevent accidents. All of the
causative factors identified in the report are affected by retrospective bias. This section discusses
the retrospective bias depicted in the U.S. Navy's report on root cause findings.
24
Hindsight Bias #1: FITZGERALD should have "planned for safety." [27]. These findings
include not operating at a safe speed, which is defined in Rule Six of the International Road
Rules [27]. FITZGERALD did not plan their path along the Traffic Separation Scheme [27]. The
Traffic Separation Scheme is defined in Rule 10 of the International Road Rules as a helpful
traffic lane on the high seas [27]. This bias indicates what the crew should have done to avoid a
collision. However, these biases do not add value to the analysis because they do not come down
to the root question of why the assigned personnel think the decision is safe. The mistake carries
the implication that the crew does not consider safety as a priority. However, before the collision
the Navigator (NAV) and the Commanding Officer (CO) had to approve the trajectory to be
executed throughout the night. Throughout the documentation, several other leadership
members, including Executive Officers (XOs), commented on the detailed discussions that the
FITZGERALD leadership team had into the oversight team's organization. These discussions are
to ensure safe operation. These examples show that FITZGERALD did develop a safety plan,
but it was not effective at preventing collisions. The lack of a safety plan was only visible
because investigators knew the accident happened.
Hindsight Bias #2: FITZGERALD is supposed to "adhere to good navigation practices." [27]
The U.S. Navy acknowledged in their report that FITZGERALD operated in accordance with
U.S. Navy guidelines for operations between sunset and sunrise by erecting "dark ships" and
"Modified Zebras". [27]. The dark ship allowed the FITZGERALD navigation team to see other
ships more clearly. The modified Zebra FITZGERALD allows for safe navigation by ensuring
the exterior lighting of the FITZGERALD cannot be mistaken for a different type of vessel.
These examples show how FITZGERALD does not neglect safe navigation procedures and
performs routines that allow safe sea navigation. In the report after the collision, the U.S. Navy
highlighted officer Fitzgerald's unsatisfactory knowledge of the International Road Rules [27].
However, the report points to the inclusion of Road Rules and proper navigation training in the
FITZGERALD process. There were three officers on guard, two who were actively conducting
training until just before the collision. This cultural phenomenon of training while on guard will
show a commitment to
25
Upgrades and secure navigation. Collisions happen, and safe navigation errors occur, so it's easy
to blame part of the process.
Hindsight Bias #3: FITZGERALD should have "done basic precautionary practices." [27]. The
U.S. Navy highlighted how the OOD "demonstrated poor seafaring skills" by not changing the
direction of FITZGERALD, not sounding a danger signal, not contacting CRYSTAL on a
Bridge-to-Bridge radio, and not calling CO [27]. The other supervisory team did not provide
backups to the OOD. This lack of reserves includes Combat Information Center (CIC) personnel
who maintain tactical situational awareness [27]. This bias doesn't see why the OOD (or any
other member of the oversight team) doesn't take this action. It's easy to come to think of it, to
look back at the list of things that the supervisory team can do. Come to think of it, it's easier to
see how that action would have prevented an accident. The team focused the action on the ships
that were directly in close proximity. Even in successful situations, the culture of debriefing
operations can find room for improvement. OOD does try to change direction to prevent
collisions. The action was taken too late and proved unsuccessful. This hindsight bias focuses on
blaming individuals and not trying to understand why they believe what they do. Analysis of a
bad guard action is only concluded because losses occurred. Would the U.S. Navy say the
surveillance team was practicing bad practices if the collision hadn't occurred?
Hindsight Bias #4: FITZGERALD should have used better communication [27]. This bias is an
extension of surveillance bias (Bias #3). The bridge team did not communicate among
themselves, and the OOD did not inform the CO of some of the necessary reports [27]. The U.S.
Navy report noted that traffic density was higher than expected, but the bridge team did not
communicate it to the CIC, XO, CO, or ask for outside help [27]. The report outlined that if the
lines of communication had been open, the accident would not have occurred. There are no
examples from the report that show how the supervisors communicate adequately. On the
contrary, through examples of missed communication, it can be seen that the supervisory team
believes that communication is not necessary. As a result, it is biased to look back to claim that
additional communication is necessary to prevent accidents because accidents are known to have
occurred and confidence that communication is not necessary is known to be lacking.
26
Looking Back Bias #5: FITZGERALD narrowly failed the previous month, and leadership didn't
handle it appropriately [27]. The U.S. Navy suggested that leadership could have prevented a
collision with CRYSTAL by identifying the root cause of the near-accident a month earlier.
Almost missing is the same collision hazard and does not result in an accident [27].
The two events have different dynamics and assess the "root cause" because they both categorize
the cause as static. This is biased because if the collision did not occur, the assumption is that the
findings of the previous near-failure report are accurate.2
Hindsight Bias #6: FITZGERALD should have "available navigation tools that are used
correctly." [27]. The U.S. Navy report claimed the supervisors did not use radar properly to
ensure navigation [27]. However, the monitoring team adjusts the direction during the
surveillance based on the data provided by the radar to avoid collisions with different ships [27].
Therefore, the monitoring team showed that they know how to use the navigation tools available
on the bridge to ensure safe navigation. In addition, the crew was blamed for not using the
Automatic Identification System (AIS) [27]. AIS is a system that enables safe navigation by
providing information to other ocean vessels about the ship's location, cargo, destination, and
direction and speed [27]. Not using AIS is a U.S. Navy policy, so blame the supervisors. Both
examples show the supervisors using the tools they have in accordance with the operating
procedures. The hindsight bias is visible because collisions are known to occur so traditional
analysis claims navigation tools are not used adequately even though supervisory teams use tools
for safe navigation on a regular basis.
Hindsight Bias #7: FITZGERALD should "respond intentionally and effectively when in
extremes." [27]. The manifestation of this bias in the lack of change of direction and speed taken
by the bridge team forms a must-have situation. The report showed OOD took action to avoid a
collision. This bias singularly looks at how FITZGERALD and CRYSTAL collide and does not
draw on a complex surface picture of the area or a vessel with an angle of approach similar to
2 This bias is key in demonstrating how CAST is proving to be a valuable model for analyzing accident reports and
determining systemic causes. CAST will show that this bias incorrectly assumes a single root cause and does not
consider the entire system.
27
FITZGERALD. The supervisory team took the action they felt was necessary and appropriate at
that time. The ship was transitioning through a busy shipping lane, so decisions had to be
analyzed under the environment placed around the system.
Hindsight Bias #8: FITZGERALD's leadership did not consider fatigue in the schedule [27].
FITZGERALD's leadership understands that schedule fatigue is common. The leadership
believes that avoiding fatigue means avoiding surgery so avoiding fatigue will prevent the
execution of work. Schedules cannot be executed without fatigue, so FITZGERALD leaders
consider fatigue when planning for navigation safety. Fatigue mitigation is assessed inaccurately
by leaders which can only be seen because accidents are known to have occurred.
Traditional Recommendations
Traditional reports identify training as a major shortage of crew aboard FITZGERALD and
recommend different forms of new training. The Most Recent Surface Force Incident
Comprehensive Review on October 26, 2017 conducted a thorough analysis of the individuals
involved with the accident and their career paths. The review discusses how most on-the-job
training (OJT) is conducted but does not address why on-the-fly training occurs. Therefore,
traditional recommendations recommend increasing the individual training of supervisors to
prevent future accidents. The U.S. Navy's recommendation is to increase the amount of training
conducted before reporting to ships so that OJT, while on alert, can still reflect more realistic
training without interfering with situational awareness.
The US Navy's FITZGERALD crash report did not list any recommendations. The report
focused on finding the cause and blaming the accident. Mistakes are divided into three
subgroups: training, leadership/culture, and burnout. The U.S. Navy's findings blamed the CO
for "poor judgment", crews for being unprepared, and lack of training on CO [27]. The
The U.S. Navy report outlined that the crew lacked understanding of International Rules
28
Road and that the surveillance team violated the rules of safe speed and proper maneuvering,
and did not properly inform the surrounding vessels of dangerous situations [27].
The U.S. Navy also published a Comprehensive Review, which examined several accidents together.
The Comprehensive Review lists recommendations after reviewing several ship collisions based on
common errors observed. The U.S. Navy's recommendations from the Comprehensive Review to
prevent future accidents include:
● Create an assessment program to assess navigation skills at regular intervals for Surface
Warfare Officers (SWOs)
● Improve seafarer and navigation training for all supervisors involved in surface
vessel navigation
● Improving risk management training for SWOs
● Conduct training with current SWOs on how to use all equipment on the bridge
● Develop and implement metrics to evaluate SWOs about sailors and navigation
● Conduct training for surface ship leaders on assessing fatigue, crew rest and stress
management
● Evaluate how to train future officers during the training track on navigation and sailor
practices before going to ship as an officer using available resources such as Yard
Patrol Craft
● Review and update qualification standards for supervisors to ensure proper
training inclusion on all relevant equipment
● Standardization and revision of guidance on how the requalification process works
on surface vessels
● Assessing the number of officers on board by the number of job billets
● Evaluating the training requirements of Executive Officers and Commanding Officers
● Revision of SWO work length to ensure proper training on the first ship
● Develop policies to ensure all personnel piloting ships can demonstrate proficiency
29
Chapter 5: CAST FITZGERALD Analysis and CRYSTAL Collision
The following section contains the CAST analysis of the FITZGERALD collision. The
steps of this method are listed in Chapter 2. Step 4 of the CAST is provided in
Chapter 3 of this report. The recommendations presented in Chapter 7 are combined
with the recommendations found from MCCAIN CAST.
30
Step 1 – Definition and Hazards of the System
System Definition:
The system analyzed in this thesis is the U.S. Navy Navigation System. The system is inherently
operational and sociotechnical in its requirements for safely navigating the open ocean using the
Navy's instructions, requirements, training, and procedures as guiding principles. This system
includes the personnel and equipment necessary to navigate safely at sea. The term "Navigation
System" is used as the composition of personnel and equipment on board the surface ships of the
U.S. Navy.
This report does not analyze the development and engineering of the vessels used to implement
the requirements. That process will require research beyond the scope of this thesis to examine
the requirements and engineering inherent in the design process, along with the integration
between those design decisions and operationalizing them within the fleet.
System Hazards:
To proceed with the process, it is first important to understand what hazards can cause
accidents. A hazard is "a state of a system or set of conditions that, together with a particular set
of worst-case environmental conditions, would cause an accident." [19]. The event of concern is
the damage to
U.S. Navy ships, damage to U.S. Navy equipment, and injuries/loss of personnel. From the
perspective of surface ship navigation, the danger is [5]:
1. A ship collides with another ship - collision
2. A ship allied with a fixed object - an allision
3. A ship lands on the seabed - grounding
This analysis investigates the danger of ships colliding with other ships.
31
Step 2 – System Security Constraints and System Requirements
System Security Constraints:
The system-level constraints required to prevent collision hazards are:
1. The Navigation System cannot navigate in the collision lane.
2. The Navigation System must properly notify other vessels of dangerous
intentions and situations.
System Requirements:
Navigation System requirements to prevent collisions and ensure safe navigation include:
1. The Navigation System must be able to control the ship, precisely controlling the speed
and direction.
2. The Navigation System must have the ability to communicate between ships.
3. The Navigation System must identify the surrounding vessels regardless of the environment.
4. Navigation System procedures must exist to recognize equipment malfunctions,
correction procedures, and mitigation plans.
32
Step 3 – Hierarchical Safety Control Structure
The Navigation System Safety Control Structure is shown in Figure 5.1. This Control
Structure is formed based on input readings from the OPNAVINST 3120.32 and
OPNAVINST 3530.4F Series for the Condition III readiness level (links to this U.S.
Navy publication are found in the references section of this report). The Condition III
readiness level is a form of the U.S. Navy's Model Navigation System Control Structure
aboard surface ships.
The roles and responsibilities for the Navigation System Control Structure are:
Commanding Officer (CO) – Responsible for the overall performance of the vessel.
The CO is responsible for ensuring the necessary missions are carried out, that the ship
complies with all U.S. Navy policies, and navigates safely at sea.
Executive Officer (XO) – Responsible for administrative duties on board the ship and is
the second person in charge. XO is also responsible for all maintenance and training on
board. XO serves as an advisor to the Deck Officer.
Navigator (NAV) – Responsible for the navigation department on board the ship
and generating navigation plans.
Engineering Department – Responsible for the maintenance and upkeep of all
engines, generators, steering, and related auxiliary equipment.
Officer of the Deck (OOD) – The direct representative of the CO on the bridge and is
responsible for running the Navigation System to operate safely at sea. OOD leads the
Bridge personnel in the safe conduct of the ship's navigation, the team includes Junior
Deck Officers, Conning Officers, Guard Quartermasters, Boatswain Mate of the Watch,
scouts, and helmsmen.
Junior Officer of the Deck (JOOD) – Responsible for operating radar on bridges and
communicating with other vessels via Bridge-to-Bridge radio telephones. JOOD also
completes the necessary checklist related to the completion of different operations.
33
Conning Officer (CONN) – Responsible as the primary reconnaissance with sight and
hearing for other ships. CONN gives commands to the helmsman on the path required
to steer the boat and the required engine speed.
Quartermaster of the Watch (QMOW) – Responsible for ensuring the Deck Officer
follows the Navy's navigation plan. QMOW operates ship navigation lights, daylight
forms, flags, fathometers, and Shipping Management Systems.
Boatswain Mate of the Watch (BMOW) – Responsible for managing the enlisted
members of the watchdog team. BMOW also operates Ship Whistles, ship-wide
announcement circuits, and ship-wide alarms.
Scouts – Responsible for identifying other vessels in the area and relaying to the
CONN and OOD of any vessels they identify.
Helmsman – Responsible for carrying out the necessary lane and speed changes given
by CONN. The helmsman operates the steering wheel and engine system.
Tactical Action Officer (TAO) – Responsible for the tactical use of the ship's weapon
systems. When necessary, TAO will direct the ship's OOD maneuvers to use the
weapon system.
Combat Information Center Supervisory Officer (CICWO) – Responsible for leading
Combat Information Center (CIC) personnel and responsible for coordinating with
Bridges to ensure safe navigation. CICWO also maintains a secret communications
network.
Surface Warfare Coordinator – Responsible for managing surface radar contact
images and coordinating with CICWO and TAO to report ships to the Bridge.
Shipping Officer – Responsible for working with the Surface Warfare Coordinator to
track surface contact images.
Note, the figures in this step were created and developed to support this thesis.
42
Figure 5. 1 USS FITZGERALD Compiled Navigation System Safety Control Structure
43
Step 5 – Analyze Physical Processes
Physical Controls and Safety-Related Equipment
Safety Requirements and Obstacles Violated:
Physical equipment must notify supervisory personnel of hazardous conditions (radar alarms).
The radar and Cruise Management System at FIZGERALD gave no indication of the collision
path.
Emergency and Safety Equipment (control):
The following includes a list of equipment available to ensure safety, and a brief discussion is
included with the equipment to understand the use by the personnel involved.
Navigation Lights – The U.S. Navy report discusses that both ships have proper lighting
equipment through their Navigation Lights. These lights are present to help sailors identify other
vessels in periods of low visibility, including the hours between sunset and sunrise.
Radar - Both ships have an operational radar system. The radar transmits energy and then, based
on the return of that energy, plans assistance for the possible navigation of ships and other
objects in the vicinity. FITZGERALD has a radar repeater through which some stations can see
the traffic picture [21]. Prior to the collision, equipment reports at FITZGERALD did not list any
radar as inoperable.
Question asked: Why don't any sailors pay attention to CRYSTAL on radar repeaters? Is the
operator inattentive? What is the process for ensuring that radar equipment is adequately
adjusted? Can the operator know if the radar is working correctly?
Shipping Management System – This system is an electronic charting system used to navigate
safely at sea with the integration of different sensors. The system uses the Global Positioning
System (GPS) as input to show the valuable location of the ship on a graph. The radar is
44
other inputs to the system. This input allows the operator to know the exact location of the
vessel.
Automatic Identification System (AIS) - This system is operated by each vessel broadcasting
information on a shared server to other vessels. This information includes the name of the ship,
origin, destination, course, and speed. The definition of this system is available via the internet
at: www.marinetraffic.com. I n a c c o r d a n c e w i t h t h e U . S . N a v y ' s p o l i c y a t t h e
t i m e o f t h e i n c i d e n t , F I T Z G E R A L D d i d n o t b r o a d c a s t i n f o r m a t i o n
t h r o u g h A I S . F I T Z G E R A L D o p e r a t e s i n r e c e p t i o n m o d e . I n t h i s
m o d e , F I T Z G E R A L D c a n s e e o t h e r s h i p s b r o a d c a s t i n g t h e i r
information, but FITZGERALD does not send information to other
s h i p s .
Question asked: Why are no operators paying attention to CRYSTAL at AIS? It seems that the
equipment is not used at all. Why is the US Navy's policy not broadcasting with AIS?
This report should note that there are other safety equipment on each vessel. However,
the equipment was not directly related to this victim. These include fathometers,
electronic graphs, GPS, flag signals (daytime), various forms of radar, and related radar
functionality.
Failures and inadequate controls:
Failure is related to the specified requirements and shows a correlation between inadequate
controls and the definition of requirements. No physical control fails.
● Indication of inadequate collision path: The radar does not notify the operator with
enough time and space to maneuver to avoid a collision.
● Indication of insufficient collision path: AIS does not notify the operator of the
collision path.
● Inadequate collision path indication: The Cruise Management System does not
provide an indication of the collision path.
45
Dangerous circumstances combined with the operating environment resulted in casualties. An
important environmental factor is the scenario that occurs at night, the sea is relatively calm,
46
The location is close off the coast of Japan, and there is good visibility with visible moonlight.
The location off the coast of Japan is a high-traffic density neighborhood known for the many
ships in the area. By understanding these factors, we can draw the conclusion that the accident
may not have occurred in the Pacific open ocean, miles away from land and with less traffic
density.
Physical Contextual Factors:
● No equipment is listed as unavailable or with an error
47
Step 6 – Analyzing the Higher Level of the Safety Control Structure
Safety Control Structure Analysis
The following is a detailed analysis of the key individuals of the Control Structure atop
FITZGERALD. The analysis will identify each individual, describing each individual's
responsibilities, and their role in the accident. The analysis will raise questions to identify the
weaknesses of the operator's process model (mental or belief model). These questions allow the
analysis of this work to read beyond the commonly used surface-level chain of cause and effect.
48
Individual:
Commanding Officer (CO)
Individual Description:
CO is the most senior member above FITZGERALD and is assigned as an officer in the
U.S. Navy in 1999. CO previously served as XO aboard FITZGERALD from November 2015
to March 2017 and took command in May [21]. The CO completed the necessary Navy training
before taking over command.
Liability related to accidents:
The CO "is ultimately responsible for the assigned unit and personnel" [29]. "The commander is
charged with absolute responsibility for the safety, welfare, and efficiency of the ship and crew
until properly released by the competent authority" [29]. This description within the Navy placed
a heavy responsibility on the CO to understand everything on his ship. The Standard
Organizational and Regulation Manual (SORM) further instructs the CO to ensure the crew can
perform their duties. The CO approves the guard personnel and approves any vacant supervisory
posts.
Role in accidents:
CARD YES:
● Falling asleep at the time of the accident.
● Approved the law of no-harbor surveillance and right reconnaissance on bridges,
contrary to what is outlined in OPNAVINST 3530.4F.
● Approve the surveillance bill does not have a radar operator in the Pilot House
communicating with the CIC [27].
● Approved a speed of 20 knots for transit across the Traffic Separation Scheme within a
busy shipping lane to the south for further operations.
● Not properly assessing the risk at night while across the Traffic Separation Scheme.
● It does not identify the shortcomings of the supervisory team's performance.
● Not ensuring adequate training for the supervisory team.
49
● It does not identify the lack of proper use of equipment (radar) in maintaining
safe navigation.
● Approve the supervisory team to navigate without CO or XO on the bridge safely.
Why?
Beliefs that contribute to behavior:
The CO trusts the supervisory team to navigate through the night safely [3]. The CO had given
the trust to leave the bridge to OOD to navigate safely, allowing him to rest before the next day's
operation. CO believes OOD is safe and it will be more productive for him to rest.
Question asked: What actions does OOD take to contribute to CO trust? What is the standard
process involved for CO to determine the ability to leave the bridge?
CO is used to on-the-job training and is part of a normalized structure on board
U.S. Navy ships. Therefore, the CO assessed the on-the-job training conducted by the two
officers on guard, and did not see the risks involved.
Question asked: How did the CO make that decision? What factors are involved in the
decision-making process?
Contextual Factors:
CO left the bridge late at night after the day's operation, he had been on the bridge for more
than 12 hours. The previous day's activities included departing from the pier in
Yokosuka, Japan, anchoring, small boat operations, and helicopter operations. These
tasks all require the presence of the CO. CO knows and approves the night's navigation
plan and transit speed. CO also knew the supervisory team as he left the bridge when the
team during the accident was on the bridge. Since CO was previously XO aboard the
FITZGERALD, he has experience in this field having previously served on the ship for
almost two years. The CO must certify each OOD. CO assesses OOD's understanding of
actions for
50
take to avoid collisions and adequate knowledge of International Road Regulations prior to
certification.
Question asked: Why didn't the CO put an XO, Navigator, or some senior supervisor on the
bridge to help navigate the busy shipping lanes? Why don't the port of the CO station and the
right reconnaissance help identify other ships? Is this a standard operating procedure?
About 30 minutes after midnight (one hour before the accident), the OOD made a contact report
to the CO; This report allows the CO to reaffirm confidence in the OOD decision-making
process.
Question asked: Does the conversation include permission to restrict contact report criteria?
Does the CO anticipate reports when crossing busy traffic lanes?
CO was on the bridge until 2300 o'clock, 2.5 hours before the accident. Based on the sequence of
events for the day, CO had been on the bridge for most of the day. This includes an hour-long
overlap with the last team before the collision.
Question asked: Does the CO accept the JOOD culture of training Konning Officers without a
proper scout presence? Does CO use radar equipment on bridges? Did the CO notice the bridge
team did not use radar equipment?
CO, XO, and Navigator leave the bridge within five minutes of their respective departures.
Question asked: Are these joint departures planned? What is a dynamic group when on a
bridge? Do they talk among themselves? Do they pay attention to the navigation situation?
The OOD makes one required report to the CO before the collision. This report is not about
CRYSTAL. The report contains a standard contact report that informs the CO
51
AN OVERVIEW OF SITUATIONAL TRAFFIC DENSITY AROUND FITZGERALD.
The proximal timeline outlines how some of the required reports were not provided to
the CO during the time prior to the accident. CO was asleep and didn't know the report
was missed.
Question asked: Is this the standard report volume for Transit Traffic Separation Scheme? Does
the CO provide additional guidance or commands to the OOD at the end of the conversation?
What additional guidance does CO provide to OOD? What does OOD communicate in the
report?
52
Individual:
Executive Office (XO)
Individual Description:
XO joined FITZGERALD in March 2017 and has served in the Navy since 1999 [21]. XO has
been part of a previous trip that has managed to navigate the same area as the accident on two
previous occasions [21].
Liability related to accidents:
The role of the XO is also outlined in the SORM to "supervise and coordinate the work, training,
training, and education of command personnel" [29]. "The executive officer is the direct
representative of the commander and should be responsible primarily to the commander for the
organization, execution of duties, training, maintenance, and good order and discipline of the
entire command" [29]. "Evaluate the performance of officers and enlisted personnel and make
recommendations to commanders regarding their promotion and advancement" [29].
Role in accidents:
XO CARD:
Not being on the bridge at the time of the collision.
Review the plan for the night and agree on the intended action.
● Not providing feedback to the CO on the performance of the OOD.
● Not ensuring proper oversight of OOD.
Why?
Beliefs that contribute to behavior:
Based on XO's actions, he felt comfortable leaving the bridge and resting for the night. He had
been on board the FITZGERALD for several trips and saw it as a great window of opportunity
to rest after a busy day.
53
Question asked: Is this the standard operating procedure for XO?
XO believes the Deck Officer is a safe and secure navigator to leave the bridge. XO expressed
some doubts about OOD's capabilities, but believes there are ways to mitigate risk with other
members of the supervisory team. XO believes that the supervisory team has satisfactory
knowledge of the International Road Rules.
Question asked: How does XO assess the level of knowledge of supervisors? Does XO believe
the training regime is adequate?
XO believes that there is feedback between CIC and the Pilot House. This belief led to his
approval of the supervisory team.
Question asked: What events developed this belief? It is believed that the XO process model
includes redundancy through stronger operators in favor of weaker operators. Is it a typical
process model? How many other examples are there?
Like CO, XO has an inaccurate assessment of the daily schedule as safe. It is common to
operate at a high cadence of activity with long days, the CO mental model assesses busy days as
routine and accepts the risks.
Question asked: Why are there no changes to prevent surgical fatigue acceptance?
Contextual Factors:
XO was on the bridge until 2305 hours, 2.5 hours before the accident. He had been on the bridge
for most of the day before leaving to sleep. This included an hour-long overlap with the last team
before the crash.
54
Question asked: Does XO accept the culture of JOOD training Konning Officers without a
proper scout presence? Does XO use radar equipment on bridges? Did XO notice that the bridge
team did not use radar equipment?
XO does not trust OOD [21]. The report outlines how six different iterations of teams existed
before they began to reduce the lack of experience at a particular supervisory station with
experience at another station.
Question asked: Did the XO voice these concerns as feedback to the CO? Does XO communicate
this to OOD? What steps has XO taken to correct the level of knowledge and acuity of OOD?
Why didn't XO stay on the bridge if he didn't trust OOD?
The next day's schedule includes technical exercises starting at 0600 [21]. XO mentioned this as
a thought process for him to leave the bridge to rest before the next day's activities.
Question asked: Was XO not alone in his decision to prioritize sleep over safe navigation? Is
this due to the high load of activity on the crew? Is there a sufficient rest cycle for the observed
crew?
CO, XO, and Navigator leave the bridge within five minutes of their respective departures.
Question asked: Are these joint departures planned? What is a dynamic group when on a
bridge? Do they talk among themselves? Do they pay attention to the navigation situation?
55
Individual:
Tactical Action Officer (TAO)
Individual Description:
SORM outlines the overarching duties of the TAO: "The TAO is the commander's representative
regarding the tactical and defensive work of the unit" [29]. "The TAO is responsible for the safe
and effective operation of the unit's combat systems (including aircraft under the tactical control
of the unit) and for other tasks specified by the commander. TAO is responsible for the smooth
and efficient operation of CIC, including the collection, display, and dissemination of tactical
data and other operationally important data..." [29].
Liability related to accidents:
The TAO is responsible for supervising personnel assigned to guard within the CIC to provide
backups for safe navigation to the bridge. TAO is responsible for supporting OOD when in
doubt.
Role in accidents:
TAGS:
Does not communicate with the OOD through the watch to prevent accidents, lost
feedback loops for safe operation.
● Not forcing a proper change of watch (the guard is allowed to go to the bathroom)
● Not enforcing proper supervision measures within the CIC.
● Not using the necessary controls as a senior member on guard.
Why?
Beliefs that contribute to behavior:
TAO believes that CICs do not participate in safe navigation and that OODs do not require
feedback from CICs. TAO believes the performance level of OOD and Pilot House-Bridge
Team is safe.
56
The question asked: What events gave rise to this belief? Why doesn't TAO communicate at all
with the bridge?
Not assessing the lack of communication between Pilot House and CIC as risky and not
enforcing feedback loops.
Question asked: What does TAO assess as a function of CIC personnel during supervision?
TAO believes that the performance of the CIC supervisory team is adequate.
Question asked: What do CIC personnel do to contribute to this belief? Administrative work and
training equipment do not convey a focused group. What mental model does TAO have to
compare personnel performance?
Contextual Factors:
FITZGERALD was not in a tactical operating environment during the collision. Therefore, TAO
focuses on the tasks related to the day-to-day work of serving as the Head of the Operations
Department. TAO has a stack of documents on the console and [34]. distracted by the
administrative duties of the TAO department head role (ordinary day-to-day work). Additional
material evidence throughout the room suggests that TAOs do not require those within the CIC
to perform their duties. Investigation after action found the CIC to be a mess, with garbage, urine
bottles, kettlebells, food, and the smell of urine throughout the room [34].
Question asked: How common are TAOs distracted by other tasks when they are required to
perform tasks related to ship safety? Is this a common occurrence for other DAOs? Why is there
training equipment in the space dedicated to the ship's navigation and tactical engagement? Is
this a standard operating procedure? Is there any external pressure that forces this behavior?
57
The CO Standing Order requires the CIC to take action to track and manage surface contact
images and when there is a situation, communicate it to the bridge [21]. These reporting criteria
form the feedback and communication loop between the CIC and the bridge. The interview
showed a lack of necessary feedback between the two teams. The order remains burdensome on
the OOD by ensuring communication agreements. TAO is also aware of these requirements.
Question asked: Why doesn't TAO enforce standards? Is it any other communication with TAO
that distracts TAO from surface navigation images? Is TAO always aware of when reports come
into the bridge? Does TAO delegate any responsibilities to other supervisors at CIC?
58
Individual:
Combat Information Center Supervisory Officer (CICWO)
Individual Description:
The CICWO oversees the CIC explicitly targeted on "combat and tactical information affecting
safe maneuvers and navigation" [29]. The CICWO must also ensure that personnel report all
vessels and necessary contacts as per the situation [29]. In particular, the CICWO should advise
OODs and provide recommendations for safe navigation, including changes in direction or speed
[29].
Liability related to accidents:
The CICWO is responsible for supervising the personnel on guard inside the CIC to provide
backups for safe navigation to the bridge. CICWO is responsible for the correct process model
to support OOD when there is doubt.
Role in accidents:
The CICWO:
Not fulfilling the responsibility to provide reserves to the bridge.
does not impose the requirements of the supervisory team in the CIC.
Not effectively managing the supervisory team to ensure members carry out the
required tasks.
Didn't make a report going to the bridge [21].
Why?
Beliefs that contribute to behavior:
It is evident from the interviews that CICWO felt it was not in the job description to provide
timely surface contact information to the bridge to aid safe navigation. Based on the lack of
action, CICWO believes OOD does not require a backup from the CIC for safe navigation.
CICWO has an inaccurate understanding of the role of CIC. CICWO assesses the performance
of the supervisory team to be adequate.
59
Question asked: Why does CICWO trust this inaccurate mental model of the system? What inputs
resulted in the CICWO model?
Contextual Factors:
CICWO, in many situations, is guided by TAO as another officer on guard within the CIC.
CICWO learns how to work in CIC Elements from TAO.
Question asked: Did CICWO learn from some DAOs? What is the relationship between TAO and
CICWO?
The contextual factors found for TAO were applied to CICWO: Investigation after action found
CIC to be messy, with garbage, urine bottles, kettlebells, food, and urine odors throughout the
room [34]. The same question was asked about CICWO. The report adds additional context to
TAO with the documents that are within the CIC, adding to the knowledge of TAO's beliefs.
There is no additional information about CICWO.
Question asked: What does the CICWO actively do during the surveillance? Where is the
CICWO within the CIC during surveillance?
60
Individual:
Surface Warfare Coordinator (SUWC)
Individual Description:
The Surface Warfare Coordinator is in charge of monitoring the surface search radar, and the
optical search system that is on board the FITZGERALD to effectively manage surface contact
images. Liability related to accidents:
Assisting TAO and CICWO in managing surface contact images [29].
Role in accidents:
Koordinator Surface Ware
Returned from the toilet and saw CRYSTAL on camera just before the accident [21].
● Not communicating other vessels operating in the vicinity to the monitoring team.
Why?
Beliefs that contribute to behavior: Through actions, the watchdog sees no added value by
the watch for safe navigation. Does not rate the watch as one that contributes to the required
feedback in the Navigation System Control Structure.
The question asked: Do all Surface Warfare Coordinators think in this mental model? Was there
an event that moved the overseer from a support role to this trust?
Contextual Factors:
The Surface Warfare Coordinator is a watch that supports bridges and provides reserves to
overseers. The information available by the superintendent is the same that is available for the
bridge. The supervisor recognizes the contact per radar imaging but does not communicate it
within the CIC or bridge [21]. This is evident throughout the watch, not only in the incidents that
led to the accident with CRYSTAL.
61
Question asked: Why didn't the supervisor report anything?
Seven supervisors inside the CIC observed contact images, but no reports to the bridge were
made. This factor falls under the Surface Surveillance Coordinator, as the sole individual
responsibility is to provide backup information to the bridge on the surface contact drawings.
Question asked: What culture or deviation from the control structure exists within the CIC where
seven people do not provide the necessary information to the bridge?
The report states that radar images were not properly adjusted aboard the FITZGERALD and
did not show CRYSTAL [10].
Question asked: Is this only for the bridge or does it include radar at the CIC? What process
does the Surface Warfare Coordinator use to verify proper radar tuning? Is there a standard
process?
62
Individual:
Perwira Dek (OOD)
Individual Description:
OOD was commissioned in the Navy in 2014 and has been aboard FITZGERALD since May
2016, with some previous experience in the crash area [21].
Liability related to accidents:
"The ongoing OOD is appointed by the commander to be responsible for the ship's safe and
proper operation including its safe and proper operation" [29]. The responsibilities of the OOD
are very inclusive, as outlined in the U.S. Navy's CO and SORM Standing Orders. The SORM
highlights the breadth of duties as: "be aware of tactical situations and geographic factors that
may affect safe navigation and take action to avoid the danger of landing or collision following
tactical doctrine, the U.S. Coast Guard Road Navigation Rules, and the orders of the commander
or other appropriate authority." [29] The SORM further directed the OOD to issue orders to
control the engines and rudder in the event of danger while also being aware of the ship's
operational plan. SORM requires OODs to report to the CO [29].
The OOD is responsible for supervising the bridge's personnel [29]. The OOD is responsible for
managing the announcement circuit, including the ship's alarms [29]. The ship had general,
chemical, and collision alarms.
Role in accidents:
The OOD:
Not making all the necessary reports made to the CO leading to the collision [21].
Do not sound the alarm before or immediately after a collision.
Do not use AIS in any capacity.
Not maintaining communication between him, his bridge monitoring team, and the CIC
team to understand the full scope of other surface vessels in the region. This lack of
communication leads to a lack of time available to make effective changes to prevent
collisions. The bridge team acted but did not have enough time to avoid CRYSTAL.
63
Not maintaining proper supervisor control over bridge team members Not acting when
JOOD recommends it.
● Not informing CIC of the bridge's decision.
● Not taking adequate measures to avoid collisions.
● Not effectively communicating the action with the surrounding ships.
● Not properly utilizing bridge resource management to employ all team members
effectively in maintaining safe navigation.
● Taking the wrong action to maintain safe navigation.
Why?
Beliefs that contribute to behavior:
OOD stated he had little trust in CIC [34]. This belief helps explain OOD's thought process
and why he did not enforce the communication network between the CIC and the bridge.
This lack of enforcement provides evidence of why feedback was not present on the night
of the accident. OOD believes CIC assistance is not necessary for safe navigation. OOD
believes no outside assistance is needed to safely navigate high-traffic neighborhoods.
Question Asked: Why don't OODs trust CIC? Is it individual specific? Does OOD bring this to
TAO, XO, Navigator, CO, or other individuals in supervisory team oversight roles? Is the lack of
trust due to previous experience? Is it a lack of trust among other OODs or just this individual?
Is this comment addressed to the entire CIC team? To TAO? Is it about all CIC teams or exactly
the ones he oversees? Is TAO aware of this lack of trust? How often do CICs and Bridges
communicate? Asking these questions is a valuable insight when examining systemic damage in
feedback networks in control structures.
OOD states that radar contact is CRYSTAL based on location and radar results [21]. OOD stated
he did not see the second contact, so OOD shifted direction to avoid
64
contacts that he saw [21]. This evidence shows how the OOD's mental model is to handle the
surface traffic density that he or she can detect.
Question asked: What is the normal process that OOD takes to maintain the correct process
model? Does OOD perform standard processes? What processes does OOD use to validate
radar and visual recognition?
OOD believes 20 knots are safe to cross the Traffic Separation Scheme.
The question asked: Was this route successfully navigated at that speed before?
OOD believes the supervisory team operates safely and in accordance with the International
Road Rules. OOD believes that taking the action it takes will avoid collisions and that JOOD
recommendations are not safe for navigation. OOD believes the JOOD recommendation will
worsen the situation.
Question asked: Is it standard practice for OODs not to follow feedback from JOOD? Are there
any other controllers that OOD doesn't follow the feedback on? What situations develop the
tendency of OOD to operate independently of other operators on the supervisory team?
Contextual Factors:
There is no equipment on the FITZGERALD bridge that is not available [21].
OOD stated in an interview that he had woken up at 0400 the day before the accident occurred
(the day of travel), and had taken a nap for an hour before taking the clock at 2200 the day
before the collision [21]. Combined, OOD had 3.5 hours of sleep in the 24 hours before the
accident.
65
Question asked: Was sleep deprivation a factor in poor OOD decision-making and lack of
CRYSTAL identification? Does fatigue affect the OOD mental model of the Navigation System?
None of the reports or interviews indicate that any supervisor on board the FITZGERALD
consults with AIS on a regular basis as part of the surveillance process.
Question asked: Why doesn't the monitoring team use all the equipment available to maintain
safe navigation?
66
Individual:
Perwira Junior Dek (JEW)
Individual Description:
JOOD during this incident was commissioned in the Navy in 2012 and has been aboard
FITZGERALD since September 2016. JOOD had been on board while on the way, but was not
on guard on the bridge in the collision area.
Liability related to accidents:
"JOOD, when assigned, is OOD's main assistant." [29]. On board the FITZGERALD, JOOD
was explicitly tasked with tracking radar contacts and managing the nearest approach point
(CPA) for traffic management [21].
Role in accidents:
The JOOD:
● The radar is not set correctly.
● Doesn't minimize clutter on radar display
● Not identifying all other vessels operating in the environment.
● Failing to adequately maintain radar contact images.
● Not providing feedback to the OOD on the requirement to provide a contact report to the
CO.
Question asked: Why did JOOD train CONN? Why doesn't JOOD monitor radar imaging? Is
anyone tasked with managing radar imaging when JOOD trains CONN? This surveillance team
stands guard while CO, XO, and Navigator remain on the bridge. Does leadership provide
support or direction when this is happening?
Does CONN have the necessary skills and knowledge base to effectively be on guard if CONN
requires consistent training by JOOD? What is the functional relationship of OOD and JOOD?
Is this relationship standard? What training and certifications does JOOD receive to operate
radar systems?
67
Why?
Beliefs that contribute to behavior:
JOOD felt the need to train CONN. JOOD believes it is safe to train CONN given the operating
environment and the surrounding ships. The use of OJT is typical on board FITGERALD and
JOOD believes that the situation has value for training.
JOOD gave feedback to OOD on the actions required for safe navigation on one instance due to
its proximity to CRYSTAL [21] and, he urged OOD to slow down [21]. Feedback is rejected,
and JOOD does not force action to fulfill its own beliefs about safe navigation requirements.
JOOD believes OOD judgment is superior.
Question asked: Was the OOD assessment proven correct in previous situations? What previous
events led to JOOD receiving rejection of its recommendation?
Contextual Factors:
JOOD is a supervisor who learns and gains experience to be certified as an OOD. The role of
JOOD is to help OODs to learn how to become OODs.
Question asked: How close is the JOOD qualification?
68
Individual:
Konning Officer (CONN)
Individual Description:
Commissioned in January 2017, FITZGERALD was its first ship, and it was the first watch in
the area [21]. This entry-level watch is the first watch that the current superintendent has.
Liability related to accidents:
CONN is responsible for relaying steering and propulsion commands from the OOD to the
helmsman and helmsman Lee [21]. CONN is also responsible for serving as a scout for the
supervisory team.
Role in accidents:
CONN Card:
● Not recognizing CRYSTAL in time to develop and implement a plan to avoid
collisions.
● Not giving enough commands to avoid a collision to the steering wheel.
Why?
Beliefs that contribute to behavior:
CONN believes that conducting training in the workplace makes it possible to maintain
situational awareness, believes that he has the necessary experience to be on guard, and believes
that he has the necessary training to be on guard. CONN believes receiving on-the-job training is
acceptable given the traffic density situation.
Question asked: How much training does CONN receive before the watch? Is this number
typical of other Fraud Officers?
Contextual Factors:
69
CONN is still learning how to be a wise sailor at the time of the collision. The U.S. Navy report
highlights how the CONN is an entry-level role for new officers aboard surface ships. This role
allows for training and experience of junior supervisors early on with their time on board. The
Surface Warfare Officer's career path required a Deck Officer's letter, and that training path
began with a watch as a Teaching Officer [5]. CONN is incentivized to learn as much as possible
to accelerate the training process to become an OOD. Evidence suggests that it was one of the
first CONN watches and was the first in the region.
The surveillance time is 2200-0200, after a day when the ship departs from the port and
undergoes some evolution such as helicopter and small boat operations.
Question asked: Is this his first watch? Is this his first night neighborhood surveillance? What
controls were in place before he picked up this watch? Is CONN involved in other operations
throughout the day?
CONN and JOOD were training on the Port Bridge wing before the crash. The accident occurred
from a crossing situation with CRYSTAL on the right side of FITZGERALD. CONN served as
the only forward reconnaissance aboard the FITZGERALD.
Question asked: Does CONN periodically move to the right side of the ship to assess traffic
density? Is there a process for determining periodicity?
70
Individual:
Boat Supervisor Pair (BMOW)
Individual Description:
Joined the Navy in July 2006 and reported to FITZGERALD in May 2015.
Liability related to accidents:
The BMOW is responsible for supervising the spotter, QMOW, helmsman, announcement
system, and telephone speaker [29]. Manage the enlisted members of the bridge team, including
helmsmen and QMOW.
Role in accidents:
The BMOW:
● Step in to carry out the orders given by the OOD immediately before the accident.
● Not providing feedback to the supervisory team on the performance of the observers.
Why?
Beliefs that contribute to behavior:
The BMOW believes he should intervene to help carry out the steering and engine commands
given by the OOD because the helmsman was slow to respond. This immediate action shows the
confidence of the BMOW that quick action is needed because the ship is in an extreme state.
BMOW believes the helmsman is skilled before taking the reins.
BMOW believes it is not his role to provide feedback to OOD. The BMOW is responsible for
maintaining enlisted members, not guard officers.
Question asked: Do all BMOWs believe that their role does not include feedback to OOD? What
training is provided to enlisted personnel to provide feedback to officers?
Contextual Factors:
71
The BMOW is the primary supervisory position and is responsible for ensuring good order and
discipline among the enlisted members of the supervisory team. No evidence has been found
that finds a culture of disobedience among enlisted members.
BMOW is a qualified helmsman with years of experience from a vigilant helmsman.
72
Individual:
Watch Quartermaster (QMOW)
Individual Description:
QMOW joined the Navy in 2002 and reported to FITZGERALD in September 2016; Previous
experience primarily includes Virginia-based ships deployed to the Mediterranean Sea and
Arabian Gulf [21].
Liability related to accidents:
The watch quartermaster is responsible for supervising the helmsman, maintaining deck logs,
and navigation issues [29]. QMOW is the navigator representative on the bridge to assist with
safe navigation as per charts and navigation commands.
Role in accidents:
The QMOW:
1. Not providing feedback to the OOD (or senior leadership) on lack of compliance with
the Rules Handbook and Navigation Regulations or the CO Standing Order.
● Didn't notify the Navigator of unsafe actions in the Pilot's
Home Why?
Beliefs that contribute to behavior:
QMOW believes an increase in speed to 20 knots is necessary to meet night navigation
requirements for the meeting position at 0600. QMOW assumes that the supervisory team
maintains proper situational awareness.
Contextual Factors:
The navigator (the officer responsible for running all the quartermasters on board) was on the
bridge for approximately an hour on guard. The action taken by the QMOW is deemed adequate
for the navigator to leave the bridge for the remainder of the surveillance. QMOW has
73
an additional role in ensuring safe navigation, such as regularly checking the weather and bridge
equipment to ensure they are functioning properly.
74
Individual:
Helmsman
Individual Description:
The helmsman joined the U.S. Navy in 2015 and reported to FITZGERALD in April 2017 [21].
Liability related to accidents:
The helmsman is responsible for carrying out the steering and propulsion orders given by the
Police Officer [21].
Role in accidents:
Helmsman:
● Not taking adequate action.
Why?
Beliefs that contribute to behavior:
The helmsman believes that he has the necessary experience to be on guard.
Question asked: How much previous experience does the helmsman have? Is this the first watch
to qualify as a helmsman? How much experience do helmsmen gain while in training? Do the
helmsman's prowess represent the other helmsman on top of FITZGERALD?
Contextual Factors:
The helmsman performs the duties required by CONN and OOD on previous watches. On this
watch the BMOW had to release him because he did not perform the act adequately. A review of
FITZGERALD's position until the collision shows how the helmsman carried out steering and
propulsion commands immediately and kept the ship going in the direction ordered until
immediately before the collision. The helmsman observes the gauge inside the bridge and does
not have a special window to look outside. As a result, the helmsman is not a member of the
75
A supervisory team that can provide strong support or feedback regarding the radar or visually
identified vessel.
Enlisted members of the supervisory team rotate between roles for five hours of supervision. No
port or right reconnaissance was stationed at FITZGERALD. No discussion was made about the
envoy supervisors being deployed to assist the BMOW.
Question asked: Why are there limited enlisted guards on the bridge? Is it a shortage of
personnel? Lack of qualifications? Is this just a standard surgical procedure in the operating
area? How many hours of vigilance does that person stand as a helmsman?
76
Step 7 – Overall Communication and Coordination Examination
Possible Controller Lost
CAST reports analyze human operators, managers, and organizations and examine automation
and other areas of control systems. This accident does not list any technological issues with the
equipment; everything works as designed. Based on the analysis, AIS is present on
FITZGERALD but not used. The AIS was identified with CAST as a possible missing
controller.
Communication and Coordination:
There are two possible forms of communication at the time of an accident: communication on
board each ship and communication between each ship. The tertiary form of communication is
between the other regional vessels and the two vessels involved in the collision. There is enough
information available from the reports available to understand the effectiveness of these
communication techniques before and during the event.
Of the two possible forms of communication, the CAST analysis proves that there are several
examples of ineffective communication above FITZGERALD.
1. Lack of communication between the Bridge and the CIC. The operator's confidence in
FITZGERALD explains the inadequate communication because the OOD does not trust
the CIC. This belief shows why Bridge did not call the CIC. In addition, CIC personnel
who believe they are not responsible for safe navigation help explain the lack of
feedback from CIC to the Bridge. Sound circuits operate during accidents and are not
degraded [21].
2. The lack of communication between the Bridge's own personnel is due to no bad
weather or noise to prevent this communication.
3. Reports that were missed to the CO from the OOD, which were not submitted at all.
4. FITZGERALD does not use its internal alarm network to warn the crew of an
impending collision.
77
These examples prove there is an opportunity for better communication on board the
FITZGERALD.
The second form of communication that is important for analysis is communication between
ships. There are several examples that show FITZGERALD and CRYSTAL are not utilizing
their communication effectively. Navigation Rules and Regulations established lights, day forms,
and sound signals as effective means of communication between ships, as all ships had to keep
an eye on them with sight and sound [26].
There are four types of ineffective communication between FITZGERALD and CRYSTAL:
1. CRYSTAL only communicates between vessels through signaling lamps compared to
using other specified means [21]. There are no reports on board the FITZGERALD
stating that the communication was ever received, therefore, the signal light proved to be
an ineffective communication technique.
2. The techniques mentioned in the Rules and Regulations of Navigation (use of the day
form) will not be effective in this situation because the event occurs between sunset and
sunrise.
3. Neither ship uses a ship whistle or equivalent device to sound a signal to another vessel,
although both vessels have the opportunity to arrange a safe passage through a sound
signal. This example is outlined in Rule 34 of the Rules and Regulations of Navigation,
which includes a definition of what to do if there is any doubt on the action to avoid a
collision [26]. The range of this sound signal is determined to be no less than two
nautical miles and this minimum range provides the ability to act to avoid collisions [26].
4. Lack of communication due to the fact that bridge-to-bridge radio systems are not used.
This voice communication system allows the ship to arrange a safe journey when the risk
of collision may exist and again, no ship has attempted to use any form of audio
communication before an accident.
These examples prove there are adequate opportunities for communication between CRYSTAL
and FITZGERALD.
78
Step 8 – Dynamics and Migration to High-Risk Countries
The most significant accidents result from the transition of the system to more dangerous
circumstances and the reduction of margins over time [19]. An organization is likely to migrate
to a higher risk state when operating assumptions change [18]. The CAST analysis highlights
changes to the control structure that was on top of the FITZGERALD at the time of the collision.
Analysis shows that some operators believe the Navigation System is safe. To show the changes
to the Control Structure above FITZGERALD, Figure 5.6 is provided below. The U.S. Navy
must review operational assumptions and create processes to ensure safety is not degraded as
changes occur.
Discussion of the Control Structure on board the USS FITZGERALD
The detailed explanation of the role and beliefs of the individual controller in the accident is
shown in more detail in Step 6 of this analysis. The following discussion includes a summary of
the interaction findings in the Control Structure. This process model influences operator behavior
and shows why they take or don't act.
Figure 5.6 shows the FITZGERALD Control Structure at the time leading up to the collision
with CRYSTAL. The green line in this control structure indicates a change in the route of
authority in how commands are issued in the lead-up to a collision. Figure 5.6 removes the
equipment found in Figure 3 Step 5.5, when the supervisor is not present or the equipment is not
in use. For example, during surveillance, the necessary reconnaissance in OPNAVINST 3530.4F
was not present on the port side and the right side of the Pilot House. A more thorough
discussion of each individual is found in Step 6. Figure 5.6 also shows the difference between
the designed Control Structure and the on-watch conditions. An alternate view of Figure 5.6 is
found in Figure 5.7, where the dotted line shows the missing feedback and the authority line that
contributed to the loss.
79
Figure 5. 2 USS FITZGERALD Control Structure at the time of the collision
80
Figure 5. 3 USS FITZGERALD Control Structure at the time of collision (Alternate View)
81
Chapter 6: MCCAIN CAST Summary
This section includes a summary of the key findings from the MCCAIN CAST Analysis. The
full MCCAIN CAST is provided in Appendix C.
Event Summary:
At 0524 hours on 21 August 2017, the USS John S MCCAIN collided with the Motor Ship
ALNIC MC in the Singapore Strait [28]. This collision caused flooding inside the MCCAIN
which resulted in the deaths of 10 U.S. Navy sailors [28]. There were no casualties above
ALNIC.
MCCAIN is a U.S. Navy Flight 1 Arleigh Burke-class destroyer stationed in Yokosuka, Japan.
ALNIC is a Liberian-flagged oil and chemical tanker [28]. The collision occurred after
MCCAIN overtook ALNIC and crossed ALNIC's turn in an unsafe manner [22]. The two ships
were in transit in the Singapore Strait at the time of the collision. MCCAIN was en route to its
scheduled port at Changi Naval Base, Singapore, during her 6-month deployment and ALNIC
had departed Mai Lao, Taiwan, on 15 August and was en route to Singapore for a scheduled
arrival date of 21 August [22, 28].
Summary of Findings:
The collision occurred due to a lack of control of the propulsion and steering system over the
MCCAIN Bridge. The operator believes that they have no control, when in reality, control is
maintained by the ship's Bridge and Integrated Navigation System (IBNS). Immediately before
the accident, control was transferred to a secondary location. The operator is unaware of this and
they have switched control. All equipment is available, no faults are reported, and the equipment
operates as designed.
The CAST analysis recommends the addition of AIS as another controller in the Control
System, reviewing radar integration, reviewing operator roles and responsibilities, and updating
the interface between the operator and IBNS to clearly indicate the location of steering control
and propulsion. The MCCAIN CAST analysis also identified the need to review the Control
Structure on how the Bridge Team and the Engineering Team communicate and
82
Coordinates. The CAST analysis found a lack of coordination between the two teams that
extended the restoration of steering control. The MCCAIN CAST analysis contains similar
findings to FITZGERALD CAST in how it identifies the lack of radar integration and
recommends reviewing the operator's roles and responsibilities for revising the Navigation
System.
83
Chapter 7: Recommendations
This chapter contains a combined recommendation from the FITZGERALD and MCCAIN
CAST Analysis, a comparison of the U.S. Navy versus CAST findings table, and a discussion of
the CAST findings. The specific recommendations of the FITZGERALD CAST Analysis are in
Appendix A and the specific recommendations of the MCCAIN CAST Analysis are in Appendix
C.
CAST Recommendations:
The CAST recommendations identify the responsibility for implementing the recommendations
to three separate entities: the Naval Naval Systems Command, the Surface Warfare Officer
School Command, and the Command Officer. The list of recommendations compiled from
MCCAIN and FITZGERALD CAST Analysis includes:
Naval Naval Systems Command (NAVSEA):
1. Update the feedback mechanism in IBNS on the Steering Control Location. The
software provides control indications. However, with a few helpful supervisors, no one
identified where the steering wheel control was. In the implementation of a better
feedback mechanism will ensure that everyone is aware when the Console Helmet no
longer has control.
2. Review other feedback paths in IBNS and update them as needed to ensure operator
awareness of control locations.
3. Review the integration between radar imaging and the Shipping Management System.
The integration of this system allows the introduction of other forms of feedback from
the QMOW to the radar imaging OOD superimposed on the navigation track image.
This provides an additional feedback path from the VMS to the QMOW to provide
awareness about the vessels in the area.
4. Review how AIS is integrated into the Navigation System. The incorporation of AIS
must effectively communicate to the personnel of other vessels in the vicinity and
whether there is a risk of collision.
84
5. Review the radar imaging adjustment process and design procedures that allow feedback
to the operator to ensure the radar is properly adjusted. In addition to procedures, update
the radar software to provide different indications to the operator when it is not
adequately adjusted.
6. Review the design to sound the signal to other boats. NAVSEA should coordinate with
SWOS to determine if additional software is required to be added to the Bridge where
it must control the sound signal.
Surface Warfare Officer School (SWOS) Command:
1. Review the dissemination of environmental information to observers. Make sure the
proper documentation reflects the expected weather conditions, traffic density,
normal traffic patterns expected.
2. Review the supervisor workload. This workload includes what work is assigned outside
of the assigned place of supervision that can cause distractions and burnout.
3. Make sure all operators are aware of how decision-making is disrupted when fatigue.
Review the procedures and requirements to identify and prevent fatigue before using the
watch.
4. Make sure the operator activates automatic signals in the software to improve
feedback from the physical system. Review the signal criteria to ensure notifications
are given in time for the supervisor's actions.
5. Review the requirements for COs to be on the bridge for extended periods of time and
develop procedures for risk management during days of high operational requirements.
6. Review the requirements and responsibilities for the CIC oversight office with an
emphasis on identifying which roles can effectively establish communication between
the CIC and the Bridge. The findings should adjust the Control Structure to build a
communication network.
7. Review the requirements and responsibilities for the Bridge monitoring station with an
emphasis on identifying which roles can effectively establish communication between
the CIC and the Bridge. The findings should adjust the Control Structure to build a
communication network.
8. Review the requirements and responsibilities for bridge supervisory stations with an
85
emphasis on identifying which roles can effectively establish communication between
Engineers
86
and Bridge. The findings should adjust the Control Structure to build a communication
network.
9. Review the requirements and responsibilities for Engineering Supervisory Stations with
an emphasis on identifying which roles can effectively establish communication between
Engineering and Bridge. The findings should adjust the Control Structure to build a
communication network.
10. Review the differences in the requirements for operating physical equipment between
types of ships. Emphasis should be placed on the review of the Safety Information
System and how feedback is provided to the operator. Based on these findings, a review
should be conducted for how requirements are generated to inform operators about the
differences and new procedures should be developed. This information should also be
used to provide the Control Structure with different operator responsibilities based on the
equipment in the Navigation System.
11. Review procedures on how COs communicate concerns through the Chain of
Command related to crew fatigue, equipment status, and daily schedules.
12. Review the Bridge Resource Management procedures to clearly redefine operator roles
and responsibilities. The roles and responsibilities of these operators must be tailored to
the specific vessel based on the physical equipment located on board the vessel
integrated in the Navigation System.
13. Review the requirements for personnel on board the Surface Vessel and adjust the
Navigation System Control Structure to reflect the available personnel. Adjusting
personnel roles and responsibilities based on personnel in the Control Structure.
Assign responsibility for operating AIS.
Cos:
1. Make sure all operators are aware of how decision-making is disrupted when crew
members are exhausted. Review the procedures and requirements to identify and
prevent fatigue before using the watch.
2. Make sure the operator activates automatic signals in the software to improve
feedback from the physical system. Review the signal criteria to ensure notifications
are given in time for the supervisor's actions.
87
The following table shows the differences in findings between the U.S. Navy Report and the
CAST Analysis.
Problem Included by the U.S. Navy in
probable causes or
findings?
Included by CAST? Parable
System Problems
Communication and
Coordination
Not Yes The CAST analysis showed a lack
of communication between
different supervisors. The U.S.
Navy has only identified a lack
of communication between the
CICs
and Bridge (see the Operators section
below).
Safety Culture Yes Yes Both reports raise similar questions
about the Culture of Safety.
Fatigue Management Yes Yes Both reports raise similar questions
about fatigue management.
Safety Information
System
Not Yes The CAST analysis provides
recommendations to update
how environmental factors
communicated to those who
need it.
Dynamics and Changes over
Time
Not Yes CAST analysis identifies planned
and unplanned changes that
are not adequately addressed
in terms of risk analysis.
Specifically, the MCCAIN
analysis shows
lack of identification when the risk
increases.
Physical Component Problems
ICE Yes Yes Both reports raised the need to
integrate AIS on board U.S.
Navy ships.
IBNS Not Yes CAST analysis identifies the need
to update the IBNS interface
to ensure operators
understand the location of steering
control and propulsion.
Shipping
Management
System (VMS)
Not Yes CAST analysis identifies the need
to review the interface and
feedback from the VMS.
Radar Yes Yes CAST analysis identifies the need
to review interfaces and
feedback from radar. The U.S.
Navy recommends
replacing old systems with new,
commercially available options.
Control Structure - Operator
88
Bridge – CIC
Coordination
Yes Yes Both reports identified the need
to address coordination
between CIC and Bridge. U.S.
Navy findings recommend
temporary increase in training
requirements
CAST analysis recommends
adjustment of the Control
Structure
Bridges – Engineering
Coordination
Not Yes The CAST analysis identified
in the MCCAIN collision lacks
coordination leading to more
confusion among
operator at the steering control
location.
Role and Responsibilities
Overview
Not Yes The CAST analysis
recommends reviewing roles
and responsibilities
operator to customize the
Control Structure.
Inadequate understanding
of the operating
environment
Not Yes The CAST analysis found that
inaccurate beliefs about the
operating environment lead to
safe operating beliefs.
Human Error Yes Not The U.S. Navy report
highlighted the main cause of
the accident as human error.
CAST analysis shows
operators make decisions
based on
what they believe to be the
safest course of action.
Table 7. 1 Comparison of findings
CAST Recommended Review
The results of the above comparison show that the STAMP analysis found three additional
controls that were inadequate compared to the U.S. Navy report:
1. Inadequate understanding of the operating environment.
2. Inadequate controls and feedback in the Navigation System.
3. Inadequate feedback from IBNS.
While the CAST Analysis found all the same problems as identified by traditional reports, there
were many recommendations in the CAST Analysis that recommended a review of the
Navigation System Control Structure and updated operator roles and responsibilities. The
CAST analysis also identified the cultural changes needed to adjust the beliefs of sailors to
prevent future accidents in any situation. A prime example of this comes in the MCCAIN
89
CAST Analysis
90
where it was found that the CO did not trust the steering control system and the propulsion of the
IBNS. CAST recommendations include feedback on the status of recommendations and the
ability to influence the Navigation System.
The added value by CAST comes from recommended changes to the Navigation System,
missing physical controllers, and inadequate physical system feedback. The Navigation Systems
Safety Control Structure was created to support this thesis and help identify some of the
shortcomings of controls and feedback missed by the U.S. Navy's findings. For example, IBNS
MCCAIN does not provide adequate feedback to some operators working to "regain" control of
the wheel. In this system, steering control is not lost, but there is a perceived loss due to
inadequate feedback from the display to the operator. This identification in CAST shows how
inadequate physical system feedback contributes to an ineffective Navigation System. In the
FITZGERALD CAST Analysis, it is shown how the OOD mental model prevents the
incorporation of CICs into safe navigation. In both collisions, the weakness of the process model
was identified by XO as it did not provide adequate feedback to the CO. These examples were
overlooked in traditional analyses and proved the value of applying CAST into future reviews to
help prevent deaths aboard U.S. Navy ships.
The Navigation System Safety Control Structure is not identified in the U.S. Navy Report. The
Navigation System Control Structure clearly shows how inadequate control and feedback lead to
dangerous circumstances. Recommendations #6 to #13 of the SWOS section aim to align roles
and responsibilities within the Control Structure to prevent future accidents. These
recommendations should result in changes to the system as a whole by changing the operator's
roles and responsibilities to be specific to each individual vessel.
Environmental factors are also necessary for accident analysis because accidents may not occur
in the Pacific open ocean, miles away from land and with less traffic density. SWOS
recommendations #1 and #12 ensure future environmental considerations to prevent accidents.
Both of these examples help demonstrate added value by performing a CAST Analysis.
91
The STAMP analysis identified the flaws in the process model in the accident. The flaws of
these process models don't blame individuals, but they help explain why each actor performs the
way they do. This distinction is important because there are no articles or reports that are
deliberately overlooked. This understanding shows how each individual does what they think is
right. This analysis helps us to ask why they think the action is enough to prevent accidents.
Understanding the existence of process model weaknesses is another area where CAST Analysis
provides value. The U.S. Navy can learn from CAST to examine how operators in the
Navigation System understand the feedback and controls in the system and can directly address
any shortcomings. This understanding leads to recommendations to review operator roles and
responsibilities and redefine them to enforce better communication and coordination (SWOS
recommendations #6 to #13). The process of considering the operator's confidence will ensure
the U.S. Navy's actions support accident prevention.
The CAST analysis also discusses physical system recommendations. These recommendations
are identified through inadequate feedback from equipment to operators. NAVSEA
recommendations improve physical system feedback. The increased feedback provided by these
recommendations will prevent future accidents by ensuring personnel are aware of the state of
the equipment being operated. An analysis of how physical systems impact accidents is largely
overlooked by the U.S. Navy's recommendations and highlights other areas where CAST
provides value to the U.S. Navy.
This comprehensive review shows that CAST can add value to the U.S. Navy's accident
analysis. CAST identifies ways to prevent accidents through the Navigation System Control
Structure, operator process models, and improved physical system feedback. The improvement
of the physical system ensures operators are provided with the feedback necessary to make
informed decisions. The process model provides value for the U.S. Navy to understand why the
operator took action in both accidents. The Control Structure shows how the Navigation System
on board the two vessels separates the operators responsible for safety. In this CAST Analysis,
each insight is different from the traditional method.
92
Chapter 8: Conclusion
This conclusion answers the research question posed and highlights the path to value creation to
the accident investigation report process. The U.S. Navy had 12 ship accidents between 2007
and 2017 [5]. This data point highlights the need to change how surface accidents are
investigated within the U.S. Navy because current methods do not work to prevent future
collisions. Changes are needed to protect the lives of sailors, protect U.S. Navy ships, and the
integrity of the force in the future. The U.S. Navy instituted changes across the fleet, as
evidenced by the Latest Comprehensive Review of Surface Force Incidents. However, the
surface fleet still suffers from accidents, as seen in the fire on board the USS BONHOMME
RICHARD (LHD 6) in 2020 and the unsafe interaction between the USS MOMSEN (DDG 92)
and the USS HARPERS FERRY (LSD 49) in 2022. The main findings from the analysis
highlight how current methods do not analyze inadequate controls and feedback in the system.
These findings present a recommended review of the Navigation System Control Structure for
surface fleet operations, the recommended way to examine the personnel process model in the
Navigation System, and recommendations for examining the feedback provided by the physical
system. Recommendations for reviewing operator roles and responsibilities in the Navigation
System should lead to changes in the overall system. Human operators continue to be one of the
most valuable assets for the U.S. Navy, and work is needed to understand the reasoning behind
their actions. This thesis shows how an inadequate feedback loop from IBNS to the helmsman
proves deficient in traditional analysis to see how when equipment is functioning properly there
is still inadequate control.
The study was limited in its findings due to several self-identified constraints. The following
provides a description of the limitations of this thesis and discusses the possible future
applications of CAST within the U.S. Navy.
This thesis is limited in its findings due to the fact that research can only utilize publicly
available (unclassified) information. This is because the thesis aims to allow as many
readers as possible. Future research may incorporate confidential reports and more
primary interviews to highlight the full benefits of CAST.
93
The report was further limited to the analysis of only two ship collisions; Future work
could expand on these findings and help track the identification of systemic factors
across ship accidents involving different operating environments, hazards, and types
U.S. Navy ships.
Future research should also address other critical accidents listed in the
RICHARD BONHOMME BONHOMME Fire Recent Comprehensive Review of
Incidents. Better trend analysis can be done using these future results.
These future measures will help provide adequate documentation across the fleet to all
stakeholders and owners of related processes. This future work will reinforce the findings of this
report, contribute to the results and recommendations, and demonstrate the further value of the
CAST Analysis.
In light of this report and the recommendations provided, these findings should be widely
disseminated within the U.S. Navy and they should incorporate CAST into their standard
procedural structure. This thesis clearly identifies where CAST provides value and how
the U.S. Navy can learn and incorporate it into its future analysis. It would be helpful to
prepare a CAST workshop for U.S. Navy investigators and leaders to attend so that they
can grow ownership of a top-down approach in Navigation Systems.
In summary, this analysis concludes that the U.S. Navy should adopt the STAMP and
CAST models as part of the current accident analysis process to ensure a more accurate
analysis. The value for the Navy is in the control and feedback loop, Safety Control
Structure Analysis, inadequate physical system feedback, and understanding the
weaknesses of the operator process model.
94
Appendix A: FITZGERALD Recommendations
Recommendations from CAST-Based Analysis:
The CAST analysis found inadequacies across physical controls and safety control structures.
The recommendations are divided into two groups: (1) equipment and (2) management and
engineering. The FITZGERALD crash contains inadequate controls and has migrated to an
unsafe model. As structures tend to migrate to more unsafe conditions, the recommendations
outlined below are made to assist the U.S. Navy in developing processes to ensure safety is not
neglected. These recommendations are not intended to point out faults on behalf of individuals,
but rather to show how to improve processes to ensure the control structure results in safe
operations. This recommendation also aims to correct the operator's process model.
Equipment:
● Indication of inadequate collision path: The radar does not notify the operator with
enough time and space to maneuver to avoid a collision.
● Indication of insufficient collision path: AIS does not notify the operator of the
collision path.
● Inadequate collision path indication: The Cruise Management System does not
provide an indication of the collision path.
All technologies work as designed, and FITZGERALD has all the operating technologies
available. The CAST analysis found that the AIS was the controller of the missing equipment.
This gap in equipment shows why it is recommended that U.S. Navy ships use AIS to provide
feedback on surface traffic density. An indication of an inadequate collision path from the
equipment to the operator leads to the following recommendations:
Naval Naval Systems Command (NAVSEA):
95
1. Review the integration between radar imaging and the Shipping Management System.
The integration of this system allows the introduction of other forms of feedback from
the QMOW to the radar imaging OOD superimposed on the navigation track image.
This provides an additional feedback path from the VMS to the QMOW to provide
awareness about the vessels in the area.
2. Review how AIS is integrated into the Navigation System. The incorporation of AIS
must effectively communicate to the personnel of other vessels in the vicinity and
whether there is a risk of collision.
3. Review the radar imaging adjustment process and design procedures that allow feedback
to the operator to ensure the radar is properly adjusted. In addition to procedures, update
the radar software to provide different indications to the operator when it is not
adequately adjusted.
Surface Warfare Officer School (SWOS) Command:
1. Make sure the operator activates automatic signals in the software to improve
feedback from the physical system. Review the signal criteria to ensure notifications
are given in time for the supervisor's actions.
Management and Engineering:
Inadequate Control/Feedback: Lack of Scouts
Inadequate Control/Feedback: Lack of CO involvement in safe navigation
Inadequate Control/Feedback: Lack of proper utilization of tools and equipment by
personnel - (sound and radar signals) - BMOW/JOOD
Inadequate Control/Feedback: Lack of CIC involvement in safe navigation
Inadequate Control/Feedback: Lack of communication and coordination between CIC
and Bridge
To address the incapacity, the following measures are recommended to the U.S. Navy. These
recommendations involve correcting missing feedback and lines of authority from the
Navigation System Control Structure. The following recommendations address these
inadequacies:
96
Surface Warfare Officer School (SWOS) Command:
1. Review the dissemination of environmental information to observers. Ensure proper
documentation reflects expected weather conditions, traffic density, expected normal
traffic patterns
2. Review the supervisor workload. This workload includes what work is assigned
outside of the assigned place of supervision that can cause distractions and
burnout.
3. Make sure all operators are aware of how decision-making is disrupted when fatigue.
Review the procedures and requirements to identify and prevent fatigue before using
the watch.
4. Make sure the operator activates automatic signals in the software to improve
feedback from the physical system. Review the signal criteria to ensure notifications
are given in time for the supervisor's actions.
5. Review the requirements for COs to be on the bridge for extended periods of time
and develop procedures for risk management during days of high operational
requirements.
6. Review the requirements and responsibilities for the CIC oversight office with an
emphasis on identifying which roles can effectively establish communication
between the CIC and the Bridge.
7. Review the requirements and responsibilities for the Bridge monitoring station with
an emphasis on identifying which roles can effectively establish communication
between the CIC and the Bridge.
8. Review procedures on how COs communicate concerns through the Chain of
Command related to crew fatigue, equipment status, and daily schedules.
9. Review the Bridge Resource Management procedures to clearly redefine operator
roles and responsibilities. The roles and responsibilities of these operators must be
tailored to the specific vessel based on the physical equipment located on board the
vessel integrated in the Navigation System.
10. Review the requirements for personnel on board the Surface Vessel and adjust the
Navigation System Control Structure to reflect the available personnel. Customize
97
roles and
98
Cos:
personnel responsibilities based on personnel in the Control Structure. Assign
responsibility for operating AIS.
1. Make sure all operators are aware of how decision-making is disrupted when crew
members are exhausted. Review the procedures and requirements to identify and
prevent fatigue before using the watch.
2. Make sure the operator activates automatic signals in the software to improve
feedback from the physical system. Review the signal criteria to ensure notifications
are given in time for the supervisor's actions.
Traditional Findings vs. CAST Discussion: FITZGERALD
This section addresses the guiding question of this research: What unique insights were not
previously uncovered through traditional analysis provided by the STAMP-based CAST
analysis of the 2017 USS FITZGERALD, and USS MCCAIN collisions for U.S. Navy surface
ships? What value does this STAMP-based approach provide to the U.S. Navy? At the time of
the accident, operators believed their actions kept FITZGERALD safe. The figures in Step 8
Chapter 5 highlight how those beliefs led to changes in the way they operated the Navigation
System. As a result, the U.S. Navy indicated the main cause of the accident was human error.
Meanwhile, CAST Analysis recommends reviewing the operator's roles and responsibilities and
adjusting them to ensure proper communication, coordination, and operation of equipment.
The U.S. Navy recommends five areas to improve based on findings in "fundamentals,
teamwork, operational safety, assessment, and culture." [5] The U.S. Navy and NTSB report
builds on the traditional cause-and-effect mindset and aims to "break the chain." This thought
process is action-oriented and does not address why actions occur as recommended by the
STAMP/CAST analysis. The CAST analysis shows that the control structure is ineffective in
preventing losses due to inadequate controls and weaknesses of the process model. The CAST
analysis identified this difference because it focused on the Navigation System within
FITZGERALD and not on the individual behavior of personnel as suggested by the U.S. Navy.
Ini
99
focused on summarizing the U.S. Navy's traditional findings and then comparing those findings
with the recommendations of the CAST analysis.
The U.S. Navy report focused on a discussion of what happened to the people on the
FITZGERALD Bridge. The U.S. Navy's recommendation is for crew rest, training, and AIS
implementation. These findings are typical of standard U.S. Navy Reports because of their
analysis of traditional swiss cheese.
The CAST analysis found several weaknesses of the process model in personnel that led to
collisions that were not discussed in traditional findings. CAST found that by looking beyond
what was in the report, the systemic practice of isolated controllers was revealed. Different
operators separate themselves and present a culture of independence. Traditional reports rely on
cause-and-effect events and blame personnel based on errors. These reports failed to properly
investigate the reasons behind the event. What elements of training and past experience lead
individuals in key leadership roles to make decisions? Why didn't CIC and Pilot House
communicate? SWOS recommendations for management and engineering 4, 6, 7, 9, and 10
allow for the integration of operator beliefs and address the communication issues raised in the
CAST Analysis.
CAST provides a clear description of the underlying control structure and the weaknesses of the
process model that, if left unaddressed, will result in the migration of guard personnel back to
more risky conditions. This migration can result in future accidents and can be prevented with
the right solutions. Traditional analysis does not look for reasons behind actions and seeks to
correct what happened. By adding new and improved individual training recommended by the
traditional model, it did not remedy the lack of feedback between the CIC and the Pilot House.
Traditional recommendations do not outline a plan to ensure future safety of the Navigation
System as process models change. Traditional findings focus on how to improve the knowledge
base of all individuals and institutionalizing more regular performance assessments will ensure
that the right people with the right knowledge are in the right place at the right time.
100
The recommendations given to SWOS to review and revise the operator's roles and
responsibilities address incorrect process models and contextual factors that lead to operator
decisions. Revision of roles and responsibilities will fix inadequate controls and feedback. The
CAST analysis further identified the need to clearly identify communication and coordination
between CIC and Bridge. The recommendation to review those responsibilities points to
another difference. In addition, recommendations for updating equipment provide additional
information to operators. CAST analysis provides recommendations that provide responsibility
for implementing recommendations, methods for examining implementation, and established
feedback systems to determine the effectiveness of controls [18]. CAST demonstrates value to
the U.S. Navy through a recommendation agency that provides a structure for continuous
improvement.
This Systems Thinking approach aims to implement effective controls to prevent future
accidents. Traditional requirements usually dictate what to do and fail to complete a thorough
analysis of what happens when the action is not taken or done at the wrong time. Understanding
the assumptions, actions, and different factors helps operators understand their limitations. By
understanding these limitations, they can explain the weaknesses of the process model why
actors take their actions. The recommendations by the Comprehensive CNO review and the U.S.
Navy report highlight individual contributors and fail to see the Navigation System as a system.
The recommendations and findings separate the CIC's mistakes from the bridges and senior
leadership errors. This entity is a subsystem in the operating system that is necessary to maintain
safe navigation. For example, fatigue is placed on command leadership because it does not
lighten; Meanwhile, it is not assessed how individual fatigue affects their performance in
managing their relationships and communication with other members of the supervisory team. It
is clear that through the previously mentioned CAST recommendations effective controls are
essential and proven to prevent future accidents.
A comparison of the findings between the U.S. Navy Report and the CAST Analysis is found in
Table 7.1 in Chapter 7. FITZGERALD CAST began answering the research question by
demonstrating added value to the U.S. Navy through an understanding of why the operator
process model in the Navigation System.
101
Appendix B: Traditional Findings of the MCCAIN Accident
This section discusses the U.S. Navy's findings about the cause of the MCCAIN accident. This
is presented before the CAST analysis to understand the traditional findings, which will allow
for subsequent comparisons with the results and recommendations of the CAST. The U.S. Navy
uses the cause-and-effect method to determine root cause findings. The goal is to determine the
root cause of the accident in order to associate it with guilt or possible causes.
USS McCain: US Navy Accident Findings
The U.S. Navy determined there were three causes of the collision, "loss of situational
awareness," "failure to follow International Maritime Rules," and "inadequate knowledge" of
steering and propulsion systems. These causative factors are outlined below, with associated
contributing factors. A link to the U.S. Navy's report on the accident can be found in the
references section of this report.
Causal Factors and Contributing Factors
The U.S. Navy determined that many failures occurred on the part of leadership and supervisors
as follows [4, 27]:
Causative Factor #1 - Loss of Situational Awareness. MCCAIN does not know the location of
the steering and propulsion. MCCAIN was unaware of how close ALNIC was before the crash.
Related Contributing Factors: not using AIS, poor logging, burnout, lack of control by
Commanders.
Causative Factor #2 – Failure to follow the International Road Rules. MCCAIN did not sound a
warning signal or a Bridge-to-Bridge Very High Frequency (VHF) radio to announce the loss of
their rudder control to other ships.
Related Contributing Factors: non-compliance with safe navigation practices.
102
Causative Factor #3 - Inadequate Knowledge. MCCAIN used supervisors without a proper
understanding of how the IBNS system works, specifically how transfers between stations work.
The software works as designed, and the supervisors are unaware of it. The CO does not arrange
Marine Detail and Anchor with more experienced supervisors.
Related Contributing Factors: misconduct in extremists, substandard supervisory proficiency,
poor risk management and ineffective coordination planning between bridges and CICs, poor
CIC performance, inadequate understanding of technology, lack of proper reconnaissance,
ineffective execution of surveillance bills, ineffective training programs.
Hindsight Bias
An important drawback of traditional analysis is that it institutes a retrospective bias in what the
organization could, should, or would have done differently to prevent accidents. This section
discusses the backward bias depicted in the factors that cause accidents. All of the causative
factors identified in the report are affected by retrospective bias.
Hindsight Bias #1: MCCAIN is supposed to maintain situational awareness [28]. This bias
suggests that MCCAIN personnel did not know the ship's location. Logs show additional
requirements for busy traffic lanes to be adhered to, so bridge teams know their location and
increased traffic density. This bias suggests that if there had been no collision, investigators
would not have called this a failure. Traditional findings claim crews lack awareness about the
location of steering control and propulsion. However, in interviews, it was evident that the crew
believed the loss of steering had occurred and took steps to remedy the loss. The claim that
crews do not maintain situational awareness is in contrast to crews who understand their lack of
control over the system and do not have the knowledge of IBNS to understand how the system
operates. A better question is why the crew does not know the location of the control and what
steps can be taken to ensure the crew is always aware of the location [28]. The bias extends to
"unplanned" shifts in CO throttle control. Procedures exist to change the controls, and the
software works correctly, so that the controls shift as designed, and will allow for known
conditions to exist [28]. U.S. Navy Report
103
listing this as another loss of consciousness. This bias once again recognizes a cause that is only
known by knowledge of collisions.
Hindsight Bias #2: MCCAIN is supposed to follow the International Road Rules [28]. The
report did not list attempts to communicate by MCCAIN and the "failure" to sound the
appropriate signals. Throughout the report, it discusses how MCCAIN follows procedures
similar to FITZGERALD on the "dark ships" and "Modified Zebras." [28] The MCCAIN
attempted to slow down the speed and show the other ships its status as a ship "not under
command" through the display of lights. MCCAIN operates in the correct traffic scheme before
losing control.
These examples show how MCCAIN makes efforts to follow the International Road Rules. This
hindsight bias implies that MCCAIN is actively putting ships and other vessels in dangerous
situations by the actions of the crew. The crew tried to follow the traffic pattern scheme and save
the ship. This bias does not consider why the crew took a particular action and did not take any
other action. This "failure" is too simplistic in its theme and does not acknowledge the actions
taken to save the ship involved in this collision. Bias once again gives cause to findings that are
only attributed to collisions occurring.
Backward Bias #3: MCCAIN observers can prevent collisions with adequate knowledge and
training [28]. In the report, it is emphasized in several parts how the sailors who controlled the
helmsman and helmsman Lee consoles were temporarily assigned to the MCCAIN of
ANTIETAM. Part of the U.S. Navy report states that these sailors did not come from ships with
the same physical system as MCCAIN. These sailors received training and stood for several
hours aboard the MCCAIN before the collision. A successful watch shows that the watchmen
have the working knowledge and training to operate under standard circumstances. People are
given orders to shift control and believe that the process they are using is correct. This bias does
not see why operators are taking actions that they believe are correct. In another example, a
sailor who escaped from a flood room on a ship said training went out blindfolded after
reporting to the ship was essential to save his life [28]. This story shows how "failure to train" in
a wide range does not adequately paint the whole picture. This cause is again listed only because
the collision is known to have occurred.
104
Hindsight Bias #4: MCCAIN's CO should have established the Sea Detail and Anchor for the
Singapore Strait transit [28]. This calls into question the Commander's decision not to place
more experienced personnel in surveillance. It fails to understand why the loss of steering
control occurs when the equipment is operating correctly. Failing to analyze why a properly
operating propulsion system is misunderstood by the operator. The CO decided it was more
beneficial through its own cost and benefit analysis to delay the Sea Detail and Anchor
arrangements to allow those crew members more rest before the long day. This understanding of
the CO thought process further suggests that this hindsight bias is only visible because a
collision occurred. Otherwise, CO can be praised for properly reducing the risk of fatigue.
MCCAIN shares a similar retrospective bias to FITZGERALD found in biases #6, #7, and #8
from Chapter 4. Bias of failure to use AIS, ineffective actions in extremists, and burnout are
common among reports. This discussion is found in Chapter 4 of this report.
Traditional Recommendations
Traditional reports identify training as a major shortage of crew at MCCAIN and recommend
various forms of new training requirements. The Comprehensive Review of the Most Recent
Surface Force Incident on October 26, 2017, after the collision, conducted a thorough analysis of
the individual's career path. Traditional recommendations recommend increased training of
individual supervisors to prevent future accidents.
The U.S. Navy's MCCAIN crash report did not list any recommendations. The report focuses on
the findings of causation and from those findings are blamed. U.S. Navy mistakes are
categorized into three subgroups: training, leadership/culture, and marine/navigation. The
The U.S. Navy's findings blamed the CO for "poor judgment", blamed the crew for being
unprepared, and blamed a lack of training [28]. The U.S. Navy further detailed the lack of
understanding of the International Road Rules and any rules violated by the surveillance team to
enter a safe speed, maneuver appropriately, and not properly notify ships around dangerous
situations [28]. The U.S. Navy also published a Comprehensive Review, which examined
several accidents together. Comprehensive Review listed
105
recommendations after reviewing several ship collisions based on common errors observed. The
U.S. Navy's recommendations from the Comprehensive Review to prevent future accidents
include:
● Create an assessment program to assess navigation skills at regular intervals for Surface
Warfare Officers (SWOs)
● Improve seafarer and navigation training for all supervisors involved in surface
vessel navigation
● Improving risk management training for SWOs
● Conduct training with current SWOs on how to use all equipment on the bridge
● Develop and implement metrics to evaluate SWOs about sailors and navigation
● Conduct training on surface ship leaders on assessing fatigue, crew rest and stress
management
● Evaluate how to train future officers during the training track on navigation and sailor
practices before going to ship as an officer using available resources such as Yard
Patrol Craft
● Review and update qualification standards for supervisors to ensure proper
training inclusion on all relevant equipment
● Standardization and revision of guidance on how the requalification process works
on surface ships.
● Assessing the number of officers on board by the number of job billets
● Evaluating the training requirements of Executive Officers and Commanding Officers
● Revision of SWO work length to ensure proper training on the first ship
● Develop policies to ensure all personnel piloting ships can demonstrate proficiency
106
Appendix C: MCCAIN and ALNIC Collision CAST Analysis
The following section completes the CAST analysis of the MCCAIN collision. The steps are
listed in Chapter 2.
107
Step 1 – Definition and Hazards of the System
System Definition:
The system analyzed was the U.S. Navy Navigation System. The system inherently operates
within the requirements to navigate safely in the open ocean using the Navy's instructions,
requirements, training, and procedures as guiding principles. This system includes the personnel
and equipment necessary to navigate safely at sea. The term "Navigation System" is used as the
composition of personnel and equipment on board the surface ships of the U.S. Navy.
The report does not analyze the development and engineering of the ships used to carry out the
mission series. That process will require research beyond the scope of this thesis to examine the
requirements and engineering inherent in the design process, along with the integration between
those design decisions and operationalizing them within the fleet. As an Arleigh Burke-class
destroyer, the MCCAIN had two controllable pitch propellers, each rotating outboard with blade
angle adjustments made to determine the desired forward or aft movement without reversing the
direction of the shaft [22]. General Electric LM2500 gas turbine engine, controls the propeller.
MCCAIN has a new propulsion and steering system labeled Integrated Bridge and Navigation
System (IBNS) which was installed in 2016 [22]. The system allows four locations to control
steering and propulsion control and additional locations for steering (rear steering) [22].
System Hazards:
To continue the process, it is first important to understand what dangers can cause losses. A
hazard is "a state of a system or set of conditions that, together with a particular set of worst-case
environmental conditions, would cause an accident." [19]. Accidents of concern are damage to
U.S. Navy ships, damage to U.S. Navy equipment, and injuries/loss of life of personnel. Taken
from the perspective of surface ship navigation, the danger is [5]:
1. A ship collides with another ship - collision
2. A ship allied with a fixed object - an allision
3. A ship lands on the seabed - grounding
This analysis investigates the danger of ships colliding with other ships.
108
Step 2 – System Security Constraints and System Requirements
System Security Constraints:
The system-level constraints required to prevent collision hazards are:
1. The Navigation System cannot navigate in the collision lane.
2. The Navigation System must properly notify other vessels of dangerous
intentions and situations.
System Requirements:
Navigation System requirements to prevent collisions and ensure safe navigation include:
1. The Navigation System must be able to control the ship, precisely controlling the speed
and direction.
2. The Navigation System must have the ability to communicate between ships.
3. The Navigation System must identify the surrounding vessels regardless of the
environment.
4. Navigation System procedures must exist to recognize equipment malfunctions,
correction procedures, and mitigation plans.
109
Step 3 – Hierarchical Safety Control Structure
The Navigation System Safety Control Structure is shown in Figure 5.1. This Control Structure
is formed based on input readings from the OPNAVINST 3120.32 and OPNAVINST 3530.4F
Series for the Condition III readiness level (links to this U.S. Navy publication are found in the
references section of this report). The Condition III readiness level is a form of the U.S. Navy's
Model Navigation System Control Structure aboard surface ships.
The roles and responsibilities for the Navigation System Control Structure are:
Commanding Officer (CO) – Responsible for the overall performance of the vessel.
The CO is responsible for ensuring the necessary missions are carried out, that the ship
complies with all U.S. Navy policies, and navigates safely at sea.
Executive Officer (XO) – Responsible for administrative duties on board the ship and is
the second person in charge. XO is also responsible for all maintenance and training on
board. XO serves as an advisor to the Deck Officer.
Navigator (NAV) – Responsible for the navigation department on board the ship
and generating navigation plans.
Engineering Department – Responsible for the maintenance and upkeep of all
engines, generators, steering, and related auxiliary equipment. The Watch
Engineering Officer is responsible for supervising all personnel and equipment.
Officer of the Deck (OOD) – The direct representative of the CO on the bridge and is
responsible for running the Navigation System to operate safely at sea. OOD leads the
Bridge personnel in the safe conduct of the ship's navigation, the team includes Junior
Deck Officers, Conning Officers, Guard Quartermasters, Boatswain Mate of the Watch,
scouts, and helmsmen.
Junior Officer of the Deck (JOOD) – Responsible for operating radar on bridges and
communicating with other vessels via Bridge-to-Bridge radio telephones. JOOD also
completes the necessary checklist related to the completion of different operations.
110
Conning Officer (CONN) – Responsible as the primary reconnaissance with sight and
hearing for other ships. CONN gives commands to the helmsman on the path required
to steer the boat and the required engine speed.
Quartermaster of the Watch (QMOW) – Responsible for ensuring the Deck Officer
follows the Navy's navigation plan. QMOW operates ship navigation lights, daylight
forms, flags, fathometers, and Shipping Management Systems.
Boatswain Mate of the Watch (BMOW) – Responsible for managing the enlisted
members of the watchdog team. BMOW also operates Ship Whistles, ship-wide
announcement circuits, and ship-wide alarms.
Scouts – Responsible for identifying other vessels in the area and relaying to the
CONN and OOD of any vessels they identify.
Helmsman – Responsible for carrying out the necessary lane and speed changes given
by CONN. The helmsman operates the steering wheel and engine system.
Tactical Action Officer (TAO) – Responsible for the tactical use of the ship's weapon
systems. When necessary, TAO will direct the ship's OOD maneuvers to use the
weapon system.
Combat Information Center Supervisory Officer (CICWO) – Responsible for leading
Combat Information Center (CIC) personnel and responsible for coordinating with
Bridges to ensure safe navigation. CICWO also maintains a secret communications
network.
Surface Warfare Coordinator – Responsible for managing surface radar contact
images and coordinating with CICWO and TAO to report ships to the Bridge.
Shipping Officer – Responsible for working with the Surface Warfare Coordinator to
track surface contact images.
Helmet Safety Officer –
Aft Steering Safety Officer –
Rear Steering Wheel Helmsman -
Note, the figures in this step were created and developed to support this thesis.
111
Figure C. 1 USS MCCAIN Compiled Navigation System Control Structure Before Singapore Strait
112
Figure C. 2 USS MCCAIN Sea Compiled Navigation System Control Structure and Anchor Details
113
Figure C. 3 USS MCCAIN Compiled Navigation System Control Structure in the Singapore Strait
114
Step 4 - Proximity Chain of Events
At 0524 hours on 21 August 2017, the USS John S MCCAIN collided with the Motor Ship
ALNIC MC in the Singapore Strait [28]. This collision caused flooding inside the MCCAIN
which resulted in the deaths of 10 U.S. Navy sailors [28]. There were no casualties above
ALNIC.
MCCAIN is a U.S. Navy Flight 1 Arleigh Burke-class destroyer stationed in Yokosuka, Japan.
ALNIC is a Liberian-flagged oil and chemical tanker [28]. The collision occurred after
MCCAIN overtook ALNIC and crossed ALNIC's turn in an unsafe manner [22]. The
comparison of the size of the two ships is shown in Figure C.5. Both ships were transiting in the
Singapore Strait at the time of the collision; Figures C.6 and C.7 outline the sequence of events
and the approximate location leading up to the collision, and Table C.1 outlines the Proximity
Chain of Events. MCCAIN was en route to its scheduled port at Changi Naval Base, Singapore,
during her 6-month deployment and ALNIC had departed Mai Lao, Taiwan, on 15 August and
was en route to Singapore for a scheduled arrival date of 21 August [22, 28]. In Figures C.6 and
C.7, the MCCAIN is a white dot with a blue line, and the orange dots represent the ALNIC and
other blood vessels in the area through the purple dots. All times presented in the Chain of
Events are local as per the ship's routine aboard the USS MCCAIN.
Figure C. 4 USS JOHN S MCCAIN (DDG 56) U.S. Navy [33].
115
Figure C. 5 Comparison of the relative size of two ships [2].
116
Time (24
hours)
Event
0001 August 20, 2017 MCCAIN is operating in the Pacific Ocean
1300 Navigation Summary was held aboard the MCCAIN for the Singapore Strait and
the side of the arrivals pier in Sembawang, Singapore
~1326 MCCAIN conducts a steering swing inspection to verify the operation of the
steering, and the test results are satisfactory
1730 MCCAIN CO retires to his cabin
1904 MCCAIN turns on the Navigation Lights as specified in the Road Regulations
2115 Modified zebra set on MCCAIN
0001 August 21, 2017 MCCAIN was on its way to Singapore, and one surface search
radar could not be operated
0100 Navigation begins to take more frequent Ship locations as required by U.S. >
Navy Regulations, 15-minute intervals
0115 MCCAIN CO arrives at the bridge
0200 Pay attention to the turnover completed; for the last 30 minutes, the supervisor
on the bridge felt relieved according to the routine of the regular boat
0418 Additional observers arrive at the bridge as part of the Modified Navigation
Details
0426 Navigation begins to take the location of the Ship more frequently as required by
U.S. Navy Regulations, 5-minute intervals
0427 MCCAIN turned around to avoid the other ships
0430 MCCAIN XO arrives at the bridge
117
0436 CO commands to switch steering mode from automatic control to backup
manual control
~0436 Automatic Radar tracking switched to manual
~0437 Various Steering orders are not recorded starting from approximately this
point to avoid other ships
0444 MCCAIN steady on lane 227T to enter Singapore Strait Traffic Separation
Scheme
~0454 MCCAIN in the range of ALNIC radar
~0457 MCCAIN speed change: 17 knots
0459 MCCAIN speed change: 16 knots
0500 Climbing to the top of the MCCAIN, the Navigator recommends changing the
speed to 18 knots to regain the desired track position
0500-0524 MCCAIN passes through several ships
0509 MCCAIN Course Change: 226T
0513 MCCAIN speed change: 18 knots
0514 MCCAIN Speed Change: 20 knots
0518 MCCAIN Course Change: 230T
~0519 MCCAIN CO saw the helmsman struggle with the steering orders and the
steering wheel of Lee and ordered the placement of the helmsman Lee. Not
being briefed in advance
0520:03 Lee Helm took control of the rudder, causing the rudder to shift to the center of
the ship. Lee Helm was only ordered to take propulsion; The supervisor did not
recognize the shift
118
0520:47 Lee Helm took control of the port shaft; The right axle remains at the steering
station
~0521 Helm believes there is a loss of steering
0521 MCCAIN is on the 228.7T track at 20 knots
ALNIC is on the 230T track at 9.6 knots, bearing 164T at 582 yards from
MCCAIN
0521 Helm reported loss of steering to OOD
0521 The loss of the Steering Victim was announced to the Ship, and orders were
given to have personnel report to After Steering (a secondary location to control
the steering).
0521 CONN ordered Helm to switch to offline steering unit
The steering unit shifted to port steering as instructed
The steering unit shifts to right-hand drive on order
0522 MCCAIN changed the lighting configuration to Not Under Command as per
International Road Rules
Lee Helm took command of the right axle but did not pair the shafts together to
allow for a consistent configuration
The wheels remain in the middle of the boat (zero degree
steering) MCCAIN CO commands a change in speed to
10 knots
0522:07 Lee Helm changed the speed commanded on the port shaft, and the right axis
remained at the old command. No supervisor notices the difference
0522:45 XO told CO that the ship was not slowing down fast enough, then CO ordered 5
knots, and CONN echoed the order
0523 CONN orders the right standard steering (15 degrees)
0523:01 After Steering takes control of the steering
119
0523:16 Helmet takes control of the steering wheel on the bridge
0523:24 Lee Helm equals port and right axle at 5 knots
0523:27 After Steering takes control of the steering
0523:58 ALNIC crashes into MCCAIN between frames 308 and
345 XO commands Collision Alarm
0524:24 Change of MCCAIN speed to all stops
0526 MCCAIN establishes Public Intersections
~0527 MCCAIN announces collision at Bridge-to-Bridge Radio
0530 MCCAIN asks tugboats and pilots to help reach Changi Naval Base
Table C. 1 USS MCCAIN Proximity Chain of Events [28].
120
Figure C. 6 Collision location and surrounding traffic [28].
Figure C. 7 Improved view of the MCCAIN and ALNIC collision paths [28].
121
Figure C. 8 After the collision of MCCAIN damage [11].
122
Step 5 – Analyze Physical Processes
Physical Controls and Safety-Related Equipment
Safety Requirements and Obstacles Violated:
● Physical equipment must notify supervisory personnel of hazardous conditions (radar
alarms). Radar and Cruise Management Systems provide no indication of the
collision path.
● The IBNS does not allow adequate steering control and propulsion to prevent
collisions.
Emergency and Safety Equipment (control):
The following includes a list of equipment available to ensure safety, and a brief discussion is
included with the equipment to understand the use by the personnel involved.
Integrated Bridge and Navigation System (IBNS) – An MCCAIN system designed to control
steering and propulsion systems. The operation of this system confused MCCAIN supervisors.
The system allows operation in the Helm Forward Station, the Bridge Command and Control
Station, and the Ship Control Console (SCC), and the Helm and Lee Helm stations are inside the
SCC [22]. The steering has an additional control location in the Steering Aft. The power unit that
controls the steering wheel is located within that space, allowing for additional troubleshooting
[22]. Each station has a graphical user interface with a touchscreen that is divided into different
areas for different indications, including where each control is assigned.
Navigation Lights – The report discusses that both ships use proper lighting equipment through
their Navigation Lights. These lights are present to help sailors identify other vessels in periods
of low visibility, including the hours between sunset and sunrise. The CO instructed the lighting
of the lights to indicate not being under command in response to the loss of steering control.
123
Radar - Both ships have an operational radar system. The radar transmits energy and then,
based on the return of that energy, plans assistance for the possible navigation of ships and other
objects in the vicinity.
Shipping Management System – This system is an electronic charting system used to navigate
safely at sea with the integration of different sensors. The system uses the Global Positioning
System (GPS) as input to show the valuable location of the ship on a graph. Radar is another
input to the system. This input allows the operator to know the exact location of the vessel.
Automatic Identification System (AIS) - This system is operated by each vessel broadcasting
information on a shared server to other vessels. This information includes the name of the ship,
origin, destination, course, and speed. It is available via the internet at: www.marinetraffic.com.
In accordance with the U.S. Navy's policy at the time of the incident, MCCAIN did not broadcast
information through AIS. MCCAIN operates in admission mode.
There are other safety equipment on each ship. However, the equipment was not directly related
to this victim. These include fathometers, electronic graphs, GPS, flag signals (daytime), various
forms of radar, and related radar functionality.
Failures and inadequate controls: Failures are related to defined requirements and show a
correlation between inadequate controls and the definition of requirements. No physical control
fails.
● Indication of inadequate collision path: The radar does not notify the operator with
enough time and space to maneuver to avoid a collision.
● Indication of insufficient collision path: AIS does not notify the operator of the
collision path.
● Inadequate collision path indication: The Cruise Management System does not
provide an indication of the collision path.
124
● Inadequate steering and propulsion control indications – the IBNS display panel does not
adequately indicate the control location for propulsion control and steering control.
An important environmental factor is that it is at night, the sea is calm, good visibility
without moonlight in sight, and it happens in the Singapore Strait. The Singapore Strait is
a high-traffic location with hundreds of ships passing through it every day.
Physical Contextual Factors:
● All equipment is listed as available with no function outside the relevant commission
[28] Discussion on Physical Control and Safety-Related Equipment
Physical contextual factors are routine. Operating at night is a standard operating procedure
for ships around the world. The safety controls in place at MCCAIN and ALNIC have
proven inadequate.
Safety features, navigation lights, and radar operation are inadequate to prevent collisions.
Navigation lights are present on both ships. At night the silhouette of the ship will not be
visible from a distance, so the lights will serve to provide visible aspects and
identification. Visibility was strong enough and the proximity between the two ships
allowed ALNIC to recognize the MCCAIN as a warship. All equipment works as
designed above MCCAIN.
The steering system and IBNS propulsion provide inadequate feedback to the operator. The
system operates as designed and has no errors. However, there is a perceived loss of
steering control and inadequate knowledge of the location of the propulsion control. The
system does not provide proper feedback to the operator about the execution of the
transfer and where the control is located after the transfer is completed.
125
Step 6 – Analyzing the Higher Level of the Safety Control Structure
Safety Control Structure Analysis
The following is a detailed analysis of the key individuals of the Control Structure at MCCAIN.
The analysis will identify each individual and then explain the individual's responsibility to
prevent collisions and address their role in the accident. The analysis will raise questions to
identify the weaknesses of the operator's process model (mental or belief model). These
questions allow the analysis of this work to read beyond the commonly used surface-level chain
of cause and effect.
126
Individual:
Commanding Officer (CO)
Individual Description:
CO is the most senior member of MCCAIN. CO previously served as XO above MCCAIN from
20 April 2015, and took command on 21 September 2016 [22]. CO was commissioned in 1998
and held the ship's previous positions as damage control assistant and chief engineer, among
others [22].
Liability related to accidents:
The CO "is ultimately responsible for the assigned unit and personnel." [29]. "The Commander
is charged with absolute responsibility for the safety, welfare, and efficiency of the ship and crew
until properly relieved of duty by the competent authority." [29] This description within the
Navy placed a heavy responsibility on the CO to understand everything on his ship. SORM then
instructed the CO to ensure the crew could perform their duties. The CO approves the personnel
on guard and approves the vacancy.
Role in accidents:
CO plays a crucial role in incorporating change into the environment. CARD YES:
At the time of the incident was on the bridge.
Directing the steering wheel to be in manual-backup mode, directing the transfer of
propulsion control from the steering wheel to the lee's steering station, and giving
multiple steering and propulsion commands.
Chose not to place the Sea and Anchor Watchbill because it pulled into the harbor. The
lack of Sea and Detail Anchor personnel present when entering the Singapore Strait at the
bridge is contrary to OPNAVINST 3530.4F, which requires them to MCCAIN operating
conditions.
● Certified by the supervisory team without proper understanding of the IBNS system.
● Not ensuring adequate training for the supervisory team.
● Not enforcing feedback between Pilot House and CIC.
127
● Placing a single reconnaissance line, which is on the opposite side of the bridge from the
collision, and no radar operator communicating with the CIC [28].
Why?
Beliefs that contribute to behavior:
CO understood that high traffic was expected, which explains why he arrived at the bridge at
0115 on the morning of the accident. CO believes that based on long transit and early
starts, it is more beneficial to wait to set up the Sea Watch and Anchor to prevent fatigue.
The CO believes the bridge team does not need any additional assistance. CO directs the
shift in propulsion control based on the helmsman's perception to be overwhelmed. CO
believes it is the right technique to ease the burden of the helmsman. CO believed new
orders were needed to correct the ship's direction, he then gave steering control and
propulsion directly to helmsman and helmsman Lee. The CO believes that manual-
backup steering mode is less risky than the standard computer-aided manual mode.
CO believes the helmsman understands the process of transferring propulsion control. The
CO believes that the transfer of propulsion control puts the ship in a safer configuration.
Contextual Factors:
CO was on the bridge at 0115.
Question asked: Are there any concerns over the helmsman's proficiency before placing
helmsman Lee? What is the level of trust of CO in the supervisory team? Are there any
previously observed shortcomings? What did CO observe while on the bridge before the
accident?
Before entering the Singapore Strait, the CO reserved a backup-manual mode as the steering
control mode.
Question asked: Why don't COs trust computer-assisted modes of operation? Why is it
trustworthy enough for off-the-strait operations? What experiences led to this belief?
128
What is the level of knowledge of the CO about the system?
129
The CO has received feedback from Navigators, Operations Officers, and Executive Officers to
place Marine Detail and Anchors.
Question asked: Why didn't the CO listen to the advice of the other leaders on board?
130
Individual:
Executive Office (XO)
Individual Description:
XO joined MCCAIN in June 2016 and has served in the Navy since 1989 [22].
Liability related to accidents:
The role of the XO is also outlined in the SORM to "supervise and coordinate the work, training,
training, and education of command personnel." [29]. "The executive officer is the direct
representative of the commander and shall have primary responsibility to the commander for the
organization, execution of duties, training, maintenance, and good order and discipline of the
entire command." [29]. "Evaluate the performance of officers and enlisted personnel and make
recommendations to commanders regarding their promotion and advancement." [29].
Role in accidents:
XO CARD:
Was on the bridge at the time of the accident and has been there since 0430 [22].
Reviewed plans for the evening.
Attended a special evolution briefing the day before.
Advise the CO to place the Sea and Anchor Watchbill before entering the Singapore
Strait.
Participate in the process of correcting the perceived loss of steering control.
Why?
Beliefs that contribute to behavior:
XO provides advice based on previous experience. XO is trained in Damage Control, and immediate
action occurs during repair efforts.
131
Question asked: What is the interaction between CO and XO? Does XO provide any other
feedback to the CO in addition to what was issued in the report? What is XO's level of
knowledge about IBNS?
XO believes CO makes a safe decision.
Question asked: Did XO feedback prove inaccurate on previous occasions?
Contextual Factors:
XO attended a briefing for the Singapore Strait transit the day before the accident and signed the
documentation to show it had reviewed plans, environmental factors and coordination efforts.
XO recommends CO to place Sea and Anchor Detail.
Question asked: Why doesn't XO provide more feedback to the CO to ensure the implementation
of the brief?
XO had been assigned to MCCAIN for over a year at the time of the accident. XO knows the sailors
of the ANTIETAM standing watch as part of the MCCAIN Navigation System.
Question asked: What is XO's level of knowledge about the equipment on board? What is XO's
understanding of the difference between MCCAIN and ANTIETAM? What does XO believe to be
the training that ANTIETAM sailors receive?
132
Individual:
Perwira Dek (OOD)
Individual Description:
The OOD for the incident was commissioned in the Navy in October 2015 and has been above
MCCAIN since March 2016 [22]. OOD recently qualified on July 30, 2017 [22].
Questions asked: Given recent qualifying, does OOD feel empowered to lead a bridge team with
CO on the bridge?
Liability related to accidents:
OOD's responsibilities are highly inclusive, as outlined in the Navy's CO Standing Order and
SORM. "The ongoing OOD is appointed by the commander to be responsible for the ship's safe
and proper operation including its safe and proper operation" [29]. The SORM highlights the
breadth of duties as: "be aware of tactical situations and geographical factors that may affect safe
navigation and take measures to avoid the danger of landing or collision following tactical
doctrine, the U.S. Coast Guard Road Navigation Rules, and the orders of the commander or
other appropriate authority" [29]. The SORM further directed the OOD to issue commands to
control the engine and rudder in danger while also knowing the operational plan for the ship's
navigation plan.
Role in accidents:
STRANGE:
Not ensuring adequate supervision of bridge personnel [29].
No general, chemical, or collision alarms are used [29].
Failing to adequately communicate actions with surrounding vessels during the loss of
the steering victim.
Not maintaining communication between him, his bridge monitoring team, and the CIC
team to understand the full scope of other surface vessels in the region. Lack
133
Communication leads to a lack of time available to make effective changes to prevent
collisions.
Acting, but not having enough time to avoid ALNIC.
Not taking adequate measures in a timely manner to ensure safe navigation.
Why?
Beliefs that contribute to behavior:
OOD believes the supervisory team is working adequately, safely, and no further assistance
is needed.
Question asked: What frame of reference should be compared to OOD?
OOD believes the CO has control of the deck. OOD describes a lack of confidence in
controlling the situation. OOD believes he has a solid understanding of the operating
environment, the Traffic Separation Scheme, and how to navigate safely.
Contextual Factors:
CO began to give orders throughout the bridge. OOD was a junior officer at the time of the
collision and had recently qualified. As per a standing order from the CO, the OOD is
required to notify other vessels in the area if there is a risk of collision during a loss of
steering. This notification did not occur.
Question asked: What do OODs believe to play with CO and XO on the bridge during the
events before the collision?
134
Individual:
Perwira Junior Dek (JEW)
Individual Description:
The JOOD for the incident was commissioned in the Navy in October 2015, having been aboard
the MCCAIN since May 25, 2017, in provisional status of the USS ANTIETAM [22].
Liability related to accidents:
"JOOD, when assigned, is the OOD's chief assistant" [29]. JOOD is specifically tasked with
assisting OODs by completing a port entry checklist [22].
Role in accidents:
The JOOD:
Lack of experience in IBNS systems for steering and propulsion.
It does not provide feedback on the bridge to ensure safe navigation.
Question asked: Can JOOD give feedback during the victim? What did JOOD do during the
fatality? What is JOOD's responsibility during casualties?
Why?
Beliefs that contribute to behavior:
JOOD believes that all the actions that need to be taken have been taken. JOOD believes the
OOD and CO have control over the situation.
Question asked: What level of knowledge does JOOD have about MCCAIN's special systems?
Contextual Factors:
JOOD from ANTIETAM is less experienced in IBNS systems for steering and propulsion [22].
ANTIETAM does not have IBNS. JOOD started standing watching JOOD in
135
August 2017 [22]. JOOD is still new to the role. JOOD performed the duties required by the role,
and there is no indication that he failed to continue performing the role.
Question asked: Does JOOD provide additional value beyond the scope of JOOD's normal
operations? What experience did JOOD have before standing guard as JOOD?
136
Individual:
Junior Supervisory Officer (JOOW)
Individual Description:
JOOW for the incident was commissioned to the Navy in May 2016 and has been aboard
MCCAIN since 2016 [22]. JOOW qualified as a rear-wheel drive safety officer and a steering
safety officer on October 20, 2016.
Liability related to accidents:
JOOW is specifically tasked with managing radar for surface contact [22]. JOOW aids in
internal and external communication while planning papers for managing surface radar images
[22].
Role in accidents:
The JOOW:
Placed as a steering safety officer after the victim occurred [22].
● Not handing over responsibility before taking on the role of a steering safety officer.
● Not controlling actions as a steering safety officer.
● It does not provide adequate communication with the rear steering, resulting in
unnecessary transfer of control.
Why?
Beliefs that contribute to behavior:
JOOW takes on the necessary role during the victim based on being the only one available to
perform the necessary tasks. JOOW believes the role of steering safety officers is more
important for navigation safety than JOOW's responsibilities. JOOW believes he has the
knowledge to perform the role of a steering safety officer.
Contextual Factors:
137
Junior Watch officers were placed as steering safety officers at the time of the fatalities. A
steering safety officer communicates with the rear steering safety officer regarding the transfer
of control and steering commands. Steering safety officers are also responsible for ensuring
compliance with proper procedures.
Question asked: If JOOW qualifies, why doesn't he give feedback to the helmsman and other
people on guard? Does JOOW hand over responsibility for other duties before taking on the
role of steering safety officer? Does JOOW understand the real situation?
JOOW visually confirmed that the correct lights were displayed on board during the collision.
138
Individual:
Konning Officer (CONN)
Individual Description:
Commissioned on 23 June 2017, the MCCAIN was its first vessel, and it was the first watch in
the area [22].
Liability related to accidents:
The CONN is responsible for relaying steering and propulsion commands to the helmsman [22].
The Troublemaker is a person who conveys orders from officers in the supervisory team to the
helmsman and helmsman Lee. CONN is also responsible for serving as a scout for the
supervisory team.
Role in accidents:
CONN Card:
Giving orders to the helmsman and helmsman lee to try to regain control during the
victim.
Work with CO and OOD to avoid collisions.
● Responsible for performing reconnaissance duties to identify collision paths early to give
time to take appropriate action.
Why?
Beliefs that contribute to behavior:
CONN is still learning how to be a wise sailor at the time of the collision. CONN believes
he has enough training to stand under proper supervision. CONN believes he can navigate
safely through dense environments.
139
Question asked: How much training does CONN receive before the watch? Is this number
typical of other Fraud Officers? Does CONN navigate other high-density traffic environments?
Contextual Factors:
The first CONN watch was on July 3, 2017.
Question asked: How many watches does CONN have? What level of proficiency does he have? Is
there any training before the first watch?
The U.S. Navy report highlights how the CONN is an entry-level role for new officers aboard
surface ships. This role allows for training and experience of junior supervisors early on with
their time on board. The Surface Warfare Officer's career path required a Deck Officer's letter,
and that training path began with a watch as a Teaching Officer [5]. Therefore, CONN is
incentivized to learn as much as possible to accelerate the training process to become an OOD.
The question asked: Does CONN feel pressured not to voice doubts about his own ability to get
away quickly?
140
Individual:
Boat Supervisor Pair (BMOW)
Individual Description:
Joined the Navy in 2015 and reported to MCCAIN on 21 May 2017, on a temporary
assignment from ANTIETAM [22]. BMOW is the qualified BMOW, helmsman, and
helmsman lee on the same date [22]. BMOW qualified for the main helmsman on August 8,
2107 [22].
Question asked: How thoroughly did BMOW understand the difference in operating equipment
between ANTIETAM and MCCAIN before qualifying?
Liability related to accidents:
Managing enlisted members of the bridge team; These people include helmsmen and QMOWs
above MCCAIN. The BMOW is responsible for supervising the spotter, QMOW, helmsman,
announcement system, and telephone speaker [29]. BMOW is mostly a supervisory position and
is responsible for ensuring good order and discipline among the registered supervisory team
members of the supervisory team.
Role in accidents:
The BMOW:
Step in to assist the helmsman in carrying out orders before the accident when the
helmsman is slow to respond.
Focus on helping the helmsman during the victim.
Why?
Beliefs that contribute to behavior:
The BMOW is responsible for keeping enlisted members, not officers, on guard. BMOW, at the
time of the accident, then had to intervene to help carry out steering and engine commands.
BMOW is a qualified helmsman with years of experience than a vigilant helmsman, which is
why BMOW stepped in to help. This action by
141
BMOW demonstrates confidence that quick action is necessary to ensure safe navigation. This
prevents the BMOW from sounding a collision alarm to warn the crew of the inevitable impact.
BMOW believes he has the knowledge that will provide value for the loss of steering response.
This belief explains why BMOW does not focus on its other responsibilities.
Question asked: Did the BMOW miss the liability announcement because it focused on the loss
of steering?
Contextual Factors:
BMOW has some of the most experience in the Pilot's House. BMOW's experience is in
systems other than IBNS. Helmsman Lee and BMOW were both assigned from ANTIETAM.
Question asked: How much experience do they have in changing control locations? Have they
ever been asked to switch control before?
The Chief Petty Officer required to conduct the training leading to certification as a helmsman,
helmsman lee, and chief helmsman did not understand IBNS [4]. The Chief Petty Officer
requested training from a system subject matter expert on IBNS, the training never happened [4].
IBNS is a new system installed in MCCAIN [22].
Question asked: What level of training has the BMOW received before certification for the
surveillance station? Does BMOW receive training on IBNS? Does BMOW teach the
difference between IBNS and the old system?
142
Individual:
Helmsman
Individual Description:
Joined the Navy in February 2017 and reported to MCCAIN on May 27, 2017, and became a
qualified helmsman on June 27, 2017 [22].
Question asked: How much previous experience does the helmsman have? What is a typical
one-month qualification? What process is carried out to determine proficiency?
Liability related to accidents:
The helmsman is responsible for carrying out the steering and propulsion orders of the Police
Officer [22].
Role in accidents:
Helmsman:
Releasing the watch at 0515 and struggling to adjust the direction and speed
simultaneously, which led to the CO ordering to place helmsman Lee [22].
Transferring steering control to the helmsman lee's operating panel. This displacement
leads to a perceived loss of steering.
Transfer the propulsion control to the steering wheel's operating panel in sequence.
Why?
Beliefs that contribute to behavior:
The helmsman believed to have lost control of the steering wheel at 05.20 when the wheels
were no longer controlling the steering wheel [28]. The helmsman believed the emergency
switch to manual-backup would not work because the system was in manual backup mode. The
helmsman believed the engine controls were transferred together, so the engine order input at
the helmsman lee's station controlled both engines.
143
Contextual Factors:
When the steering control is transferred to Lee Steering Station, the display of the helmsman
operator Lee controlling the steering wheel [28]. The emergency override button is designed to
switch control to a known state, the design suggests that it will switch control back to the
helmsman's console. The Steering Station and Lee Helm Station provide feedback to the
operator on the location and mode of steering and propulsion control [28]. The helmsman woke
up at 0450 and took off the watch at 0515, and the helmsman did not attend the navigation
briefing the day before.
Question Asked: Is the helmsman aware of the situation enough to pick up the watch? Is the
helmsman alert when picking up the watch? What is the level of knowledge of the helmsman
about the feedback that IBNS provides on the screen?
About four minutes after freeing the watch as a helmsman, the CO decided that a steer of Lee
was needed at the surveillance station. The placed helmsman lee is the previous helmsman who
was released; In contrast, the previous helmsman took the watch as Lee's helmsman. The
helmsman and helmsman lee transferred the propulsion controls one by one according to the
procedure. The IBNS display provides an indication to show the difference between the
machines.
Question asked: Why didn't the helmsman Lee recognize his screen indicating that he has
steering control? Why didn't the helmsman realize that Lee's steering station was in control?
Why don't the two operators pay attention to the difference in propulsion control between the
engines?
Control for propulsion is usually at the Steering Station [28]. The helmet controls the steering
using manual wheels, while the propulsion is through a flat panel screen [22]. The location of the
wheel is physically located between the Helm and Lee Helm displays. The helmsman is located
at the same distance as the flat panel screens of the Helm and Lee Helm stations.
Question asked: Why is the propulsion control not always at Lee's steering station? Is there a
144
belief that propulsion needs to be diverted with an additional supervisor?
145
Step 7 – Overall Communication and Coordination Examination
Possible Controller Lost
CAST reports analyze human operators, managers, and organizations and examine automation
and other areas of control systems. This accident does not list any technological issues with the
equipment; everything works as designed. AIS was identified as a possible missing controller. It
is in MCCAIN but is not used.
Communication and Coordination
There are two forms of communication that exist during an accident: communication on board
each ship and communication between each ship. There is enough information available from the
reports available to understand the effectiveness of this communication technique before the
event.
Of the two possible forms of communication, the CAST analysis proves that there are several
examples of ineffective communication above MCCAIN:
1. Lack of communication among bridge personnel. Sound circuits operate during
accidents and are not degraded [22]. All supervisors only focused on the loss of steering.
This focus on one single aspect of the controls in the Navigation System results in a lack
of coordination among the controls of the other Navigation System.
2. Lack of communication with other MCCAIN members. The bridge personnel did not use
the internal alarm network it had to warn the crew of an impending collision. This lack of
communication is an example of a missed opportunity for communication from the
bridge to the rest of the ship.
Second, communication between ships is assessed. Throughout the report, the only
communication between the ships was after the collision when the MCCAIN came out via radio
phone. Navigation Rules and Regulations establish lights, day form,
146
and sound signals as an effective means of communication between ships, as all ships must
supervise with sight and sound [26].3 N o c r e w m e m b e r u s e s a s h i p w h i s t l e o r
e q u i v a l e n t d e v i c e t o s o u n d a s i g n a l t o a n o t h e r v e s s e l . P e r s o n n e l
have the opportunity to arrange safe travel through effective
communication [26]. The form of communication is through the use
o f b r i d g e - t o - b r i d g e r a d i o s y s t e m s o r s h i p w h i s t l e s . E f f e c t i v e
c o m m u n i c a t i o n r e s u l t s i n m o r e t i m e t o m a k e d e c i s i o n s , a n d m o r e
t i m e a l l o w s a c t i o n s t a k e n t o b e m o r e i m p a c t f u l . T h i s v o i c e
c o m m u n i c a t i o n s y s t e m a l l o w s t h e s h i p t o a r r a n g e a s a f e j o u r n e y
w h e n t h e r i s k o f a c o l l i s i o n m a y e x i s t . A s h i p w h i s t l e i s a l s o a n
e f f e c t i v e m e a n s o f c o m m u n i c a t i o n b e t w e e n s h i p s . N o s h i p t r i e d t o
u s e a n y f o r m o f e f f e c t i v e c o m m u n i c a t i o n b e f o r e t h e a c c i d e n t .
147
3 The use of the noon form would not be effective in this situation, as the event occurred between sunset and
sunrise.
148
Step 8 – Dynamics and Migration to High-Risk Countries
Most significant accidents result from shifting systems to more dangerous systems and
decreasing margins over time [19]. The CAST analysis highlights changes to the control
structure present in the MCCAIN at the time of the collision. Referring to the figures in Step 3
of the analysis, this step provides an updated Control Structure to indicate changes in control by
the operator. The updated green line highlights the new authority issued immediately before the
accident. Areas to watch for are how CIC, Engineering, and Bridge divide themselves and the
lack of communication lines between spaces. It shows the complex network of interrelationships
between all the operating elements of the Navigation System and how the divergence of the
Control Structure is not just one individual error. There is no root cause. The system operates
unsafely, and only requires the right combination of hazards and environments to cause
accidents.
The following images show a summary of the interaction findings above the MCCAIN that led
to the collision. The detailed role and beliefs of the individual controller in the accident are
described in more detail in Step 6 of this analysis. These numbers define the Control Structure
that is run by the MCCAIN Navigation System. This report presents four versions of the Control
Structure. First, the interaction within the Singapore Strait (Figures C.9 and C.10) and then the
Model of the Control Structure from the moment of perceived loss of steering to the collision
(Figures C.11 and C.12). Each set models the Control Structure in two forms, the first removing
the missing feedback and authority lines from the Control Structure in Step 3, the other
representing the missing lines as dotted lines. Both forms are provided to help understand the
accident.
149
Figure C. 9 USS MCCAIN Safety Control Structure before collision
150
Figure C. 10 Safety Control Structure of USS MCCAIN before collision - Version A
151
Figure C. 11 USS MCCAIN Safety Control Structure at the time of collision
152
Figure C. 12 USS MCCAIN Safety Control Structure at the time of collision – Version A
153
Figure C. 13 Map of the collision path between the USS MCCAIN and M/V ALNIC MC [24].
154
Step 9 - Recommendations
Recommendations from CAST-Based Analysis:
The CAST analysis found inadequacies across physical controls and safety control structures.
The recommendations are divided into two groups: (1) equipment and (2) management and
engineering. The MCCAIN accident contained inadequate controls and had migrated to an
unsafe model. As structures tend to migrate to more unsafe conditions, the recommendations
outlined below are made to assist the U.S. Navy in developing processes to ensure safety is not
neglected. These recommendations are not intended to point out faults on behalf of individuals,
but rather to show how to improve processes to ensure the control structure results in safe
operations. This recommendation also aims to correct the operator's process model.
Equipment:
Inadequate Control/Feedback: IBNS feedback to the operator on steering position
control and propulsion
Inadequate Control/Feedback: IBNS Process to Control Propulsion Location
Indication of inadequate collision path: The radar does not notify the operator with
enough time and space to maneuver to avoid a collision.
Indication of insufficient collision path: AIS does not notify the operator of the
collision path.
Inadequate collision path indication: The Cruise Management System does not
provide an indication of the collision path.
All technologies work as designed, and MCCAIN has all the operating technologies available.
The equipment is not understood by the operator. Reading the original report leads to the
perception that the equipment is not working accurately. However, the analysis conducted by
CAST shows differently. Traditional reports miss recommended equipment software updates
155
from CAST to indicate a positive indication of the steering control location. Updates to this
equipment show how all equipment can function as designed, but accidents can still occur.
Naval Naval Systems Command (NAVSEA):
1. Update the feedback mechanism in IBNS on the Steering Control Location. The
software provides control indications. However, with a few helpful supervisors, no one
identified where the steering wheel control was. In the implementation of a better
feedback mechanism will ensure that everyone is aware when the Console Helmet no
longer has control.
2. Review other feedback paths in IBNS and update them as needed to ensure operator
awareness of control locations.
3. Review the integration between radar imaging and the Shipping Management System.
The integration of this system allows the introduction of other forms of feedback from
the QMOW to the radar imaging OOD superimposed on the navigation track image.
This provides an additional feedback path from the VMS to the QMOW to provide
awareness about the vessels in the area.
4. Review how AIS is integrated into the Navigation System. The incorporation of AIS
must effectively communicate to the personnel of other vessels in the vicinity and
whether there is a risk of collision.
5. Review the design to sound the signal to other boats. NAVSEA should coordinate with
SWOS to determine if additional software is required to be added to the Bridge where
it must control the sound signal.
CAST identifies three additional recommendations (compared to the FITZGERALD CAST
Analysis) that are directly related to new software or hardware for equipment.
1. Update the IBNS software to provide a better indication of where steering control and
propulsion are occurring. This feedback should occur when the transfer occurs and
provide a means for the operator to easily identify the location while it is in a stable
state.
2. Update the control software to transfer the throttle control to ensure the port and
right shaft are controlled from the same control location. Physical systems confuse
156
operators at control locations by design.
157
3. Location review for voice signals in conjunction with the review of operator roles and
responsibilities ensures the software supports the new Navigation Safety System.
Management and Engineering:
Inadequate Control/Feedback: Lack of Proper Supervision
Inadequate Control/Feedback: Lack of CO involvement in safe navigation
Inadequate Control/Feedback: Lack of input from Helmet Safety Officers
Inadequate Control/Feedback: Lack of proper utilization of tools and equipment - (sound
and radar signals) - BMOW/JOOD
Inadequate Control/Feedback: Lack of CIC involvement in safe navigation
Inadequate Control/Feedback: Lack of communication and coordination between CIC
and Bridge
Inadequate Control/Feedback: Lack of communication and coordination between
the Engineering Department and Bridge
To address the incapacity, the following measures are recommended to the U.S. Navy. This CAST
analysis determined that MCCAIN had migrated to a condition with a higher level of risk. The
recommendation is to provide updates on the roles and responsibilities of operators to ensure
proper operation, communication, and coordination.
Surface Warfare Officer School (SWOS) Command:
1. Review the dissemination of environmental information to observers. Make sure the
proper documentation reflects the expected weather conditions, traffic density,
normal traffic patterns expected.
2. Review the supervisor workload. This workload includes what work is assigned outside
of the assigned place of supervision that can cause distractions and burnout.
3. Make sure all operators are aware of how decision-making is disrupted when fatigue.
Review the procedures and requirements to identify and prevent fatigue before using the
watch.
158
4. Make sure the operator activates automatic signals in the software to improve
feedback from the physical system. Review the signal criteria to ensure notifications
are given in time for the supervisor's actions.
5. Review the requirements for COs to be on the bridge for extended periods of time and
develop procedures for risk management during days of high operational requirements.
6. Review the requirements and responsibilities for the CIC oversight office with an
emphasis on identifying which roles can effectively establish communication between
the CIC and the Bridge. The findings should adjust the Control Structure to build a
communication network.
7. Review the requirements and responsibilities for the Bridge monitoring station with an
emphasis on identifying which roles can effectively establish communication between
the CIC and the Bridge. The findings should adjust the Control Structure to build a
communication network.
8. Review the requirements and responsibilities for Bridge monitoring stations with an
emphasis on identifying which roles can effectively establish communication between
Engineering and Bridges. The findings should adjust the Control Structure to build a
communication network.
9. Review the requirements and responsibilities for Engineering Supervisory Stations with
an emphasis on identifying which roles can effectively establish communication between
Engineering and Bridge. The findings should adjust the Control Structure to build a
communication network.
10. Review the differences in the requirements for operating physical equipment between
types of ships. Emphasis should be placed on the review of the Safety Information
System and how feedback is provided to the operator. Based on these findings, a review
should be conducted for how requirements are generated to inform operators about the
differences and new procedures should be developed. This information should also be
used to provide the Control Structure with different operator responsibilities based on the
equipment in the Navigation System.
11. Review procedures on how COs communicate concerns through the Chain of
Command related to crew fatigue, equipment status, and daily schedules.
12. Review the Bridge Resource Management procedures to clearly redefine operator
159
roles and responsibilities. The roles and responsibilities of this operator should be
160
tailored to a specific vessel based on the physical equipment located on board the vessel
integrated in the Navigation System.
13. Review the requirements for personnel on board the Surface Vessel and adjust the
Navigation System Control Structure to reflect the available personnel. Adjusting
personnel roles and responsibilities based on personnel in the Control Structure.
Assign responsibility for operating AIS.
Cos:
1. Make sure all operators are aware of how decision-making is disrupted when crew
members are exhausted. Review the procedures and requirements to identify and
prevent fatigue before using the watch.
2. Make sure the operator activates automatic signals in the software to improve
feedback from the physical system. Review the signal criteria to ensure notifications
are given in time for the supervisor's actions.
Traditional vs. CAST Findings Discussion: MCCAIN
This section continues the discussion from Chapter 7 and Appendix A to answer the guiding
question of this research: What unique insights were not previously uncovered through the
traditional analysis provided by the STAMP-based CAST analysis of the 2017 USS
FITZGERALD, and USS MCCAIN collisions for U.S. Navy surface ships? What value does this
STAMP-based approach provide to the U.S. Navy? At the time of the accident, operators
believed their actions kept MCCAIN safe. The numbers in Step 8 of this section highlight how
those beliefs led to changes in the way they operated the Navigation System. As a result, the
U.S. Navy indicated the main cause of the accident was human error. Meanwhile, CAST
Analysis recommends reviewing the operator's roles and responsibilities and adjusting them to
ensure proper communication, coordination, and operation of equipment. The CAST analysis
further identified changes that needed to be made to the IBNS control system software to
prevent future accidents.
The U.S. Navy recommends five areas to improve based on findings in "fundamentals,
teamwork, operational safety, assessment, and culture." [5]. The U.S. Navy and NTSB
161
report
162
Build on the traditional cause-and-effect mindset and aim to "break the chain." This thought
process is action-oriented and does not address why actions occur as recommended by the
STAMP/CAST analysis. The CAST analysis shows that the control structure is ineffective in
preventing losses due to inadequate controls and weaknesses of the process model. The CAST
analysis identified this difference because it focused on the Navigation System within
FITZGERALD and not on the individual behavior of personnel as suggested by the U.S. Navy.
This section focuses on summarizing the U.S. Navy's traditional findings and then comparing
those findings with the recommendations of the CAST analysis.
The U.S. Navy report focused on a discussion of what happened to the people on the FITZGERALD
Bridge. The U.S. Navy's recommendation is for crew rest, training, and AIS implementation. These
findings are typical of standard U.S. Navy Reports because of their analysis of traditional swiss
cheese.
The CAST analysis found several weaknesses of the process model in personnel that led to
collisions that were not discussed in traditional findings. CAST found that by looking beyond
what was in the report, the systemic practice of isolated controllers was revealed. Different
operators separate themselves and present a culture of independence. Traditional reports rely on
cause-and-effect events and blame personnel based on errors. These reports failed to properly
investigate the reasons behind the event. What is the steering safety officer's process model
during a loss of steering? Why doesn't CO trust standard steering mode? Why did they transfer
the propulsion control when the helmsman lee could control it from its original location? SWOS
recommendations for management and engineering #6 to #13 allow for the integration of
operator beliefs and address the communication issues raised in the CAST Analysis.
CAST provides a clear description of the underlying control structure and the weaknesses of the
process model that, if left unaddressed, will result in the migration of guard personnel back to
more risky conditions. This migration can result in future accidents and can be prevented with
the right solutions. Traditional analysis does not look for reasons behind actions and seeks to
correct what happened. By adding new and improved individual training recommended by
163
traditional model, it does not remedy the lack of feedback between CIC and Pilot House.
Traditional recommendations do not outline a plan to ensure future safety of the Navigation
System as process models change. Traditional findings focus on how to improve the knowledge
base of all individuals and institutionalizing more regular performance assessments will ensure
that the right people with the right knowledge are in the right place at the right time.
The recommendations given to SWOS to review and revise the operator's roles and
responsibilities address incorrect process models and contextual factors that lead to operator
decisions. Revision of roles and responsibilities will fix inadequate controls and feedback. The
CAST analysis further identified the need to clearly identify communication and coordination
between the CIC, the Engineering Department, and the Bridges. The recommendation to review
those responsibilities points to another difference. In addition, recommendations for updating
equipment provide additional information to operators. CAST analysis provides
recommendations that provide responsibility for implementing recommendations, methods for
examining implementation, and established feedback systems to determine the effectiveness of
controls [18]. CAST demonstrates value to the U.S. Navy through a recommendation agency
that provides a structure for continuous improvement.
This Systems Thinking approach aims to implement effective controls to prevent future
accidents. Traditional requirements usually dictate what to do and fail to complete a thorough
analysis of what happens when the action is not taken or done at the wrong time. Understanding
the assumptions, actions, and different factors helps operators understand their limitations. By
understanding these limitations, they can explain the weaknesses of the process model why
actors take their actions. The recommendations by the Comprehensive CNO review and the U.S.
Navy report highlight individual contributors and fail to see the Navigation System as a system.
The recommendations and findings separate the CIC's mistakes from the bridges and senior
leadership errors. This entity is a subsystem in the operating system that is necessary to maintain
safe navigation. For example, fatigue is placed on command leadership because it does not
lighten; Meanwhile, it is not assessed how individual fatigue affects their performance in
managing their relationships and communication with
other members of the supervisory team. It is clear that through the previously mentioned CAST
recommendations effective controls are essential and proven to prevent future accidents.
A comparison of the findings between the U.S. Navy Report and the CAST Analysis is found in
Table 7.1 in Chapter 7. MCCAIN CAST began answering the research question by demonstrating
added value to the U.S. Navy through an understanding of why the operator process model in the
Navigation System.
