Scholarly article on topic 'Situation awareness in bridge operations – A study of collisions between attendant vessels and offshore facilities in the North Sea'

Situation awareness in bridge operations – A study of collisions between attendant vessels and offshore facilities in the North Sea Academic research paper on "History and archaeology"

CC BY-NC-ND
0
0
Share paper
Academic journal
Safety Science
OECD Field of science
Keywords
{"Situation awareness" / Safety / Maritime / Transportation / Offshore}

Abstract of research paper on History and archaeology, author of scientific article — Hilde Sandhåland, Helle Oltedal, Jarle Eid

Abstract This study examined accident reports (n =23) for collisions between attendant vessels and offshore facilities on the Norwegian continental shelf during the period of 2001–2011. An initial analysis indicated that the concept of situation awareness (SA) might be useful for providing a more detailed understanding of the processes that lead to collisions. SA is defined as ‘being aware of what is happening around you and understanding what that information means to you now and in the future’ (Endsley, 2012, p. 13). The first part of the study contains an analysis of accident reports that reveals that the collisions with offshore facilities were preceded by loss of SA on the bridge in 18 of the 23 instances. Three types of SA errors were identified: failure to perceive the situation correctly (Level 1 SA; n =13), failure to comprehend the situation (Level 2 SA; n =4), and failure to project the situation into the future (Level 3 SA; n =1). In the second part of the study, the human, technological and organisational factors described in the accident reports are analysed to evaluate how the factors may have affected the duty officers‘ awareness of the situation. The results indicate that inadequate operation planning, inadequate bridge design, insufficient training, communication failures and distracting elements were the underlying factors that significantly contributed to the collisions.

Academic research paper on topic "Situation awareness in bridge operations – A study of collisions between attendant vessels and offshore facilities in the North Sea"

ELSEVIER

Contents lists available at ScienceDirect

Safety Science

journal homepage: www.elsevier.com/locate/ssci

Situation awareness in bridge operations - A study of collisions between attendant vessels and offshore facilities in the North Sea

Hilde Sandhâlanda,b'*, Helle Oltedala, Jarle Eidb

a Department of Maritime Studies, Stord/Haugesund University College, Bjornsonsgate 45, N-5528 Haugesund, Norway b Department of Psychosocial Science, University of Bergen, P.O. Box 7807, NO-5020 Bergen, Norway

ARTICLE INFO

ABSTRACT

Article history:

Received 11 April 2014

Received in revised form 24 April 2015

Accepted 23 June 2015

Available online 9 July 2015

Keywords:

Situation awareness

Safety

Maritime

Transportation

Offshore

This study examined accident reports (n = 23) for collisions between attendant vessels and offshore facilities on the Norwegian continental shelf during the period of 2001-2011. An initial analysis indicated that the concept of situation awareness (SA) might be useful for providing a more detailed understanding of the processes that lead to collisions. SA is defined as 'being aware of what is happening around you and understanding what that information means to you now and in the future' (Endsley, 2012, p. 13). The first part of the study contains an analysis of accident reports that reveals that the collisions with offshore facilities were preceded by loss of SA on the bridge in 18 of the 23 instances. Three types of SA errors were identified: failure to perceive the situation correctly (Level 1 SA; n = 13), failure to comprehend the situation (Level 2 SA; n = 4), and failure to project the situation into the future (Level 3 SA; n = 1). In the second part of the study, the human, technological and organisational factors described in the accident reports are analysed to evaluate how the factors may have affected the duty officers' awareness of the situation. The results indicate that inadequate operation planning, inadequate bridge design, insufficient training, communication failures and distracting elements were the underlying factors that significantly contributed to the collisions.

© 2015 The Authors. Published by Elsevier Ltd. This is an open access article under the CCBY-NC-ND license

(http://creativecommons.org/licenses/by-nc-nd/4XI/).

1. Introduction

During the period of 2001-2011, a total of 27 collisions were reported between attendant vessels1 and offshore facilities on the Norwegian continental shelf. At least six of these collisions were deemed to have very high hazard potentials (Kvitrud, 2011; Oltedal, 2012). The catastrophic potential of collisions between attendant vessels and offshore facilities was demonstrated in dramatic fashion by the Mumbai High North accident in July 2005. A multipurpose support vessel lost control and hit several marine risers at the Mumbai High North offshore complex off the west coast of India. The collision caused a gas leak that resulted in a serious fire, and parts of the complex collapsed after approximately two hours. Of the 384 persons who were on board that day, 362 were rescued, and 22 died (Daley, 2013). The objective of this study is to

* Corresponding author at: Department of Maritime Studies, Stord/Haugesund University College, Bjornsonsgate 45, N-5528 Haugesund, Norway. Tel.: +47 928 58 788, +47 52 70 27 62.

E-mail address: Hilde.Sandhaland@hsh.no (H. Sandhaland).

1 This term refers to vessels that provide services to offshore installations and includes platform supply vessels (PSVs), anchor-handling vessels, standby vessels and oil tankers. Historical data show that 98% of collisions between vessels and offshore facilities on the Norwegian continental shelf involve attendant vessels (the North West European Area Guidelines, 2009).

understand the human factors and processes that contributed to the reported collisions on the Norwegian continental shelf to prevent similar events in future. The analysis was based on the assumption that to be effective, bridge crews on attendant vessels must act decisively during stressful, high-risk situations. The analysis also assumed that situation awareness (SA) is a prerequisite for quick and good decisions (Endsley, 1995b). According to Endsley (2012, p. 13), SA can be described as 'being aware of what is happening around you and understanding what that information means to you now and in the future'. That is, the bridge crew must be able to identify key aspects of the environment accurately, understand the meaning of what they sense, and have a good sense of what can happen. Although we have no data to verify that SA errors contributed to the Mumbai High North accident, the available information strongly suggests that a loss of SA might have been a contributing factor. The weather conditions were unfavourable when the vessel approached the offshore facility on its windward side. Due to technical problems, the approach was initially made in manual mode and, subsequently, in emergency mode, which indicates that the vessel's position was entirely under human control (Daley, 2013). In such conditions, it is particularly important that the bridge crew is attentive and has the ability to assess the situation continuously and act appropriately to avoid severe consequences. Any collision between seagoing vessels and fixed installations, such as bridges and quays, has the

http://dx.doi.org/10.1016/j.ssci.2015.06.021 0925-7535/® 2015 The Authors. Published by Elsevier Ltd.

This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/).

potential for major consequences to human, environmental and economic assets. However, as shown in the Mumbai High North case, collisions with offshore production facilities have notably high hazard potentials. In addition to the risk of injuries and fatalities, damage to hydrocarbon pipes and subsequent ignition and fire may cause severe oil spills and thus represents a threat to marine life and vulnerable ecosystems.

In the current study, we examined 23 of the 27 collisions that occurred in the period from 2001 to 2011 to determine the role of human errors that might have been related to the loss of SA. However, because human error caused by the loss of SA can be perceived as a consequence of the underlying circumstances in an organisation (Reason, 1997), the current study also aimed to identify the human, technological and organisational factors that might have influenced the bridge crews' abilities to achieve and maintain SA as the events unfold. The incidents that we analysed occurred within a petro-maritime context in which various organisations and actors, including both internal actors on board the vessel and external actors (e.g., the offshore facility), interact on a daily basis. However, our primary emphasis was on the bridge operations, and our study is therefore limited to the course of events on the bridge. To provide a frame of reference, we will briefly outline the concept of SA and suggest several factors that might have affected the bridge crews' SA formation.

1.1. The concept of situation awareness

According to Endsley (1995b), SA in bridge operations generally involves three levels of information processing. At the first level (SA Level 1), the duty officer perceives the status and dynamics of the relevant elements in his/her environment. Given that our attention and working memory capacities are limited and selective (Simons, 2000), a typical error at this level would be the missing of critical information. At the second level (SA Level 2), the duty officer will integrate and evaluate the information at hand. He/she is required to understand the perceived information in relation to the relevant goals and objectives. Because our attention and working memory capacities are limited, we rely on information stored in our long-term memory in the form of particular mental models (Endsley, 1995b). A mental model can be understood as 'the mechanisms whereby humans are able to generate descriptions of system purpose and form, explanations of system functioning and observed system states, and predictions of future system states' (Rouse and Morris, 1986, p. 351). Thus, a typical error at the second level would be a failure to comprehend the situation. The duty officer might misinterpret the information or experience limitations in working memory due to information overload and/or stress (Endsley, 2012). At the third level (SA Level 3), the duty officer uses his/her perception and comprehension of the current situation to estimate what will happen in the near future (Endsley, 1995b). For example, by calculating speed, currents and wind, the duty officer should be able to avoid a collision with an offshore facility by reprogramming the automatic systems.

As proposed by Endsley, the three-level approach focuses on cognitive processes and takes the mind of each individual as the unit of analysis. However, this approach has certain limitations in terms of our understanding of how SA is achieved in collaborative systems. In this respect, a more recent perspective on SA provides an alternative manner in which to examine SA. Following from the concept of distributed SA, SA is viewed as a system property in which SA related information is distributed between different agents (both human and non-human) in a collaborative system. In this perspective, the focus of study is on the interactions between the agents comprising the system, and a central aim is to understand how SA-related information is transferred between different agents in day-to-day operations (Salmon et al., 2012). In this

manner, the application of a distributed SA perspective may enhance our understanding of the factors that influence SA formation among the bridge crew. Communication is a particularly critical dimension that might be a source of misinformation and thus affect a bridge crew's SA requirements (Kanki, 2010; Patrick and Belton, 2003; Weick et al., 1999). Should a crew member fail to transfer information or communicate information in an ambiguous manner, the bridge crew's SA formation might suffer (Endsley, 1995b). The technological environment of the bridge also provides SA-related information; thus, man-machine interactions are of particular importance on board offshore vessels. The extent to which and how the technology provides the bridge crew with information is therefore a critical dimension in the SA context (Endsley, 2012). It has also been suggested that planning activities aimed at anticipating events might have a positive effect on bridge crews' abilities to achieve SA. High-quality planning should ideally improve the understanding of risk and enable crew members to seek information in advance and plan for various scenarios (Endsley and Robertson, 2000; Flin et al., 2008). Such planning may be particularly important in situations in which the bridge crew has limited time to act to avoid consequences. In addition to highlighting interactions with both humans and the environment, Bolstad et al. (2005) emphasised that the operators' abilities are a central component in the formation of SA in collaborative systems. From this perspective, emphasis should be placed on factors such as training regimes, including how the shipping companies ensure that the bridge crew has sufficient knowledge to understand what they sense.

The loss of SA is frequently seen as an important contributing factor to accidents in various industries, such as the aviation (Endsley, 1995a; Jones and Endsley, 1996) and maritime industries (Barnett et al., 2006; Grech et al., 2002). An accident analysis from the offshore drilling industry indicates that the loss of SA is a significant antecedent of human error. Of the 135 cases that were associated with a loss of SA, 67% were attributable to a lack of perception of critical information (SA level 1), 20% were attributed to a failure to comprehend the situation (SA level 2), and 13% were attributed to an inability to project the situation into the near future (SA level 3) (Sneddon et al., 2006). To the best of our knowledge, no previous studies have examined the significance of the loss of SA during bridge operations on board offshore vessels.

1.2. International standards and industry guidelines

Several international standards and guidelines have been developed to support seafarers and help them operate safely at sea. The oldest such standard is the International Convention for the Safety of Life at Sea that was developed by the International Maritime Organization as a response to the Titanic disaster. This convention was adopted in 1914 and was most recently revised in 2011. The main objective of this convention is to specify minimum standards for the construction of and equipment on board vessels. Of particular significance in the SA context is the principle that bridge design and the design of navigational systems and equipment should enable the bridge crew to have convenient and continuous access to essential information that is provided in a clear and unambiguous manner (International Maritime Organization, 2012). Furthermore, following a series of major accidents at sea in the early 1990s, the International Maritime Organization began to develop new regulations that account for human factors (Gholamreza and Wolff, 2008). This update included a new revision of the Standard for Training, Certification and Watch-Keeping for Seafarers (International Maritime Organization, 2011) that incorporated new minimum requirements for the training and competence of seafarers and thus aimed to increase the knowledge and skills of seafarers worldwide. This update also included a

revision of the International Safety Management Code (International Maritime Organization, 2010) that aimed to establish a minimum standard for safety management systems (Rodriguez and Champbell Hubbard, 1998-1999). However, because the code sets out functional requirements, rather than specific operating procedures, the industry is still relatively free to customise its safety management systems to its own needs within the framework of the code. A recent example is the North West European Area (NWEA) guidelines for the safe management of offshore supply and anchor-handling operations.2 These guidelines were developed as a joint project by maritime and offshore organisations in Denmark, the Netherlands, the UK and Norway, and they were implemented in 2006. The purpose of these guidelines was to incorporate the best practices in offshore supply and anchor-handling operations into the industry (the North West European Area Guidelines, 2009). Although the NWEA guidelines are officially only recommendations, in reality, clients require shipping companies that provide supply and rig moving services to adhere to them. Several requirements that were incorporated into the NWEA guidelines were intended to increase the awareness of bridge crews of the situation and the upcoming operations, for example, by mandating that two navigators are on the bridge when operating inside the safety zone around an offshore facility and by providing checklists and standards for risk assessment that must be completed and met prior to entering the safety zone. International standards and industry guidelines can thus be seen as structured recommendations that are intended to assist bridge crews in their work performance.

2. Methodology

2.1. Sample description

The objective of this study was to understand the human factors and processes that contributed to the 27 collisions between attendant vessels and offshore facilities on the Norwegian continental shelf in the period of 2001 to 2011. The only available data about these incidents are presented in reports from various investigations, and this study is based on reviews and analyses of the data presented in these reports. Initially, we were able to collect reports about 24 of the incidents, but one was excluded due to sparse information. Three of the incidents included in this study were investigated by more than one agency or organisation, resulting in a total of 28 accident reports. In these three cases, the accident reports dealing with the same accident provided richer sources of information about the cases in question. However, the suggested causes were not counted more than once. Ten reports originated from operators, fourteen from shipping companies, two from consulting firms in cooperation with shipping companies, one from the owner of the offshore facility and one from the Norwegian Petroleum Safety Authority. The reports varied in length from 4 to 63 pages, and the total number of pages including appendixes was 701. Table 1 presents an overview of the types of vessels that were involved in the incidents, and Table 2 provides an overview of the types of operations that were being conducted at the times of the incidents.

2.2. Procedure

The coding was quite a challenge because the reports were surprisingly diverse in terms of their contents, structures and applied methodologies. Indeed, the methodologies were only explicitly described in seven of the reports. In the remaining 21 reports,

2 The NWEA guidelines were replaced by Guidelines for Offshore and Marine Operations (GOMO), which were implemented on the 1st of June 2014. However, the NWEA guidelines were applicable at the time of the collisions included in this study.

Table 1

Type of vessels involved in the incidents.

Type of vessel No of incidents

Platform supply vessel 17

Anchor-handling vessel 2

Standby vessel 2

Shuttle tanker 1

Well stimulation vessel 1

Table 2

Type of operation being conducted at the times of the incidents.

Operation No of incidents

Loading/offloading 10

Approaching offshore facility 8

Departing from offshore facility 2

Anchor handling 2

Stand-by services 1

the methodologies used to arrive at the findings and conclusions were unknown. However, all of the reports contained statements about the original investigators beliefs regarding the causes of the incidents. To select the most appropriate approach for analysing the accident reports, these statements were initially reviewed and organised into major topics. The results indicated that human error (caused either directly by the bridge crew or by inadequate responses to technical faults), technical faults and adverse weather conditions emerged as the major causal categories, and causal categories were implicated both separately and in combination. Twenty-one cases involved some type of human error, nine cases involved some type of technical fault, and six cases involved adverse weather conditions (e.g., heavy fog, swells and waves). In eight cases, human error occurred in combination with a technical fault, in five cases, human error occurred in combination with adverse weather conditions, and in the remaining eight cases, human error was identified as the sole direct cause.

Based on the initial processing of the reports, we decided to follow an approach that remained open to organizational, technological, individual factors and environmental force-related factors. The second analytical step consisted of a process of open and axial coding (Neuman, 2006) and provided opportunities to develop categories that described the causal factors and to examine the associations between categories. In this process, failures related to 'problem detection' and 'problem diagnosis' emerged as two major categories of human error that contributed to the incidents. These categories were considered to be congruent with Level 1 and Level 2 in Endsley's (1995b) theory of situation awareness, and this concept therefore emerged as a major topic of the study.

Initially, we intended to end the procedure after the second step. However, due to the identified link between the categories and the theory of SA, we decided to elaborate further on the significance of the loss of SA. Consequently, a further analysis focused exclusively on the 21 cases in which the incidents were caused by human error alone or in combination with weather conditions or technical faults. The third analytical step therefore involved the use of Jones and Endsley's (1996) conceptual framework, which classifies and describes the sources of SA errors at each of the SA levels, to reanalyse and reclassify the information about the causes presented in the reports. In cases in which more than one SA error was identified, we only coded the error that occurred closest in time to the collision.

Because the previous analytical steps were not sufficient to understand why the losses of SA occurred, we decided to extend the analysis to identify the contributing factors. In the fourth step, each accident report was re-examined to identify the human, technological and organisational contributing causes associated with

the SA errors. These contributing causes were assigned an initial code, and the codes were later condensed into broad categories. For example, 'insufficient risk assessment', 'inadequate use of the pre-entry checklist' and 'insufficient technical tests' before the vessels entered the offshore facilities' safety zones were all categorised as 'planning failure'. In addition to 'planning failure', 'inadequate design', 'communication failure', 'distracting elements' and 'insufficient training' emerged as major categories.

Finally, to increase the reliability of the coding, the reports were independently analysed and classified (according to the SA conceptual framework) by two of the authors. Both authors remained blind to the other's classifications during this process. The raters agreed in the majority of the cases. In cases of disagreement, the raters discussed the cases and reached agreement by clarifying and explaining their positions. In all but two cases, the raters reached agreement about their classifications. For these two cases, a third rater analysed and classified the accident reports. The final classifications were in accordance with the classifications of the majority. The two cases in question are marked with asterisks (/) in Table 5.

2.3. Methodological challenges

As noted in previous studies that have analysed accident reports, the present study contains limitations and shortcomings concerning the ability to represent all aspects of an incident; '[all such reports] are - even the best of them - a highly selective version of the actuality, and it is also very much a subjective process' (Reason, 2008, p. 58). Although the accuracy of a report can never be known with any degree of certainty, it is important to identify the conditions that might have led to inaccuracy (Scott, 1990). As previously noted, the accident reports were surprisingly diverse in terms content, structure, and applied methodology. Although some of the reports contained a relatively comprehensive analysis, it should be noted that some of the reports contained rather sparse information beyond the acute phase of the incident and emphasised technical faults and human error. Therefore, it is likely that the organisational contributing causes were underrepresented in the sample. Thus, the distribution of contributing causes might be somewhat distorted relative to the actual distribution. Because the methodologies applied in the investigations were not explicitly described in the majority of the reports, it is also difficult to assess whether and how various SA aspects were covered in the investigations. In addition to the arguments outlined above, an important question is whether the researchers were able to draw the correct conclusions based on the data presented in the accident reports. Although the data utilised in this study consists of the investigators' descriptions of the incidents and their beliefs regarding the causes of the incidents, the coding process always includes subjective judgements. For example, in the present study, failures to apply the mandatory checklists before the vessels entered the offshore facilities' 500-m safety zones were coded as 'planning failures'. Another code that might have been applicable in these cases is 'procedure violation', which would have communicated another aspect of the causal picture. However, we attempted to established transparency in this study such that the description of the incidents and associated contributing factors are presented as narrative text to a large extent. The reader must however bear in mind that the reliability of this study might be affected by the aforementioned conditions.

3. Results

The cases included in our study varied in relative severity, both in terms of actual consequences and loss potential. The majority of

Table 3

Consequences.

Severity Consequences No of

rating incidents

Minor Minor or no material damage to facility and/or vessel 15 Examples: minor damage to railing, antennas, fender lists, bulk hoses and minor dents in bulwark

Severe Considerable material damage to facility and/or vessel 8 Examples: dents in shaft and bracing on the offshore facility and dents in the vessels hull

the cases (n = 15) involved minor impacts with the offshore facility and limited to minor material damage to the offshore facility and/or vessel. Typical scenarios in these cases were that the vessel drifted into the offshore facility due to technical problems or due to inattentiveness by the bridge crew. Thus, in these cases, relatively low amounts of force were involved. Additionally, the bridge crews were able to restore normal states by pulling out from the offshore facility relatively swiftly. The remaining cases (n = 8) were assessed either by the Norwegian Safety Petroleum Authority or the service provider as having severe loss potentials. In these cases, the vessels hit the offshore facility at relatively high speeds3 or made contact with the offshore facility repeatedly due to problems pulling out from the offshore facility and restore a normal state. Table 3 provide some examples of the actual consequences according to severity rating.

According to the accident reports, the wind speeds were at calm and high wind, moderate gale, and near gale levels at the times of the incidents. However, no information about wind speed was available in three of the accident reports. In two other reports, the wind speeds were described as light and thus could not be classified according to Beaufort's scale. The wave heights at the times of the incidents according to the accident reports were between zero and six metres.4 However, in three of the accident reports, no information about wave height was available. In two other reports, the conditions were described as calm seas. An overview of the weather conditions at the times of the incidents is provided in Table 4.

SA errors were identified in 18 of the 21 cases we analysed. Table 5 provides an overview of the classifications of these 18 cases according to Jones and Endsley's (1996) conceptual framework. Thirteen incidents were classified as Level 1 errors, four cases were classified as Level 2 errors, and one case was classified as a Level 3 error. Regarding the SA Level 1 errors, the most common source was a 'failure to monitor or observe data', which was applicable in 8 of the 13 cases. The most common source of the Level 2 errors was a 'lack of/poor mental model', which was applicable in all four cases. The incident classified as a Level 3 error was due to a failure to project the possible consequences of a particular manoeuvre when the vessel was about to leave the offshore facility. In twelve of the cases, the bridge crew failed to perceive or comprehend critical information regarding the vessel's technical status.

Table 6 provides an overview of contributing causes that were associated with each source of SA error according to Jones and Endsley's (1996) conceptual framework. The column on the left shows the numbers of incidents associated with each source of SA error as presented in Table 5. The remaining columns show the numbers of cases associated with each category of contributing cause as identified in our analysis.

Overall, 'planning failure' was identified as the most common contributing cause and was applicable in 10 of the 18 cases. The

3 In one of the cases the vessel collided with the offshore facility at a speed of 9.7 knots.

4 In nine cases, whether the wave height was measured as significant or maximum wave height was not specified. In four cases, wave height was significant wave height, and in three cases, it was measured as maximum wave height.

Table 4

Weather conditions.

Wind speed Wave height Number of incidents

Fresh breeze - high wind, moderate gale, near gale (17-33 knot) 0-4 m 7

Fresh breeze - high wind, moderate gale, near gale (17-33 knot) 1.5-6 m 11

Fresh gale - hurricane (34 knot-p 64 knot) N/A 0

Described as light wind Described as calm sea 2

Information not available Information not available 3

Table 5

Sources of SA errors according to Jones and Endsley's (1996) conceptual framework.

Level of error No of incidents

Level 1 error - perception 13

Failure to monitor or observe data 8*

Hard to discriminate or detect data 1

Data not available 2

Misperception of data 2

Memory loss 0

Level 2 error - comprehension 4

Lack of/poor mental model 4

Use of incorrect mental model 0

Over-reliance on default values 0

Other 0

Level 3 error - projection 1

Lack of or incomplete mental model 0

Over-projection of current trends 0

Other 1

next most common causes were 'inadequate design', 'communication failure' and 'insufficient training', which occurred in seven of the 18 cases. 'Planning failure' in combination with 'failure to monitor or observe data' was identified as the most common contributing cause among the SA Level 1 errors and was applicable in five of eight cases. The most common contributing cause among the SA Level 2 errors was 'insufficient training' associated with 'lack of/poor mental model', which was applicable in all four cases. In the following sections, we elaborate on our findings and provide examples drawn from the accident reports in accordance with the structure provided by Jones and Endsley's (1996) conceptual framework.

3.1. Level 1 error - perception

3.1.1. Failure to monitor or observe data

In eight cases, the source of the SA error was the bridge crew's failure to monitor or observe critical available information. In five of these cases, the bridge crew failed to detect settings in the vessel's technical system. Notably, two cases followed an almost identical course of events in that they were both caused by the bridge

crew believing that the vessel was on manual steering when it was actually on autopilot. Because the autopilot overrides manual steering, all attempts to steer the vessel failed, which led to unavoidable impact with the offshore facility. After one of the incidents, the investigators stated, 'he [the officer] checked critical functions (...) but he did not check the status of the autopilot' (Report no 106 - D01, p. 8). The last three cases were due to insufficient monitoring of the vessel's relative distance to the offshore facilities. In one of the accident reports, it was noted that 'both the master and the first officer were present on the bridge on [name of the vessel] when the vessel was within the 500-m safety zone of [name of the installation], but for a while, no one kept lookout in the vessel's longitudinal direction' (Report no 115-D02, p. 15) (translated from Norwegian into English). When the bridge crew's attention was finally drawn to the longitudinal direction, it was too late to reverse the situation because the vessel was critically close to the offshore facility.

The investigators emphasised what has been classified as 'planning failure' as the most common contributing cause associated with the 'failure to observe or monitor data', which was applicable in five of the eight cases. In three of these five cases, more active use of the available checklists during the planning stage before the vessel entered the offshore facility's safety zone might have helped the bridge crew to perceive critical data from the vessel's technical system. The second most common contributing causes associated with 'failure to monitor or observe data' were 'communication failure' and 'distracting elements', which were both applicable in four of the eight cases. Regards 'communication failure', two cases were related to ambiguities in communication during the transfer of command. 1n one of these cases, the ambiguity in communication led to confusion about who was actually in command of the vessel. The investigators stated that 'the master was of the opinion that the first officer was in command of the vessel (...). The master did not monitor the vessel's position, while the first officer took it for granted that the master was in control and command of the vessel' (Report no 109-D01, pp. 12-14). That no one was in command resulted in an unmonitored approach to the offshore facility. Regarding 'distracting elements', these elements stemmed from incoming telephone calls, the performance of administrative tasks and distractions due to other activities on deck. These

Table 6

Contributing causes associated with sources of SA errors.

Sources of SA errors Contributing causes

Inadequate design Planning failure Communication failure Distracting elements Insufficient training

Level 1 error - perception (n= 13)

Failure to monitor or observe data (n = 8) 2 5 4 4 3

Hard to discriminate or detect data (n = 1) 1 0 0 1 0

Data not available (n = 2) 1 1 1 0 0

Misperception of data (n = 2) 1 2 1 0 0

Level 2 error - comprehension (n = 4)

Lack of/poor mental model (n = 4) 2 1 1 0 4

Level 3 error - projection (n=1)

Other (n = 1) 0 1 0 1 0

Total 7 10 7 6 7

activities are believed to have reduced the bridge crew's attention to the navigational activities.

3.1.2. Hard to discriminate/detect data

One of the incidents included in our study was caused by the bridge crew's difficulty in detecting critical information because the vessel was moving between offshore facilities in the dark and in heavy fog. Due to the visibility conditions, the crew failed to detect one of the offshore facility's legs, which resulted in a minor impact.

The investigators emphasised both factors that were classified as 'inadequate design' and 'distracting elements' as potential contributing causes of the incident. Firstly, regarding design issues, it was noted that due to the shape of the bridge, the bridge crew was not able to see parts of the offshore facility from the manoeuvring position. Additionally, it was noted that the legs of the offshore facilities were painted a dark colour that was difficult to discern in reduced visibility conditions. Secondly, regarding 'distracting elements', the accident report stated that a moment of inattention by the master due to VHF communication contributed to the incident.

3.1.3. Data not available

In two cases, critical information concerning the state of the vessel's technical system from the bridge was not accessible (in due time). In one of the cases, a technical fault in one of the thrus-ters was a contributing cause to the incident, but because the joystick manoeuvring system did not have a system for monitoring the individual movements of the thrusters, the bridge crew received no failure warning before beginning to position the vessel close to the offshore facility. The other case was related to faulty settings in the dynamic positioning5 (DP) system. A mishap that occurred while making adjustments to the DP system resulted in a situation in which the joystick's references regarding forward and stern were switched relative to the expectations of the bridge crew. There were no indicators available on the bridge that could have informed the crew about this faulty setting at the time of the incident.

According to the investigators, 'inadequate design' was a contributing cause of the first incident because there was reason to believe that the incident could have been prevented if the design of the technical system had supported the information needs of the bridge crew regarding the status of the thruster. In the second incident, the investigators highlighted what were classified as a 'planning failure' and a 'communication failure' as contributing causes. The accident report states that it was common procedure on board the vessel to test all functions of the DP system before the vessel enters an offshore facility's safety zone. Thus, although the functions were not tested, after making adjustments to the DP, the bridge crew could have detected the faulty settings in the planning stage if the mandatory test of the DP had been performed. However, the adjustments to the DP were performed in cooperation with the DP manufacturer, who helped the bridge crew with the software via phone. In this context, the investigators noted that the communication between the involved parties, particularly the information received from the manufacturer, was not sufficient.

3.1.4. Misperception of data

Two of the cases were related to misperceptions of available information. In the first case, the bridge crew assessed the current direction as be northeast, but it was actually southwest. In the

5 DP is an advanced automated manoeuvring system that is based on positioning reference systems such as global positioning systems.

investigators' view, this misperception played an important role in the course of the events. In the other case, the vessel approached the offshore facility on autopilot, and all attempts to steer the vessel manually failed. According to the investigators, the duty officer stated that he performed a functional test of the rudders prior to entering the safety zone and that he was convinced that the rudders were working in manual mode. However, this perception proved incorrect.

In the first case, both 'communication failure' and 'planning failure' might have contributed to the bridge crew's misperceptions. Regarding the 'communication failure', the accident report highlighted that the previous shift had kept the vessel outside of the safety zone for a while and would have had information about the current conditions, but this information was not transferred during the shift changeover. The investigators also noted that according to standard procedure, the weather conditions, including how the current is affecting the positioning of the vessel, should be assessed approximately 50 m away from the offshore facility. Because this assessment was not performed, the bridge crew missed an opportunity to reassess the perceived current conditions while planning the approach to the offshore facility. In the second case, the 'planning failure' might have contributed to the incident because the investigators emphasised that the technical systems were not checked before entering the safety zone in accordance with the vessel's procedures.

3.2. Level 2 errors - comprehension

3.2.1. Lack of/poor mental model

In the four cases that were classified as SA Level 2 errors, the bridge crews perceived critical information but failed to comprehend its meaning. All four cases are believed to have been caused by a 'lack of or poor mental models', and all of these incidents were related to a type of miscomprehension of the status of the vessel's technical system. One of the incidents occurred when the vessel's DP was activated during a loading/offloading operation alongside an offshore facility. Due to a known failure in a computer card, one of the propeller units was deselected in the DP. Although the redundancy requirements for the DP operation were not met, the bridge crew decided to perform the operation because they thought it would be sufficient to use the deselected propeller unit as a manual backup. At some point, the DP reference systems were lost, and the vessel began to drift towards the offshore facility. In an attempt to reverse the situation, the bridge crew attempted to stop the movement by utilising the deselected propeller unit while the vessel's DP system was still activated. As a consequence of operating the system in this manner, a strong force that the DP system was not aware of was introduced. Consequently, the vessel continued to drift towards the offshore facility with the DP system activated, while the manual use of the deselected propeller unit caused a strong rotation that led the forepart of the vessel to collide with the offshore facility. According to the investigators, 'Apparently, the crew were not aware of the risk involved and the effect of operating with the system configured as it was' (Report I08-D01, p. 12).

'Insufficient training' was believed to be a common contributing cause in all four of the cases that were associated with 'lack of/poor mental models'. Two of the accident reports highlighted relatively comprehensive deficiencies in training. For example, in the case outlined above, the investigators stated that 'no systematic training was given in handling the vessel or training on a simulator, despite several of the navigators having no experience of this DP control system, limited or no experience in the handling and use of diesel electric propulsion, and operations close to offshore installations' (Report no I08-D01, p. 18).

3.3. Level 3 errors - projection 3.3.1. Other

One case in our sample was classified as an SA Level 3 error, indicating that the bridge crew failed to project future states. 1n this case, the duty officer was positioning the vessel using the joystick control. When the loading operation commenced, the vessel was not in a stable position and was still drifting towards the offshore facility. At approximately the same time that the crane hook was disconnected from the deck load, the duty officer noticed that the gyro repeater had lost its signal, and he therefore decided to switch from joystick to manual control to pull back from the offshore facility. However, because the vessel was still drifting towards the facility, he failed to project the consequences of his counter manoeuvre. Consequently, the stern drifted towards the offshore facility and made contact with one of its legs.

'Distracting elements' and 'planning failure' were identified as contributing causes in the incident. 1t was noted in the accident report that a possible contributing factor to the incident was the fact that the duty officer was distracted by the gyro repeater. Additionally, the report highlighted that the vessel should have been, but was not, in a stable position before the loading operation commenced.

4. Discussion

The present study presents a comprehensive analysis of the collisions between attendant vessels and offshore facilities on the Norwegian continental shelf over a 10-year period. Our primary aim was to determine the role of SA in these collisions. The results indicated that SA errors likely have preceded the collisions in 18 of the 21 cases. In this context, SA errors should not be confused with decision errors because the duty officers believed that they had made the right decisions based on their perceptions and assessments of the situations. However, due to inadequate situational assessment, as judged by the subsequent collisions or significant breaches of safety barriers, their actions were demonstrated to be wrong.

Notably, 12 of the 18 cases associated with SA errors were related to the vessel's technical status, e.g., missing critical information regarding the vessel's steering mode or deficient comprehension related to the status of the technical system. These findings may not be surprising because the bridge crew's duties on board attendant vessels largely involve operating and monitoring technology. 1n this context, it is notable that in the last decade, the overall technical system in the bridge has developed towards increased automation (e.g., electronic maps and dynamic positioning systems) with the intention of improving operational efficiency and safety (Dekker, 2005; Lee and Moray, 1994). However, the bridge crew still plays a crucial role in the control of these systems. For example, DP keeps the vessel in a fixed position that is consistent with the bridge crew's programming of the system. However, the bridge crew needs to monitor parameters, respond to alarms and diagnose failures to maintain safe operations alongside the offshore facilities. Such activities can be taxing, and automation may therefore provide the illusion of a reduced workload while, in reality, increasing the workload (Bhardwaj, 2013). In contrast to the tasks entrusted to the automatic systems, those entrusted to the bridge crew rely on demanding cognitive processes, such as sustained attention, perception and diagnostic skills. In this context, it is also significant that automation often adds to the complexity of a system, which in turn, can cause human performance problems. Perrow (1999) took a rather deterministic stand when he claimed that accidents are unavoidable in systems that are characterised by complex interactions and tight couplings. Accidents are

bound to happen due to characteristics such as a limited understanding of the system, indirect information from the monitors and alarms, time-dependent processes and little room for error in the system. One of the main problems of complex systems is that they challenge the operator's ability to form reliable mental models of how the system works (Endsley, 2012; Parasuraman and Riley, 1997). Complexity may consequently slow the ability to detect a failure or other important information. Furthermore, complexity challenges the operator's ability to comprehend the information correctly and project future states. Although vessels using DP in close proximity to the offshore facilities have built-in technical redundancy, there is little room for error if the technology fails because the time that is available for a response is notably limited. In such situations, it is of the utmost importance that all failures are detected early and correctly diagnosed and that the crew acquires manual control when necessary.

Our analysis identified six sources of SA errors among which 'failure to monitor or observe data' associated with SA Level 1 errors was the most common source of failure. These results are in line with similar studies from the aviation (Jones and Endsley, 1996), offshore (Sneddon et al., 2006) and marine transport (Grech et al., 2002) industries that have also indicated that most common types of SA failures are related to situations in which all of the information are available, but that information is not perceived by those involved. In this context, it is notable that the number of items of equipment at the main workstation increased from 22 to 40 during the period of 1990 to 2006 (Lützhoft et al., 2006). Correspondingly, on a randomly selected offshore vessel, the DP operator is required to retrieve information from 6 monitors and 17 control panels of varying sizes at the DP station, which requires the switching of attention between various computer systems while also attending to the surrounding environment. Therefore, there is a risk of missing critical information. Organisational redundancy might also be a factor that should be considered in this respect. Redundancy in the form of manning the bridge with two navigators while operating inside an offshore facility's safety zone would in principle facilitate safety because the officers could monitor each other and raise critical questions (Rosness, 2001). However, there is evidence from our sample that the implementation of this principle could have both positive and negative effects. Failures to clarify the division of labour could lead to incorrect assumptions about who is responsible for specific tasks, which in turn, could lead to insufficient monitoring of critical information.

Finally, in recognition of the limitations of a solely SA-centred approach, our final aim in this study was to examine whether human, technological and organisational factors might have affected the bridge crews' abilities to achieve and maintain SA. In our analysis, we divided the contributing causes into five categories and found that 'planning failure' was the most significant factor overall. In the planning phase, the bridge crew is required to retrieve information from various sources to decide on the most favourable approach and positioning of the vessel alongside the offshore facility. Among others, these information sources include weather forecasts, personnel from the offshore facilities and technical equipment on board the vessel. Therefore, it is important that the bridge crew pays attention in the planning phase to obtain the necessary SA for operation. A majority of the cases associated with 'planning failure' can be regarded as incidences of procedural violations. According to the shipping companies' safety management systems and the NWEA guidelines, the bridge crews are supposed to use checklists that contain items such as the status of the vessel's technical system, weather conditions and communication lines prior to entering an offshore facility's safety zone. Although checklists do not contain SA information per se, they contain items that are meant to ensure that the important SA information is retrieved and considered during the planning phase. In this

manner, checklists are important tools in the process of achieving SA prior to entering an offshore facility's 500-m zone. However, when failures to comply with mandatory checklists are observed, it is necessary to understand why the procedural violations occurred and not simply ascertain that they have occurred (Dekker, 2005). Although the accident reports included in our study seldom provided explanations in this context, research suggests several potential explanations. For example, Rasmussen (1997) highlighted that factors such as production pressure and individual motivation to exert less effort may lead to violations of safety procedures. Dekker (2005) also emphasised that procedural violations can be viewed as sensible actions overall when the pressures and trade-offs that exist in what he calls 'real work' are considered. Moreover, an important factor for ensuring compliance with procedures is that the procedures are perceived to be practicable and meaningful by the bridge crew, or as Reason (2008, p. 58) phrased it, 'attitudes and beliefs leading to non-compliance are only half the problem. The other half, or more, arises from bad procedures'.

Regarding the SA Level 2 errors, 'insufficient training' was identified as the most significant contributing cause. Because human working memory has a very limited capacity, we tend to rely on mental models that are stored in our long-term memory during the processing of information. Well-developed mental models are created from training and experience and can influence an operator's ability to achieve SA at all levels (Endsley, 1995b). In the current study, insufficient training was primarily associated with the SA Level 2 errors that were caused by 'lack of or incomplete mental models' related to the vessels' technical systems. In general, a fairly large proportion of the maritime training regime consists of on-board training in the sense that senior officers train the cadets and junior officers on board their vessels. However, it is notable in this context that a lack of equipment standardisation appears to be characteristic of the maritime industry. For example, different vessels of the same type in a shipping company's fleet can be equipped with devices from different manufacturers, and these differences can entail significant differences in man-machine interfaces. Autopilot can serve as a simple example. Attempts to steer a vessel manually when the autopilot is activated can have the following consequences: (a) no signals other than the autopilot button indicate that the autopilot is activated, (b) control is automatically transferred to manual steering after a few seconds, or (c) an alarm sounds to indicate that the autopilot is activated. This lack of standardisation means that retraining and practice are of the utmost importance whenever an officer is transferred to a different vessel (Grech et al., 2008). If such training and practice does not occur, the officer might work based on a simplified mental model and thereby be vulnerable to SA errors.

5. Conclusions

Several studies have reported that the loss of SA is a significant factor in incidents and accidents that are associated with human error (Endsley, 1995a; Grech et al., 2002; Jones and Endsley, 1996). In this respect, our findings confirm earlier research in that 18 of 21 cases associated with human error may involve the loss of SA. Our study further suggests that 'inadequate design', 'planning failure', 'communication failure',' distracting elements' and 'insufficient training' may have been significant contributing factors to the incidents. These findings are perhaps not surprising because the avoidance of these factors is an important precondition for the safe operation of any system. However, this study demonstrated how these factors might have influenced the SA of the bridge crews during the courses of the events. In so doing, this study examined the contributing factors from the perspective of

the potential consequences on SA rather than as general weaknesses in the system. To our knowledge, no previous studies of accident reports have examined the roles of contributing factors related to the loss of SA in accidents and incidents.

Extensive SA-related research has been performed over several decades. However, whether these research efforts have actually led to improvements in the industry has been questioned (Salmon and Stanton, 2013). In this context, the present study will hopefully have practical implications for the petro-maritime industry because it identified some potential areas for improvement. Most notably, errors due to reduced vigilance and misconceptions of the technical automation systems emerged as the primary antecedents of collisions. In this context, Endsley (2012) recommended design principles that are believed to support SA in man-machine interactions. To create technological environments that support the SA needs of bridge crews, the industry should provide for design processes that are driven by SA theory in both new builds and modifications of existing vessels in the fleet. Overall, 'inadequate planning' was identified as the most common contributing cause. This finding is important because it might have direct practical implications for the shipping industry such as revising existing procedures for planning activities and/or ensuring that bridge crews comply with existing procedures. The current study also revealed that 'insufficient training' was the most common contributing cause associated with failure to comprehend or assess the situation at hand. Because well-developed mental models come from experience and training (Endsley, 1995b), it is of the utmost importance that shipping companies adopt procedures that ensure that sufficient on-board training is provided in addition to training on navigation simulators. Due to the lack of standardisation of technical equipment, these procedures should provide sufficient overlap periods and training whenever an officer is transferred to a new vessel in a shipping company's fleet.

Acknowledgments

We would like to thank the Norwegian Maritime Authority, the Norwegian Petroleum Safety Authority and the other organisations that made accident reports available to us. The authors also wish to thank the staff of the Department of Maritime Studies at Stord/Haugesund University College for contributing valuable knowledge concerning navigation and the maritime industry.

This work was supported by the Norwegian Research Council's TRANSIKK programme (Grant Number 210494).

References

Barnett, M., Gatfield, D., Pecan, C., 2006. Non - technical skills: The vital ingredient in world maritime technology. In: Proceedings of the international conference of world maritime technology. London, UK.

Bhardwaj, S., 2013. Technology, and the up-skilling or deskilling conundrum. WMU J. Mar. Affairs 12, 245-253.

Bolstad, C.A., Cuevas, H.M., Gonzalez, C., Schenider, M., 2005. Modeling shared situation awareness. In: Proceedings of the 14th Conference on Behaviour Representation in Modeling and Simulation (BRIMS). Los Angeles, CA, US (May).

Daley, J., 2013. Mumbai high north platform disaster. J. Undergraduate Eng. Scholarship 1, 1-8, Retrieved from <http://journals.library.mun.ca/ojs/index. php/prototype/article/view/468>.

Dekker, S., 2005. Ten Questions about Human Error: a New View of Human Factors and System Safety. Lawrence Erlbaum, Mahwah, N.J. (NY, US: CRC Press).

Endsley, M.R., 1995a. A taxonomy of situation awareness errors. In: Fuller, R., Johnston, N., McDonald, N. (Eds.), Human Factors in Aviation Operations. Ashgate Publishing Limited, Aldershot, UK, pp. 287-292.

Endsley, M.R., 1995b. Toward a theory of situation awareness in dynamic systems. Human Factors: J. Human Factors Ergonom. Soc. 37, 32-64. http://dx.doi.org/ 10.1518/001872095779049543.

Endsley, M.R., 2012. Designing for Situation Awareness. CRC Press, Boca Raton, Fla, US.

Endsley, M.R., Robertson, M.M., 2000. Training for situation awareness in individuals and teams. In: Endsley, M.R., Garland, D.J. (Eds.). Lawrence Erlbaum Associates Publishers, Mahwah, NJ, US, pp. 349-365.

Flin, R., O'Connor, P., Crichton, M., 2008. Safety at the Sharp End: A Guide to NonTechnical Skills. Ashgate, Aldershot, UK.

Gholamreza, E., Wolff, M.R., 2008. Contradictions in the practices of training for and assessment of competency. Educ. Train. 50,260-272. http://dx.doi.org/10.1108/ 00400910810874026.

Grech, M.R., Horberry, T., Smith, A., 2002. Human error in maritime operations: analyses of accident reports using the leximancer tool. Proc. Human Factors Ergonom. Soc. Ann. Meet. 46, 1718-1721. http://dx.doi.org/10.1177/ 154193120204601906.

Grech, M.R., Horberry, T., Koester, T., 2008. Human Factors in the Maritime Domain. CRC Press, Boca Raton, Fla., US.

International maritime organization, 2010. ISM code: International Safety Management Code and Guidelines on Implementation of the ISM Code. International Maritime Organization, London, UK.

International Maritime Organization, 2011. International Convention on Standards of Training, Certification and Watchkeeping for Seafarers (STCW): Including 2010 Manila Amendments; STCW Convention and STCW Code. International Maritime Organization, London, UK.

International Maritime Organization, 2012. SOLAS: Consolidated Text of the International Convention for the Safety of Life at Sea, 1974, and its Protocol of 1988: Articles, Annexes and Certificates : Incorporating all Amendments in Effect from 1 July 2012. International Maritime Organization, London, UK.

Jones, D.G., Endsley, M.R., 1996. Sources of situation awareness errors in aviation. Aviat. Space Environ. Med. 67, 507-512.

Kanki, B.G., 2010. Communication and crew resource management. In: Kanki, B.G., Helmreich, R.L., Anca, J. (Eds.), Crew Resource Management. Academic Press, London, UK, pp. 111-145.

Kvitrud, A., 2011. Collisions between platforms and ships in norway in the period 2001-2010. In: Proceedings of OMAE 2011, 30th International Conference on Ocean, Offshore and Arctic Engineering. Rotterdam, The Netherlands.

Lee, J.D., Moray, N., 1994. Trust, self-confidence, and operators' adaptation to automation. Int. J. Hum Comput Stud. 40, 153-184. http://dx.doi.org/10.1006/ ijhc.1994.1007.

Lützhöft, M., Sherwood, J., Earthy, J.V., Bergquist, C., 2006. Making safety by tying the knot: examining resilience in shipping. In: Proceedings of the 2nd symposium on resilience engineering. Antibes-Juan-les-Pins, France.

Neuman, W.L., 2006. Social Research Methods: Qualitative and Quantitative Approaches. Pearson, Boston, US.

Oltedal, H.A., 2012. Ship - platform collisions in the North Sea. In: Proceeding on the Annual European Safety and Reliability Conference 2012. Helsinki, Finland.

Parasuraman, R., Riley, V., 1997. Humans and automation: use, misuse, disuse, abuse. Hum. Factors 39, 230-253. http://dx.doi.org/10.1518/0018720977 78543886.

Patrick, J., Belton, S., 2003. What's going on? Nucl. Eng. Int., 36-40 (January)

Perrow, C., 1999. Normal Accidents: Living with High-Risk Technologies. Princeton University Press, Princeton, N.J., US.

Rasmussen, J., 1997. Risk management in a dynamic society: a modelling problem. Saf. Sci. 27, 183-213. http://dx.doi.org/10.1016/S0925-7535(97)00052-0.

Reason, J., 1997. Managing the Risks of Organizational Accidents. Ashgate, Aldershot, UK.

Reason, J., 2008. The Human Contribution: Unsafe Acts, Accidents and Heroic Recoveries. Ashgate, Farnham, UK.

Rodriguez, A.J., Champbell Hubbard, M., 1998-1999. The international safety management (ISM) code: a new level of uniformity. Tulane Law Rev. 73, 1585-1589.

Rosness, R., 2001. Slank og sárbar? om verdien av organisatorisk redundans [Slim and vulnerable? the value of orgnaizational redundancy]. (No. STF38 A01413). SINTEF, Trondheim, Norway.

Rouse, W.B., Morris, N.M., 1986. On looking into the black box: prospects and limits in the search for mental models. Psychol. Bull. 100, 349-363. http://dx.doi.org/ 10.1037/0033-2909.100.3.349.

Salmon, P.M., Stanton, N.A., 2013. Situation awareness and safety: contribution or confusion? situation awareness and safety editorial. Saf. Sci. 56, 1-5. http:// dx.doi.org/10.1016/j.ssci.2012.10.011.

Salmon, P.M., Stanton, N.A., Walker, G.H., Jenkins, D.P., 2012. Distributed Situation Awareness: Theory, Measurement and Application to Teamwork. Ashgate Publishing Ltd, Farnham, UK.

Scott, J., 1990. A Matter of Record: Documentary Sources in Social Research. Polity Press, Cambridge, US.

Simons, D.J., 2000. Attentional capture and inattentional blindness. Trends Cogn. Sci. 4, 147-155. http://dx.doi.org/10.1016/S1364-6613(00)01455-8.

Sneddon, A., Mearns, K., Flin, R., 2006. Situation awareness and safety in offshore drill crews. Cogn. Technol. Work 8,255-267. http://dx.doi.org/10.1007/s10111-006-0040-1.

The North West European Area Guidelines, 2009. Guidelines for the Safe Management of Offshore Supply and Rig Move Operations. Retrieved from <http://www.nwea.info/>.

Weick, K.E., Sutcliffe, K.M., Obstfeld, D., 1999. Organizing for high reliability: processes of collective mindfulness. In: Sutton, R.I., Staw, B.M. (Eds.). Elsevier Science/JAI Press, Stamford, CT, US, pp. 81-123.