Modelling Vessel Traffic Service to understand resilience in everyday operations

Reliability Engineering and System Safety ∎ (∎∎∎∎) ∎∎∎–∎∎∎

Contents lists available at ScienceDirect

Reliability Engineering and System Safety journal homepage: www.elsevier.com/locate/ress

Modelling Vessel Traffic Service to understand resilience in everyday operations Gesa Praetorius a,n, Erik Hollnagel b, Joakim Dahlman c a

World Maritime University, Maritime Risk and System Safety, P.O. Box 500, SE 201 24 Malmö, Sweden University of Southern Denmark, Center for Kvalitet, P.V. Tuxensvej 5, DK 5500 Middelfart, Denmark c Chalmers University of Technology, Department of Shipping and Marine Technology, Maritime Human Factors, SE 412 96 Gothenburg, Sweden b

art ic l e i nf o

Keywords: Vessel Traffic Service (VTS) Functional Resonance Analysis Method (FRAM) Resilience engineering System design

a b s t r a c t Vessel Traffic Service (VTS) is a service to promote traffic fluency and safety in the entrance to ports. This article's purpose has been to explore everyday operations of the VTS system to gain insights in how it contributes to safe and efficient traffic movements. Interviews, focus groups and an observation have been conducted to collect data about everyday operations, as well as to grasp how the VTS system adapts to changing operational conditions. The results show that work within the VTS domain is highly complex and that the two systems modelled realise their services vastly differently, which in turn affects the systems' ability to monitor, respond and anticipate. This is of great importance to consider whenever changes are planned and implemented within the VTS domain. Only if everyday operations are properly analysed and understood, it can be estimated how alterations to technology and organisation will affect the overall system performance. & 2015 Elsevier Ltd. All rights reserved.

1. Introduction Shipping has been one of the major means of transportation more than the past 5000 years. From local trading along rivers, shipping has developed into transportation global business [38] demanding efficient and safe operations. As in other domains, demands are normally responded to through changes both in technology and organisation. Examples of such change within the maritime domain include, but are not limited to, the increase of the volume and size of vessels through the past decade [41], the introduction and integration of decision support tools such as the AIS and electronic chart displays, into one standardised system [27], and the introduction of safety management systems [29,40]. However, although these improvements are often introduced to increase the safety within the maritime transport system, they have generally been used to increase the overall productivity, counteracting their initial safety effect with the consequence of inducing incidents and accidents rather than preventing them completely [32]. This paper will consider one of the most recent examples fora maritime safety measures, the so-called Vessel

n

Corresponding author. Tel.: þ 46 40 128 442. E-mail addresses: [email protected] (G. Praetorius), [email protected] (E. Hollnagel), [email protected] (J. Dahlman).

Traffic Service (VTS), a service implemented to promote safe, efficient and environmental-friendly marine traffic [22]. VTS is a shore-side service within a country's territorial waters. VTS Operators (VTSOs) monitor the traffic, assist in navigational matters, and provide information to all vessels in a designated area, normally port areas or areas that pose navigational difficulties. VTS can be delivered on three different service levels: Information Service (INS), Traffic Organisation Service (TOS), and Navigational Assistance Service (NAS). Information Service (INS) means broadcasting information to all participating vessel within the VTS area on a specific VTS channel. INS contains information relevant for the safe passage of the area, and can consist of reports on position, identity and intentions of other traffic, or information concerning the meteorological and geographical state of the area. Traffic Organisation Service (TOS) is an operational management of traffic movements within the determined VTS area conducted through VHF broadcasts. It aims to prevent the upcoming of dangerous situations as well as to avoid congestions within the area. Navigational Assistance Service (NAS) is the highest service level a VTS can exercise and is often only provided upon request of a vessel. NAS is an intervention in the decision making on board with the aim to assist the traffic to a safe and expedient passage by providing information on the VHF. However, the decision making power remains with the Master on board the vessel and is not transferred to the VTS ashore. Therefore, ships are offered instructions only when safety is at risk or upon their request. As the

http://dx.doi.org/10.1016/j.ress.2015.03.020 0951-8320/& 2015 Elsevier Ltd. All rights reserved.

Please cite this article as: Praetorius G, et al. Modelling Vessel Traffic Service to understand resilience in everyday operations. Reliability Engineering and System Safety (2015), http://dx.doi.org/10.1016/j.ress.2015.03.020i

G. Praetorius et al. / Reliability Engineering and System Safety ∎ (∎∎∎∎) ∎∎∎–∎∎∎

2

international framework identifies VTS as an assistance service, the VTSOs are not supposed to take part in traffic management tasks such as voyage optimisation, route planning, or the planning of traffic density in the area. That constrains the possibilities of the VTS to actively work for safe and efficient traffic movements. While VTS has often been studied with either focus on technology (i.e. [6,24,44]), information needs (i.e. [5]), communication [4,9,10,25], or interface design [42], there is only a limited amount of research focusing on the VTS as sociotechnical system, and the challenges that VTSOs face within the settings of their daily work. As Nuutinen, Savioja, and Sonninen [30] note, the VTS system is currently undergoing changes. Developments both within the VTS system (e.g. such as chain planning) and the maritime domain as such, will pose challenges for how traffic management is conducted currently. Therefore this article focuses on how the VTS contributes to safe and efficient traffic movements within the VTS area. The Functional Resonance Analysis Method (FRAM) is used to describe everyday operations of two VTS systems. The VTS is a socio-technical system under change and it is essential to understand how the system maintains control through adapting to the uncertain and dynamic environment that the maritime traffic constitutes. Furthermore, the resilience engineering abilities (respond, monitor, anticipate and learn) are used to identify and discuss the systems' ability to resilience and ways in which one may strengthen the systems' possibilities to sustain required functioning during many different operating conditions.

2. Background Large sociotechnical systems, such as the VTS, comprise processes distributed over people, technology and organisations, which are becoming increasingly complex and therefore hard to control. Control is important for sociotechnical systems as these systems must adapt to the context to be able to operate in a large variety of operational conditions and match challenges that may arise through the dynamic character of the environment. Control here is not meant in an absolute way, but rather wants to emphasise the pressure on today's system to produce stable output over time – e.g. efficient and safe traffic movements – based on a dynamic input [20]. Resilience engineering (RE) is a relatively young body of research that emerged at the beginning of the 2000s. Resilience, which has its origin as a concept within ecology in the early 1970s, defines an ecological system's ability to arrive at an equilibrium, or stable state, over time in a dynamic and changing environment [15]. In the context of socio-technical systems, resilience is the ability to sustain required functioning and achieve system goals under a variety of operational conditions. In resilience engineering, systems are analysed with the aid of four cornerstones, monitoring, response, anticipation, and learning, which characterise the features a system should have to be able to maintain its functioning before, during and after anticipated and unanticipated events have occurred. Furthermore, RE emphasises examples of the positive, meaning that it is concerned with how systems succeed by adapting their performance to the demands within the environment [21]. When adaption is successful, safety emerges as a property, as the system balances goals and demands in the current context [49], e.g. safe and efficient traffic movement within a port approach. In the core of the RE framework, there are four abilities (learn, monitor, anticipate and respond) that can help to understand a system's performance and provide insights in how resilience manifests itself in everyday operation. These four abilities are essential for a system to be able to recognise challenging conditions, respond to them, evaluate the response and prepare for

future events. The four abilities are mutually dependent, and each represents one facet of a system's functioning. By analysing everyday operations with the aid of the abilities, one is able to identify ways in which the system's capacity for knowing what to do (respond), what to look for (monitor), what to expect (anticipate) and what has occurred (learn) can be strengthened [16]. Furthermore, informing design activities with the help of findings in relation to the four cornerstones can help to make a system more bumpable [51] in the sense that it will be able to operate under a variety of conditions without major performance drops. 2.1. Functional Resonance Analysis Method (FRAM) The FRAM is a method to analyse and model complex sociotechnical systems. The method focuses on the concept of performance variability and ways in which systems manage and monitor potential and actual variability. FRAM is based on four basic principles; the principle of equivalence of successes and failures, principle of approximate adjustments, principle of emergence and the principle of functional resonance (e.g. [14,18]). The principle of equivalence of successes and failures expresses that the only difference in between these two is the judgement of the outcome. While an action is deemed as success if it has the desired outcome, the same action can be identified as a failure when negative and unforeseen consequences occur. How these consequences can arise is accounted by the principle of approximate adjustments. Sociotechnical systems are complex systems acting in an uncertain and dynamic environment. Functions are distributed over people, technology and organisation that adjust their performance to be able to meet the demands the system is facing in the current situation. As this adjustment is based on the availability of resources (e.g. time, manpower) it will always be approximate. Consequently, everyday performance is and needs to be variable to help the system to successfully adapt its functioning to the current operational conditions. While variability within one function possibly can be managed or monitored, the principle of emergence emphasises that variability in multiple functions may combine in unanticipated ways and cause disproportional and non-linear effects. Although performance variability can lead to negative outcomes, it is first and foremost necessary for a system's resilience, for the ability to function under beneficial and harmful conditions alike. The last principle, the principle of functional resonance, highlights the potential of the variability in multiple functions to resonate, and therefore reinforce and even amplify itself, so that the outcome of a function might carry an unusually high amount of variability, which the system is not able to manage given the current condition. As a result, accidents might occur. FRAM consists of four steps which are used to model the system based on functions and to identify sources of performance variability as well as measures to manage, dampen or monitor it. In Step 1 all necessary system functions are defined. The aim is to afford a consistent description as a basis of the analysis. All functions are described in form of their six aspects (Input, Output, Time, Control, Precondition, and Resources/Executing conditions, Table 1). These aspects describe the basic characteristic of an activity and help to understand relations among functional units within a system. The functions that are the focus of the analysis are called foreground functions. Functions that are required by the foreground functions, but which do not themselves contribute to the variability being investigated, are called background functions [17]. Background functions represent the context and while they do not vary during the time frame specific for the analysis, they shape the performance and affect how events progress [19]. Step 2 helps to identify the variability of the functions in the FRAM model. The functions performance can vary in various ways.

Please cite this article as: Praetorius G, et al. Modelling Vessel Traffic Service to understand resilience in everyday operations. Reliability Engineering and System Safety (2015), http://dx.doi.org/10.1016/j.ress.2015.03.020i

G. Praetorius et al. / Reliability Engineering and System Safety ∎ (∎∎∎∎) ∎∎∎–∎∎∎

3

Table 1 Aspects of a function. Aspect

Description

Input (I)

Conventional input and/or a signal that activates the function, is used or transformed by the function (requires change of state for the function to start) Result of what the function does, represents a change of the system's state or output parameters Conditions that need to be fulfilled before the function can be carried out Material or matter that are consumed, or executive conditions, that need to be present, while the function is active

Output (O) Precondition (P) Resource (R)/ executing condition Control (C) Time (T)

Supervises or regulates the function so that it derives the desired output Aspects of time that affect the way the function is carried out

While functions involving humans tend to vary a lot, technical functions usually show a stable performance over time. Organisational functions do not show the same extent of variability as human functions, but show a delayed effect on these. There are three types of variability that can be characterised in a function: endogenous, exogenous, and upstream–downstream coupling variability. Endogenous variability arises due to the nature of the function and is therefore internal, while exogenous variability is due to the variability of external factors, such as the work environment. Most interesting for an event analysis is the upstream– downstream coupling variability as it can become the basis for functional resonance. Upstream functions are carried out before downstream functions in the instantiation of the model, which means that variability in the earlier will impact on the performance of the latter [17]. In Step 3 of the analysis, an instantiation is created to see how performance variability can propagate through the system. It can help to understand how performance variability within some functions can amplify or dampen the variability of other functions, as the instantiation provides a way of simulating the functions performance within a specific operational condition to identify vulnerabilities and strengths of the system at work. The final step, Step 4, is used to suggest ways in which performance variability can be monitored, managed or eliminated. Based on the results from step 2 and 3 it is analysed how to best monitor and manage the variability where it is necessary. However, the analyst should keep in mind that varying performance also is an indicator for the flexibility to adapt performance to specific conditions, which means that eliminating variability can make the system rather stiff and brittle [49]. The FRAM has widely been applied for the purpose of retrospective analysis to incidents and accidents in several domains [14,35,47]. Mostly the aim has been to investigate how adverse events had arisen due to performance adjustments within normal performance giving raise to functional resonance, rather than the accidents or incidents being caused by single fault of a human operator. Furthermore, the importance of the FRAM as a method for resilience engineering has been emphasised by several researcher. There is a growing body of work in which the method is utilised within the area of risk assessment and to develop strategies, means and measures with focus on a system's ability to resilience (e.g. [26,28,46]). While the FRAM has initially mostly been applied within the aviation domain (e.g. [48]), it has become a prominent compliment to other risk assessment and event investigation methods and is nowadays employed in a wide range of high hazard domains such as health care (e.g. [1,39]), maintenance (e.g. [12]), and railway traffic supervision [3]. Overall, results indicate that the FRAM helps to understand underlying dynamics of the system's functions interacting with each other across technology, human operators and organisation. Thereby the method can help to identify risks that would otherwise not be noticed. Furthermore, with regards to resilience engineering, the FRAM offers a

possibility to explore the system's ability to recognise and adapt to changes in the operational environment. Within the scope of this article, the FRAM is used to model three different VTS systems to portray the complexity of everyday operations and the way, in which the system adapt to both natural and other constraints in their operational context. The aim is to show the impact of system design on a system's ability to resilience, i.e. to manage its adaptive capacity [50] to maintain required operations in the light of expected and unexpected events.

3. Methodology The data collection comprised two types of interviews (semistructured, focus group) and one six hour long observation at a VTS centre. Two methods, grounded theory and FRAM, were used to analyse the data. Grounded theory has been applied to categorise and sort all collected data, while the FRAM was employed to model everyday operations of the VTS system and gain insights into what is required for successfully providing a service to the marine community. 3.1. Participants Eight informants participated within the data collection. An overview about which activities each informant participated in, is displayed in Table 2. The participants worked at four different VTS centres (VTS 1, VTS 2, VTS 3, and VTS 4) in Northern Europe, and are currently working as VTSO (5), VTS supervisor (VTSS, 1), VTS manager (1) or traffic planner (1). All participants have prior been working as navigating officer for at least two years, and their experience working within the VTS domain ranged from 6 to 26 years. VTS is a high risk domain and the sampling for this research has been opportunistic or emergent [31] guided by the availability of access to VTS centres and the willingness of operators, managers and traffic planners to participate within this study outside of their scheduled work. 3.2. Data collection Three different methods of data collection were used to obtain data on everyday operations of VTS systems. Firstly semistructured interviews were conducted to explore the scope of the service and the overall workings of the system in relation to system goals such as traffic efficiency and safety. To gain insights in how work is actually conducted, an observation shadowing a VTSO was carried out. In a last step, two focus groups discussing VTS operations in detail were conducted. All three methods aimed at highlighting a different facet of everyday operation to reveal the complexity of work-as-done at a VTS centre.

Please cite this article as: Praetorius G, et al. Modelling Vessel Traffic Service to understand resilience in everyday operations. Reliability Engineering and System Safety (2015), http://dx.doi.org/10.1016/j.ress.2015.03.020i

G. Praetorius et al. / Reliability Engineering and System Safety ∎ (∎∎∎∎) ∎∎∎–∎∎∎

4

3.2.1. Semi-structured interviews Three separate interviews with one VTS manager, one supervisor and one traffic planner were conducted as part of this data collection. All interviews were conducted at a VTS centre, due to the availability of participants, and were recorded with the help of a recording device. The interviews were semi-structured or interview guide-based [31] following a clear structure, but leaving room for follow-up questions. Beside demographic information, the interview guide was focused on operators' and organisational needs to accomplish safe and efficient traffic movements within their area of responsibility.

3.2.2. Open-ended observation The data collected through the interviews were complemented through an open-ended naturalistic observation. This type of observation is often used to see what is out there without being limited by preconceptions or hypotheses [31]. The observation took place at a VTS centre offering all three service levels during a shift of a VTSO. The observation followed that operator through the various stages of work during a shift. The aim of the observation was to gain a better understanding for how VTS operators monitor, adapt to, and respond to variations within the dynamic environment. The observation was accompanied by an informal conversational interview [31].

verbally. The first focus group took approximately 120 min in total and focused on three questions.

 What are the preconditions for safe traffic movements?  What are the preconditions for efficient traffic movements?  What is the role of the VTS in a Vessel Traffic Management setting? Each question was posed to the participants separately and they were asked to answer it first individually on paper (5 min), and then discuss the same question in plenary for approximately 25–30 min. The second focus group was held after all semi-structured interviews and the observation had been conducted and the data had been analysed with the help of grounded theory. The aim of focus group 2 was to seek confirmation and calibrate the obtained results from the first part of the data collection. Originally it was planned to hold focus group 2 with all subjects that had earlier participated within this study, but due to the availability of informants, only two VTSOs and one VTSS could attend. After a short summary of the study results so far, the participants were asked to describe their everyday work in form of activities that they conduct to increase predictability and foresight for themselves, but also for the traffic participants. 3.3. Data analysis and functional modelling

3.2.3. Focus group interview Two focus groups were conducted during the course of this study. The first focus group aimed at exploring how VTS operators reasoning about the balance of efficiency and safety when providing a service to the vessels under their control. Four VTSOs from two different VTS centres participated. The subjects were asked to sign a consent form after been given information both written and Table 2 Overview over participants. Participant's position

VTS centre

Participated in

VTSO VTSO VTSO VTSO VTSS VTSO Traffic planner VTS manager

VTS 4 VTS 4 VTS 1 VTS 1 VTS 2 VTS 3 VTS 3 No specific centre

Focus group 1 Focus group 1 Focus group 1 Focus group 1, focus group 2 Interview, focus group 2 Observation, focus group 2 Observation, interview Interview

All collected data were analysed using two different methods. First, a grounded theory analysis was conducted [7]. All data recorded during the interviews was transcribed for the analysis, and all fieldnotes and transcriptions were entered into MaxQDA [11] to identify core concepts of how VTS contributes to safe and efficient traffic movements. In a second step, the collected data were used as basis for the modelling of everyday operations of three VTS systems with the help of FRAM. The aim of this analysis was to gain more depths in how VTS is realised in various settings, and how that affects the ability to monitor, respond, anticipate and learn. Step 1–3 are presented within the result chapter, while step 4 of each analysis of each system lays a ground for the discussion.

4. Results First, the results of the grounded theory analysis will be presented in this section to highlight the overall role and

Fig.1. The role of the VTS system in balancing safe and efficient traffic movements.

Please cite this article as: Praetorius G, et al. Modelling Vessel Traffic Service to understand resilience in everyday operations. Reliability Engineering and System Safety (2015), http://dx.doi.org/10.1016/j.ress.2015.03.020i

G. Praetorius et al. / Reliability Engineering and System Safety ∎ (∎∎∎∎) ∎∎∎–∎∎∎

contribution of the VTS system to maritime traffic management. Second, the results of the FRAM analysis are presented to reveal deeper insights in how VTS manifests itself within specific conditions. The aim has been to explore the complexity of everyday work and highlight differences and similarities in how VTS is contributing to the overall safety and efficiency of traffic movements within a determined area.

5

Depending on the service level offered at a certain VTS centre, the possibility to create foresight or shape preconditions can be limited. While TOS and NAS allow the operator to organise the traffic and assist in on board decision making, it is slightly harder to accomplish if the mandate is only assigning information service to a centre. 4.2. Everyday operations of the VTS system

4.1. The VTS system's contribution to traffic management The grounded theory analysis has revealed that the VTS system contributes to safe and efficient traffic movements in two ways, by shaping preconditions and by creating foresight for the vessels within the VTS area and other services, such as pilot service, tug service and lock service. The VTS uses communication to accomplish this goal (Fig. 1). Shaping preconditions is realised by providing the information needed for the safe voyage into or out of the port and through the VTS area to the traffic. The VTSO monitors the area as a whole and actively searches for information that may affect the navigation of a vessel. The information must be provided to the bridge-team in good time, often well ahead of a potential adverse situation so that there is enough time left to make an adequate manoeuvre. The purpose of shaping preconditions is to create buffer in terms of time for the system as a whole, or effectively more action space for all participants. While it is often most efficient to choose individual goals, e.g. be the first vessel to pick up a pilot, the VTS system monitors traffic patterns to be able to anticipate whether the pursuit of individual goals is endangering the overall system goal of a safe and fluent traffic flow within the area. Create foresight also means to provide vessels with relevant information for their navigation. But, while shaping preconditions emphasises the VTS's importance for monitoring system goals and informing various services and participating vessels, creating foresight highlights that the VTS affects the way traffic flows through providing information. The information that is transmitted to vessels within the area aims to synchronise traffic movements and to coordinate them so that it becomes easier to identify traffic patterns and to monitor the overall traffic flow. If the traffic is synchronised it flows smoothly and by coordinating between vessels and port services (e.g. pilotage, tug) the VTS is central for creating means to handle changes within the operating conditions, e.g. weather or parts of a fairway need to be closed. The main means for the VTS to create foresight and shape preconditions is communication. VTSOs are in contact with the traffic through the use of VHF radio and all information transmitted to the traffic is public and available to everyone. This allows the VTS to either contact only one vessel, or to broadcast information to every vessel that is currently within the area.

VTSO

INS

geographical /hydrometeo rological information

Traffic information

Traffic monitoring

Give/deny berth clearance

Fig. 2. VTS task description for VTS 1.

Give/deny clearance to leave anchorage

While the grounded theory analysis above provides insights in how the VTS system contributes to safe and efficient traffic movements, it does not show how the system actually creates foresight and shapes preconditions. To gain a better understanding on what functions are involved in daily operations, three of the four VTS systems represented within the study have been modelled with the help of FRAM. Within the scope of this paper, we will present a FRAM model of two systems, VTS 1 and VTS 3 to show the complexity of everyday work and emphasise what functions are needed to promote safe and efficient traffic movements within the area of response.

4.2.1. VTS 1 VTS 1 is part of the local port infrastructure in one of northern European largest ports. The service is provided by a single VTSO on duty. The operator is located in next to the pilot dispatch and the harbour master within a joint operation centre in the port. In this specific area, the VTS is offering information service (INS), as well as the service is responsible of issuing berth clearances, and clearances to leave anchorage. Fig. 2 above shows a generic description of the VTS 1 system. It is operated by one VTSO who provides INS and monitors the traffic within the area. Within the scope of INS, information on the weather, the geographical conditions and other traffic is provided to support the bridge teams in their navigation. VTS 1's core activities are to monitor the traffic and to inform the traffic. Information on traffic participants needs to be obtained through other services, and due to the limitations of the legal mandate, the VTS system is characterised by feedback control to a large extent. The VTSO cannot actively organise the traffic and needs to rely on support from other services, such as pilot service. We can delay vessel from anchorage and berth. The harbour office or the port control can support, if it's in or within the harbour limit, because they are sitting next to us […]They can say “No you are not going to come to that berth”. I can't say it because I don't have the jurisdiction (VTSO). A VTSO therefore actively collects information about the vessels (ETA, destination, draught, speed), ordered services (booked tugs and/or pilots), and harbour operations (terminals, loading schedules etc.) from other organisations within the port infrastructure. The VTS itself does not get any notice of incoming traffic until the time that a vessel crosses the reporting line into the VTS area. Yeah, they got it before us, because they got 24 h notice, I have, the pilot, they got 24 h, the port authority, pilot order got 5 h notice, and we actually is when entering the VTS area (VTSO).

4.2.2. FRAM-model of daily operations of VTS 1 4.2.2.1. Step 1: The functions of VTS 1. The functional model of VTS 1 consists of four foreground functions (provide traffic information, give/deny berth clearance, give/deny clearance to leave anchorage, and traffic monitoring) representing the main tasks executed by the system and four background functions (collect traffic information, collect hydro-meteorological information, receive vessel report, and establish VHF contact), which provide necessary input to the foreground functions.

Please cite this article as: Praetorius G, et al. Modelling Vessel Traffic Service to understand resilience in everyday operations. Reliability Engineering and System Safety (2015), http://dx.doi.org/10.1016/j.ress.2015.03.020i

G. Praetorius et al. / Reliability Engineering and System Safety ∎ (∎∎∎∎) ∎∎∎–∎∎∎

6

Table 3 Overview of VTS 1 functions. Foreground functions

Background functions

Functions connected to environment

Provide traffic information Give/deny berth clearance give/deny clearance to leave anchorage

Establish VHF contact Collect traffic information Collect hydro-meteorological information Receive vessel report

Enter VTS area (Vessel) Pass reporting point (Vessel) Request to leave berth (Vessel)

Traffic monitoring

For the completeness of the model, seven other functions that represent aspects of the environment have been added. These functions arise from the environment and are beyond the scope of the system as defined in this article. An example is that request berth clearance is a function needed to activate give/deny berth clearance, but it is executed by a vessel, not by the VTS system. Table 3 shows an overview about all functions included in the functional model. 4.2.2.2. Step 2: Identify variability. Variability can arise internally (endogenous) in a function or stem externally (exogenous) from other functions. Within the VTS 1 functional model, variability is mostly due to the fact that the VTSO is the essential control measure for the performance of all foreground functions. The operator is supervising all functions and has to make the decisions what to monitor in the traffic picture, when to contact traffic by providing information, and how to react towards request such as a vessel requesting to leave anchorage. This means that the functions heavily depend on the human operator's ability to adapt to changing traffic loads and to be alert to be able to react quickly whenever a situation is developing within the VTS area. VTSOs are educated according to recommendations and guidelines but previous experience at sea as well as working experience as VTSO can affect the way in which the functions' performance is controlled and monitored. This may lead to differences in when function is executed, as well as in the way it is performed, i.e. precision and timing of the output. Especially when the VTSO has to attend to several tasks as once, e.g. giving berth clearance at the same time as the operator provides traffic information and monitors the overall traffic picture, it is likely that the performance of the functions varies and that variability may resonate. Performance of the VTS system is further variable as it is heavily depending on the environment consisting of the maritime traffic and other port services, as well as on geographical and hydro-meteorological aspects. Performance variability within VTS 1 can stem from several sources that can either be connected to the environment (bad visibility, low water-levels in fairway, heavy winds, and current), vessel traffic (size, cargo, deep draught etc), or exceptional conditions, such as military exercises, regattas. 4.2.2.3. Step 3: Aggregation of variability. Variability of various kinds may aggregate within a given context and therefore amplify. Normally this step discusses instantiations of the model. However, as this article attempts to use the FRAM to analyse the system's functional setup for everyday operations, we will show where and how variability is likely to spread based on the functions and their identified relations to each other, which are represented in Fig. 3. The functional model of everyday operation of VTS 1 is represented by Fig. 3 and shows the complex ways in which the various functions depend on each other. In comparison to Fig. 2, Fig. 3 depicts the functions necessary to provide the current service at VTS 1. Instead of producing a specific instantiation, the figure below shows the upstream–downstream relations between the set of functions necessary of daily operation.

Request to leave anchorage (Vessel) Provide forecast to VTS (weather service) Establish harbour infrastructure (Maritime Administration) Install VTS (Maritime Administration)

The model shows that VTS 1 has a strong dependency on information that needs to be actively collected from other services. To collect traffic information is, for example, dependent on information that is collected from the pilot service, tug service, and harbour master. As a consequence, there is a risk for coupling variability that might affect several functions at once as soon as the traffic information cannot be collected from the other service, e.g. due to missing information, or the timing being too late. Adjacent services are mostly a resource to the foreground functions, but they can also serve as additional control measure in functions such as request/deny berth clearance. As VTS 1 has only a limited mandate regarding traffic organisation, vessels can decide to disregard the output in the case of the denial of a request. In those cases, pilot services and/or harbour master are needed as extra control. This dependency on other services' support can introduces variability in the couplings among the functions when a service decides not to actively support the VTSOs decision regarding a request. 4.2.2.4. Step 4: Managing variability. Step 4 in the FRAM requires the analyst to reason on how performance variability can possibly be monitored and managed. Right now VTS 1 is heavily depending on the performance of the single operator and the operator's relation to other services, such as pilots or the harbour master, to be able to cope with the complexity of everyday work. As a lot of the variability that might accumulate stems from changes in the environment, it is necessary to keep the operator's flexibility, i.e. ability to react towards events. However, it might be necessary to consider providing the VTSO with an increased level of control through assigning TOS to the centre under analysis. Right now, although legally part of traffic management, the centre only offers information service, leaving the VTSO to rely on the support from adjacent services to maintain control in case a vessel decides not to accept the VTS's decision to deny a clearance. Through the assignment of TOS to VTS 1, it would be possible for the operator to have the ability to manage traffic more actively than solely providing information, and it would provide a longer time horizon in VTS operations. Therefore, increasing the service level offered, as well as stating explicit guidelines for when and how to cooperate with other services may increase the time-frame of operations (traffic management instead of providing information) and therefore also the ability of the operator to react ahead of a situation developing in the area. 4.2.3. VTS 3 VTS 3 is located on the entrance to a river in northern Europe. The VTS centre incorporates staff from two countries that jointly operate the VTS system. The VTS offers all three service levels and works closely together with other services, such as pilot service, lock service and tug service. Fig. 4 shows the generic description of VTS 3. Additionally to VTSS and VTSOs working at the centre, the system also has a traffic planner, which is a function that is operated by a senior VTSO and a pilot jointly. The planner provides

Please cite this article as: Praetorius G, et al. Modelling Vessel Traffic Service to understand resilience in everyday operations. Reliability Engineering and System Safety (2015), http://dx.doi.org/10.1016/j.ress.2015.03.020i

G. Praetorius et al. / Reliability Engineering and System Safety ∎ (∎∎∎∎) ∎∎∎–∎∎∎

7

Fig. 3. VTS 1 and its functional units. The harbour infrastructure is an important resource to many of the VTS-related functions. The dependencies among functions show the complexity of daily work. The red marked outputs are directed towards the vessel(s) that are navigating within the VTS area. (For interpretation of the references to colour in this figure legend, the reader is referred to the web version of this article.)

VTS 3

Traffic planner

VTSS

make sailing plan for deep draught vessels

supervise staff during shift

VTSO

INS

TOS

NAS

pilotage intake

Fig. 4. VTS task description for VTS 3.

a sailing plan for deep draught vessels that plan the voyage including meeting position with other traffic along it. The VTSS supervises the VTSOs during the shift and can also assist in VTSO tasks if required. VTS 3 is not only responsible for a port approach, but also supervises traffic along the river that caters to several major ports with complex lock systems creating constraints for the capacity of the nautical services. In combination with tidal waters, strong currents, and limited manoeuvring space along the river, supporting maritime traffic is a complex task requiring activities in various time horizons to be able to respond early to upcoming problems.

4.2.4. FRAM-model of daily operations of VTS 3 4.2.4.1. Step 1: The functions of VTS 3. The functional model of VTS 3 (Fig. 5) consists of 18 functions, 11 foreground functions (translate messages, provide shipping broadcast, organise traffic on river, provide information service, provide navigational assistance, monitor traffic, queue vessels for pilotage, decide on pilotage method, request information for pilotage, calculate tidal windows, and make sailing plan), three background function

(establish contact, supervise staff, and obtain vessel information) and four functions for the completeness of the model, e.g. establish VTS organisation, which provides the VTS staff and local operational procedures (Table 4).

4.2.4.2. Step 2: Identify the variability. The functional setup shows a system, VTS 3, in which functions are distributed over operators, on different levels in the organisation, that need to work together to accomplish successful operation. Particularly the functions controlled by the VTSO are depending on input stemming from functions executed by the traffic planner. Variable output in terms of time and precision can therefore easily amplify variability in the VTSO-related functions. Further, the VTSO is forced to supervise and control the performance of functions that work on different time horizons and with different focuses. On the one hand the operator is monitoring and organising traffic as a whole, where on the other hand the VTSO also preparing a single vessel for pilotage. This may give raise to endogenous variability.

Please cite this article as: Praetorius G, et al. Modelling Vessel Traffic Service to understand resilience in everyday operations. Reliability Engineering and System Safety (2015), http://dx.doi.org/10.1016/j.ress.2015.03.020i

G. Praetorius et al. / Reliability Engineering and System Safety ∎ (∎∎∎∎) ∎∎∎–∎∎∎

8

Fig. 5. VTS 3 and its functional units. The VTS 3 shows additional functional units as pilotage intake is integrated within the services offered. This generates additional functions and couplings to other units within the system. The red marked outputs, time aspects and control aspects represent interactions with functional units beyond the scope of this article. (For interpretation of the references to colour in this figure legend, the reader is referred to the web version of this article.)

Table 4 Overview of VTS 3 functions. Foreground functions

Background functions

Functions (environment) providing input to system

Translate messages Provide shipping broadcast Organise traffic on river Provide information service Provide navigational assistance Monitor traffic Queue vessels for pilotage Decide on pilotage method Request information for pilotage Calculate tidal windows Make sailing plan

Establish contact Supervise staff Obtain vessel information

Establish VTS organisation (Maritime Administration) Pass reporting point (Vessel) Pass reporting line (Vessel) Report to VTS (Vessel)

In comparison to VTS 1, VTS 3's model also shows functions, i.e. translate messages, that have been introduce permanently to manage the performance variability that can stem from the environment, i.e. vessels that need to make a traffic arrangement for a meeting, but do not have the means to communicate as they do not have a common language between the bridge-teams. Within the area of VTS 3, a lot of traffic is inland traffic that is not normally reporting in English. Therefore, local operational procedures dictate that both English and Dutch are used within this system. This puts additional work on the VTSO, who represents the control aspect of multiple foreground functions.

4.2.4.3. Step 3: Aggregation of variability. The functional model of VTS 3 (Fig. 5) reveals the dependencies among the functions and shows the number of functions that relate to providing services to the vessels within the area. The model shows complex interactions, in which some functions provide essential input to multiple downstream functions. Through the multiple couplings, e.g. traffic plan (output of make sailing plan) is a resource to amongst other provide information service, decide on pilotage method and queue

vessels for pilotage, variability can easily spread and amplify, especially as some of the functions, according to the informant, have only been recently introduced to the system. In addition to the three service levels offered at the centre, the VTS system has recently been assigned to provide the intake for pilotage of a vessel. It results in three additional functions, queue vessels for pilotage, decide on pilotage method and request information for pilotage, which need to be carried out on top of the functions connected to the service levels. During the data collection, the informant also recognised that the conditions, under which these functions are carried out, often lead to huge performance variability in the output, which could easily accumulate to functional resonance. So that gives very confusing traffic patterns and even for us, and even with the cooperation with the pilot it sometimes like, we think “oh, we had a guardian angel today” so we are still waiting for the day we don't have a guardian angel because it's very messy and for us it's messy but also for the ships too. Sometimes they are like “ahh, what do I have to do” and we have to get used to this new situation (VTSO). Within VTS 3, the traffic planner makes pre-hand sailing plans to de-conflict traffic movements as well as to compensate for the

Please cite this article as: Praetorius G, et al. Modelling Vessel Traffic Service to understand resilience in everyday operations. Reliability Engineering and System Safety (2015), http://dx.doi.org/10.1016/j.ress.2015.03.020i

G. Praetorius et al. / Reliability Engineering and System Safety ∎ (∎∎∎∎) ∎∎∎–∎∎∎

natural constraints put on the navigation of vessels within the area. The traffic planner is foremost responsible for planning deep draught vessels, as these are the most restricted ships, and as they can only meet other traffic at few spots along the river. The planner-related functions, make sailing plan and calculate tidal windows, provide another measure of managing the performance variability within the system as they provide a traffic plan which increases the predictability of traffic movements within the area. This in turn supports the task of traffic monitoring and providing information service. 4.2.4.4. Step 4: Consequences of the analysis. The model of VTS 3 shows clear signs of how the VTS system has already adapted its functioning to the current operational conditions. To avoid congestion and encounters alongside the river, an advanced planning system is in place where traffic is de-conflicted prior to entering the VTS area. This dampens the performance variability that can stem from the environment (maritime traffic) and helps the system to manage its resources. However, as in VTS 1, multiple functions are depending on the VTSO, and the example above shows that the system is currently operating close to its margins. A distribution of functions among the VTSS and VTSO, in which the supervisor could relief the operator from some tasks is desirable. A possible distribution could be to assign the VTSS all functions related to the intake and pilot boarding, while the VTSO monitors, informs and guides the traffic.

5. Discussion This article set out to obtain insights in how resilience manifests itself when VTS systems conduct everyday operations. After determining the core concepts in how VTS contributes to safe and efficient traffic movements, FRAM-models of two distinct VTS systems have been presented to gain a deeper understanding for everyday operations within the VTS domain. 5.1. Creating foresight and shaping preconditions – but very differently The first analysis identified creating foresight and shaping preconditions as the two common functions for how the VTS system contributes to the safe and efficient movement of maritime traffic, but the FRAM analysis revealed that both system carry out fairly different activities during their daily operations as they have to respond to different constraints, some of them introduced through the natural environment, e.g. tidal waters, and some of them due to the way the specific VTS system is organised and integrated into the overall port structure. Table 5 shows a brief comparison between VTS 1 and VTS 3. It is apparent that the services are quite different from each other. While VTS 3 is a system that needs to cope with high traffic load in tidal waters, which means the need to more thoroughly plan the traffic to avoid congestions due to lock structures at port entrances, VTS 1 is responsible for an area, where the surrounding geography restricts navigation and water levels do not differ so that traffic is heavily affected. The greatest challenge that VTS 1 is facing, is the fact that the traffic distributes unevenly in the fairways and without a legal mandate to support traffic organisation, the system is not able to constrain traffic movements by directing vessels into one of the two fairways depending on the current traffic density. Besides the geographical conditions, the local organisation of the VTS systems is vastly different. VTS 1 is operated by a single operator, while VTS 3 has a more complex organisation, in which operators are responsible for a certain set of activities, and

9

multiple operators working during one shift. Due to the need for a more detailed planning of the traffic in accordance with tidal windows, the system requires a split between VTSOs to provide information and monitor traffic in real time response, and VTSS or traffic planners that plan and de-conflict traffic movements to decrease the risk for congestions and incidents. As VTS 3 require traffic planning, the time horizon for their operation also differs from VTS 1. While VTS 3 starts to plan a vessel as early as up to two days prior to her arrival to make sure that she can make her tide and does not pose any risk within the area, VTS 1 starts to work with a vessel when she has passed the reporting line into the area, which means that the earliest contact is established much later than in VTS 3. 5.2. The FRAM to understand the systems' ability to resilience This article presents findings from the application of the FRAM to model everyday operations within the VTS domain. The aim was to gain insights into how the VTS system serves to promote safe and fluent traffic movements during everyday operations. The results indicate that while the two VTS systems considered in this article share a common purpose (shaping preconditions and creating foresight) and two foreground functions (provide information service and monitoring traffic), there are substantial differences in how the systems operate. Both VTS systems are well adapted to local circumstances, and one of the models (VTS 3) demonstrated that hard constraints, e.g., tidal waters or a lock system, can be effectively used to provide increased predictability for possible changes under operational conditions. Instead of becoming a hindrance, natural constraints are used to justify the planning of traffic movements at a longer time scale to mitigate the risk of future congestion, close traffic encounters and generally dangerous situations to the greatest extent possible. However, VTS 3 shows multiple dependencies among functions, especially those that are concerned with the planning of the traffic, which creates and almost aviation-like system with clearances and time slots allocated for each vessel. While this increases the ability to anticipate and prepare responses in good time, the FRAM analysis revealed that these dependencies also make the system less adaptable to unforeseen events. The functional setup is complex and stretches functions over at least three organisation level from frontline operator to planner. This makes the system rather stiff, or brittle, as adaptions cannot easily be undertaken in situations where the need for buffering capacity [49] arises. These situations may, for example, comprise deep draught vessels heading towards a meeting location not anticipated, or multiple vessels missing their tidal windows creating future congestions in a sensitive sea area. In comparison to VTS 3, VTS 1 has only a limited set of foreground functions and is only assigned the duty to provide information service. Additional duties, such as intake procedures for pilotage or traffic organisation, are not part of the VTS system. The biggest challenge for this system lies in anticipating future traffic movements, managing events, such as a vessel deciding to leave berth although she has not received a clearance, that fall outside of the pre-defined performance envelop, and to obtain all information required to prepare the system for upcoming situations, as the system lacks the ability to manage performance variability once it resonates. Especially prone to variability are therefore functions that show dependencies on the support of adjacent services that operate with a longer time horizon, e.g. pilot services, and it affects both monitoring, anticipation and the ability to respond. If the system relies on this input and the control provided by these services, the absence of it might lead to a fast spread and amplification of variability. However, as the system only has a single VTSO as control measure, it has the potential to show flexibility [49] through restructuring itself after a disruption has a occurred.

Please cite this article as: Praetorius G, et al. Modelling Vessel Traffic Service to understand resilience in everyday operations. Reliability Engineering and System Safety (2015), http://dx.doi.org/10.1016/j.ress.2015.03.020i

G. Praetorius et al. / Reliability Engineering and System Safety ∎ (∎∎∎∎) ∎∎∎–∎∎∎

10

Table 5 VTS system comparison. VTS 1 Services offered include INS, some TOS VTS area characteristics Port approach through archipelago VTS organisation 1 VTSO VTS and pilot dispatch share service centre, but VTS independent service Area-specific demands/ Two fairways, but 90% of all traffic within one of the challenges fairways

Time horizon for operation

VTS 3 INS, NAS, TOS, pilotage intake, shipping broadcast Entrance to river from sea, tidal waters, strong currents 1 traffic planner, 1 VTSS and several VTSOs rotating workstations VTS is integrated into chain planning service including pilotage, tugs, lock services Lock system at entrance to several ports along river

Limited space for navigation along the river with only few locations for possible anchorage Bilingual VTS operation to engage local and inland traffic into VTS system VTSO does not receive vessel reports prior to vessel's Traffic planner plans deep draught vessel arrival in area Information on future traffic through other services 12 h ahead of arrival, 6 h ahead confirmation Time horizon dependent on other services VTS shares information system with other services, such as tugs, lock services, berth and pilot service, along the river. (tugs – 24 h, pilot order – 5 h, port -24 h) VTSO is responsible for controlling and updating ETAs and other vessel information

The FRAM analysis of both systems revealed the complex interactions that constitute everyday operations in the VTS domain and showed that, although providing services under the same label, VTS is realised fairly differently. One system, VTS 1 is loosely coupled with a high ability to restructure and adapt to a changing context. However, the system's ability to anticipate and monitor is limited due to dependencies on other services to support and provide input to the system. The other system, VTS 3, is highly coupled and extensive planning provides an increased ability to anticipate and therefore to prepare organisational responses to upcoming (expected) events. However, due to the complex interactions, the system is rather stiff and is therefore in its ability to quickly adapt to changes in the environment. One could say that it has less flexibility and less buffering capacity as disruptions in one or two functions can propagate given raise to functional resonance and therefore to the possibility of a system breakdown. The analysis presented here is by no means complete. This is a first attempt of understanding complexity in everyday operations in the maritime domain, and in VTS in specific, through the lens of FRAM and shows therefore several possibilities for a way forward. A next step from here would be to make use of specific scenarios to evaluate further how performance variability spreads through the functions given a defined context. Both Woltjer [46] and de Carvalho [8], for example, have employed the FRAM to explore resilience characteristics [49] of a system. They created instantiations based on accident investigation reports and then analysed how performance variability had spread and what this could indicate for the buffering capacity, flexibility and tolerance of the system. However, while this might have provided insights in which types of functions relate to the characteristics of resilience, the articles again based their analyses on events where resilience and safety were absent and where work was modelled based on investigation reports. In contrast to that, the study presented here tried to model work-as-done identifying the essential system functions needed to successfully fulfil the system goal (safe and efficient traffic flow within the VTS area). Through the functional modelling the complexity of everyday work could be depicted as well as the FRAM helped to reveal ways in which the systems already had adapted to their operational context, inventing new functions to be able to cope with the demands of a situation. Furthermore, uncovering the complexity of every operations with the FRAM provides another strong case for why management, rule-makers and regulators should consider how work is currently conducted before implementing changes. VTS is currently on the verge of change and several simultaneous developments, such as e-navigation [23], chain planning [37], and

extended ship-shore route planning [33,34] push towards fast pace technical and organisational developments. However, many of these suggestions appear to ignore the fact that changes to technology and/ or organisation changes are typically accompanied by changes in how work is conducted, or as Wiener [45] states, “Progress imposes not only new possibilities for the future but new restrictions.” (p.46). While new technology and more centralised traffic management appear appealing, one should bear in mind that new demands will arise from these changes. Complexity of everyday work needs to be properly understood before changes are implemented as consequences can otherwise be unpredictable. 5.3. Methodological discussion As mentioned above, the FRAM shows great potential as a method to uncover complexity in every performance and can therefore account for events or disruptions that arise as functions within a system adjust their performance to the current situation. Furthermore, as discussed above, the FRAM can enable the analyst to look for potential sources of functional resonance and suggest dampening measures prior to accidents. However, applying the FRAM may be suitable for analysing certain events with the help of instantiating the model, meaning showing the outcome given a defined set of operating conditions, it is still difficult to analyse and model everyday operations, and situations where everything goes right. As safety is a non-event [43] it becomes hard to identify which functions one should focus on. Furthermore, field data from observations and interviews is sometimes hard to convey into the functional model. The data is exhaustive and substantial expert knowledge is needed to identify functions and their aspects, as well as to determine the variability in normal operations. Grounded theory was employed as a first step in this process. By micro-coding core concepts and identifying the role of the VTS for safe and efficient traffic movements, Fig. 1 created a means of communication between the expert participants and the researchers. It showed what the systems had in common and helped the informants to identify both functions of their VTS system, but also situations in which the variability faced is exceeding what the system can compensate for. This iterative process was time-consuming and resulted in the models being developed further after each round of expert auditing. 5.4. Future research and wider implication of this study This article has presented a first attempt to understand the complexity of everyday operation within the VTS domain through the lens of FRAM. In comparison to earlier research ([1,8,13,28]), no

Please cite this article as: Praetorius G, et al. Modelling Vessel Traffic Service to understand resilience in everyday operations. Reliability Engineering and System Safety (2015), http://dx.doi.org/10.1016/j.ress.2015.03.020i

G. Praetorius et al. / Reliability Engineering and System Safety ∎ (∎∎∎∎) ∎∎∎–∎∎∎

specific scenario was used to model the system. Instead grounded theory and expert input was used to connect the system's purpose to its functions and the way in which the functional design increases or decreases a system's ability to resilience. However, these aspects deserve to be explored further. A first step could be to instantiate the models and try to identify further success factors for everyday operations through the FRAM. Furthermore, these factors could then be developed into indicators for system performance that both frontline operators and management could use to improve the means and measures in which risk are identified and controlled. Another line of research interesting to develop would be to use the FRAM models for the development of training scenarios to identify essential skills frontline operators need to successfully cope with the demands of the operating context. One example could be to adopt the concept resilience skills [36] or resilience markers [2] to identify training needs and requirements based on the models of everyday operations. To be safe also means to provide means and measures for a system or an organisation to be able to sustain required system functions under a large variety of operating conditions.

6. Concluding remarks This article set out to gain insights in how the VTS system contributes to efficient and safe traffic movements within the VTS domain. The analysis showed that although the two VTS systems considered within this study share a common purpose (shaping preconditions and creating foresight) and some functions (provide information service and monitoring traffic), there are large differences in how VTS is realised. Furthermore, the FRAM analysis has shown both advantages and disadvantages with the systems' design. As discussed above, anticipation, responding and monitoring are core tasks for a VTS and are what enables the system to create foresight and shape preconditions for the traffic within the area of responsibility. Everyday operations within the VTS domain are highly complex and each system has developed means and measures to cope with the natural constraints and uncertainty encountered in the environment. Before any changes to a VTS system are made, regardless whether these are organisational, technical or legal, a thorough analysis of the current system and its dependencies between functions should be conducted. Only if the complexity of everyday work is understood and properly analysed, one can estimate how changes will affect the overall system performance.

Acknowledgements We would like to acknowledge the Region of Västra Götaland and the Mary von Sydow, född Wijk, Donationsfond for funding this research. We would also like to express our gratitude to all experts who participated in this study. Their willingness to share their expertise and welcome us in the settings of their daily work has been essential for this research. References [1] Alm H, Woltjer R. Patient safety investigation through the lens of FRAM. In: de Waard D, Axelsson A, Berglund M, Peters B, Weikert C, editors. Human factors: a system view of human, technology and organisation. Maastricht, The Netherlands: Shaker Publishing; 2010. [2] Back J, Furniss D, Hildebrandt M, Blandford A. Resilience markers for safer systems and organisations. Comput Saf Reliab Secur 2008:99–112. [3] Belmonte F, Schön W, Heurley L, Capel R. Interdisciplinary safety analysis of complex socio-technological systems based on the functional resonance accident model: an application to railway trafficsupervision. Reliab Eng Syst Saf 2011;96(2):237–49. http://dx.doi.org/10.1016/j.ress.2010.09.006.

11

[4] Brodje A, Lundh M, Jenvald J, Dahlman J. Exploring non-technical miscommunication in vessel traffic service operation. Cognit Technol Work 2013;15 (3):347–57. http://dx.doi.org/10.1007/s10111-012-0236-5. [5] Brödje, A, Lützhöft, M, & Dahlman, J. The whats, whens, whys and hows of VTS operator use of sensor information. In: Paper presented at the international conference on human performance at sea. HPAS, Glasgow; 2010. [6] Chang, S J. Development and analysis of ais applications as an efficient tool for vessel traffic service. Paper presented at the OCEANS ‘04; 2004. [7] Corbin J, Strauss A. Basics of qualitative research 3e. 3rd edition. London: Sage Publication, inc.; 2008. [8] de Carvalho PVR. The use of Functional Resonance Analysis Method (FRAM) in a mid-air collision to understand some characteristics of the air traffic management system resilience. Reliab Eng Syst Saf 2011;96(11):1482–98. http://dx.doi.org/10.1016/j.ress.2011.05.009. [9] Froholdt, L L The communicative blue: human factors in technologically mediated routine and non-routine interaction in the maritime industry: Ph. D. Dissertation: Lisa Loloma Froholdt; 2011. [10] Froholdt LL. Getting closer to context: a case study of communication between ship and shore in an emergency situation. Text Talk – Interdiscip J Lang Discourse Commun Stud 2012;30(4):385–402. [11] GmbH, V. S. C. S.. MAXQDA. The Art of Data Analysis. From 〈http://www. maxqda.com/〉; 2013. [12] Herrera, I A, & Hovden, J. Leading indicators applied to maintenance in the framework of resilience engineering: a conceptual approach. In: Proceedings of the third resilience engineering symposium, Antibes – Juan Les Pins, France. 〈http://www.sintef.se/globalassets/project/building-safety/publications/ 2008-resilience-engineering-symposium-leading-indicators-herrera-hovden. pdf〉; 2008. [13] Herrera IA, Woltjer R. Comparing a multi-linear (STEP) and systemic (FRAM) method for accident analysis. Reliab Eng Syst Saf 2010;95(12):1269–75. http: //dx.doi.org/10.1016/j.ress.2010.06.003. [14] Herrera IA, Woltjer R. Comparing a multi-linear (STEP) and systemic (FRAM) method for accident investigation. Reliab Eng Syst Saf 2010;95(12):1269–75. [15] Holling CS. Resilience and stability of ecological systems. Annu Rev Ecol Syst 1973;1973(4):1–23. [16] Hollnagel E. Prologue: the scope of resilience engineering. In: Hollnagel E, Pariès J, Woods D, Wreathall J, editors. Resilience engineering in practice. A guidebook. Farnham, Surrey, UK: Ashgate Publishing; 2011. [17] Hollnagel E. FRAM: the functional resonance analysis method – modelling complex socio-technical systems. Burlington, USA: Ashgate Publishing Company; 2012. [18] Hollnagel, E. The Four Basic Principles of the FRAM. Retrieved 20140312, From 〈http://functionalresonance.com/basic-principles.html〉; 2014. [19] Hollnagel E, Hounsgaard J, Colligan L. FRAM – the functional resonance analysis method – a handbook for the practical use of the method. Middelfart: Centre for Quality; 2014. [20] Hollnagel E, Woods DD. Joint cognitive systems. Foundations of cognitive systems engineering. Boca Raton, FL: CRC Press; 2005. [21] Hollnagel E, Woods DD, Leveson N. Resilience engineering: concepts and precepts. Burlington, USA: Ashgate; 2006. [22] IMO Guidelines for Vessel Traffic Services. In I. M. Organisation (Ed.), Resolution A.857 (20) International Maritime Organization; 1997. [23] IMO. Strategy for the development and implementation of e-Navigation Report of the Maritime Safety Committee on its eighty-fifth session (Vol. MSC 85/26/add.1); 2009. [24] Kao S-L, Lee K-T, Chang K-Y, Ko M-D. A fuzzy logic method for collision avoidance in vessel traffic service. J Navig 2007;60:17–31. [25] Kataria, AMaritime English and the VTS. In: Proceedings of the international maritime english conference, Constanta, Romania; 2011. [26] Lundblad, K, Speziali, J, Woltjer, R, & Lundberg, J. FRAM as a risk assessment method for nuclear fuel transportation. In: Proceedings of the international confererence working on safety; 2008. [27] Lützhöft M, Grech M, Porathe T. Information environment, fatigue, and culture in the maritime domain. Rev Hu Factors Ergon 2011;7:280–322 Human Factors and Ergonomics Society. [28] Macchi, L, Hollnagel, E, & Leonhardt, J. Resilience engineering approach to safety assessment: an application of FRAM for the MSAW system. Paper presented at the EUROCONTROL Safety R&D Seminar, Germany; 2009. [29] Manuel ME. Maritime risk and organizational learning. Burlington, USA: Ashgate; 2011. [30] Nuutinen M, Savioja P, Sonninen S. Challenges of developing the complex socio-technical system: realising the present, acknowledging the past, and envisaging the future of vessel traffic services. Appl Ergon 2006;28:513–24. [31] Patton MQ. Qualitative research & evaluation methods. Sage Publication; 2002. [32] Perrow C. Normal accidents. Living with high-risk technologies. Princeton, New Jersey: Princeton University Press; 1999. [33] Porathe T. Transmitting intended and suggested routes in ship operations: cognitive off-loading by placing knowledge in the world. Work 2012;41:4873–8. [34] Porathe, T, de Vries, L, & Prison, J. Ship voyage plan coordination in the MONALISA project: user tests of a prototype ship traffic management system. In: Proceedings of the human factors and ergonomics society Europe annual conference. Chapter 2013, Torino; 2013.

Please cite this article as: Praetorius G, et al. Modelling Vessel Traffic Service to understand resilience in everyday operations. Reliability Engineering and System Safety (2015), http://dx.doi.org/10.1016/j.ress.2015.03.020i

12

G. Praetorius et al. / Reliability Engineering and System Safety ∎ (∎∎∎∎) ∎∎∎–∎∎∎

[35] Praetorius, G, Lundh, M, & Lützhöft, M. Learning from the past for pro-activity – a re-analysis of the accident of the MV herald of free enterprise. Paper presented at the Resilience Engineering IV. Sophia Antipolis; 2011. [36] Saurin TA, Wachs P, Righi AW, Henriqson É. The design of scenario-based training from the resilience engineering perspective: a study with grid electricians. Accid Anal Prev 2014;68:30–41. http://dx.doi.org/10.1016/j. aap.2013.05.022. [37] Seignette RWP. Vessel traffic management in the Port of Rotterdam. In Maritime Information Services Ltd. Port Technology International 2012;53:105–7. [38] Stopford M. Maritime economics. New York: Routledge; 2009. [39] Sujan M-A, Felici M. Combining failure mode and functional resonance analyses in healthcare settings. In: Ortmeier F, Daniel P, editors. Computer safety, reliability, and security, Vol. 7612. Berlin Heidelberg: Springer; 2012. p. 364–75. [40] Trafford SM. Maritime safety. The human factors. Sussex: Book Guild Publishing; 2009. [41] UNCTAD.. Review of Maritime Transport 2013. In U. N. C. O. T. A. D. (UNCTAD) (Ed.), Review of Maritime Transport. New York and Genua: United Nations; 2013. [42] Van Dam, S, Mulder, M, & Van Paassen, M M. Ecological interface design for vessel traffic management: a theoretical overview. In: Proceedings of the 11th IFAC symposium on control in transportation systems; 2006. [43] Weick KE. Organization culture as a source of high reliability. Calif Manag Rev 1987;29(2):112–27. [44] Vespe, M, Sciotti, M, Burro, F, Battistello, G, & Sorge, S. Decision support platforms for satellite-extended vessel traffic services. Paper presented at the RADAR; 2008.

[45] Wiener, N. The Human Use of Human Beings: Cybernetics and Society: Da Capo Press, Incorporated; 1988. [46] Woltjer, R. Resilience assessment based on models of functional resonance. In: Proceedings of the third resilience engineering symposium, Antibes – Juan Les Pins; 2008. [47] Woltjer, R, & Hollnagel, E. The Alaska Airlines Flight 261 accident: a systemic analysis of functional resonance. In: Proceedings of the international symposium on aviation psychology (ISAP), Dayton, OH; 2007. [48] Woltjer, R, & Hollnagel, E. Functional modeling for risk assessment of automation in a changing air traffic management environment. In: Proceedings of the fourth international conference working on safety, Crete, Greece; 2008. [49] Woods D. Essential Characteristics fo Resilience. In: Hollnagel E, Woods D, Leveson N, editors. Resilience engineering: precepts and concepts. Abingdon: Ashgate Publishing Group; 2006. p. 21–34. [50] Woods DD. Resilience and the ability to anticipate. In: Hollnagel E, Pariès J, Woods DD, Wreathall J, editors. Resilience engineering in practice. A guidebook. Farnham, Surrey, UK: Ashgate Publishing Limited; 2011. [51] Woods DD, Hollnagel E. Joint cognitive systems. Patterns in cognitive systems engineering. Boca Raton, FL: CRC Press; 2006.

Please cite this article as: Praetorius G, et al. Modelling Vessel Traffic Service to understand resilience in everyday operations. Reliability Engineering and System Safety (2015), http://dx.doi.org/10.1016/j.ress.2015.03.020i