Assessment of accident theories for major accidents focusing on the MV SEWOL disaster: Similarities, differences, and discussion for a combined approach

Safety Science 82 (2016) 410–420

Contents lists available at ScienceDirect

Safety Science journal homepage: www.elsevier.com/locate/ssci

Assessment of accident theories for major accidents focusing on the MV SEWOL disaster: Similarities, differences, and discussion for a combined approach Kim Hyungju a,⇑, Haugen Stein b,1, Utne Ingrid Bouwer b,2 a b

Department of Production and Quality Engineering, Norwegian University of Science and Technology, Trondheim, Norway Department of Marine Technology, Norwegian University of Science and Technology, Trondheim, Norway

a r t i c l e

i n f o

Article history: Received 3 July 2015 Received in revised form 23 September 2015 Accepted 20 October 2015 Available online 11 November 2015 Keywords: Energy-barrier model MMD theory Conflicting objectives perspective HRO theory Korean ferry accident, MV SEWOL

a b s t r a c t On 16th April 2014, the MV SEWOL capsized in South Korea, and 304 persons died or went missing. This article describes the accident and finds causes from four different theoretical points of view: the energybarrier model, Turner’s man-made disasters model, Rasmussen’s conflicting objectives perspective, and high reliability organizations theory. The results show that the theories together point out a total of 23 different causes to the accident. Different causes are identified from different theories and they complement each other. Finally, this article discusses a possible combination of the perspectives for improving both accident investigation and accident prevention. Ó 2015 Elsevier Ltd. All rights reserved.

1. Introduction On 16th April 2014, a RORO3 passenger ferry carrying 476 passengers and crew capsized on route from Incheon to Jeju in South Korea, and 304 persons died or went missing. The Korean society was immensely shocked because (1) it happened only 20 km from the coast, (2) most of the victims were secondary high school students on a school trip, and (3) the captain and crew escaped first without any instruction on evacuation for passengers. In general, a lot of effort has been put into research on understanding why major accidents occur and finding means for how we can prevent them from recurring. Some popular theories and perspectives on major accidents are the energy-barrier model (Gibson, 1961; Haddon, 1970, 1980), Turner’s man-made disasters (MMD) model (Pidgeon and O’Leary, 2000; Turner and Pidgeon, 1997), Perrow’s normal accident (NAT) theory (Perrow, 1984), high ⇑ Corresponding author at: S.P. Andersens veg 5, Valgrinda 1.306B, Trondheim 7491, Norway. E-mail addresses: [email protected] (H. Kim), [email protected] (S. Haugen), [email protected] (I.B. Utne). 1 Address: Otto Nielsens veg 10, Marinteknisk senter D2.098, Trondheim 7491, Norway. 2 Address: Otto Nielsens veg 10, Marinteknisk senter E2.101, Trondheim 7491, Norway. 3 Roll-On/Roll-Off. http://dx.doi.org/10.1016/j.ssci.2015.10.009 0925-7535/Ó 2015 Elsevier Ltd. All rights reserved.

reliability organizations (HRO) theory (LaPorte and Consolini, 1991; Rochlin et al., 1987) Rasmussen’s conflicting objectives perspective (Rasmussen, 1997), and resilience engineering (Hollnagel, 2004, 2008). Each theory represents different perspectives on major accidents and understands the accident mechanisms in its own particular way, sometimes focusing on different causes of the same accident (Kim and Haugen, 2015). There are many studies on comparison and application of accident investigation methods. Benner (1985) investigates and compares 17 accident investigation methodologies in 17 selected government agencies in US, and Lehto and Salvendy (1991) reviews 54 accident causation models and 16 methods of application, and categorizes them into three groups. Sklet (2004) analyzes 14 accident investigation methods and compares them according to 7 characteristics, and Lundberg et al. (2009) examines three aspects of eight accident investigation manuals. Other studies which review and compare accident investigation methodologies include Ferry (1988), Hollnagel and Speziali (2008), Herrera and Woltjer (2010), Agent et al. (1994), and Katsakiori et al. (2009). There are, however, few studies which compare different perspectives on major accidents with practical applications. Yang and Haugen (2014) review six perspectives on major accidents, and suggests a possible combination of the perspectives, and Saleh et al. (2010) investigates 5 perspectives on major accidents from a ‘‘control problem” and ‘‘system theoretic” point of view, but

H. Kim et al. / Safety Science 82 (2016) 410–420 Table 1 General particulars of the MV SEWOL (KMST, 2014). Name Ship type Builder Year Class Port of registry Owner Gross tonnage Capacity Length (over all) Depth Beam Draft Speed (maximum/design)

SEWOL RORO Passenger ship Hayashikane Dockyard Co., Ltd., Japan 1994 Korean Register of Shipping (since 2012) Incheon, South Korea (since 2012) Chonghaejin Marine Company (since 2012) 6825 GT 956 persons (921 passengers + 35 crews) 145.61 m 14.00 m 22.00 m 6.25 m 23.55 knots/22.00 knots

neither of them provide practical applications of the perspectives. A detailed evaluation and comparison of six perspectives on major accidents with practical applications is provided by Rosness et al. (2010). Kim and Haugen (2015) investigated the accident of the Titanic, which occurred a hundred years ago, and suggests a possible combination of the perspectives. However, none of them discusses the combination of the theories both from an accident investigation and prevention point of view. The main objective of this article is to investigate and find causes to the accident of the MV SEWOL by using four different theories or perspectives of major accidents, i.e., the energybarrier model, Turner’s man-made disasters model, Rasmussen’s conflicting objectives perspective, and HRO. The article discusses a possible combination of the perspectives from an accident investigation and prevention point of view. More specifically, the article studies how each perspective can be applied to an actual accident, and identifies how each perspective interact, complement, or conflict with each other. The ultimate objective of this article is to contribute to the improvement of accident investigation methods and accident causation models. Hopefully, improved accident theories will lead to more knowledge of the causes to the accident, placing focus on need for improved regulations and follow up from authorities, more efficient safety management systems and safety climate in companies. In the long term, this may contribute to preventing a recurrence of similar disasters as the MV SEWOL. This article does not cover NAT theory, because it fails to explain any real accident (Hopkins, 2014). Further, there are many similarities between HRO theory and resilience engineering (Hopkins, 2014; Le Coze and Dupre, 2006), and the article therefore focuses on HRO theory only, as it was proposed almost a generation earlier than resilience engineering. The remainder of this article is organized as follows: details of the accident of the MV SEWOL are given in Section 2, and the accident is investigated through the four accident perspectives from Section 3 to Section 6. Results and discussion are presented in Section 7, and concluding remarks follow in Section 8. 2. Details about the disaster The ferry MV SEWOL capsized in the morning on April 16th 2014 on its way from Incheon to Jeju in South Korea. 304 persons died, of which a large proportion was students. 2.1. Description of the MV SEWOL Chonghaejin Marine Company purchased the vessel from A-Line Ferry Co., Ltd. in Japan in 2012 and extended it to increase passenger space. The ship owner changed the name of the vessel from NAMINOUE to SEWOL, and the MV SEWOL began operating on

411

16th March 2013. The MV SEWOL made two round trips per week from Incheon to Jeju, and each voyage took about 13.5 h (KMST, 2014). General particulars of the MV SEWOL are given in Table 1.

2.2. Timeline of the disaster The timeline in Table 2 below is a summary based on BAI (2014), MINBYUN (2014) and KMST (2014).

2.3. Casualties and survivors In total, 476 persons were aboard the MV SEWOL: 325 high school students, 14 teachers, 108 other passengers, 15 sailing crew members4 and 14 service crew members.5 304 of them died or went missing, and 172 persons survived giving a survival ratio of 36% (MINBYUN, 2014). Details of the casualties and survivors are given in Table 3.

2.4. Accident investigation A joint prosecution-police investigation team concluded (MINBYUN, 2014) that the sinking of the MV SEWOL was caused by (1) a stability problem due to extension, (2) cargo overload and discharging ballast water, and (3) unsecured cargo. A sharp turn caused unsecured cargo to slide to the portside and made the MV SEWOL list. The MV SEWOL could not recover its stability because of the inherent stability problem due to the extension, overloading of cargo, and lack of ballast water. The Korean Maritime Safety Tribunal and the Board of Audit and Inspection published the Safety Investigation Report and Audit and Inspection Report, which includes many secondary and indirect causes of the accident (BAI, 2014; KMST, 2014). The following sections analyze the accident from the different accident theories or perspectives point of view.

3. The energy-barrier model 3.1. A brief description of the energy-barrier model The Energy-barrier model states that the absence of effective barriers between a harmful energy source and a vulnerable object causes accidents (Haddon, 1970, 1980; Rosness et al., 2010). Sklet (2006) defines safety barriers as ‘‘physical and/or non-physical means planned to prevent, control, or mitigate undesired events or accidents” and proposes to distinguish between barrier function and barrier system; barrier function is ‘‘a function planned to prevent, control, or mitigate undesired events or accidents”, and barrier system is ‘‘a system that has been designed and implemented to perform one or more barrier functions” (Petroleum Safety Authority Norway, 2013; Sklet, 2006). Safety barriers can be classified in several different ways, for example, proactive barriers (frequency-reducing) and reactive (consequence-reducing) barriers, active and passive barriers, and so on (Rausand, 2011). It is a main principle behind safety in design to prevent accidents from occurring through implementation of barrier functions (Kjellen, 2000; Rosness et al., 2010). Practical safety management is thus greatly influenced by the energy-barrier model (Rausand, 2011). 4 Crew members who are in charge of sailing (e.g. captain, chief/second/third officer, helmsman, chief engineer, etc.). 5 Crew members who provide passenger service (e.g. chef, stewardess, purser, etc.).

412

H. Kim et al. / Safety Science 82 (2016) 410–420

Table 2 Timeline of the accident of the MV SEWOL. Date

Time

Event

Remarks

15th April 2014

Before departure

MV SEWOL overloads cargo

Before departure

MV SEWOL discharges ballast water

20:50 21:00

Cargo overloading inspection MV SEWOL departs from Incheon to Jeju

Recommended: 987 ton Carried: 2,142.7 ton Recommended: 1,703 ton Carried: 761.2 ton Failed to detect overloading 476 persons aboard

08:48 08:52

MV SEWOL makes a sharp turn MV SEWOL lists 30° on the portside First rescue call by one of the high school students Announcement for passengers ‘‘stay still and wait for the rescue” Jindo VTS orders the captain of the MV SEWOL to decide for himself whether to extricate passengers or not Patrol Boat 123 of Korea Coast Guard arrives MV SEWOL lists 52.5° A small rubber boat from Patrol Boat 123 rescues 7 sailing crew members MV SEWOL lists 57.3° Patrol Boat 123 rescues the captain and other sailing crew first and then begins to rescue passengers who escape from the vessel West Regional Coast Guard orders Patrol Boat 123 to enter into the vessel and rescue passengers

16th April 2014

08:56 09:26 09:30 09:34 09:39 09:44 09:46 09:47

MV SEWOL begins to list

Repeated 7 times during 30 min The captain takes no action Patrol boat spends 9 min just watching the vessel Not passengers but crew members first

No rescue operation for passengers No one enters Rescue passengers outside the vessel only

10:17 10:21 10:31

MV SEWOL lists 108.1° Last rescue of 30 passengers MV SEWOL utterly capsizes

None of the passengers trapped inside the sunken vessel was rescued

Table 3 Casualties and survivors (MINBYUN, 2014).

Aboard Survived Dead and missing Survival ratio

Total number

High school students

Teachers

Other passengers

Sailing crew

Service crew

476 172 304 36%

325 75 250 23%

14 2 12 14%

108 75 33 70%

15 15 0 100%

14 5 9 36%

3.2. The accident viewed by the energy-barrier model According to the accident investigation report of the KMST (2014), the helmsman of the MV SEWOL turned the wheel to starboard inordinately, which caused the vessel’s excessive list to the port side. Several negative conditions made the vessel more prone to listing and eventually the MV SEWOL capsized. Untrained crew members neglected their duty to extricate passengers from the sinking vessel, and the Korea Coast Guard failed to rescue lots of passengers before the vessel sank (KMST, 2014). ‘‘Sharp turn” is the initiating event, ‘‘capsize” is the hazardous event, and ‘‘lots of fatalities” is the consequence of the accident of the MV SEWOL. We can identify two barrier functions in the accident trajectory from the initiating event to the consequence. ‘‘Prevent capsizing” of the vessel is a barrier function between ‘‘sharp turn” and ‘‘capsizing”, and ‘‘prevent fatality” is located between ‘‘capsizing” and ‘‘lots of fatalities”. The prosecution concluded that the sharp turn of the MV SEWOL occurred by a mistake of the helmsman without any failure of the steering gear. The third mate ordered the helmsman to change the course of the vessel from 140° to 145°, but after the changing of the course, the helmsman continued to turn, which caused a sharp turn of the vessel (KMST, 2014; MINBYUN, 2014). After the initiating event, the proactive barrier should prevent the hazardous event from occurring, but in this case, it failed.

Fig. 1 shows the barrier function of the proactive barrier; ‘‘prevent capsizing after sharp turn”, which may be broken down into barrier sub-functions ‘‘prevent loss of inherent stability”, ‘‘prevent cargo overloading”, ‘‘contain proper amount of ballast water”, and ‘‘prevent movement of cargo”. Each barrier sub-function has barrier systems with several barrier elements. The relation among these barrier functions, systems, and elements are illustrated in Fig. 1. The first barrier sub-function; ‘‘prevent loss of inherent stability”, is realized by a barrier system, ‘‘stability estimation and inspection”. The barrier elements of this barrier system are ‘‘ship engineers of the ship owner” and ‘‘inspectors of Korean Register of Shipping (KR)”. The ship owner extended the MV SEWOL, which increased the light weight by 187 tons and caused imbalance by 30 tons. After the extension, the ship owner underestimated the lightweight of the MV SEWOL with 100 tons compared to its actual weight, but KR did not recognize it and approved the vessel (BAI, 2014). Consequently, the MV SEWOL had an inherent stability problem before sailing. The barrier system of the second barrier sub-function; ‘‘prevent cargo overloading” is ‘‘cargo check before departure”. The barrier elements are ‘‘crews of the vessel” and ‘‘officers of Federation of Shipping Associations (FSA)”. The third barrier sub-function; ‘‘contain proper amount of ballast water” is fulfilled by ‘‘ballast water system”, whose barrier elements are ‘‘pump, pipe, tank, etc.” and

H. Kim et al. / Safety Science 82 (2016) 410–420

413

Fig. 1. Proactive barrier.

Fig. 2. Reactive barrier.

‘‘crews of the vessel”. On the last voyage, the MV SEWOL carried 2142.2 tons of cargo while the authorized limit of cargo was 987 ton. To make matters worse, the captain discharged ballast water to conceal the overloading and cheat the vessel safety officer of the Federation of Shipping Associations. The MV SEWOL was loaded with only 761.2 tons of ballast water, which is less than half of the recommended 1703 tons (KMST, 2014). The last barrier sub-function; ‘‘prevent movement of cargo” is realized by ‘‘cargo securing”. The barrier elements of this barrier system are ‘‘lashing fittings”, ‘‘crew of the vessel”, and ‘‘officers of FSA”. The Federation of Shipping Associations has a responsibility to supervise the securing of cargo before departure of the vessel, but they failed to identify that the crews of the vessel did not secure the containers properly. Unsecured cargo fell to the port side and worsened the stability of the vessel when the MV SEWOL made a sharp turn (MINBYUN, 2014). Fig. 2 shows the barrier function of the reactive barrier; ‘‘prevent fatalities after capsizing”, and it consists of three barrier sub-functions; ‘‘evacuation from sinking vessel”, ‘‘rescue from sinking vessel”, and ‘‘rescue from sunken vessel”. The first barrier sub-function in Fig. 2; ‘‘evacuation from sinking vessel” is fulfilled by a barrier system, ‘‘lifesaving appliances”, and it consists of ‘‘life rafts” and ‘‘crews of the vessel”. After the sharp turn at 08:52 AM, the MV SEWOL listed 30° to portside and

capsized gradually. The last survivor was rescued from the sinking vessel at 10:21 AM; 89 min after the MV SEWOL began to list. Passengers had enough time to evacuate from the sinking vessel. However, crew members of the MV SEWOL made announcements; ‘‘stay where you are (inside the cabin) and wait for the rescue” and escaped first from the sinking vessel. Hence, survivors escaped from the sinking vessel without any evacuation order. As a result, 100% of the sailing crew members (captain, officers, helmsman, engineers, etc.) survived, while only 23% of high school students survived (BAI, 2014; KMST, 2014; MINBYUN, 2014). The second barrier sub-function, ‘‘rescue from sinking vessel”, is realized by two barrier systems, ‘‘detecting sinking vessel” and ‘‘rescue by Korea Coast Guard (KCG)”. The barrier elements of the former are ‘‘crews of the vessel”, ‘‘Vessel Traffic Service (VTS) equipment”, and ‘‘officers of VTS”. ‘‘Patrol ships of KCG” and ‘‘crews of patrol ship” are barrier elements of the latter. The first distress call was not sent by crews of the vessel, but by one of the passengers at 8:52 AM. 3 min later, the chief officer called for help to a wrong VTS which is located 80 km away. This led to 12 min delay of rescue. Meanwhile, the strange track of the MV SEWOL could be followed in Jindo VTS at 08:50 AM, but they failed to monitor the situation and noticed the accident at 09:06 AM; a 16 min delay of rescue operation (MINBYUN, 2014). Considering that the total available rescue time for the Korea Coast Guard was only 49 min

414

H. Kim et al. / Safety Science 82 (2016) 410–420

before the MV SEWOL sank, 16 min is not a short time period. The Korean Coast Guard could have rescued lots of additional passengers, if the Jindo VTS had noticed the accident immediately. Inappropriate rescue operation of Patrol Boat 123 also contributed to the number of fatalities. Patrol Boat 123 of Mokpo Coast Guard arrived first on site and began to rescue at 09:35 AM. They should have rescued the passengers immediately, but failed to do so. Patrol Boat 123 spent 15 min rescuing all of the sailing crew members first, and finally began to rescue passengers at 09:50 AM. MV SEWOL capsized 31 min after they started rescuing passengers, making it impossible to rescue any more passengers (BAI, 2014; MINBYUN, 2014). The barrier system of the last barrier sub-function, ‘‘rescue from sunken vessel”, is ‘‘underwater rescue”, whose barrier elements are ‘‘countermeasure headquarter”, ‘‘officers of KCG”, and ‘‘National Police Agency (NPA), Ship Salvage Unit (SSU), Underwater Demolition Team (UDT), and National 119 Rescue Service”. In total, 10 countermeasure headquarters were organized to control the rescue operation, and three days afterward, a centralized headquarter was established (BAI, 2014) Because of the absence of a centralized disaster control center, special rescue agents for underwater rescue operations from NPA, SSU, UDT, and National 199 Rescue Service were not effectively deployed (MINBYUN, 2014). Corruption and illegal business favors worsened the situation. The prosecutor substantiated that several corrupt officers of Korea Coast Guard granted favors to a private salvage company for the rescue operation. The Korea Coast Guard decided to mobilize a new built large barge from a private salvage company to support the rescue operation. The barge was still in a shipyard because its safety inspection was not completed, and it took 7 days for the barge to come to the site. However, there were 7 barges with similar size nearby the site, which could have been mobilized within 2–3 h. The private salvage company charged the government 1.5 billion KRW; 70% of the barge building cost, for the use of the barge (Seo, 2014). 3.3. Concluding remarks on the energy-barrier model The energy-barrier model explains the causation of the MV SEWOL accident with failures of barrier functions. After the sharp turn of the vessel, the proactive barrier failed to prevent capsizing, which consists of four barrier sub-functions: ‘‘prevent loss of inherent stability”, ‘‘prevent cargo overloading”, ‘‘contain proper amount of ballast water”, and ‘‘prevent movement of cargo”. Failure of the reactive barrier could not prevent lots of fatalities after the capsizing of the vessel. The barrier sub-functions of the reactive barrier are ‘‘evacuation from sinking vessel”, ‘‘rescue from sinking vessel and sea”, and ‘‘rescue from sunken vessel”. Seen from the energy-barrier perspective, strengthening these barrier functions can prevent similar accidents from occurring in the future. 4. Man made disasters (MMD) theory 4.1. Brief description of MMD theory The MMD theory is based on the idea that disasters and major accidents develop not through a single physical event, but through a long chain of events, related to lack of information flow and misperception among humans and organizations (Pidgeon and O’Leary, 2000; Rosness et al., 2010). Turner and Pidgeon (1997) emphasize that there is nearly always somebody in an organization who knows something about impending hazards, but the organization fails to take action on the hazard because of lack of information flow. The quality of the information flow is therefore significantly important to control risk and prevent disasters. The MMD model is composed of six stages: ‘‘notionally normal starting

point”, ‘‘incubation period with misperceptions and lack of information flow”, ‘‘precipitating event”, ‘‘onset”, ‘‘rescue, dealing with immediate problems”, and ‘‘full cultural readjustment” (Turner and Pidgeon, 1997). While ‘‘full cultural readjustment” is an important stage of the MMD theory, it is outside the scope of this article because it is not about causes of the accident, but what happens in society afterwards. 4.2. The accident viewed by MMD theory 4.2.1. Notionally normal starting point Rosness et al. (2010) describe this state as ‘‘culturally accepted as being advisable and necessary precautions to keep risks at an acceptable level”. In other words, we could also say that this means that there is a general belief that safety is well taken care of. Before the accident of the MV SEWOL, there were culturally held beliefs and regulations about hazards of passenger ships in Korea. The Ministry of Ocean and Fisheries issues licenses to operate ferries after a general safety evaluation and supervises safety inspections of the Korean Register of Shipping. The Korean Register of Shipping inspects and approves stability and safety of passenger vessels, and the Korea Coast Guard evaluates sailing management of vessels and supervises the Federation of Shipping Associations, which is in charge of safety check of vessels before departure (MINBYUN, 2014). 4.2.2. Incubation period with misperceptions and lack of information flow An unnoticed set of events, which are at odds with the culturally accepted beliefs about the hazards in Korea, were accumulated for several years. The Korean Register of Shipping did not identify the underestimated weight after the extension of the MV SEWOL, and the Ministry of Ocean and Fisheries failed to supervise it. Cursory safety inspections of the Federation of Shipping Associations were not noticed by the Korea Coast Guard. Consequently, the MV SEWOL operated with a stability problem (BAI, 2014). The captain and crew of the MV SEWOL knew this stability problem before the disaster, but this was not shared with the dominant decision makers. The former captain of the MV SEWOL ordered the crew to maneuver the vessel with less than 5° turns, because he knew that even slight course changes could cause excessive list of the vessel. Some crew members of the MV SEWOL had mentioned safety problems of overloaded and unsecured cargo several times before the disaster, but the Chonghaejin Marine Company ignored them and did not take proper measures to ensure the safety of the vessel (KMST, 2014). Many of the employees of Chonghaejin Marine Company knew about the overloading, unsecured cargo and stability problem of the MV SEWOL, but they could not take any safety measures because of the company culture. One of the employees testified, in a trial on 14th August 2014 in Kwangju District Court, that if he had restricted the voyage of the MV SEWOL because of safety problems, he would have been dismissed from the company (MINBYUN, 2014). It can also be argued that the crew members and employees of the ship owner should have taken action on this stability problem in spite of the rigid company culture, if they could have anticipated the disaster due to the stability problem. They might have ignored the stability problem because of ‘‘reluctance to fear the worst outcome”, which is one of the important reasons why knowledge is not shared (Turner and Pidgeon, 1997). 4.2.3. Precipitating event and onset For individuals and groups who share the culturally accepted beliefs about hazards of passenger vessels, capsizing of the MV SEWOL due to a sharp turn with stability problems was an unpredictable event; a precipitating event of the disaster. The

H. Kim et al. / Safety Science 82 (2016) 410–420

415

precipitating event was followed by the onset; unanticipated consequences due to the failure. The onset in the disaster of the MV SEWOL is that 304 passengers were not evacuated and trapped inside the sinking vessel. 4.2.4. Rescue, dealing with immediate problems The Korea Coast Guard and the government rescued none of the trapped passengers after the MV SEWOL sinking. While the failure to rescue is one of the critical causes of the high fatality number in the MV SEWOL disaster, the MMD theory does not seem to focus on that. This stage of Turner’s model focuses on rapid redefinitions of the situation and on the beginning of cultural readjustment to the precipitating event (Rosness et al., 2010; Turner and Pidgeon, 1997). The theory does not cover failure of rescue and the causes of this failure. 4.3. Concluding remarks on the MMD theory The MMD theory points us towards the fact that the captain, crew members and employees of the ship owner knew about the stability problem of the vessel during the incubation period. This means that there was someone who actually knew about the hazards, but the knowledge was not acted on because of the company culture which does not allow any critical safety concerns and the reluctance among people to fear the worst outcome. One weakness of this theory is that it pays little attention to the fact that rescue might fail. While the failure of the rescue operations led to the high fatality number in the accident of the MV SEWOL, the failure to rescue is not well defined in the MMD theory. 5. Conflicting objectives perspectives 5.1. Brief description of conflicting objectives perspectives Rasmussen (1997) points out that individuals and organizations are exposed to conflicting organizational pressures (e.g., finance or workload), which makes sociotechnical systems migrate toward the boundary of acceptable risk, as shown in Fig. 3. In a complex system, parallel activities with distributed decision making at many levels, from political systems to individual operators, may change the boundary of acceptable risk for another activity without noticing the change (Rasmussen, 1994; Rosness et al., 2010). Actors in the ‘‘sharp end” may strive for local optimization without realization of the movement of the boundary and cross over the boundary of risk (Rosness et al., 2010). 5.2. The accident viewed by the conflicting objectives perspectives The Korean government relaxed several safety regulations for coastal liners to invigorate the economy. In 2009, the limitation for age of coastal liners was extended from 25 years to 30 years, and the economic effect of this relaxation was estimated to 20.9 million USD per year by the government (MINBYUN, 2014; MLTM, 2008). The interval of the special safety inspection for old vessels was also extended from 15 years to 20 years in 2011 (MINBYUN, 2014). Considering the fact that the MV SEWOL was 18 years old when the ship owner purchased it from Japan, relaxation of these regulations might be relevant to the occurrence of the disaster. The ship owner, Chonghaejin Marine Company, focused on cost and operating efficiency. The Board of Audit and Inspection uncovered that Chonghaejin Marine Company overloaded the MV SEWOL and the MV OHAMANA in 56 out of 118 voyages from January 2014 to April 2014 (BAI, 2014). It has been confirmed in an audit report from the Financial Supervisory Service that the Chonghaejin Mar-

Fig. 3. Rasmussen’s migration model (Rasmussen, 1994).

ine Company, the ship owner, had spent only 0.001% of its total sales on training for its employees in 2013; about 3.8 USD6 per employee per year (MINBYUN, 2014). In addition, 15 of 29 crew members of MV SEWOL, including the captain, were temporary employees with low salary (MINBYUN, 2014). The captain and crew members of the MV SEWOL cannot avoid criticism for their irresponsible behavior, because they overloaded cargo and escaped first from the sinking vessel without any evacuation order for passengers. On the other hand, they were not trained for that kind of situation and experienced job instability with low wages, because the ship owner focused on cost and efficiency. The Korea Coast Guard was also affected by conflicting objectives. It was an unplanned rescue operation for Patrol Boat 123. Medium size patrol boats (over 200 ton) were originally scheduled to be mobilized in the area where the MV SEWOL sank, but all of the medium size patrol boats were mobilized in a special crackdown on illegal foreign fishing vessels. Therefore, a small size patrol boat, Patrol Boat 123 (100 ton), arrived first to the site and was the on-scene commander from 09:16 AM to 11:19 AM (BAI, 2014; MINBYUN, 2014). Conflicting objectives of the Korean government, the Korea Coast Guard, and the ship owner made the MV SEWOL migrate over the boundary of acceptable risk, and consequently, the disaster occurred. Lindblom (1959) emphasizes that creating independent institutions, ‘‘watchdogs”, to monitor safety performance is a common strategy for handling conflicting objectives (Rosness et al., 2010). There were several ‘‘watchdogs” for safety of coastal liners in Korea, but they failed to identify the hazardous situation, because they were not independent. The Ministry of Ocean and Fisheries and the Korea Coast Guard supervise the Korean Register of Shipping and the Federation of Shipping Associations, respectively. However, 10 out of 12 former chief directors of the Federation of Shipping Associations were from the Ministry of Maritime Affairs and Fisheries, and 2 out of 3 executive directors, at the time of the disaster, were former executives of the Korea Coast Guard and the Ministry of Maritime Affairs and Fisheries. 8 out of 12 former chief directors of the Korean Register of Shipping came from high-ranking government offices, including the Ministry of Maritime Affairs and Fisheries (MINBYUN, 2014). In addition, shipping companies pay labor costs and other shipping control costs for the Federation of Shipping Associations, which supervises the safety of shipping companies (BAI, 2014). Dependency between these organizations hindered proper supervision of the safety performance of the MV SEWOL. 6

4584 KRW (exchange rate on 2nd February 2015; 1 USD is 1192 KRW).

416

H. Kim et al. / Safety Science 82 (2016) 410–420

5.3. Concluding remarks on the conflicting objectives perspective From the conflicting objectives perspectives point of view, the accident occurred because of economic pressure, unacceptable work load and lack of independent watchdogs. Relaxation of safety regulations by the government, cargo overloading, lack of safety training and job instability by the ship owner are caused by economic pressure. Unacceptable workload led to mobilization of every medium size patrol boat in another operation. All of these pressures and workload were not detected among others because watchdogs were dependent on each other. 6. High reliability organizations (HRO) theory 6.1. Brief description of HRO theory The main difference between the previous perspectives and the HRO theory is that the HRO theory explains ‘‘why so few serious accidents actually occur” instead of ‘‘why accidents occur” (Rosness et al., 2010). Because of this, we need to look for evidence that HRO characteristics were lacking or missing in the involved organizations. LaPorte and Consolini (1991) emphasize that HROs achieve reliable organizations from less than perfectly reliable human beings by building redundancy, and Rosness et al. (2000) terms this capability as ‘‘organizational redundancy” (Rosness et al., 2010). Spontaneous reconfiguration of the organization is another important aspect of HRO. While Perrow (1984) claims that an organization cannot be both centralized and decentralized at the same time, this capability of reconfiguration enables HROs to be centralized and decentralized, depending on the situation (LaPorte and Consolini, 1991). Weick and Sutcliffe (2001) suggest the notion of ‘‘mindfulness” with five elements as prominent characteristics of HROs; preoccupation with failure, reluctance to simplify interpretations, sensitivity to operations, commitment to resilience, and deference to expertise. The first three elements are classified as ‘‘anticipation and awareness of the unexpected” and the last two elements as ‘‘contain the unexpected”. 6.2. The accident viewed by HRO theory According to KOSTAT (2014), there have been about 1000 shipwrecks every year since 2007, and almost 99% of the persons have survived and have successfully been rescued. If the Korea Coast Guard and the ship owner were HROs, they could learn free lessons7 from those normal (successful) rescue operations and detect early problems before they became too substantial, which is relevant to ‘‘sensitivity to operation”. Therefore, the Korea Coast Guard had to train their crew members for rescue operations and secure enough patrol boats for each area, and the ship owner should have paid more attention to the safety training; ‘‘preoccupation with failure”. However, the Korea Coast Guard mobilized all of the medium size patrol boats from the site before the accident for another operation (see Section 5.2). The captain of Patrol Boat 123 testified, on the trial on 13th August 2014, that he has worked for Korea Coast Guard for 34 years, but he had never been trained in a rescue operation for a sinking vessel (MINBYUN, 2014). Moreover, Chonghaejin Marine Company spent a low amount of money for the training of their employees (see Section 5.2). The former captain of the MV SEWOL ordered the crew members to maneuver the vessel with less than 5° turns, because he knew the stability problem of the vessel, which means that they

7 Deficiencies reveled by normal operation before problems become too substantial (Weick and Sutcliffe, 2001; Rosness et al., 2010).

have learned a free lesson from normal operation; ‘‘sensitivity to operation”. If the Chonghaejin Marine Company was a HRO, it should anticipate the worst accident case and take action on that problem; ‘‘preoccupation with failure”. However, the captain and crew members took no action and even overloaded MV SEWOL. All of the captain, crew members, employees of the ship owner, and the Korea Coast Guard failed to anticipate that severe consequences could occur if several separate, small errors happened to coincide. The officer of the Federation of Shipping Associations had checked the draft of the MV SEWOL through his telescope about 100 m away before departure and concluded that the vessel was not overloaded. He did not realize that the captain deceived him by draining ballast water from the vessel (KMST, 2014). The simplification of inspection for cargo overloading had produced a blind spot, and consequently, this made the officer of the Federation of Shipping Associations fail to detect overloading, which was one of the most critical causes of the disaster; ‘‘reluctance to simplify interpretations”. If the captain and crew members are a HRO, they should have an ability to control the situation and help passengers to evacuate from the sinking vessel during the capsizing of the MV SEWOL; ‘‘commitment to resilience”. However, they did not. The captain and crew members of the MV SEWOL escaped first from the sinking vessel without any evacuation order to passengers (see Section 3.2). This is also relevant to ‘‘deference to expertise”. During the listing of the MV SEWOL, decisions for evacuation were migrated to the captain of the vessel who was in the very front line. Jindo VTS ordered the captain to judge the situation and decide for himself whether to extricate passengers or not, because the captain ‘‘knows the situation best” (KMST, 2014). However, the captain did not take any measures and escaped first from the vessel, while most of the passengers were staying inside their cabins. We can find one important factor that might be overlooked by the HRO theory; persons in the sharp end might be unexperienced or unprepared. Personnel in the front line should be experts who have experience and ability to handle the situation, and the organization must monitor and judge their expertise before giving responsibilities for decision making. Migration of decisions to ‘‘unqualified personnel” can be more dangerous than centralized decisionmaking, as proved in this disaster. After the capsizing of the MV SEWOL, the Koran Government had no ability to control the situation and rescue passengers from the sunken vessel; ‘‘commitment to resilience”. As previously mentioned, 10 countermeasure headquarters were established by various kinds of government organizations to control the disaster after the MV SEWOL had capsized (MINBYUN, 2014), and each headquarter announced different rescue operation results and different numbers of persons on-board and rescued (BAI, 2014). Un-unified headquarters caused inefficiency and confusion in the rescue operation. For example, Mokpo Coast Guard commanded the Underwater Rescue Team 122 to ride a fishing boat from the port to the site, while there was a patrol ship in the port. The patrol ship arrived at 11:00 AM at the site, and the underwater rescue team arrived at 12:19 (BAI, 2014). Another example is inappropriate commands from the Korea Coast Guard. The Korea Coast Guard commanded Mokpo Coast Guard and West Regional Coast Guard that ‘‘the passenger vessel has its own buoyancy, and therefore, keep your composure and rescue” at 10:17 AM, while the MV SEWOL listed 108.1° and all of the entrances and decks were already flooded at that time. 7 min later, at 10:24 AM, the Korea Coast Guard commanded Patrol Boat 123 to enter into the MV SEWOL and induce passengers to evacuate, but it was impossible to enter into the vessel at that time, and the MV SEWOL utterly capsized 7 min after the command. The Korea Coast Guard was not resilient enough to rescue the large number of passengers from the sinking vessel.

417

H. Kim et al. / Safety Science 82 (2016) 410–420

6.3. Concluding remarks on HRO theory If the crew members, ship owner, and the Korean Government were HROs, they should have learned free lessons from normal operation and anticipated the accident situation. Although they failed to do this, they should have had an ability to prevent the situation from getting out of control after something had started to go wrong. However, the captain and crew members failed to extricate passengers from the sinking vessel, and the Korean Government failed to rescue passengers from the sunken vessel. To summarize, they failed to both anticipate and contain the unexpected events.

Table 4 Causes of the accident in different perspectives point of view. No

Theory

Cause

Remarks

E1

Energybarrier Energybarrier Energybarrier Energybarrier Energybarrier Energybarrier Energybarrier MMD

Loss of inherent stability

Failure of proactive barrier Failure of proactive barrier Failure of proactive barrier Failure of proactive barrier Failure of reactive barrier Failure of reactive barrier Failure of reactive barrier Lack of information flow

E2 E3 E4 E5 E6

7. Results and discussion 7.1. Results Each perspective on major accidents describes the disaster of the MV SEWOL focusing on different aspects. The Energy-barrier model indicates that there were proactive and reactive barriers to prevent the disaster, and failure to establish and maintain adequate barrier functions caused the large number of fatalities. According to the MMD theory, an incubation period with lack of information flow led to the disaster, and the conflicting objectives perspective finds causes to the accident from the economic pressure, unacceptable workload and lack of independent watchdogs. The HRO theory concludes that failure to anticipate the unexpected events and the ability to handle the unexpected events are the main cause of the disaster. The results are summarized in Table 4, and it shows that different perspectives highlight different causes of the disaster. Focusing on only one perspective may therefore make us omit some critical causes of the accident. The results show two main limitations with the MMD model and the HRO theory. The HRO theory emphasizes that personnel with the most expertise in the front line should make decisions in case of accident or accident expected situations, which is defined as ‘‘high-tempo mode” in the theory. However, migration of decisions to the front line might be much more dangerous than centralized decision making, if the organization fails to identify the fact that the personnel in the front line are not experts and lack the ability to handle the situation, like in the disaster of the MV SEWOL. The MMD model focuses mainly on information flow in the incubation period and seems to overlook possible problems in rescue stage. Rescue might be imperfect and, sometimes, it can be one of the most critical causes of the disaster as proved in the MV SEWOL accident. 7.2. A combined theoretical approach for accident investigation While every perspective describes the causes of the accident in their own way, some of them are complementary to other perspectives. For example, the Energy-barrier model points out that the barrier-sub function ‘‘prevent cargo overloading” was impaired, and it led to capsizing of the vessel. The conflicting objectives perspective explains that the ship owner overloaded the MV SEWOL repeatedly because of economic pressure. The MMD model claims that many of the crews and employees of the ship owner knew the problem, but the company culture prevented them from correcting it. The HRO theory points out that the crew members overloaded cargo because they failed to anticipate potential failures, and simplified interpretation prevented the officer of FSA from identifying the overloading. These relations between the theories and models are illustrated in Fig. 4. The Energy-barrier model provides an explicit view of how the cargo overloading contributes to the accident development, while the MMD model, conflicting objectives perspective, and the HRO theory support the Energy-barrier model

E7 M1

C1 C2

C3 C4

Conflict objectives Conflict objectives Conflict objectives Conflict objectives

Cargo overloading Lack of ballast water Unsecured cargo Failure to evacuation from sinking vessel Failure to rescue from sinking vessel Failure to rescue from sunken vessel Captain, crew members and employees knew the stability problem, but the information was not shared Relaxation of safety regulation Ship owner focuses on economy (cargo overloading, lack of safety training) Mobilization of medium size patrol boats Pressures and workload could not be detected before the accident Korean Government and ship owner failed to learn from lots of shipwrecks Lack of rescue training for Patrol Boats Mobilization of medium size patrol boats Lack of safety training for crew members of the MV SEWOL Crew members knew the stability problem, but took no action

H1

HRO

H2

HRO

H3

HRO

H4

HRO

H5

HRO

H6

HRO

H7

HRO

H8

HRO

H9

HRO

H10

HRO

Cargo overloading of the MV SEWOL FSA failed to detect cargo overloading Captain and crew members escaped without evacuation order Decision was moved to unprepared captain Un-unified headquarters

H11

HRO

Inappropriate commands

Financial pressure Financial pressure

Workload Dependent watchdog

Sensitivity to operations Preoccupation with failure Preoccupation with failure Preoccupation with failure Sensitivity to operations & preoccupation with failure Preoccupation with failure Reluctance to simplify Commitment to resilience Deference to expertise Commitment to resilience Commitment to resilience

by identifying performance influencing factors (PIFs).8 The combination of all of the perspectives can help us understand the entire sequence and causes of the accident when we investigate an accident. 7.3. A combined theoretical approach for accident prevention The main difference between accident investigation and accident prevention is whether it is in hindsight or in foresight. We need to analyze only one accident scenario when we investigate an accident in hindsight, while lots of scenarios should be analyzed for accident prevention in foresight. The Energy-barrier model provides a clear view of the accident sequence of events, and 8 Conditions which are significant for the ability of barrier functions and elements to perform as intended (Petroleum Safety Authority Norway, 2013).

418

H. Kim et al. / Safety Science 82 (2016) 410–420

Fig. 4. Combination of perspectives (refer to Table 4 for the letters).

Fig. 5. Combination of accident theories.

therefore, we can prevent accident scenarios from occurring efficiently and effectively with the energy-barrier model. However, this is restricted to specific accident scenarios; the Energy-barrier model developed in Section 3.2 is relevant for ships capsizing after a sharp turn only. A ship collision, grounding, fire and other accident scenarios cannot be covered with this model. ‘‘Prevent cargo overloading”, for example, cannot prevent a fire on the vessel. We therefore need to develop every single accident scenario to prevent accidents. Unfortunately, it is impossible for us to develop all kinds of accident scenarios. Some might not be identified, and others might be excluded because they have low risk. Fig. 5 shows an example with 10 accident scenarios identified, and each scenario has its own risk. Then the best situation would be to have enough resources to establish barriers for all 10 accident

scenarios and reduce risk as much as possible. However, the reality is not so ideal. We have limited resources, and establishing barriers for low-risk accident scenarios may be inefficient and costly. What we can do with the energy-barrier model is to prioritize the scenarios and establish barriers for the critical accident scenarios to meet the acceptable risk level, which means that we do nothing for lowrisk accident scenarios and unidentified accident scenarios. Another option to prevent accidents is to improve overall performance of the organization through the MMD theory, the conflicting objectives perspective and the HRO theory. The strength of this option is that improving the overall performance of the organization can be helpful for preventing many accident scenarios simultaneously, even for the unidentified scenarios. Improving the ability to handle unexpected events in light of the HRO theory, for

H. Kim et al. / Safety Science 82 (2016) 410–420

instance, can contribute to preventing not only fatalities after capsizing, but also fatalities after fire, grounding, collision, etc. Therefore, it seems that improving the overall performance of the organization is more efficient than building barriers to prevent accidents. However, this is a too simplified view. Sometimes establishing specific barrier can be more effective; for instance, installing automatic sprinkler system may be more effective for preventing escalation of fire than improving performance of the organization without sprinkler systems. To summarize, the energy-barrier model is efficient for preventing specific critical scenarios, while the other three theories may cover all accident scenarios including unidentified ones through improving the performance of the organization. Therefore, the combination of the four perspectives may be useful in accident prevention. We first identify critical accident scenarios and establish barriers for those scenarios. At the same time, we can improve the overall performance of the organization to cover low-risk scenarios and unidentified scenarios through the MMD theory, the conflicting objectives perspective and the HRO theory. As a result, we can prevent critical accident scenarios, low-risk scenarios and unidentified scenarios all together in efficient and an effective way. This combination is illustrated in Fig. 5. 7.4. Other accident theories and the accident of the MV SEWOL This article has focused on four selected accident theories to explain the disaster of the MV SEWOL. It is also interesting to comment on the accident in view of Diane Vaughan’s ‘‘normalization of deviance” (Vaughan, 1996) and the recent book by Donald Palmer about ‘‘organizational wrongdoing” (Palmer, 2012). Vaughan used the Challenger accident to illustrate how behavior which in isolation and in hindsight is unacceptable, can be regarded as normal within an organization. Slowly, ‘‘deviant” behavior may develop in this way. Palmer also points to deviant behavior, but focuses specifically on behavior which can be regarded as ‘‘wrongful”. This may be seen as a more restrictive definition than Vaughan uses. When deviant behaviors occur frequently over many years without an accident, people in the organization begin to believe that these violations are expected and therefore acceptable (Prielipp et al., 2010; Vaughan, 1996). In the accident of the MV SEWOL, the vessel was overloaded with cargo more than twice of the recommended amount, and the captain drained ballast water to conceal the overloading (see Section 3.2). This violation occurred frequently over a long period of time without any major accidents, and the people in the organization became accustomed to cargo overloading with discharging ballast water, despite the fact that the deviant behavior reduces the stability of the vessel, significantly. Cargo overloading became ‘‘normalized” to the captain and crewmembers of the MV SEWOL, and therefore, the former captain ordered the crewmembers to maneuver the vessel less than 5° turns without taking any proper measures for the stability problem (see Section 6.2). The overloading and draining of ballast water can both be regarded as examples of ‘‘wrongful” behavior, meeting Palmers definition. In his book, Palmer (2012) introduces eight explanations to understand the causes of organizational wrongdoing: a rational choice, culture, ethical decisions, administrative systems, situational social influence, the power structure, accident wrongdoing, and the social control of organizational wrongdoing. Some of the eight explanations can be used to investigate wrongdoings of the disaster of the MV SEWOL. For instance, the vessel was overloaded because the ship owner focused on cost and operating efficiency (see Section 5.2). This behavior is a ‘‘rational choice” to the ship owner because the ship owner could create additional profit through overloaded cargo. In order to avoid being discharged, the captain and crew members of the MV SEWOL had no choice but

419

to overload cargo and risk their own lives (see Section 4.2), which is introduced as ‘‘the power structure” in Palmer’s explanation. Regardless of their inclinations to engage in wrongdoing, the captain and crew members still engaged in wrongdoing. A comprehensive review of the accident in view of Vaughans and Palmers theories have not been performed, but these small examples serve to illustrate even more clearly how use of different perspectives can provide a new understanding of an accident. 8. Concluding remarks This article has investigated the MV SEWOL accident using different accident theories and found a total of 23 causes that contributed to the accident; 7 is identified when applying the energybarrier model, 1 from the MMD theory, 4 from the conflicting objectives perspective, and 11 causes from HRO theory. The results indicate that the disaster was not caused by a single human error nor by a single technical error, but by a combination of failures of the entire organizations, including the shipping company and the government-affiliated organizations. To prevent similar disasters from occurring, all the relevant organizations must make an effort to enforce and implement organizational barriers relevant to specific critical accidents, improve information flow, establish independent watchdogs for conflicting objectives, and contain ‘‘mindfulness” in the organizations, instead of focusing on superficial causes. Strengthening several regulations or punishing persons at the sharp end only cannot prevent the same or similar disasters as the MV SEWOL. The result of the analysis in the article also shows that while each perspective describes the accident in their own way, they complement each other, at least for this particular accident. Each perspective has its own benefits, and the combination of them might be more efficient than focusing only on one perspective. When we investigate the accident, the energy-barrier model can describe the entire sequence of the accident, and the three other perspectives supports the energy-barrier model through identifying performance influencing factors (PIFs). From an accident prevention point of view, the energy-barrier model is useful for specific accident scenarios, and the others can improve the entire performance of organizations to prevent low-risk scenarios and unidentified scenarios. Therefore, this article emphasizes the necessity for combining these perspectives to improve the understanding and the prevention of major accidents. This combination can help us distribute our limited resource efficiently to understand and prevent major accidents. Developing an integrated model of major accidents is subject to future work. Acknowledgements One year after the accident, the parents and families of the victims still require a thorough investigation of this accident. The authors sincerely hope that this thorough investigation will be realized to prevent similar disasters from recurring, and honor the memory of 314 passengers, including 9 missing persons of the MV SEWOL. Also, thank you to the anonymous reviewers who suggested improvements to the article. References Agent, K.R., Deacon, J.A., Pigman, J.G., Stamatiadis, N., 1994. Evaluation of advanced surveying technology for accident investigation. Kentucky Transportation Center Research Report. Paper 433, (20.02.2015). BAI, 2014. [Accident responses to SEWOL Ferry and actual conditions of safety management and supervision for coastal liners] (in Korean). The Board of Audit and Inspection (BAI) of Korea, Seoul, South Korea,
420

H. Kim et al. / Safety Science 82 (2016) 410–420

bai/cop/bbs/detailBoardArticle.do?mdex=&bbsId=BBSMSTR_100000000009& pageIndex=1&tabOkFlag=&nttId=1673> (20.02.2015). Benner Jr., L., 1985. Rating accident models and investigation methodologies. J. Safety Res. 16 (3), 105–126. Ferry, T.S., 1988. Modern Accident Investigation and Analysis. John Wiley & Sons, New York. Gibson, J.J., 1961. The contribution of experimental psychology to the formulation of the problem of safety – a brief for basic research. Behavioral Approaches to Accident Prevention. Association for the Aid of Crippled Children, New York, pp. 77–89. Haddon, W., 1970. On the escape of tigers: an ecologic note. Am. J. Public Health 60 (12), 2229–2234. Haddon, W., 1980. The basic strategies for reducing damage from hazards of all kinds. Hazard Prevent. 16 (11), 8–12. Herrera, I.A., Woltjer, R., 2010. Comparing a multi-linear (STEP) and systemic (FRAM) method for accident analysis. Reliab. Eng. Syst. Safety 95 (12), 1269– 1275. Hollnagel, E., 2004. Barriers and Accident Prevention. Ashgate, Aldershot, UK. Hollnagel, E., 2008. Risk + barriers = safety? Safety Sci. 46 (2), 221–229. Hollnagel, E., Speziali, J., 2008. Study on Developments in Accident Investigation Methods: a Survey of the ‘‘state-of-the-art”. SKI Report 2008:50, SKI, (15.04.2015). Hopkins, A., 2014. Issues in safety science. Safety Sci. 67, 6–14. Katsakiori, P., Sakellaropoulos, G., Manatakis, E., 2009. Towards an evaluation of accident investigation methods in terms of their alignment with accident causation models. Safety Sci. 47 (7), 1007–1015. Kim, H., Haugen, S., 2015. Titanic viewed from different perspectives on major accidents. In: Proceedings of the 24th European Safety and Reliability Conference (ESREL 2014): 14–18 Sep 2014. Taylor and Francis, Wroclaw, Poland. Kjellen, U., 2000. Prevention of Accidents through Experience Feedback. Taylor and Francis, London. KMST, 2014. [Investigation report of the capsizing of the MV SEWOL] (in Korean). Korean Maritime Safety Tribunal (KMST), Seoul, South Korea, (10.02.2015). KOSTAT, 2014. [Statics of shipwreck] (in Korean). Statistics Korea (KOSTAT), Daejeon, South Korea, (18.02.2015). LaPorte, T., Consolini, P., 1991. Working in practice but not in theory: theoretical challenges of ‘‘high-reliability organizations”. J. Public Admin. Res. Theory 1 (1), 19–47. Le Coze, J.C., Dupre, M., 2006. How to prevent a normal accident in a high reliable organisation: the art of resilience, a case study in the chemical industry. In: Proceedings of the Second Resilience Engineering Symposium: Paris, France. Lehto, M., Salvendy, G., 1991. Models of accident causation and their application: review and reappraisal. J. Eng. Technol. Manage. 8 (2), 173–205. Lindblom, C.E., 1959. The science of muddling through. Public Admin. Rev. 19, 79– 88. Lundberg, J., Rollenhagen, C., Hollnagel, E., 2009. What-you-look-for-is-what-youfind: the consequences of underlying accident models in eight accident investigation manuals. Safety Sci. 47 (10), 1297–1311. MINBYUN, 2014. 416 [MV SEWOL – Documentation by Lawyers for a Democratic Society (MINBYUN)] (in Korean). Beautyful People, GyeongGi-Do, Korea.

MLTM, 2008. [Research for the improvement of age limitation of coastal liners] (in Korean). Ministry of Land, Transport and Maritime Affairs (MLTM) of Korea, South Korea, (15.02.2015). Palmer, D., 2012. Normal Organizational Wrongdoing. Oxford University Press, Oxford, UK. Perrow, C., 1984. Normal Accidents. Basic Books, New York. Petroleum Safety Authority Norway, 2013. Principles for Barrier Management in the Petroleum Industry. Petroleum Safety Authority, Norway, (17.06.2015). Pidgeon, N., O’Leary, M., 2000. Man-made disasters: why technology and organizations (sometimes) fail. Safety Sci. 34 (1–3), 15–30. Prielipp, R.C., Magro, M., Morell, R.C., Brull, S.J., 2010. The normalization of deviance: do we (un) knowingly accept doing the wrong thing? Anesth. Analg. 110 (5), 1499–1502. Rasmussen, J., 1994. Risk management, adaptation, and design for safety. In: Sahlin, N.E., Brehmer, B. (Eds.), Future Risks and Risk Management. Kluwer, Dordrecht. Rasmussen, J., 1997. Risk management in a dynamic society: a modelling problem. Safety Sci. 27 (2), 183–213. Rausand, M., 2011. Risk Assessment; Theory, Methods, and Applications. Wiley, Hoboken, NJ. Rochlin, G.I., La Porte, T.R., Roberts, K.H., 1987. The self-designing high-reliability organization: aircraft carrier flight operations at sea. Naval War Coll. Rev. 40 (4), 76–90. Rosness, R., Grøtan, T.O., Guttormsen, G., Herrera, I.A., Steiro, T., Størseth, F., Tinmannsvik, R.K., Wærø, I., 2010. Organisational Accidents and Resilient Organisations: Six Perspectives Revision 2 (SINTEF Report). Rosness, R., Håkonsen, G., Steiro, T., Tinmannsvik, R.K., 2000. The vulnerable robustness of high reliability organisations: a case study report from an offshore oil production platform. Paper presented at the 18th ESReDA seminar Risk Management and Human Reliability in Social Context, Karlstad, Sweden, 15–16 June, 2000. Saleh, J.H., Marais, K.B., Bakolas, E., Cowlagi, R.V., 2010. Highlights from the literature on accident causation and system safety: review of major ideas, recent contributions, and challenges. Reliab. Eng. Syst. Safety 95 (11), 1105– 1116. Seo, B. ... - [UNDINE received illegal business favor... It has been confirmed that there was a cozy relations between Korea Coast Guard and UNDINE] (in Korean). JTBC 6 Oct 2014. (10.02.2015). Sklet, S., 2004. Comparison of some selected methods for accident investigation. J. Hazard. Mater. 111 (1–3), 29–37. Sklet, S., 2006. Safety barriers: definition, classification, and performance. J. Loss Prevent. Process Ind. 19 (5), 494–506. Turner, B.A., Pidgeon, N.F., 1997. Man-made Disasters. Butterworth-Heinemann, Oxford. Vaughan, D., 1996. The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA. University of Chicago Press, Chicago. Weick, K.E., Sutcliffe, K.M., 2001. Managing the Unexpected. Jossey-Bass, San Francisco. Yang, X., Haugen, S., 2014. A fresh look at barriers from alternative perspectives on risk. Paper presented at the Probabilistic Safety Assessment and Management. Hawaii, USA, 22–27 June, 2014.