From the magazine – Nowadays, there is zero tolerance by the public for accidents in ports that involve loss of life and damage to critical infrastructure. The two most recent examples of the potential catastrophic consequences of maritime pilotage accidents are the collapse of the Genoa Pilots Tower (2013) and the Baltimore Francis Scott Key Bridge (2024).
This article first appeared in SWZ|Maritime’s July/August 2025 nautical developments special. It was written by Antonio Di Lieto, former shipmaster and hydrographer, now Manager of Simulation Studies at CSMART (Center for Simulator Maritime Training, Carnival Corporation), adilieto@carnival.com.
Nine people and six people respectively lost their lives in the two accidents mentioned above, both linked to a loss of propulsion of the container ships Jolly Nero and Dali in proximity to critical infrastructure.
Normal accidents. This is how sociologist Charles Perrow would have defined these two events, arguing that modern industrial and transport systems are so complexly interactive and tightly coupled that they make large-scale accidents inevitable, even “normal.” That is, sooner or later, an unforeseen combination of failures will cause cascading effects without the possibility of recovery.
In the early eighties, Perrow described marine transport as an error-inducing system where the tendency to blame operators is particularly prominent. Many would argue that this is still the case today, in an industry whose operating culture is heavily influenced by the longstanding and deep-rooted provision in charter parties of “proceeding with utmost dispatch”.
With all that said, does the adoption of the “normal accident theory” necessarily mean pessimistic resignation in the face of catastrophic accidents, such as the ones that occurred to the Jolly Nero and Dali crews?
Also read: SWZ|Maritime’s July/August 2025 issue: Nautics and the biggest nautical event SAIL
Fixing the system without making it worse
In Perrow’s own words, at the very least, we should work to stop blaming the wrong people and the wrong factors and stop trying to fix the system in ways that only make it riskier. One way to fix the system without making it worse is to reconsider its risk management philosophy and challenge the traditional idea that risk can be calculated based on the probability of an unwanted event and the severity of its potential consequences.
The Jolly Nero judgment is a demonstration of how quantitative risk analyses might not be defensible in a criminal court of law. During the criminal trial that followed the Jolly Nero accident, the shipping company claimed that the cases of engine start failure constituted only 0.0044 per cent of the total number of starts during manoeuvres in port. The estimate was based on the number of similar ships to the Jolly Nero and the number of voyages made.
This argument was rejected by the judge, who maintained that even when the cases are in the order of one or two per year and not always for the same ship, we are in the presence of situations that cannot but be considered “risky”. That is to say, manoeuvring a ship in confined water is always high risk, period.
Also read: Shipping risks in packed North Sea poorly understood
Precautionary risk management
If we take this as a starting point, we should abandon the traditional heat maps with green, yellow, and red used for risk assessments and look for all the “precautions” that are reasonably practicable, regardless of the level of risk. This is a paradigm shift for the maritime industry, where decision-making on the adoption of risk control measures is presently based on the idea that risk can be quantified and reduced to a level that is tolerable compared to a predefined maximum threshold.
The goal of “precautionary risk management” is instead to identify all precautions that are technically feasible for each of the credible hazardous conditions, such as manoeuvring a ship in close proximity to critical infrastructure. Once all possible precautions have been identified, the time comes to decide which of these should be implemented by evaluating their reasonableness. A reasonable precaution is a precaution that can be achieved through efforts and/or costs that are sustainable and proportionate to the potential consequences of an accident.
The decision-making on precautions outlines the main conceptual difference between the precautionary and probabilistic risk management approaches. The precautionary approach – known as SFAIRP (So Far As It is Reasonably Practicable) – leads to considering good practice and adopting all reasonable precautions, regardless of minimum levels of risk. The probabilistic approach – known as ALARP (As Low As it is Reasonably Practicable) – instead could lead to the discarding of some risk control measures only because they are below a risk threshold considered acceptable.
The United Kingdom government Health and Safety Executive (HSE) seems to be in favour of the precautionary approach (SFAIRP) when it calls for importance to be given to the use of operational practices and technical solutions to avoid accidents with potentially serious consequences, even if a given event is considered unlikely. The same HSE admits that in complex and high-risk contexts, adopting good practice alone may not be enough to comply with the law.
Specifically, HSE advises that once the type of good practice relevant to a specific situation has been identified, it is always necessary to question if there are other precautions that could be effective to further reduce the risk, and that these additional precautions need to be evaluated before their implementation to determine whether they are reasonable.
Different approach to risk management
The same is true in Australia, where quantitative analyses carried out to meet acceptable levels of risk have never passed the scrutiny of the courts after an accident. The present Australian safety legislation calls for a different approach to risk management. This is an approach that requires the adoption of all precautions that are reasonably practicable, according to the SFAIRP principle.
The difference between SFAIRP and ALARP is not semantic, but substantial. Adopting the ALARP principle means deciding what precautions to take based on the probability of future events and the estimation of potential consequences. This means accepting the idea that the level of risk can be measured in the same way that other production parameters are measured. This is an idea that, especially in “high-risk” operational contexts such as maritime pilotage, is only an illusion.
‘Risk is not a scientific concept or a physical quantity that can be measured. If it were, two risk management experts would always have to come to the same conclusions. But this never happens,’ maintains Richard Robinson, an Australian engineer who has devoted his career to implementing the precautionary approach in safetycritical contexts, including several Australian and New Zealand ports, articulating the process into the following steps:
- Identification of hazardous conditions.
- Search for all possible precautions.
- Choice of reasonable precautions.
- Implementation of reasonable precautions.
Also read: Shipping losses hit all-time low despite increasing risks
New terminology
The SFAIRP approach is associated with different terminology. For example, “risk control measures” are replaced by “reasonable precautions,” which is an admission of the impossibility of controlling the risk in a scientific way and the impossibility of aiming at the ideal of “zero accidents.” In fact, the assumption of the precautionary approach is that a “normal accident,” as Perrow would call it, can still occur, even when everything that was reasonable to do to prevent it has been done.
The lack of homogeneity in language associated with different risk management approaches reflects the presence of ongoing changes that often occur unevenly. It can happen that, at a given time, new and more convincing theories prevail, but they can coexist for a given period with the outdated ones. That is why, if differences exist, it might be wise to use the terminology used in laws, rather than the terms adopted by industry organisations or regulatory bodies.
The UK HSE acknowledges that SFAIRP is the term most often used in the Health and Safety Work Act and regulations, while ALARP is used by operators. However, the HSE itself points out that if you must write legal documents, you must use the correct SFAIRP term.
Stop blaming the wrong people
To deal with the increasing level of scrutiny by the courts and by an increasingly intolerant public opinion, in the event of large-scale accidents such as the ones that occurred to the Jolly Nero in 2013 and to the Dali in 2024, port authorities, shipping companies, pilotage organisations, masters, officers, and pilots must be able to demonstrate that they have done everything possible to prevent it.
And, after that, stop blaming the wrong people and stop trying to fix the system in ways that only make it riskier.
References
- Australian Work Health and Safety Act, No. 137 (2011)
- Di Lieto, A. (2022), Diligent Pilotage, Il Grande Gioco
- Perrow, C. (1984), Normal Accidents, Princeton University Press
- Robinson, R., & Francis, G. (2019), Engineering Due Diligence, ed. 11, R2A Pty Ltd
- UK Health and Safety at Work etc. Act (1974)
- UK Health and Safety Executive (2003), Assessing compliance with the law in individual cases and the use of good practice, retrieved from www.hse.gov.uk
Picture: The container ship Dali allided with the Francis Scott Key Bridge in Baltimore, which then collapsed (US Coast Guard photo by Petty Officer 3rd Class Kimberly Reaves).
