Version classiqueVersion mobile

Proceedings of the fourth Resilience Engineering Symposium

Erik Hollnagel
Éric Rigaud
Denis Besnard

Learning From The Past For Pro-activity – A Re-analysis Of The Accident Of The MV Herald Of Free Enterprise

Gesa Praetorius, Monica Lundh et Margareta Lützhöft


On the evening of the 6th of March, 1987, the Roll on/Roll off Ferry Herald of Free Enterprise left the berth in the port of Zeebrugge at 18.05 and capsized about 20 minutes later. 188 people died in this tragic event. A formal investigation report concluded that both the crewmembers and the shipping company were to be held responsible for the outcome. Although the shipping company was considered partly accountable, the investigation based its result on a rather person-centered view on how accidents occur. This perspective on accidents, being the outcome of a chain of events leading to an unwanted consequence, has been challenged during the past 20 years by several researchers. This article re-analyzes this specific accident from a systemic perspective. Functional Resonance Analysis Method (FRAM) is used to shed new light on what may have cause the ship to capsize. In addition, we discuss whether results from accident analysis can be used to develop pro-active measures for the safe operation of ships.

Note de l’auteur

Note portant sur l’auteur1

Note portant sur l’auteur2

Note portant sur l’auteur3

Texte intégral


1On the evening of the 6th of March, 1987, the Roll on/Roll off Ferry Herald of Free Enterprise left the berth in the port of Zeebrugge at 18.05. She was manned with 80 crewmembers, carried 81 cars, 47 freight vehicles, two or three other vehicles and 459 passengers. About 20 minutes after her departure, the ferry passed the outer mole and capsized minutes later. 150 passengers and 38 crewmembers died in the accident (Department of Transport, 1987).

2The formal investigation report concluded that several crewmembers seriously neglected their duties and thereby contributed to the casualty. Furthermore, the report emphasized the responsibility of the shipping company for the outcome of the event (Department of Transport, 1987). It was the first time an accident investigation in the shipping domain took into account that whatever happens on board is a reflection of company policies and enforcements of those policies. It was concluded that the shipping company “Townsend Car Ferries Limited” also had to be held accountable for the accident as they had not taken appropriate actions concerning the safety and safe operation of their vessel (Department of Transport, 1987).

3In the aftermath of this accident, one of the major safety instruments in the shipping domain was developed, the International Safety Management Code (ISM Code). It was adopted by the International Maritime Organisation (IMO) in 1993 (IMO, 2010). The objectives of the code are safety at sea, safe management and the avoidance of damage to the marine environment (Trafford, 2009). This code is seen as one of the major safety instruments since it emphasizes the impact of organizational factors (mainly shore-made arrangements) on the safe operation of ships (J.U. Schröder-Hinrichs, 2010). However, according to our opinion, it offers insufficient advice concerning the pro-active safety management.

4During the 23 years since the Herald of Free Enterprise capsized, there has been a major development in the area of accident analysis. A large body of literature (Amalberti, 2001; Dekker, 2004; Hollnagel, 2004) suggests that there is a need for new accident models in order to understand concepts such as “accident” and “incident” and their relation to safety as a emergent system property. Moreover, a turn from a person-centred perspective, focusing on single events and human errors, to a system-centred perspective (Holden, 2009) will construct an in-depth understanding of why accidents occur, and to efficiently introduce pro-active safety measures.

5The methods used at the time of the accident with Herald of Free Enterprise did not incorporate a systemic perspective. The analysis of this particular accident became a pioneering-work enhancing the responsibilities of the shipping companies (IMO, 2010). During recent years, systemic accident analysis methods have been developed (Leveson, Dulac, Marais, & Carroll, 2009; Stoop & Dekker, 2009). The topic of this paper is to investigate if a re-analysis, using a method with a systems perspective, can shed new light on the events that led to the capsizing of the vessel. The aim is to apply a systemic accident model on the data obtained from the accident investigation report. The following questions are the focus of this study:

  1. Can a re-analysis with a systemic methodology lead to new conclusions on what caused this event?

  2. Can results of accident investigations be used to develop pro-active safety measures in the shipping domain?


6This article performs a re-analysis of the accident of the Herald of Free Enterprise. The analysis is built solely upon the formal investigation report (Department of Transport, 1987) using the functional resonance analysis method (FRAM) developed by Hollnagel (2004).


7This method is a systemic analysis method which tries not only to explain what has happened, but also emphasizes why and how a certain event could occur (Herrera & Woltjer, 2010). The socio-technical system is treated as a whole and instead of focusing on single components it is analysed by describing interactions within the system based on non-linear dependencies, performance conditions and the system's variability. The result of this type of analysis is a complex model in a specific context with focus on understanding the accident in relation to normal operation beyond a bimodal (failure/success) description (Herrera & Woltjer, 2010).

8FRAM is based on four principles (Herrera & Woltjer, 2010; Hollnagel, 2004):

  1. Success and failure emerge from the same sources. In today's complex system success and failure arise from adaptions that organizations, groups and humans make to cope with complexity. Success in operation is based on the ability to anticipate, monitor, recognize and manage risks, while failures are often due to the absence of this ability (Herrera & Woltjer, 2010)

  2. Socio-technical systems are underspecified and only partly predictable as they need to adapt to meet the demands the context poses towards them. Therefore a certain variability of a system's performance is necessary and normal to be able to control a process. The variability of one function though is seldom large enough to cause an accident (Hollnagel, 2004).

  3. Disproportionately large consequences can arise when the variability of multiple functions combines in unanticipated ways (Hollnagel, 2004).

  4. When the variability of several functions resonates, this variability might exceed the normal limits and result in an accident (Hollnagel, 2004). Further, the methodology consists of four steps (Hollnagel, 2004) which are described in more detail in the following paragraphs.

Step 1: Identify essential system functions

9In the first step of the analysis the essential system components and functions are identified based on empirical data. In our case the data used to derive the system's components and functions was elicited out of the investigation report. With the help of experts, former employees in the Swedish merchant fleet, the essential functions for the model of the operation on the Herald of Free Enterprise were derived (Hollnagel, 2004). 34 functions were identified.

10Each function was described in detail by its 6 characteristics: Input (I), Output (O), Preconditions (P), Control (C), Time (T) and Resources (R). After the description, the functions were graphically represented in form of a snowflake (see Figure 1) to frame the basis for both the system model and the accident instantiation.

Figure 1: The FRAM “Snowflake”

Step 2: Determine the potential for variability of the functions

11As variability of performance in a function can cause functional resonance, it is essential to determine the potential for variability of each function identified in step 1. One way of determining how variable the performance in a function can be, so-called Common Performance Conditions (CPCs) were used. CPCs are based on the idea of MTO-analysis, an analysis framework which focuses on huMan, Technological and Organisational aspects of the context in which socio-technical systems act (C Rollenhagen, 1995). These performance conditions originate from the Cognitive Reliability and Error Analysis (CREAM) (Hollnagel, 1998) and are used to describe the context or performance conditions for a function in more detail. There are 11 CPCs which were used in the analysis: Availability of resources, Training and Experience, HMI and operational support, Access to procedures and methods, Conditions of work, Number of goals and conflict resolution, Available time, Circadian rhythm, Crew Collaboration Quality, and Quality of support of organization. Each relevant CPC for a function was judged by one of the three categories proposed by Hollnagel (2004): Stable or variable but adequate, stable or variable but inadequate, and unpredictable.

Step 3: Define the functional resonance based on dependencies among functions

12To be able to describe the functional resonance in the system, the dependencies, both wanted and unwanted, among functions need to be determined. This is done by looking for connections between functions which could occur under certain circumstances. Input and output, preconditions, time, control and resources are matched to each other and the functions are connected. The emerging network can then be used to describe the overall structure of dependencies that exist in the aggregated larger system.

13Connections show the expected steps through the operational procedures and can show how the variability in one component can have an impact on another function's performance variability. By generating a model of the socio-technical system based on functional units with dependencies, the functional resonance in the system can be identified.

Step 4: Formulate countermeasures

14In the last step of the analysis countermeasures and barriers, protective, preventive or dampening, are introduced to the model. By recognizing the dependencies and the way the functions affect each other, one can now formulate barriers to dampen the effects of the functions' variability.

15Further, Woltjer & Hollnagel (2008) emphasize that this step also aims at finding ways to monitor and manage performance variability in a socio-technical system as, due to the basic principles FRAM is built on, it is neither possible nor meaningful to completely eliminate any type of variability in the system. It is rather about how harmful variability can be recognized before the variability of various functions combines in unanticipated ways that might cause an accident.

Results and discussion

Results from the accident investigation

16MS Herald of Free Enterprise capsized because she went to sea with her bow doors open allowing water to ingress on the car deck. Water on the car deck impaired the stability of the ship which finally capsized. The investigation report states that the capsizing was partly caused or contributed to by serious negligence of three crew members (master, chief officer and assistant bosun) and partly caused or contributed to by the fault of the Owners . The assistant bosun had accepted that it was his duty to close the bow doors at the time of departure from Zeebrugge. When released from his duties by the bosun, he went to his cabin, fell asleep and was not awakened by the call which announced that the ship was ready to sail and that the crew should man the harbour stations (i.e. the crew members’ positions when leaving or approaching harbour). Consequently he failed to turn up for duty. The results of the investigation further stated it was also the duty of the officer loading the main vehicle deck (G deck) to ensure that the bow doors were secure when leaving port. In practice, this instruction was interpreted as the loading officer should merely see that someone was at the controls and ready to close the doors. At the time of the accident, the chief officer was the loading officer (Department of Transport, 1987).

17Furthermore, the Master who served on board relied upon the absence of a report telling him the ship was not seaworthy. This was a dangerous assumption which lead to him taking the Herald of Free Enterprise to sea with the bow doors open. However, the Master followed a system which was operated by all masters who served on board. The ship standing orders did not make any reference to the opening and closing of the bow and stern doors. On previous occasions, other ships in the same company had proceeded to sea with bow or stern door open, a fact which was known to the Owners.

18The investigation report also concludes that the underlying or cardinal faults lay higher up in the Company. The company gave evidence of not realizing their responsibility for the safe management of their ships. The directors did not show a sufficient comprehension of what their duties were which also rendered them at fault. Thus, all must be regarded as sharing responsibility for the safety on board the Herald of Free Enterprise. The investigation report describes the Company as “From top to bottom the body corporate was infected with the disease of sloppiness” and “The failure on the part of the shore management to give proper and clear directions was a contributory cause of the disaster” (Department of Transport, 1987).

Results from the application of FRAM

Step 1: Identifying The Essential Functions

19Based on the data derived from the accident report 34 functions, e.g. Share Cargo Duty, Put Chain in Place, Trim Vessel, and Communicating with Assistant Bosun, were identified. After the identification each function was described in a table based on its six characteristics.

20In Table 1 one can see an example for such a description. The function Communicate with Assistant Bosun is described by its six aspects Input, Output, Precondition, Resources, Time, and Control.

Table 1: Example for a function description for the function Communicate with Assistant Bosun

Table 1: Example for a function description for the function Communicate with Assistant Bosun

Step 2: Determining The Potential Variability For The Functions

21After the functions had been described by their characteristics, the potential variability for each function was determined with the help of the 11 CPCs. Each CPC represents one or two specific aspects of the human, technological and organizational context in which the function is executed. In a CPC table, as illustrated by Table 2, each function was described with help of the CPCs which might have an influence on the variability of performance of the function. Table 2 shows the CPC description for the function Communicate with Assistant Bosun.

22After the CPCs were used to describe the performance conditions of the function during the normal procedure and during the incident, it became clear how variable the performance of several functions was and that this might have a large impact on the overall functional resonance in the model.

Table 2: Example for a function’s CPC description. Here the CPCs for Communicate with Assistant Bosun

Table 2: Example for a function’s CPC description. Here the CPCs for Communicate with Assistant Bosun

Step 3: Defining The Functional Resonance Based On Dependencies AmongThe Functions

23After applying the CPCs to the functions, the functions were graphically represented and connected based on their relation to each other. The functions were represented as “snowflakes” and the dependencies were represented by connections in between the functions.

24The graphical representation resulted in a model on how the various functions relate to each other and how they can possibly impact on each other based on performance variability. It also emphasized how functional resonance can occur if one function’s output is variable, when it serves as input or precondition for another function.

25One of the major results of this part of the analysis was that it highlighted how much of the functional resonance in the system was due to variability of the functions concerning aspects of work organization and communication among crewmembers, between ship personnel and shore personnel as well as between shipping company and crewmembers.

26Furthermore, it became clear that the functional resonance was not caused by a single factor. It was not just the open bow doors, but a combination of the variability in various functions in the system which led to the unwanted outcome of the vessel capsizing.

Step 4: Formulating Countermeasures

27Based on the model several suggestions for countermeasures with dampening effect on the functional resonance could be formulated. The following list summarizes some of these countermeasures:

  • Clear division of labor amongst the offices during the cargo operations

  • Work organization and Ship’s Standing Orders need to stated so that they are appropriate for the voyage the vessel is on

  • State responsibilities for ship and shore staff concerning the loading operations so that the coordination and cooperation between those two departments can be improved

  • Introduction of a reporting system where all crewmembers can report on missing/failing and desirable organizational/technical support which is needed to conduct the operations in a proper way, e.g. no more blind operation

  • Procedures, rules and checklists onboard should be formulated jointly with crew and company representatives

  • Norms and attitudes in the company and onboard need to emphasize safety


28This study has approached the tragic capsizing of the Herald of Free Enterprise from a systemic perspective. The results of this systemic analysis show that there was a functional resonance which spread through the variability of performance in various functions. The accident can therefore not be said to have a single cause, but that various functions were variable in their performance at the time leading to the unwanted outcome. Thus, we do not think that human failure or human error can be considered as one of the major reasons for why the outcome was not as expected. On the contrary, the “human error” identified in the original article is considered to be symptom and a sign of the variability that a function can have if one or several preconditions, inputs are not fulfilled or if control measures, available resources and time are insufficient, the combination of the variability may combine into an unwanted and unexpected event. Furthermore, the systemic analysis enabled us to see constructive countermeasures which can have a dampening effect on the functional resonance in the system.

29Although the FRAM offers a new perspective on the accident, no new reasons or causes for it could be identified. This was mainly due to the fact that no raw data on the accident was available to us. We based our analysis solely on the information gained by studying the accident investigation report which created several problems. One of the problems using accident investigation models is that the data is already analysed from a perspective of the chosen accident model (Lundberg, Rollenhagen, & Hollnagel, 2009). A questionnaire distributed among accident investigators in different sectors in Sweden revealed that the most common perceived cause to accidents were the “human factor” (33%) and that models based on complex linear models associated with the analysis of barriers were most often used (Rollenhagen, Westerlund, Lundberg, & Hollnagel, 2010). Different accident models have different scopes and consider different factors. Thus, the results become an assumption of the investigation model and from this follows a risk of biasing further investigation performed on the results of an accident analysis (Lundberg, et al., 2009).

30As mentioned earlier, one of the effects of this accident was the introduction of the International Safety Management Code for shipping (ISM). The ISM code is basically a set of open guidelines, offering little help in interpreting the concepts contained in it. This has then prompted the publishing of interpretations of ISM by organisations such as DNV (Det Norske Veritas) and IACS (International Association of Classification Societies). A lot of time is put into the collection of data but less into the following, or indeed, the preceding steps. The whole idea of accident and incident reporting is to learn from them and be proactive. In any endeavour where data are collected, be it reporting or research, one must be aware of the time, resources and the analysis effort needed. This applies to planning, deciding on format and concepts, data structure, competence and time needed for categorisation, analysis and interpretation. Then, and only then, we can implement feedback loops where lessons learned can be used for revision of SMS and ISM. We believe that more work is needed before ISM is a truly pro-active tool.

31On the other hand, it can be discussed whether ISM or an SMS would have caught the risks and mistakes in this chain of events. Would the assistant bosun or the loading officer have identified the (in hindsight) apparent risks? Again, this strengthens our argument that FRAM may be usefully applied to find systemic risks and variability in a work system which may lead to elevated risks. Regarding the effects of ISM in changing the mindset from human error to organisational issues, it seems we are not quite there yet; recent research shows that the introduction of the ISM code has not changed the focus of accident investigators to organizational factors more than before .


32Although the systemic analysis could not provide new conclusion on the accident and its cause, it has provided a deeper understanding on how functional resonance in the maritime domain may arise and how the Functional Resonance Analysis Method (FRAM) can be used to emphasize a system’s weakness and to introduce appropriate countermeasures.


33We would like to acknowledge the Fru Mary von Sydow, född Wijk, foundation, the Region of Västra Götaland and The Swedish Mercantile Maritime Foundation for financing this research. Furthermore, we would like to express a special thanks to Professor Eric Hollnagel, who introduced the authors to FRAM and opened their eyes for possible applications within the maritime domain.



Amalberti, R. (2001). The paradoxes of almost totally safe transportation systems. Safety Science, 37, 109-126.

Dekker, S. (2004). Why we need new accident models. Journal of Human Factors and Aerospace Safety, 2, in press.

Department of Transport. (1987). MV Herald of Free Enterprise. Report for Court No. 8074 Formal Investigation.

Herrera, I. A., & Woltjer, R. (2010). Comparing a multi-linear (STEP) and systemic (FRAM) method for accident investigation. Reliability Engineering and System Safety (RESS), 95(12), 1269-1275.

Holden, R. J. (2009). People or Systems? To blame is human. The fix is to engineer. Professional Safety (December 2009), 34-41.

Hollnagel, E. (1998). Cognitive Reliability and Error Analysis Method CREAM. Oxford, UK: Elsevier.

Hollnagel, E. (2004). Barriers and Accident Prevention. Aldershot, UK: Ashgate.

IMO. (2010). Development of the ISM Code. Retrieved 2011-02-10, 2011.

Leveson, N., Dulac, N., Marais, K., & Carroll, J. (2009). Moving Beyond Normal Accidents and High Reliability Organizations: A Systems Approach to Safety in Complex Systems. Organization Studies, 30(02 & 03), 227-249.

Lundberg, J., Rollenhagen, C., & Hollnagel, E. (2009). What-You-Look-For-Is-What-You-Find – The consequences of underlying accident models in eight accident investigation manuals. Safety Science, 47, 1297-1311.

Rollenhagen, C. (1995). MTO -en introduktion. Samband Människa, Teknik och Organisation. Lund: Studentlitteratur.

Rollenhagen, C., Westerlund, J., Lundberg, J., & Hollnagel, E. (2010). The context and habits of accident investigation practices: A study of 108 Swedish investigators. Safety Science, 28.

Schröder-Hinrichs, J-U. (2010). Human and Organizational Factors in the Maritime World-Are We Keeping up to Speed. WMU Journal of Maritime Affairs, 9(1), 1-3.

Schröder-Hinrichs, J-U., Baldauf, M., Ghirxi, K.T. (2011). Accident investigation reporting deficiencies related to organizational factors in machinery space fires and explosions. Accident; Analysis and Prevention 43(3), 1187-96.

Stoop, J., & Dekker, S. (2009). Accident modelling: from symptom to system. Paper presented at the Annual Meeting of the Human Factors and Ergonomics Society European Chapter, Linköping.

Trafford, S. M. (2009). Maritime Safety. The Human Factors. Sussex: Book Guild Publishing.

Woltjer, R., & Hollnagel, E. (2008). Functional modeling for risk assessment of automation in a changing air traffic management environment. Paper presented at the 4th International Conference Working on Safety.


1 Chalmers University of Technology, Department of Shipping and Marine Technology, Gothenburg, Sweden

2 Chalmers University of Technology, Department of Shipping and Marine Technology, Gothenburg, Sweden

3 University of Technology, Department of Shipping and Marine Technology, Gothenburg, Sweden

Table des illustrations

Légende Figure 1: The FRAM “Snowflake”
Fichier image/jpeg, 436k
Titre Table 1: Example for a function description for the function Communicate with Assistant Bosun
Fichier image/jpeg, 100k
Fichier image/jpeg, 120k
Titre Table 2: Example for a function’s CPC description. Here the CPCs for Communicate with Assistant Bosun
Fichier image/jpeg, 412k
Fichier image/jpeg, 472k

Le texte et les autres éléments (illustrations, fichiers annexes importés) sont sous Licence OpenEdition Books, sauf mention contraire.

Rechercher dans OpenEdition Search

Vous allez être redirigé vers OpenEdition Search