System Theoretic Safety Analysis of the Sewol-Ho Ferry Accident in South Korea by Yisug Kwon B.S. Mechanical Engineering, Kumoh National University, Kyungbuk, S. Korea, 1992 M.S. Mechanical Engineering, Kumoh National University, Kyungbuk, S. Korea, 1995 Ph.D. Mechanical Engineering, Pusan National University, Pusan, S. Korea, 2005 Submitted to the System Design and Management Program in Partial Fulfillment of the Requirements for the Degree of Master of Science in Engineering and Management at the Massachusetts Institute of Technology February 2016 © 2016 Yisug Kwon All rights reserved The author hereby grants to MIT permission to reproduce and to distribute publicly paper and electronic copies of this thesis document in whole or in part in any medium now known or hereafter created. Signature of Author ________________________________________________________________________________ Yisug Kwon System Design and Management Program December 2015 Certified by _________________________________________________________________________________________ Nancy G. Leveson Thesis Supervisor Engineering Systems Division Accepted by _________________________________________________________________________________________ Patrick Hale Director System Design and Management Program System Theoretic Safety Analysis of the Sewol-Ho Ferry Accident in South Korea by Yisug Kwon Submitted to the System Design and Management Program in December, 2015 in Partial Fulfillment of the Requirements for the Degree of Master of Science in Engineering and Management ABSTRACT The disaster of the Sewol-Ho, which took place on April 16, 2014, was one of the worst maritime disasters in South Korea in decades, and rescuing only 172 of a total 476 people triggered thorough accident investigations. As the results of the investigations performed by the Korea Maritime Safety Tribunal and the Board of Audit and Inspection of Korea, 399 people were blamed for the accident and arrested, 154 of them were put in jail, many safety policies and manuals were found inadequate, new safeguards against the kinds of accidents were implemented, and Korean high and low governments’ structures which were related to the accident were reorganized: disbanding the 61-year-old Republic of Korea Coast Guard and establishing a new Ministry responsible for Korean public safety. The accident investigation reports, however, were limited in revealing the most important systemic causal mechanisms leading to a more complete understanding of the reason why the accident occurred, and therefore, appear to be inadequate in designing and obtaining sociotechnical system level safety because they did not apply system engineering tools in the investigations. The Systems-Theoretic Accident Model and Processes (STAMP), created by Dr. Nancy Leveson, is an accident model based on systems theory. It has been applied to improve system safety in a number of complex sociotechnical systems. STAMP has the capability to help identify a broader set of systemic causal factors and develop and improve the safety control structure for the entire maritime transportation safety structure. This thesis applies the Causal Analysis based on Systems Theory (CAST) accident analysis tool created by Dr. Leveson to the accident and provides the application and findings of CAST. The CAST analysis demonstrated that a complete set of systemic causal factors was identified by the systems theory approach, which was much broader than those of the Korea Maritime Safety Tribunal and the Board of Audit and Inspection of Korea. The powerful and effective tool to reveal the systemic causal mechanism led to the identification of the systemic causal factors and system improvements of the safety control system. Thesis Supervisor: Nancy G. Leveson Title: Professor of Aeronautics and Astronautics and Engineering Systems Yisug Kwon MIT SDM Thesis 2 Acknowledgements “If I speak in the tongues of men and of angels, but I do not have love, I am a noisy gong or a clanging cymbal (1Co 13:1). Love is patient, love is kind, it is not envious. Love does not brag, it is not puffed up. It is not rude, it is not self-serving, it is not easily angered or resentful. It is not glad about injustice, but rejoices in the truth. It bears all things, believes all things, hopes all things, endures all things (1Co 13:4-7). I would first like to thank God for the great opportunity to learn. I would like to thank Dr. Leveson, as my thesis supervisor, for contributing to my understanding of STAMP and guiding me along the way. At her class, ESD355 Engineering of software, in the fall, 2013, Dr. Leveson claimed that Safety is a system property. It must always be analyzed top-down and for the system as a whole. When putting two or more existing components (“systems”) together, the emergent properties must be analyzed for the integrated system. Calling that larger system a “System of systems” may be misleading by implying that emergent properties can be treated differently than any other system or different system engineering techniques can be used (Leveson, 2013). This claim challenged me to know more about system engineering and STAMP, and start my thesis research. I would like to thank the MIT SDM program, including the faculty, staff, and cohort. Special thanks to Pat Hale who welcomed me to the 1-year SDM Certificate program and later, this SDM Master program, and has been a great supporter along the way. To my sponsor company and its great people, I would like to thank you, especially Dan, Randy, and Jinho for supporting me to get through this SDM program. I am especially thankful to Lim, Rana whose full support and encouragement allowed me to enjoy this program at MIT, and to my angels, Jungtaik, Sungtaik and Euntaik. I would like to express my deepest sympathy to the families for the losses in the accident. Yisug Kwon MIT SDM Thesis 3 Table of Contents ABSTRACT ............................................................................................................................................................... 2 Acknowledgements .............................................................................................................................................. 3 List of Acronyms .................................................................................................................................................... 6 Chapter 1: Introduction ...................................................................................................................................... 7 Motivation ......................................................................................................................................................... 7 Objective ......................................................................................................................................................... 10 Overview ........................................................................................................................................................ 10 Chapter 2: Literature review ......................................................................................................................... 11 STAMP (Systems-Theoretic Accident Model and Processes) .................................................... 13 Causal Analysis based on STAMP or CAST ........................................................................................ 23 Chapter 3: Summary of the Sewol-Ho Accident (Oh, 2015) .............................................................. 25 Chapter 4: Korea Maritime Safety Tribunal (KMST) Root Cause Analysis .................................. 34 Contributing Factors to the capsizing of the ferry: ........................................................................ 34 Contributing Factors to not rescuing all people from the distressed ferry: ........................ 35 Root Causes of the capsizing of the ferry: ......................................................................................... 35 Root Causes of not rescuing all people from the distressed ferry: .......................................... 36 Recommendations related to the capsizing of the ferry:............................................................. 37 Recommendations related to not rescuing all people from the distressed ferry: ............. 37 Chapter 5: Board of Audit and Inspection of Korea (BAI) Root Cause Analysis ........................ 39 Contributing Factors to the capsizing of the ferry: ........................................................................ 39 Contributing Factors to not rescuing all people from the distressed ferry: ........................ 41 Root Causes of the capsizing of the ferry: ......................................................................................... 42 Root Causes of not rescuing all people from the distressed ferry: .......................................... 43 Recommendations related to the capsizing of the ferry:............................................................. 43 Recommendations related to not rescuing all people from the distressed ferry: ............. 43 Chapter 6: CAST ANALYSIS ............................................................................................................................ 44 CAST Step 1: Identify the System(s) and Hazard(s) Involved in the Loss ............................ 45 Yisug Kwon MIT SDM Thesis 4 CAST Step 2: Identify the System Safety Constraints and Requirements with the hazards ............................................................................................................................................................................ 45 CAST Step 3: Document the Safety Control Structure in place to control the hazard and enforce the safety constraints ................................................................................................................ 46 CAST Step 4: Determine the proximate events leading to the loss .......................................... 50 CAST Step 5: Analyze the Loss at the Physical System Level ..................................................... 67 CAST Step 6: Moving up the Levels of the Safety Control Structure, Determine How and Why each Successive Higher Level Allowed or Contributed to the Inadequate Control at the Current Level ........................................................................................................................................ 72 CAST Step 7: Examine Communication and coordination Contributors ............................. 154 CAST Step 8: Determine the dynamics and changes in the system and the safety control structure relating to the loss and any weakening of the safety control structure over time. ................................................................................................................................................................ 157 CAST Step 9: Generate Recommendations ...................................................................................... 159 CAST Summary .......................................................................................................................................... 170 Chapter 7: Comparison of KMST and BAI Root Cause Analyses and CAST ............................... 171 Bibliography ....................................................................................................................................................... 174 Yisug Kwon MIT SDM Thesis 5 List of Acronyms AIS Auto Identification System AMSS Advanced Maritime Surveillance System BAI Board of Audit and Inspection of Korea CAST Causal Analysis based on STAMP EDRE Emergency Deployment Readiness Exercise FM Frequency Modulation KMOF Korea Ministry of Oceans and Fisheries KMST Korea Maritime Safety Tribunal KR Korea Register of Shipping KSA Korea Shipping Association OMR Operation Management Regulations Document OSC On Scene Commander PFDs Personal floatation devices ROKCG Republic of Korea Coast Guard ROP Rescue Operations of Passengers SAR Search and Rescue SSB Single-SideBand modulation STAMP System-Theoretic Accident Model and Processes TRS Trunked Radio System VHF Very High Frequency VTS Vessel Traffic Service Yisug Kwon MIT SDM Thesis 6 Chapter 1: Introduction Motivation Passengers expect joyful, peaceful and safe sea travels to the destinations when they ride cruise ships, ferries or any transportation means at sea waters. They want the maritime transportation system to be safe. Similar to the crewmembers, Chonghaejin Marine Company, Republic of Korea or South Korea Coast Guard (ROKCG), Korea Register of Shipping (KR), Korea Shipping Association (KSA), and Regulators do not set out to provide passengers unsafe travel. Also, the safety of maritime transportation industry is also relatively well controlled and maintained compared to land transportation ones. For most Koreans, passengers riding on ships assumed that the sea travels they take resulted in neither harm nor serious accidents until the Sewol-Ho accident occurred, 295 died and nine people remained missing. Since the Sewol-Ho accident, mass media in South Korea has focused on finding people to blame for the accident for several months. Due to the emphasis on the blame sought by Korean prosecutors and Board of Audit and Inspection of Korea (BAI), 399 people involved had been arrested, and 154 among them were put in jail (May 5, 2015). Since the time of the accident, some individuals and organizations have attempted to find the causes and improve the safety of the maritime transportation system. For example, Korea Maritime Safety Tribunal (KMST) published the accident investigation report which presented safety problems of the maritime transportation system and called for government and industry-wide changes. Around the same time, the BAI also published the audit report, which presented faults of people, ordered the related organizations to charge them and enforced regulations and rules to prevent people from committing the faults in the future. Even with the efforts, Koreans are sure that the safety of the maritime transportation system remains inadequate. The efforts made mostly at the lower levels of the organizations involved in the accident may achieve little success in part because the modern maritime transportation system is a Yisug Kwon MIT SDM Thesis 7 complex and sociotechnical system in which the bottom-up decentralized decision making can lead and has led to major accidents. Each local decision may be “correct” in the limited context in which it was made but leads to an accident when the independent decisions and organizational behaviors interact in dysfunctional ways (Leveson, 2011, pp. 14). The decentralized decisions, like all safety-critical decisions, must be made in the context of system-level information and from a total systems perspective to be effective in reducing accidents (Leveson, 2011, pp. 44). As a complex system, it is inherently difficult to improve in part because of the number of components, as well as the degree of coupling among those components. The coupling between system elements increases the difficulty in predicting emergent properties such as system safety (Leveson, 2011, pp. 64). The root cause analysis investigation approach without the consideration of system safety as an emergent property has remained, however, standard across the safety investigation organizations including the KMST. Systems including the maritime transportation system are not static. Rather than accidents being a chance occurrence of multiple independent events, accidents tend to involve the effects of a systematic migration of organizational behavior toward an accident under the influence of pressure toward cost-effectiveness in an aggressive, competitive environment. (Rasmussen and Svedung, 2000, pp. 14). Therefore, any approach to enhancing safety that includes the social system and humans must account for adaptation (Leveson, 2011, pp. 51). Accident investigations are vital to the efforts to improve the safety of the system as the investigators strive to understand why an accident occurred and to identify the areas that need to be improved to prevent accidents from occurring in the future. While the KMST accident investigation report outlined recommendations needed to improve the safety of maritime transportation system, it did not include systemic causal factors to understand why the accident occurred and to identify the areas need to be improved to prevent future accidents. Yisug Kwon MIT SDM Thesis 8 This thesis intends to understand why the accident occurred and to identify the areas that need to be improved to prevent future accidents by using a system safety approach for accident investigation, the Causal Accident based on STAMP (CAST) accident analysis tool, developed by Dr. Nancy Leveson. CAST is a tool based on the Systems-Theoretic Accident Model and Processes (STAMP), a model created using system theory (Leveson, 2011). The use of CAST does not lead to identifying single causal factors or variables. Instead, CAST provides the ability to examine the entire sociotechnical system design to identify the weaknesses in the existing safety control structure and to identify changes that will not simply eliminate symptoms but potentially all the causal factors, including the systemic ones. One goal of CAST is to get away from assigning blame and instead to shift the focus to why the accident occurred and how to prevent similar losses in the future. To accomplish this goal, it is necessary to minimize hindsight bias by determining why people behaved the way they did, given the information they had at the time (Leveson, 2011, pp. 349). Yisug Kwon MIT SDM Thesis 9 Objective The objective of this thesis is (1) to show the application of CAST, Causal Analysis based on STAMP (Systems Theoretic Accident Model and Processes) accident analysis tool to investigate the Sewol-Ho Ferry Accident at the entire maritime transportation sociotechnological system level and to provide the system level safety improvements to the system safety control structure; (2) to show that CAST is an accident analysis tool to effectively and holistically analyze the entire maritime transportation sociotechnological system level disaster; and (3) to show that CAST can provide preventive solutions in a holistic view of top-down system safety engineering. Overview Chapter 2 provides an overview of STAMP and Causal Analysis based on STAMP (CAST) which is used as the research methodology for this thesis. Chapter 3 conducts a review of the Sewol-Ho accident documents made at the courtrooms, which were compiled by Oh, Jun-Ho (Oh, 2015). Chapters 4 and 5 present the findings of the Root Cause Analyses conducted by the Korea Maritime Safety Tribunal and the Board of Audit and Inspection of Korea respectively. Chapters 6 analyzes the Sewol-Ho accident at the maritime transportation system level using the CAST and also provides the recommendations and CAST summary. Chapters 7 discusses the comparison of KMST and BAI Root Cause Analyses and CAST. Yisug Kwon MIT SDM Thesis 10