The Estonia Disaster: A Bottomless Source of Learning

The sinking of the Estonia ro-ro passenger ferry stands out as one of the most disastrous accidents in modern times. The tragedy claimed 852 lives and the wreck was declared a marine graveyard. At first glance, the sinking seems to have been triggered by a single technical failure only minutes before the point of no return, with no warning signs. The first objective of this review was to verify whether the pattern of typical major accidents can be found in the Estonia disaster. The usual pattern involves multiple human errors combined with an immature organizational culture. Our detailed review of the Estonia sinking revealed several characteristics of typical major accidents in the chain of events leading up to it. However, the review also made it clear that, to be sure about what really happened, a thorough reinvestigation of the accident is necessary. To fully understand the story, we first need a short recap of the ro-ro ferry disasters.

High-risk design of ro-ro ferries
The earlier designs of the Roll-on Roll-off (ro-ro) ferries were inherently high-risk. To maximize the effectiveness of any cargo vessel, the key is to minimize the time in port by efficiently loading and unloading the cargo. The ro-ro vessels were specially designed for this purpose, in that trucks and cars could be loaded quickly in open deck spaces with few bulkheads and segregations.

The negative implications of this design became obvious in 1982 when the ro-ro vessel European Gateway collided with another ship. Water entered the cargo deck and the vessel capsized, leading to the loss of six lives. The story continues in 1987, when the crew omitted to close the bow visor of the ro-ro ferry Herald of Free Enterprise. The result was a rapid capsize causing 193 fatalities.

When water is allowed to move freely on an open deck space, the vessel’s stability is significantly reduced. This “free surface effect” was therefore also a concern when extinguishing the fire on the ro-ro ferry Scandinavian Star in 1990. This time, however, the fire itself caused 159 deaths.

Lessons were not learned
It is terrible when accidents like those involving Estonia and Herald of Free Enterprise takes place. But it is unforgivable when we are not able to learn from them. During a storm in the Baltic Sea in January 1993, the Polish ro-ro ferry Jan Hewelius capsized and sank. Only nine of the 64 persons on board survived. This is the deadliest maritime disaster involving a Polish ship.

Only two days later, there was a close call. The crew on board a large ro-ro ferry, Diana II, discovered that the bow visor locks had failed, allowing seawater to enter. Luckily the vessel was sailing into calmer waters and major technical repairs were carried out in port. The problem seemed to have been solved.

However, Diana II was not “one of a kind”. She was very similar to another vessel, which could almost be considered her sister vessel. This younger “sister” was the ro-ro ferry MS Estonia. She had practically the same bow visor as Diana II but was owned and operated by another company. The crew of Estonia were therefore unaware of the problems experienced on board Diana II when they sailed into a heavy storm on 28 September 1994.

The accident investigation conclusion
The official accident investigation into the Estonia disaster in 1997 stated that the locking system of the ship's bow visor was defective, flooding the car deck and causing the vessel to roll over and sink. Heavy head-on swells triggered the loss of the bow visor, allowing seawater to enter the car deck. It took less than an hour from the first concern being raised to the vessel sinking. Hence, the high-risk design combined with a critical technical failure is the reason for the accident.

A typical major accident scenario
Most major accidents follow a similar pattern:

1. Multiple failures take place
2. There are several human errors
3. Failures were present over a period of several days or even two years
4. Somebody was aware of these failures
5. Some of the eight leadership behaviors had a weak presence

As listed above, in most cases somebody knew about the failures before the accident took place. But because of point 5, the failures were not responded to, allowing them to escalate to a critical situation. This is the reason why organizational culture plays an important role in accident scenarios.

Technical failures can also reveal cultural characteristics
The categorization of failures as “human” or “technical” is not always sufficient. For example, technical failures that should have been identified- or responded to by the personnel also divulge something about the organizational culture. The official accident investigation report reveals several cultural characteristics that played an important role in the accident.

The eight leadership behaviors
It is too superficial to state that the failures were caused by an immature safety culture or “human error”. The challenge must be more specifically defined, addressing the reasons why the failures were not managed in time to prevent the accidents taking place. Through numerous reviews of major accidents in several industries, SAYFR has identified eight Leadership Behaviors that needs to be in place to effectively manage failures and hinder this escalation. These are listed below:

• Manage Dilemmas: Seek out and manage failures arising from conflicts and dilemmas between goals, policies and people.
• Teamwork: Collaborate towards common goals and agreed norms, while helping each other to become better in the process.
• Speak-Up: Speak up if you observe non-compliance, hazards or if you have any concerns. Encourage and empower others to do the same
• Give Feedback: Give personal feedback to show that you see, understand and appreciate what people around you do. Give critical feedback without blame or causing shame.
• Learn: Have the attitude that you can always learn something new and see failure as a vital source of learning.
• Openness: Be open to the possibility that no-one (not even you) is right and that this might have severe consequences. Be open to feedback from others.
• Care: Take ownership of your job by resolving problems and manage failures, even when they are outside of your formal role. Show colleagues that you care about their wellbeing.
• Trust: See the value of and have confidence in other people. Believe that people act with good intentions (and without hidden agendas), even when they act and think in a way that is different from you

Most accidents follow the pattern
The above cultural characteristics can be seen in the chain of events leading up to the accidents involving European Gateway and Herald of Free Enterprise, which were operated by the same company, Townsend Thoresen (TT). It can even be documented that one TT captain, Captain Blower, spoke up to shore management about the risks involving the bow visors, but his concerns were not listened to, manifesting low Trust, Openness and Learning. Several failures on board Scandinavian Star were obvious even to the passengers, as the vessel was not ready for operation. Jan Hewelius had been involved in at least 28 incidents prior to capsizing. Last, but not least, the Titanic received more than 30 iceberg warnings, but still continued her voyage at full speed.

Estonia managed dilemmas differently to other ferries
On the night of the Estonia accident, there were two other ro-ro ferries in the same area of the Baltic Sea. These were Mariella and Silja Europe. Both reduced their speed due to the heavy weather. Estonia was 15 minutes late leaving Tallinn and the captain expressed concerns that they would arrive late in Stockholm. The engines were kept at full speed through the heavy head-on swells, until the ship developed a list. This implies that the Dilemma of keeping to schedule was evident onboard Estonia.

Low openness for the possibility that something was very wrong
At about 00:55 one of the seamen on board Estonia heard a sharp metallic bang on the car deck in the bow area. This was reported to the bridge. Despite this information, the speed and course were kept constant. This illustrates that there was low Openness to the possibility that something fundamental was wrong. An avoidance maneuver at this stage, turning the vessel’s bow away from the waves, might have changed the outcome of this situation.

Deficient accident investigation
The official accident investigation report did not reflect some of the survivors’ key observations. Firstly, the survivors are convinced that the time sequence in the accident report does not match what they experienced; they claim that the accident happened much faster in reality. Secondly, several survivors observed water on the cabin deck below the cargo deck. The investigation does not fully explain how the water got there.

The decks below the car deck were subdivided into 14 watertight compartments. This means that even capsizing should not in theory have caused the vessel to sink. However, it is common in major accidents that watertight doors are not properly closed, thus disabling this safety barrier. This happened in the European Gateway sinking, the Costa Concordia capsize in 2012 and several other accidents. But such failures are normally well documented by the accident investigations. The Estonia report only states that the officer on watch started to close the watertight doors when a list developed. It is unclear if this operation was successful and, if not, which watertight doors were not properly closed. It might be that open watertight doors explain the water below the car deck.

Several conspiracy theories
In hindsight the accident scenarios of major incidents like the Titanic and Scandinavian Star disasters seem unrealistic. And that is sadly the nature of major incidents. In the minutes before these accidents took place, even the people at the scene did not anticipate what was about to occur. In the case of the Estonia accident, the rumors started early. The first official diving operation reached the MS Estonia at 70-90 meters depth four days after the sinking. The ROV pictures revealed some surprising observations. Somebody had already visited the vessel. The railing on the ramp behind the bow visor had been dismantled and stacked on the sea bottom next to the ship.

It soon became clear that Estonia was used by Western intelligence agencies to bring out Soviet military equipment. The official announcement only confirmed two incidents of such transportation, respectively one and two weeks prior to the disaster. However, some survivors of the Estonia accident observed military vehicles entering the ship on her last voyage too.

This has fueled conspiracy theories alleging that the sinking might have been deliberate. One motive could be to prevent secret military equipment from falling into the hands of the enemy. Furthermore, the well-respected builder of Estonia claimed that explosives had been used to remove parts of the bow visor. Lastly, it has been suggested that the rapid capsize and sinking may indicate other holes in the hull in addition to the open bow. For example, a collision could have damaged the starboard stabilizer fin. It is known that such damages can be critical, such as in the case of the Nordlys ro-ro ferry accident in 2011.

Need for reinvestigation
The official accident report seems to identify the most plausible accident scenario. It would be difficult to fabricate the Diana II incident that took place 18 months prior to the Estonia accident. But, over time, alternative strategies have gained terrain. The investigation failed to:

1. Document why seawater was observed below the car deck at an early stage of the incident.
2. Thoroughly interview survivors with respect to both their observations and their perception of time.
3. Rule out that the vessel had other holes in the hull.
4. Document the kind of cargo on board.
5. Document that the failure of the bow visor to lock was identical on both Estonia and Diana II.

It seems that the investigation locked its conclusion at too early a stage, without considering alternative scenarios. Even though the most likely scenario may be what the official investigation documented in 1997, alternative scenarios cannot be ruled out.

Two takeaways
Our review revealed two things. First of all, the Estonia scenario followed more of a typical pattern of major accidents, than previously anticipated. The combination of low Openness and weak management of Dilemmas is similar to several other accidents such as those involving the Titanic, Exxon Valdez and Deepwater Horizon where people spoke up but nobody did anything about it. This plus the Diana II incident also demonstrates that the failures were actually known 18 months prior to the accident. The learning across organizations should be an area of increased focus on the part of shipping companies, yards and classification societies.

Secondly, the investigation failed to establish the facts that would rule out alternative scenarios. When survivors have experienced something different to what the official investigation report says, one party must be wrong. This, combined with the impression that the survivors were not properly interviewed, means the investigation can easily be questioned. A new investigation may reveal more than the newly identified hole in the hull of Estonia and should go beyond that narrow focus. New insights into the watertight doors, the military cargo on board and the timing of the sequence of events should be more thoroughly investigated. One thing is for sure; the Estonia accident will provide an almost bottomless source of learning far beyond ship design.

References
http://www.gard.no/web/updates/content/20651838/ship-disasters-involving-watertight-doors

https://www.tuhh.de/alt/ssi/marine-casualty-simulations/european-gateway.html

http://www.multi.fi/estonia/estorap.html

https://www.estoniaferrydisaster.net/estonia%20final%20report/Contents.htm

https://lounaeestlane.ee/wp-content/uploads/2019/09/0_Final_Report_Research_Study_on_the_Sinking_Sequence_of_MV_Estonia.pdf