SCTA in Reverse (Part 2): Dissecting the Herald of Free Enterprise Disaster with TABIE Tools

1. Introduction

In Part 1 of this series, we introduced the concept of “SCTA in reverse” – applying the systematic analytical tools of Safety Critical Task Analysis retrospectively to understand major incidents. We examined the Herald of Free Enterprise disaster, where a routine ferry departure from Zeebrugge on March 6, 1987, turned catastrophic in just four minutes, claiming 193 lives.

Now, in Part 2, we move from concept to application. We’ll demonstrate how TABIE (Task Analysis Based Incident Evaluation) – a methodology specifically designed for incident investigation – systematically dissects the Herald disaster to reveal not just what happened, but how and why it happened at multiple levels of the system.

What TABIE Brings to Incident Investigation

TABIE represents an evolution of traditional SCTA methods, specifically adapted for incident investigation. Where standard SCTA asks “what could go wrong?”, TABIE asks “what did go wrong, and why?” It provides:

• The ASAP (Accident Sequence and Precursor) model – a structured framework for mapping both the immediate incident sequence and the precursor events that created latent conditions
• Incident and event mapping: Based on Hierarchical Task Analysis principles
• Systematic failure mode classification – identifying specific types of human error at each critical juncture
• Detailed PIF analysis – understanding the organisational, design, and contextual factors that made failures more likely

More recent developments include:

• Explicit linkage mechanisms – connecting immediate failures back to earlier organisational decisions and systemic conditions
• Lines of enquiry generation – systematically identifying questions that need further investigation rather than accepting surface explanations

Our Analytical Journey

We’ll walk through the Herald disaster in four movements:

First, we’ll map the complete accident sequence using the ASAP model, from precursor events (organisational pressures, design decisions) through the departure sequence to the final consequence. This provides the scaffolding for our analysis.

Second, we’ll focus deeply on three critical failures that directly led to catastrophe:

1. Assistant Boatswain Stanley not closing the bow doors
2. Captain Lewry departing with the doors open
3. The decision to accelerate while the ship was low in the water

For each, we’ll conduct detailed failure mode and PIF analysis, revealing the multiple factors, from fatigue to time pressure to design limitations, that converged at each point.

Third, we’ll highlight two new TABIE capabilities still under development:

• Explicit latent condition linkage – showing how we can trace immediate failures back to specific earlier organisational decisions (like the infamous “sail 15 minutes early” memo)
• Lines of enquiry – demonstrating how TABIE generates systematic investigative questions that probe deeper than surface explanations (like asking not just “why was Stanley asleep?” but “what were his working patterns, shift schedules, and the company’s fatigue management policies?”)

Finally, we’ll reflect on what this depth of analysis reveals and preview Part 3’s exploration of where incident investigation methodology is heading.

An Important Caveat

Before we proceed, a crucial note: This analysis is primarily an illustrative demonstration of Human Factors investigation methodology rather than a definitive forensic re-examination of the Herald disaster.

The Sheen Inquiry of 1987 conducted an exhaustive investigation with access to witness testimony, technical evidence, and company records that we don’t have. Our purpose here is pedagogical – to show how TABIE tools work and what insights they can generate – rather than to challenge or supplant that official investigation.

Some details in our analysis may be simplified, interpreted differently than in the official inquiry, or based on limited information from public sources. Where we make inferences about working conditions, organisational culture, or individual decision-making, these are hypothetical examples demonstrating how TABIE analysis would proceed, not claims about what actually occurred.

The value of this exercise lies not in discovering new facts about the Herald disaster, but in demonstrating how modern Human Factors methodologies provide structured, systematic approaches to understanding complex accidents. These are approaches that can be applied to current and future incidents where we do have access to complete information.

With that caveat established, let’s begin our deep dive into the systematic analysis of how a routine ferry crossing became one of Britain’s worst peacetime maritime disasters.

2. The ASAP Model Framework

The Accident Sequence and Precursor (ASAP) model provides the structural backbone for our TABIE analysis. Unlike simple timeline approaches that focus only on the immediate incident sequence, ASAP explicitly recognises that major accidents have deep roots: organisational decisions, design choices, and systemic conditions that create latent failures long before the final catastrophic event.

Understanding the ASAP Structure

The ASAP model divides incident analysis into five distinct but interconnected phases:

Phase 1: Precursor organisational and policy conditions exist which impact on subsequent performance, failures or recovery

Phase 1 encompasses all the decisions and conditions that created vulnerabilities before the Herald arrived in Zeebrugge that day. Rather than catalogue every precursor, we’ll focus on one particularly revealing example: the company memo about sailing times.

The “Sail 15 Minutes Early” Directive

In August 1986, seven months before the disaster, Townsend Thoresen management sent a memo to ferry masters. The memo explicitly stated that masters should “put pressure on the first officer” and aim to sail “15 minutes early” to maintain schedule adherence.

This wasn’t merely about punctuality. This memo represented a fundamental statement of organisational priorities that would permeate decision-making at every level.

What it communicated:

• Schedule adherence was paramount
• Pressure on subordinates was an acceptable management tool
• “Early departure” was the performance standard, not “on-time” or “safe departure”

The latent condition it created: A cultural norm where time pressure competed with, and potentially superseded, safety procedures. When crew members faced trade-offs between thoroughness and speed, this memo had already signalled which way management expected them to lean.

The Broader Precursor Landscape

While we’ve focused on the memo, Phase 1 contains multiple other precursors visible in the ASAP diagram:

• Design decisions: No bow door indicators (a years-old choice)
• Route assignment: Herald on unfamiliar Zeebrugge route (months before)
• Infrastructure: Zeebrugge ramp height issues requiring ballasting (ongoing)
• Staffing: Role ambiguities around door-closing responsibility (persistent)

Each created its own latent condition. In combination, they formed a system vulnerable to the kinds of routine performance variability that inevitably occurs in real operations.

Phase 2: Latent precursor failure (human or hardware) occurs – The Departure Sequence

Phase 2 captures the immediate operational sequence where the initial failures occurred – the critical 30-40 minutes leading up to departure at 18:05 GMT.

The HTA reveals the complexity of departure operations at Zeebrugge, but two elements stand out as particularly critical:

Critical Element 1: Stanley Falls Asleep

Task 2.1.2 shows Assistant Boatswain Mark Stanley completing his deck cleaning duties and heading to his cabin for a break at 16:30. The note states he “won’t be needed on car deck again until just before 18:00 sailing.”

What happened: Stanley fell asleep and didn’t wake for the “harbour stations” call that should have summoned him to close the bow doors.

The critical vulnerability: The entire bow door closing operation depended on one person being in the right place at the right time. The only back up seems to be a confirmatory check by Chief Officer Leslie Sabel, and potentially a check by the captain before departure.

Critical Element 2: The Ballasting Time Pressure

The HTA reveals a significant operational complication at Zeebrugge. The port’s loading ramp couldn’t reach the Herald’s E deck, so the ship had to be lowered by filling ballast tanks. From the information we have gathered, it appears there wasn’t enough time to lower and raise the ship before departure. With what occurred, it seems time pressure led to the ship departing while still riding lower in the water than normal – a condition that would prove critical once water began entering through the open bow doors.

Phase 3: Initiating event occurs

This phase of the analysis covers leaving the bow doors open, departing without confirming the bow doors are closed, and accelerating before the ship has been fully raised from the ballast procedure for lowering it.

Focusing on just one element of this we can highlight specific failings in the HTA. This is a little odd in a way as we are mapping events that did not occur, and have greyed out these events to help highlight this. In 3.1.1 we see Stanley did not close the bow doors; 3.1.2 Sabel did not confirm the doors were closed before leaving the deck, and Cornellius put a safety chain across the bow doors despite them not being closed.

Phase 4: Consequence occurs

By this time the fate of the ship has already been sealed in the preceding events. This sequence captures the capsizing of the ship which happens over the course of about 4 minutes.

Phase 5: Post consequence management to minimise losses

This phase describes the recovery. Despite the huge loss of life, sources we have reviewed to complete this analysis say that it could have been a lot worse if the ship had not come to rest on a sand bank and for the heroic efforts of those who responded.

This can often be an important part of a major incident response which can be overlooked in typical incident evaluations.

3. Three Critical Failures: Deep Dive Analysis

The ASAP model has mapped out the full accident sequence, but to truly understand how the Herald disaster occurred, we need to examine three critical failures in depth. For each, we’ll conduct detailed failure mode analysis and Performance Influencing Factors (PIF) assessment – the heart of the TABIE methodology.

3.1 Critical Failure 1: Stanley Falls Asleep and Doesn’t Close the Bow Doors

The Failure

At approximately 18:00 GMT, Assistant Boatswain Mark Stanley should have responded to the “harbour stations” call and proceeded to close the bow doors. Instead, he remained asleep in his cabin. This omission -a task step simply not performed- became the primary initiating event for the disaster.

Failure Mode Classification

Using SHERPA-style failure mode taxonomy, this is a clear omission error:

• Task step: Close bow doors before departure
• Failure type: Omitted
• Consequence: Bow doors remain open as ship departs

But understanding that Stanley omitted the task tells us nothing about why. This is where PIF analysis becomes invaluable.

Example Performance Influencing Factors Analysis

Let’s systematically examine potential factors that could have increased the likelihood of this failure:

Negative PIFs – Fatigue and Sleep

• FATIGUE: Stanley had been working since early morning on deck cleaning duties – physically demanding work in March weather conditions. By 16:30 when he went to his cabin, he’d been working for hours.
• SLEEP OPPORTUNITY: The gap between finishing deck duties (16:30) and harbour stations call (18:00) was only 90 minutes – barely enough for restorative rest, but long enough to fall into deep sleep from which waking is difficult.
• CIRCADIAN RHYTHM: Evening departure (18:00) falls during a natural energy dip in most people’s circadian cycles, making sleep more likely and waking more difficult.

Negative PIFs – Task Design and Alerting

• RELIANCE ON SINGLE ALERT: The entire system for summoning Stanley relied on him hearing and responding to a single harbour stations announcement. No backup alert, no check-in requirement, no fail-safe.
• NO CONFIRMATION PROTOCOL: No system required Stanley to confirm he’d received the harbour stations call or that he was proceeding to close doors. His absence could go unnoticed.
• ACOUSTIC ENVIRONMENT: Cabin location and ambient ship noise may have made the announcement difficult to hear, especially for someone asleep.

Negative PIFs – Role Clarity and Responsibility

• AMBIGUOUS OWNERSHIP: While Stanley was expected to close doors, the Sheen Inquiry revealed confusion about whose ultimate responsibility this was. Chief Officer Sabel believed the bosun was responsible; the bosun believed it was the assistant bosun; Stanley believed officers would check.
• NO POSITIVE CONFIRMATION REQUIRED: Unlike many safety-critical tasks, there was no requirement for Stanley to report completion. The system operated on an assumption of completion rather than verification.

Negative PIFs – Organisational Culture

• NORMALISATION OF TIME PRESSURE: The August 1986 memo about sailing early had created an environment where speed was prioritised. This may have discouraged thoroughness in checking procedures.
• LACK OF REDUNDANCY: The organisation had designed a system with a single point of failure. One person not responding to one call could doom the ship.

3.2 Critical Failure 2: Captain Lewry Departs with Bow Doors Open

The Failure

At 18:05 GMT, Captain David Lewry ordered the Herald to leave harbour and proceed to sea. He did so without confirming that the bow doors were closed – indeed, without any direct knowledge of their status. Within minutes of leaving the harbour, water would begin flooding through those open doors.

Failure Mode Classification

This is a more complex failure involving multiple elements:

• Primary failure: Action taken with incomplete information – Lewry departed without verifying door status
• Secondary failure: Check omitted – No confirmation of door closure before departure
• Contributing failure: Wrong assumption – Assumed doors were closed based on absence of contrary information

Example Performance Influencing Factors Analysis

Let’s systematically examine potential factors that could have increased the likelihood of this failure:

Negative PIFs – Information Availability

• NO BOW DOOR INDICATORS ON BRIDGE: Perhaps the most damning design failure revealed by the Sheen Inquiry. Lewry had absolutely no way to verify door status from the bridge. This wasn’t an oversight in his actions; it was a fundamental design limitation.
• ABSENCE OF INFORMATION TREATED AS CONFIRMATION: In the absence of door status indicators, the system relied on crew reporting problems. Silence was interpreted as success – a dangerous assumption in safety-critical operations.
• NO SYSTEMATIC CONFIRMATION PROTOCOL: Unlike many ferry operators who required positive confirmation of door closure, Townsend Thoresen operated on an assumption-based system.

Negative PIFs – Time Pressure

• COMMERCIAL PRESSURE: Ferry operations are commercially driven by schedule adherence. Late departures mean late arrivals, missed connections, customer complaints, and commercial penalties.

Negative PIFs – Normal Operations and Routine

• NORMALISATION OF DEPARTURE PROCEDURE: Lewry had overseen hundreds, probably thousands of ferry departures. The vast majority were routine. This creates powerful psychological momentum toward assuming this departure is also routine.
• TRUST IN SUBORDINATES: A captain must trust that crew members complete their assigned tasks. Lewry had no specific reason to doubt that Stanley had closed the doors as Stanley had presumably done so dozens of times before.

Negative PIFs – Organisational System Design

• DISTRIBUTED RESPONSIBILITY WITHOUT COORDINATION: Multiple people had roles in the departure sequence (Stanley closing doors, Sabel checking deck, officers monitoring departure) but no one person had overall responsibility for verifying all safety-critical tasks were complete.
• NO CHECKLIST CULTURE: Unlike aviation, which by 1987 had long embraced systematic checklists for safety-critical operations, ferry operations relied heavily on individual judgment and memory.
• CULTURAL ACCEPTANCE OF RISK: The absence of door indicators wasn’t unique to the Herald – it was industry standard. This suggests a broader cultural acceptance of this particular risk across ferry operations.

3.3 Critical Failure 3: Acceleration While Low in the Water

The Failure

Shortly after clearing Zeebrugge harbour, the Herald accelerated to cruising speed while still riding low in the water due to incomplete ballast adjustment. The ship’s trim (its orientation in the water) was bow-down, meaning the open bow doors were closer to the waterline than they would normally be.

When acceleration created a bow wave, water began entering through the open doors. The low position in the water meant water entered faster and in greater volume than it would have if the ship had been at normal trim.

Failure Mode Classification

This failure involves:

• Action mistimed: Acceleration before completing ballast adjustment
• Wrong sequence: Speeding up before ensuring proper trim
• Inadequate monitoring: Not recognising the ship’s vulnerable low position

Performance Influencing Factors Analysis

Negative PIFs – Task Design and Infrastructure

• ZEEBRUGGE RAMP HEIGHT ISSUE: The fundamental problem was that Zeebrugge’s loading ramp couldn’t reach the Herald’s E deck at normal waterline. This was a known infrastructure incompatibility that forced an awkward workaround.
• TIME-CONSUMING BALLAST PROCEDURE: Lowering the ship for loading, then raising it again for sailing, took significant time. In the time-pressured environment of ferry operations, this created a conflict between thoroughness and schedule.
• INCOMPLETE PROCEDURE: Based on the evidence, it appears the Herald was sailing before the ballasting procedure was fully completed. This wasn’t an individual decision to cut corners – it was a systemic response to an impossible time constraint.

Negative PIFs – Information and Monitoring

• NO SPECIFIC LOW-WATER WARNINGS: There was no alarm or indicator system that warned “ship is low in water, minimise bow wave until trim corrected.”

Connecting the Three Failures

These three critical failures weren’t independent. They formed an interconnected chain:

1. Stanley’s omission created an abnormal condition (open doors) that was invisible to everyone else
2. Lewry’s departure without door status information meant this abnormal condition went to sea
3. Acceleration while low interacted with the unknown open doors to create the catastrophic water ingress

Each failure alone might have been recoverable. Stanley might have woken and closed doors after departure. Lewry might have noticed something amiss before reaching open water. The ship might have remained stable enough at low speed for the problem to be discovered.

But the system had removed redundancy. There were no backup checks, no secondary confirmations, no fail-safes. Each layer of defence had a hole, and on March 6, 1987, those holes aligned.

4. New Features of the TABIE Toolbox

The analysis we’ve conducted so far (mapping the accident sequence, identifying critical failures, analysing failure modes and PIFs) represents the core of TABIE methodology. But TABIE offers two additional new capabilities that take incident investigation to a deeper level. These features are still under active development, but the Herald disaster provides an excellent opportunity to demonstrate their potential.

4.1 Explicit Latent Condition Linkage

Traditional incident investigation often identifies latent conditions – the organisational and systemic factors that created vulnerabilities – but struggles to show precisely how those conditions contributed to specific failures. Investigators might note that “time pressure was a factor” or “organisational culture contributed,” but the connection between a management decision months earlier and a specific failure on the day remains somewhat fuzzy.

The Sheen Inquiry was actually remarkably good at making these connections, but it did so through narrative prose. TABIE aims to make these linkages explicit and traceable within the analytical framework itself.

4.2 Lines of Enquiry Generation

Traditional incident investigation often accepts initial explanations and stops there. “Stanley was asleep” or “Captain departed without checking” become endpoints rather than starting points for deeper enquiry. Critical questions that could reveal systemic issues remain unasked.

Even sophisticated investigations can miss important questions if they rely purely on investigator intuition about what to ask. Different investigators might pursue different lines of enquiry based on their experience and interests, leading to inconsistent investigation depth.

There is also the issue of how an investigation develops, gathering data and evidence, and make sense of what happened. Here lines of enquiry can emerge and get closed out throughout the analysis, as the analysis moves from mapping events, to considering failures, latent conditions, etc. For a developing analysis not all facts are known at the outset and the investigation is not always simple and linear.

Generated lines of enquiry:

1. Fatigue management: What were Stanley’s actual working hours in the days preceding March 6? What was the company’s fatigue risk management system? Were rest periods adequate and protected?
2. Previous occurrences: Had Stanley or other crew members previously failed to respond to harbour stations calls? If so, what happened? Were there near misses?
3. Alerting system effectiveness: Had anyone assessed whether the harbour stations announcement system was reliably audible in crew cabins? Were there complaints about missing calls?
4. Role clarity: What training did Stanley receive about his responsibilities? What did he understand about who would check his work?
5. Backup systems: Why was there no engineered backup to a human memory-dependent system? Had anyone proposed door closure indicators or alarms?
6. Industry practice: How did other ferry operators handle bow door status confirmation? Were door indicators standard elsewhere? If so, why not at Townsend Thoresen?
7. Risk assessment history: Had Townsend Thoresen ever conducted a risk assessment of departing with doors open? If so, what conclusions were reached? If not, why not?
8. Previous concerns: Had any masters, officers, or crew raised concerns about the absence of door status indicators? If so, what happened to those concerns?
9. Decision-making pressure: What were the actual commercial consequences of late departure? How was schedule performance monitored and reported? What pressure did masters face?
10. Alternative practices: What systematic confirmation procedures did Lewry use for other safety-critical tasks? Why weren’t similar procedures applied to door closure?
11. Near miss history: Had there been previous occasions when doors were nearly left open, or opened unexpectedly during voyage? What was learned from those incidents?

5. Conclusion: What SCTA in Reverse Reveals

We began with a simple proposition: apply the rigorous analytical tools of Safety Critical Task Analysis retrospectively to understand major incidents. Through TABIE’s structured methodology, we’ve mapped the complete causal chain from precursor organisational decisions through latent failures to the final catastrophe, identifying specific failure modes rather than vague attributions, and analysing how organisational decisions, design choices, and operational pressures converged to make each failure more likely.

Perhaps the most important insight is the shift from blame to systemic understanding. Stanley falling asleep was almost an expected outcome of fatigue, inadequate rest opportunity, and an alerting system with no backup. Lewry departing without confirming door status was rational decision-making within a system that provided no means to verify critical information. The Sheen Inquiry concluded the company was “infected with the disease of sloppiness from top to bottom.” Our analysis reveals that sloppiness was systemic, not individual – the organisation had designed, incentivised, and normalised the very behaviours that led to disaster.

TABIE demonstrates that effective incident investigation requires structure (the ASAP model ensures consideration of precursors, not just dramatic failures), systematic failure classification (pointing toward appropriate interventions), and PIF analysis (revealing leverage points for change). Fix the PIFs, not just the people. The Herald disaster wasn’t inevitable, but given the system design, it was predictable. That’s the uncomfortable truth SCTA in reverse reveals – and the foundation for preventing the next disaster.

In Part 3, we’ll reflect on the analysis presented here, some challenges and further innovations to the TABIE Toolbox to enhance Human Factors Risk Management thinking.

---

Acknowledgements

This blog post was written with the assistance of Claude (Anthropic), which provided valuable support in structuring the analysis, synthesising information from multiple sources, and drafting content. The author remains responsible for the final content and any errors or omissions.

References

Primary Sources:

Sheen, Mr Justice (1987). mv Herald of Free Enterprise: Report of Court No. 8074 Formal Investigation. Crown Department of Transport. Available at: https://assets.publishing.service.gov.uk/media/54c1704ce5274a15b6000025/FormalInvestigation_HeraldofFreeEnterprise-MSA1894.pdf

Video Sources:

“193 Dead After Bow Doors Left Open!” YouTube video. Available at: https://www.youtube.com/watch?v=-YDpmdT9hzU(Accessed 2025)

“The Zeebrugge Ferry Disaster | A Short Documentary | Fascinating Horror.” YouTube video. Available at: https://www.youtube.com/watch?v=whvdjg6i2Hc&t=1s (Accessed 2025)

“Seconds from Disaster: Zeebrugge Ferry Disaster.” YouTube video. Available at: https://www.youtube.com/watch?v=1mHPGOvLX0k (Accessed 2025)

Additional Sources:

MS Herald of Free Enterprise. Wikipedia. Available at: https://en.wikipedia.org/wiki/MS_Herald_of_Free_Enterprise (Accessed 2025)

Embrey, D. (2025). TABIE: A Task Analysis Based Incident Evaluation technique. HRA Technical Paper. Human Reliability Associates Ltd.

Regulatory Guidance:

Health and Safety Executive. Human Factors Delivery Guide for COMAH Sites. HSE, December 2023.

Health and Safety Executive. COMAH SRAM 2015 – Human factors criteria. Available at: https://www.hse.gov.uk/comah/assets/docs/s12d.pdf

---

Note: This is Part 2 of a three-part series examining how Safety Critical Task Analysis methods can be applied retrospectively to major incidents. Future parts will include additional technical references and case study materials.