Safety - Have a Framework

Your company builds and operates energy facilities. The people who manage the sites and the people on site have safety credentials and training. You manage those people, maybe you are the CEO, and you may not have that training or field experience. Do you have a framework to understand and manage the safety program? 

The best systematic model for managing safety was put forth by Dr. James Reason. The New York Times obituary following his death on February 4, 2025 quoted the former chairman of The National Transportation Safety Board from a blog post on Dr. Reason’s 80th birthday “Some scholars play a critical role in founding a whole field of study… …in the field of safety, Dr. James Reason has played such a role.”

Wikipedia provides a succinct summary of his model: “Among his many contributions is the introduction of the Swiss cheese model, a conceptual framework for the description of accidents based on the notion that accidents will happen only if multiple barriers fail, thus creating a path from an initiating cause to the ultimate, unwanted consequences …”

Accidents occur when weaknesses or holes in defense barriers align. Accident prevention is enhanced by creating multiple defense barriers and keeping the number and size of the holes in each barrier small. It is an entire field of study, but the simple Swiss cheese model is a helpful framework when thinking about safety. It allows a proactive approach instead of reacting to seemingly random chaotic accidents.

As a manager you can use this framework to think about how many defense barriers are in place, what holes exist, how the quantity and size of holes can be reduced, and what else can be done to ensure holes do not align. A good safety program will closely examine incident reports and near-miss reports to provide valuable feedback on each of these questions.

A recent tragic example shows how a high-level view by a non-specialist using the Swiss cheese framework may have identified a high-risk situation. The MV Dali containership killed 6 bridge workers when it destroyed the Francis Scott Key Bridge in Baltimore on March 26, 2024. The ship’s energy systems were a significant factor in the accident.

Per the NTSB Marine Investigation Report MIR-25-40 issued in late 2025, the ship departed the Port of Baltimore propelled by a single main diesel engine while electricity for on-board systems was provided by 2 of its 4 diesel generators. The ship was on course in the middle of the channel about 0.6 miles from the bridge when the cascade of failures began:

●       Time 0: The low voltage (LV) electrical system suddenly experienced a blackout.  

●       Time 8 seconds: The main propulsion engine shut down due to the loss of critical ancillary equipment that was powered by the LV system. The main engine was not restarted due to a lengthy process and the crew was kept busy with the ensuing events.

●       Time 1 minute: LV power was restored and the Emergency Generator was connected. Rudder control was restored. The ship’s course had only changed slightly.

●       Time 2 minutes: A second blackout occurred, this time affecting both the LV and HV systems. This second blackout was caused by fuel pumps for the diesel generators not being configured correctly to automatically restart after the first LV blackout.

●       Time 2 minutes 36 seconds: LV and HV power was restored. The Emergency Generator was not affected by the second blackout, so rudder control was maintained.

●       The ship started to veer off-course more quickly. The rudder was at maximum position but ineffective with the main propulsion engine off. The course change occurred due to the “bank effect” of the channel configuration, i.e. the deep narrow channel opens up on the west side where Curtis Bay Channel branches off, and MV Dali veered that way towards the bridge support.

●       Time 4 minutes 10 seconds: The ship impacted the bridge.

This tragic situation did not represent new or unknown conditions: historic east coast ports bring ships in close proximity to critical infrastructure (e.g. under bridges), containerships have become incredibly large in recent decades, bridges designed in the early 1970s are vulnerable to slow speed collisions with these containerships, the configuration of this channel puts a premium on maneuverability, and both rudder control and propulsion are needed for close quarters control and maneuverability for a ship of this size. These are not highly technical nuances.

As was seen, if propulsion fails at the wrong moment there is nothing that can prevent the bridge impact and collapse. From the Swiss cheese framework, all the usual defense barriers such as procedures, training, communications, navigation tools, redundant shipboard systems, etc. were ineffective. Accident prevention depended on a single defense barrier, main engine reliability, yet the engine’s control system was designed to shut the engine down to protect itself. The NTSB report points out errors by the crew that prolonged the first blackout, delayed the connection of the emergency generator, and caused the second blackout. But, the first blackout occurred due to a single wire that was not properly seated in its connection block, most likely at the time the ship was constructed 10 years prior. The main engine shut down automatically 8 seconds after that wire failed, and there was nothing the pilots or crew could do to stop the chain of events that was set in motion.

An operational review using the Swiss cheese framework could have plausibly identified the presence of the lone defensive barrier. Such a review could have highlighted 2 potential mitigations: improve the main engine reliability and add new defense barriers. Changing the engine design from automatic trip to manual trip on loss of LV power would have made a significant improvement in main engine reliability. Revising procedures to keep the tugs alongside until the ship passed under the bridge would have added a defense barrier.

You may not be presented with such high risk situations, but there is room for improvement in any safety program. The Swiss cheese model is simple yet provides a framework for management scrutiny of safety programs. Risk scenarios can be analyzed to ensure there are as many defense barriers as possible. Incidents occur with the alignment of holes across barriers, and each barrier can be proactively improved or reactively improved after an incident. That continuous improvement imposes some order on a problem that otherwise can seem random and chaotic.