A risk list for a ship's bridge

The HMNZS Manawanui grounding rewritten as a risk analysis, in the structure a medical device file would use. Controls are listed in order of priority — inherent safety by design first, protective measures second, information and training last — because that is the order in which they actually work.

The first three control groups are the designer's and are ordered by strength, as ISO 14971 requires. The last three belong to the operating organisation and do not sit on the same ladder — a drilled response is not weaker than a warning label. Scheduled frame checks do not guarantee that anyone notices; they create an occasion for noticing.

This is an illustration, not a risk file, and not an assessment of what the Royal New Zealand Navy did or should have done.

Severity levels follow the five-level qualitative scheme in ISO 14971. Severity is suggested, not asserted. Probability is deliberately omitted: the probability of use error is difficult to estimate, so selection should be driven by severity.
IDHazard and foreseeable sequence of events Hazardous situationHarmSeverity
(suggested)		 Risk controls, in priority orderResidual risk Present on Manawanui?Report ref.
R01

Automation holds a commanded state regardless of proximity to danger

  1. Autopilot engaged for transit or a straight survey leg
  2. operational context changes to close-quarters work near a hazard
  3. nobody disengages it because nothing prompts it
 Vessel holds a course towards a hazard under automatic control while the crew believe they are steering it Grounding, collision, loss of vessel, injury, death Catastrophic

Inherent safety by design

  • Geographic or depth-based inhibition: autopilot refuses to engage, or drops out, inside a set distance from charted danger or below a set depth

Protective measures

  • Escalating annunciation of autopilot state when speed, depth or proximity to hazard crosses a threshold

Information and training

  • Standing order limiting autopilot use in pilotage and close-quarters work
  • named person owns the decision

Competence and drill

  • Crew drilled in the transition from transit to close-quarters work, including what changes about control

Team and resource management

  • Qualified helmsperson standing by in hazardous navigational situations, as SOLAS V/24 requires
  • a person on the helm during restricted manoeuvring, as the US Navy requires of the master helmsman

Scheduled frame checks

  • Task-phase transition check: on changing from transit to close-quarters work, the control mode is stated aloud
 Whether the crew notice the operational context has changed No rule found. Court records areas of no instructions or procedures leaving a void to be managed ¶51, ¶48
R02

A change in who or what is driving the vessel, known to one person only

  1. One crew member changes control mode
  2. nobody announces it
  3. another crew member acts on a model of the vessel formed before the change
 Two or more people on the bridge hold different and incompatible beliefs about the state of the vessel Grounding, collision, loss of vessel, injury, death Catastrophic

Inherent safety by design

  • Mode change triggers an unmissable indication that does not depend on anyone speaking: audible annunciation, or a physical change at every control position

Protective measures

  • Mode state logged and displayed continuously at each control station, not only where it was changed

Information and training

  • Written requirement that every control mode change is announced and acknowledged

Competence and drill

  • Callout and acknowledgement drilled rather than briefed
  • assessed on demonstrated performance, not demonstrated knowledge

Team and resource management

  • A designated monitoring role whose job is to hear the callout and confirm it

Scheduled frame checks

  • Periodic state check during a task phase: everyone states what they believe the vessel is doing
 A callout can be made and not heard, or heard and not registered No protocol required mode to be announced. Four mode changes in nine minutes, none verbalised ¶61(g,i,p,q), ¶61(p)
R03

A manual control that moves freely while its commands are being discarded

  1. Operator makes a demand
  2. the control moves normally
  3. nothing happens to the vessel
  4. no message, no resistance, no rejection
 Operator concludes the machinery has failed when in fact the input was ignored; a false diagnosis now drives every subsequent action As above, plus harm from actions taken on the false diagnosis Catastrophic

Inherent safety by design

  • Physical interlock: the lever does not move while automation holds authority. Or the inverse: touching the manual control disengages automation immediately

Protective measures

  • Explicit rejection feedback at the point of input: manual input rejected, vessel in autopilot

Information and training

  • Rule that unresponsive controls prompt a mode check before a fault diagnosis

Competence and drill

  • Mode-check-first reflex drilled until it arrives without deliberation, as aviation drills stripping automation before diagnosing

Team and resource management

  • A second person confirms the mode check has been made before a fault is accepted

Scheduled frame checks

  • One deliberate question before any diagnosis of machinery failure: what mode am I in?
 Whether the operator questions the diagnosis once formed Absent. Demands placed on both thrusters, thrusters did not follow, no rejection indication recorded ¶61(t)
R04

Automation holding a commanded parameter that conflicts with the operator's intent

  1. Autopilot in speed mode holding a commanded speed
  2. operator demands astern to stop
  3. automation reads the deceleration as a disturbance and applies more power ahead
 Vessel accelerates towards the hazard while the operator believes they are stopping it Higher impact energy; impact energy rises with the square of speed Catastrophic

Inherent safety by design

  • Conflict detection: a demand opposing the commanded parameter drops the automation out rather than being overridden by it

Protective measures

  • Alert on demand-versus-response divergence: astern demanded, speed rising

Information and training

  • Explicit instruction on what each automation mode holds and what it will oppose

Competence and drill

  • Drilled recognition of automation opposing an input, and of the correct first action

Team and resource management

  • Second person cross-checks the response against the demand and calls the divergence

Scheduled frame checks

  • When the vessel does the opposite of what was asked, treat that as a mode question before a machinery question
 Whether a conflict alert is noticed during a perceived emergency Absent. Full astern demanded, power to 100 per cent, ship accelerated to 10.7 knots at first contact ¶19, ¶61(ee,hh)
R05

A procedure that is known but has never been performed under pressure

  1. Crew hold the required certificates
  2. the procedure exists on a card
  3. it has never been rehearsed in the condition in which it would be needed
  4. the condition arrives
 The correct action is available and is not reached for, because knowledge and practised response are different capabilities Grounding, collision, loss of vessel, injury, death Catastrophic

Inherent safety by design

  • Remove the need for the procedure. See R01, R03, R04

Protective measures

  • Not applicable: this is a capability gap, not a detectable state

Information and training

  • Written procedures that exist, are current, and are short enough to be used

Competence and drill

  • Periodic drills in realistic conditions
  • assessment against demonstrated performance, not demonstrated knowledge

Team and resource management

  • Drills run as a team so handover, callout and challenge are rehearsed alongside the technical action
 Skill decay between drills Ship had not completed a work-up since being introduced into service; three elements of force generation not completed ¶53(a), ¶257
R06

An emergency checklist whose ordering does not match the urgency of the situation

  1. A fault is diagnosed
  2. the card is worked through in order
  3. the item that would resolve the situation sits partway down it
 Available time expires before the effective step is reached Grounding, collision, loss of vessel, injury, death Critical

Inherent safety by design

  • Order the card by effectiveness and time cost, not diagnostic logic. Aviation strips automation first, then diagnoses

Protective measures

  • Immediate-action items separated visually from the diagnostic items below them

Information and training

  • Immediate actions committed to memory rather than read

Competence and drill

  • Immediate actions drilled to automaticity

Team and resource management

  • One person reads the card while another actions it, so reading does not compete with doing
 Whether the card is picked up at all once a diagnosis has been adopted Bridge cards for thruster control failure never actioned; taking the ship in hand appears at item (iii) ¶277(c)
R07

Oversight assigned to a person who does not understand the system being overseen

  1. A supervisory role exists but is not defined
  2. the person filling it has not completed platform-specific training and holds no endorsement for the vessel
 Redundancy exists on the watch bill and not in practice; nobody present can catch the error Grounding, collision, loss of vessel, injury, death Critical

Inherent safety by design

  • Not applicable

Protective measures

  • Competence gating: platform endorsement required before the supervisory role can be assigned

Information and training

  • Written definition of what the supervisor is watching for and what they are empowered to stop

Competence and drill

  • Platform endorsement completed and current
  • supervisory competence assessed on demonstrated performance

Team and resource management

  • A supervisory role with no other duties while assigned, as the US Navy requires of the helm safety officer
 Whether a qualified supervisor would have been attending to the right thing Supervisor role not clearly defined; not platform endorsed; azimuth thruster courses not completed; inadequate understanding of how the ship operated ¶53(f)
R08

An alert channel carrying more signals than can be attended to

  1. Alarms sound routinely during normal operation
  2. the crew habituate
  3. a meaningful alarm sounds
 A correct and timely warning is delivered and not received Grounding, collision, loss of vessel, injury, death Critical

Inherent safety by design

  • Reduce the alarm population
  • suppress alarms expected in the current mode

Protective measures

  • Prioritisation so a small number of alarms are distinguishable as critical by sound alone

Information and training

  • Documented alarm inventory: what each alarm means, which are critical, and which are expected in the current mode

Competence and drill

  • Simulator exposure to alarm floods and to the single unexpected alarm in an otherwise quiet watch
  • response drilled to the point of habit under controlled deck conditions

Team and resource management

  • Alarm acknowledged aloud by a named person rather than silenced without comment
 Substantial, and it worsens as systems are added Chart system alarm sounded at 18:15:20 with no comment in bridge audio; the Court stopped recording further instances ¶61(v)
R09

Authority over the vessel available at a position where the state of the vessel is not

  1. Thrust control exists at more than one station
  2. mode control exists at one
  3. an operator works from the station without it
 Operator has full authority over the machinery and no local means of establishing or changing what is driving it Grounding, collision, loss of vessel, injury, death Critical

Inherent safety by design

  • Mode control and mode indication at every station that has thrust control

Protective measures

  • Mode annunciation repeated at all stations

Information and training

  • Rule defining which station has the conn

Competence and drill

  • Handover between stations drilled

Team and resource management

  • Conn formally transferred and acknowledged aloud between stations
 Whether the operator checks a display that is not in front of them From the report it is unclear if there were two azimuth thruster control positions; one autopilot switch, on the DP desk. This could be a hypothetical scenario. Figure 2
R10

A vessel employed on a task for which it has not been assessed as fit

  1. An operational need arises
  2. the vessel is capable in general terms
  3. no assessment is made of whether it is equipped, crewed and proceduralised for this specific task
 Vessel operates in a regime for which no procedures, no training pipeline and no risk assessment exist As above, with no defence in depth because none was built for this task Catastrophic

Inherent safety by design

  • Gate the task on formal release
  • no release, no task

Protective measures

  • Independent review of the release decision

Information and training

  • Clear documentation of which roles the vessel is released for

Competence and drill

  • Crew trained and drilled for the specific task, not the general capability

Team and resource management

  • Independent challenge of the release decision by someone outside the chain requesting the task

Scheduled frame checks

  • Pre-task review: assume this has gone badly wrong, and explain why
 Commercial or operational pressure to proceed anyway No evidence surveying was operationally released or approved by the Seaworthiness Board; release system poorly understood ¶50, ¶259
R11

Attention diverted at a moment when it is fully committed

  1. A person approaches the operator during a manoeuvre and asks a question
  2. the question is legitimate, the timing is not
 Operator's attention is split at the moment a control action is being taken Grounding, collision, loss of vessel, injury, death Critical

Inherent safety by design

  • Not applicable

Protective measures

  • Declared sterile period, as aviation applies below ten thousand feet: no non-essential conversation during defined phases

Information and training

  • Shared understanding of when the bridge is closed to non-essential traffic, and the standing to enforce it

Competence and drill

  • Sterile-period discipline drilled, not briefed

Team and resource management

  • Anyone on the bridge empowered to declare the period, not only the senior officer
 The Court addressed this by saying the officer of the watch should not have been distracted, which is a judgement rather than a control Distraction recorded as a contributory factor; no sterile-period rule found ¶53(e)
R12

An event recorder that captures actions but not the state they were taken in

  1. An incident occurs
  2. the recorder holds audio, positions and control demands
  3. it does not hold control mode
 Post-incident: the investigation cannot establish the state of the vessel directly and must infer it from secondary effects Not to persons. To the organisation's ability to learn, and to every vessel that would have benefited from the finding Serious

Inherent safety by design

  • Log control mode as a recorded parameter

Protective measures

  • Periodic verification that recorded data can be retrieved and read

Information and training

  • Procedures for preserving recorded data after an incident

Competence and drill

  • Data retrieval rehearsed rather than assumed
 Low, and this is the cheapest item on the list Mode not recorded; the Court inferred every mode change from thruster behaviour using expert testimony. Potential for undiagnosed faults as inference not correlated to verified inputs. ¶61 footnotes 15-16
R13

A correct procedure is available, fits the situation, and is not actioned

  1. A fault is diagnosed
  2. a procedure exists that addresses it
  3. the crew have been taught it
  4. nobody reaches for it
  5. the situation runs to its conclusion with the procedure unused
 The means of recovery is present and untouched while the vessel continues towards the hazard Grounding, collision, loss of vessel, injury, death Catastrophic

Inherent safety by design

  • Remove the need for the procedure entirely. See R01, R03, R04 — a control that cannot be forgotten beats a procedure that can

Protective measures

  • None identified. Nothing detects the state: correct procedure available, not actioned

Information and training

  • Procedure written, current, and short enough to be reached within the time available

Competence and drill

  • Rehearsal under pressure so the response arrives without deliberation
  • assessment against demonstrated action, not demonstrated knowledge

Team and resource management

  • A second person whose defined task is to confirm the procedure has been actioned, rather than to assume it has

Scheduled frame checks

  • None. Reaching for a procedure requires first noticing that the situation calls for it
 Whether the operator recognises the situation as one the procedure addresses — which the adopted diagnosis may prevent Bridge cards for thruster control failure existed, fitted the situation, and were never actioned. Listed by the Court among the direct causes ¶277(c), ¶245(d)

Derived from the Court of Inquiry into the loss of HMNZS Manawanui, final report dated 31 March 2025. Structure follows the risk control priority in ISO 14971. Not a comment on the court martial proceedings arising from the loss.