Off Course Before the Rock: What Costa Concordia Still Teaches Us About Safety
On the evening of 13 Jan 12, the Costa Concordia was carrying 4,229 people when it struck rocks near the Italian island of Giglio. Thirty-two passengers and crew members died, a major passenger vessel was lost, and an incident that began with a navigational deviation became one of the defining maritime disasters of the modern cruise industry.
The simplest explanation is that Captain Francesco Schettino made a reckless decision and took the ship too close to the island. That is true, and Schettino was ultimately convicted of multiple manslaughter, causing a maritime disaster and abandoning passengers, but stopping the analysis there wastes most of the safety lesson.
The ship had a bridge team. It had qualified officers, navigation equipment, procedures, a safety management system and an organisation ashore, yet those controls did not stop one senior person from taking more than four thousand people towards a known hazard.
That is where Costa Concordia becomes relevant well beyond the maritime industry.
The disaster started before the collision
The Costa Concordia was supposed to follow a planned passage past Giglio. Instead, the vessel deviated from that route for a much closer coastal pass, commonly described as a sail-by salute, and at approximately 2145h its port side struck the Le Scole rocks.
The important point is not simply that somebody changed the plan. Operational plans change every day because weather, equipment, customers, people and operating conditions refuse to read the paperwork beforehand.
The problem is uncontrolled deviation.
When a change materially reduces the distance between an operation and a known hazard, the control process should become stronger. The reason for the change should be understood, the new hazards assessed, operating margins confirmed, affected people briefed and another competent person involved where the possible consequence warrants it.
Costa Concordia did the opposite. The vessel moved closer to the hazard while the decision-making process became increasingly dependent upon the judgement of the person who had directed the deviation.
That pattern is familiar in ordinary workplaces.
A lifting sequence changes because the crane has already arrived. A delivery route is accepted because the customer wants the load immediately, energised work continues because production does not want another shutdown, or worsening weather is accepted because the crew has nearly finished.
Each decision can sound operationally reasonable when described by an experienced person. None of that demonstrates that the changed risk has been controlled.
A functioning change-management system needs to distinguish ordinary discretion from a material deviation requiring reassessment and additional authority. Without that boundary, the person with the greatest confidence can quietly become the entire risk-control system.
Previous success is not proof of safety
Costa Concordia also demonstrates how previous success can distort risk perception. A non-standard activity can occur several times without an incident, and every successful repetition can strengthen confidence without proving that the activity was adequately controlled.
This is one of the problems with normalisation of deviation. The absence of an adverse consequence becomes mistaken for evidence that the practice itself is sound.
It happens when workers regularly bypass an interlock without injury. It happens when pedestrians continually enter a vehicle operating area without being struck, when a poorly restrained load completes another journey, or when a plant defect remains in service because it has not yet failed badly enough to force somebody to act.
Successful exposure is still exposure.
The useful question is not, “Has this hurt anyone before?” It is whether the control remains reliable when the operating margin gets smaller, another variable changes or the same deviation occurs on the wrong day.
A bridge full of people still failed to challenge the decision
The Costa Concordia was not being navigated by one person sitting alone in a wheelhouse. Other officers were present, and the subsequent international safety response addressed voyage planning, bridge navigational procedures and deviations from planned routes.
That makes the authority gradient particularly important.
A workplace can employ competent people, give them information and still construct a culture in which they struggle to challenge the person above them. Rank, reputation, confidence and personality can all influence whether somebody raises a concern directly or gradually turns a warning into a polite observation.
The junior person sees something wrong and asks a question. The senior person dismisses it, so the next challenge becomes softer, and eventually the junior person assumes the senior person knows something they do not.
Silence then starts looking like agreement.
This is why “speak up” campaigns achieve very little unless an organisation defines what speaking up actually means. People need clear escalation expectations and genuine authority to intervene when an operating limit has been exceeded.
A worker who technically possesses stop-work authority but knows that using it against the wrong manager will damage their career does not have effective stop-work authority. They have a sentence in a procedure.
High-consequence operations need something stronger.
The collision was only the beginning
Once Costa Concordia struck the rocks, the original navigational failure became a rapidly developing emergency. Flooding affected machinery spaces, propulsion and electrical systems were lost or impaired, and the vessel began developing the conditions that would eventually leave it lying heavily to starboard near the shore.
At that point, waiting for perfect information carried its own risk.
Serious incidents rarely provide leaders with the comfort of a completed investigation before action is required. The extent of damage may be uncertain while the consequences of delay are already becoming very clear.
Emergency systems therefore need predetermined escalation triggers.
Loss of critical power, uncontrolled flooding, loss of steering, fire beyond first response, structural instability or failure of another critical control should initiate defined actions. The response should not depend upon somebody in the middle of the emergency eventually deciding that events now feel sufficiently disastrous.
The International Maritime Organization (IMO) subsequently examined passenger-ship safety measures arising from Costa Concordia, including voyage planning, bridge procedures, emergency arrangements and life-saving provisions.
The lesson is broader than maritime operations. Emergency plans need to describe what causes escalation, who takes control and what happens next, rather than providing little more than a phone list and an evacuation diagram.
Information is a control
Passengers aboard Costa Concordia were initially reassured that the vessel was experiencing an electrical problem while the actual situation involved major hull damage, flooding and loss of essential systems.
That matters because information changes behaviour.
If passengers believe the problem is minor, they may return to a cabin, leave a lifejacket behind, separate from family members or delay moving towards an assembly area. The same principle applies to workers during any industrial emergency.
Leaders sometimes soften information because they want to avoid panic. That is different from knowingly creating false reassurance.
A useful emergency message can acknowledge what is known, what remains uncertain and what people need to do immediately. It does not require speculation, and it certainly does not require pretending the situation is better than the evidence indicates.
Bad news needs to move quickly through an organisation. When technical information is softened as it passes through management, commercial or communications functions, the people making decisions downstream are no longer responding to the actual event.
One of the clearest lessons was passenger preparation
At the time of Costa Concordia, international requirements permitted the muster of newly embarked passengers within 24 hours of embarkation. That meant passengers could commence a voyage without first completing the full emergency muster process.
The IMO changed that requirement following the disaster.
From 01 Jan 15, newly embarked passengers were required to undergo safety drills, including mustering at lifeboat stations, before departure or immediately after departure. The IMO also recommended measures including additional lifejackets near muster stations and improvements to how passenger emergency instructions were communicated.
That is not a minor administrative amendment.
Passengers cannot respond to an emergency using information they have never been given. They cannot use survival equipment they cannot locate, and equipment is of limited value if access to it depends upon returning through an unsafe part of a vessel during an emergency.
I have a very personal view of that lesson.
I have been the passenger
I survived a fatal boat accident.
Before that incident, I had not been instructed to wear a personal flotation device. I had not received the kind of passenger briefing that prepared me for what happened, and it later became apparent that there were insufficient PFDs available for everybody aboard.
When the accident occurred, we were not safety professionals standing back and analysing a failed system. We were passengers trying to get ourselves out of it.
We ended up effectively rescuing ourselves across volcanic rock. My legs were cut up during the escape, and assistance took more than thirty minutes to reach us.
The first help did not arrive because some immaculate emergency response system operated exactly as written. Another boat had left before us, reached port, realised our vessel had not returned and came back looking.
That experience changed my view of emergency planning permanently.
“Help will come” is not an emergency control. A credible plan needs to consider how anybody knows help is required, what happens if the vessel cannot communicate, how long external assistance may realistically take and what passengers and crew are expected to do during the gap.
Thirty minutes is not particularly remarkable when written into an emergency response plan.
It feels considerably longer from inside the emergency.
PFDs cannot become the passenger's responsibility after the accident
One of the things that stayed with me afterwards was an attempt to push responsibility back towards passengers because we had not been wearing PFDs.
There is a fairly obvious problem with that argument when passengers were never instructed to wear them.
If an operator controls the vessel, the equipment, the passenger briefing and the operating environment, it cannot discover personal responsibility only after the incident. If the risk assessment requires PFDs to be worn, the system needs to make that requirement clear and practicable before the emergency exists.
Australia's current domestic commercial vessel regime reflects exactly that systems approach. AMSA requires operators to address lifejacket wear through their safety management system, including risk assessment and written procedures, while lifejackets that are not being worn must remain readily available when needed.
Passenger operations must also address safety briefings and lifejacket information.
The same principle applies throughout WHS.
An organisation cannot require respiratory protection and then neglect fit testing. It cannot require workers to stay outside a vehicle exclusion zone while designing the work so they continually need to enter it, and it cannot rely on worker behaviour as the final control while controlling every upstream condition that makes the required behaviour difficult.
Personal responsibility exists, but it does not erase organisational control.
An emergency plan has to work after something has failed
Australian domestic commercial vessel operators are required to implement and maintain safety management systems based on the risks of their operations. Current AMSA guidance requires passenger emergency management to address matters including passenger briefings, assembly arrangements, lifejackets, passenger numbers and emergency procedures for events such as collision, grounding, flooding, person overboard and loss of steering.
That is the difference between an emergency plan and an emergency document.
The question is not whether a procedure exists. The question is whether the procedure still works after the foreseeable failure has removed electricity, communications, access, equipment, key personnel or the normal assembly location.
Redundancy matters because emergencies have an irritating habit of damaging the very systems that were supposed to manage them.
A serious exercise therefore needs to test more than a neat evacuation undertaken on a sunny morning while everybody knows it is a drill. Remove a communications system, make the normal access route unavailable, take the usual incident controller out of the scenario or introduce an unaccounted passenger.
Then see whether the system still functions.
Surviving is not the end of the incident
There is another lesson that accident investigations and emergency procedures can handle poorly.
Physical survival does not mean the harm has finished.
Cuts heal. Equipment is recovered, statements are taken, the vessel disappears into an investigation process and organisational attention eventually moves somewhere else.
The people involved do not necessarily move at the same speed.
My own maritime experience did not finish when we reached safety. The fear, loss of control, deaths associated with the incident, the experience of having to rescue ourselves and the delay before assistance arrived remained long after the physical injuries were dealt with.
How an organisation behaves afterwards matters as well.
An affected person can deal with the trauma of the original event and then encounter a second layer of harm through blame, minimisation, defensive communication or having to fight for a straightforward explanation of what occurred.
This is why post-incident psychological health should sit inside serious incident management rather than being outsourced to a telephone number at the bottom of an email.
That does not mean diagnosing people or forcing them into counselling. It means providing accurate information, maintaining contact, offering appropriate support, recognising that responses may develop later and ensuring managers do not compound the incident by becoming defensive or shifting responsibility before the evidence has been established.
The Australian lesson is not about copying maritime rules
Costa Concordia occurred within an international maritime regulatory system, not Australian WHS or OHS legislation. The legal frameworks are different, but the control principles translate remarkably well.
A high-consequence operation requires defined operating limits. Material deviations need additional scrutiny, authority must have boundaries, competent people must be able to challenge decisions and emergency escalation needs to begin before complete failure has been proven.
People exposed to the risk need useful information before they need to act on it.
Survival equipment needs to be sufficient and accessible, rescue assumptions need to be realistic, and the organisation needs to remain responsible for the people affected after the immediate danger has passed.
AMSA's current approach to domestic commercial vessel safety similarly requires a risk-based safety management system, passenger safety arrangements and emergency procedures rather than treating passenger safety as something improvised after departure.
That is the real lesson from Costa Concordia.
Thirty-two people did not die simply because a ship struck a rock. They died within a sequence where deviation, authority, monitoring, emergency command, communication and evacuation repeatedly failed to interrupt what came next.
The job of a safety system is not to assume that experienced people will always make the right decision.
It is to make sure that when somebody does not, there is still something left in the system capable of stopping them.
Comments