619

1 INTRODUCTION

Passenger embarkation and debarkation at a fixed

berth normally take place between a vessel and a

comparatively stable shore structure. At anchorage,

however, passengers move between two floating

platforms that heave, roll and yaw independently. The

changing gap between a ship and a small boat creates

a short but safety-critical exposure in which a loss of

balance, a failure of the access arrangement, or a

delayed recovery response can rapidly produce serious

injury or fatality. Research on pilot and personnel

transfer has repeatedly identified relative motion,

unsuitable access, communication failure, human

factors and environmental conditions as dominant

contributors to accidents [3, 6, 17, 23, 28, 31, 32].

The problem is particularly important for

Indonesian pioneer shipping services. These services

provide essential mobility and logistics to

underdeveloped, frontier and outermost areas that are

not commercially attractive to regular operators.

Vessel design and service patterns are adapted to

remote routes, but port infrastructure and local feeder

arrangements remain uneven [4, 11, 16]. At Sofyanin,

Pioneer Service Vessel R-72 must remain at anchorage

Formal Safety Assessment of Passenger Embarkation

and Debarkation at Anchorage: A Case Study

of an Indonesian Pioneer Service Vessel

F. Muhammad

, D. Widarbowo

, M. Idris

, M. Kendek

, F. Filemon

, D. Haryanto

& S. Suganjar

Politeknik Pelayaran Sorong, Sorong, Southwest Papua, Indonesia

Politeknik Pelayaran Barombong, Makassar, South Sulawesi, Indonesia

ABSTRACT: Passenger transfer between an anchored pioneer service vessel and local connecting boats combines

relative motion, limited infrastructure and fragmented operational authority. This study develops risk-control

options and an International Safety Management Code-based operating procedure for such transfers. A

qualitative single-case design with an adapted semi-quantitative Formal Safety Assessment was applied to

Pioneer Service Vessel R-72 at Sofyanin anchorage, Indonesia. Evidence comprised case observations, Safety

Management System documents and role-based expert judgement from a master, a harbour master and a certified

ISM Code auditor. Fifteen hazards were identified, while five common scenarios were scored on a 5 × 5 likelihood-

severity matrix and summarised by median and range. The initial risks of falling overboard and boat capsizing

were Extreme, each with a median score of 20. Collision between boats, passenger crushing or impact, and loss

of boat position were High, each with a median score of 12. A layered control package reduced four scenarios to

Medium, but capsizing remained High with a residual median of 10 because catastrophic severity and uncertainty

in overload control persisted. Eight control groups were formulated and mapped to ISM Code clauses 5-12. The

resulting Layered Passenger Transfer Safety System integrates no-go criteria, boat acceptance, fit-for-purpose

access, transfer-zone control, personal flotation devices and rescue readiness, competence and vulnerable-

passenger arrangements, organisational learning, and formal local coordination. A written procedure alone

cannot establish tolerable risk unless capacity, equipment, emergency readiness and stop-work authority are

objectively verified. Controlled field trials remain necessary before operational adoption.

http://www.transnav.eu

the International Journal

on Marine Navigation

and Safety of Sea Transportation

Volume 20

Number 3

September 2026

DOI: 10.12716/1001.20.03.10

620

because no permanent berth is available. Passengers

are carried between shore and ship by locally operated

boats and then transferred through a ship-side access

arrangement. The service is socially necessary, but the

operational interface is exposed to overloading, limited

freeboard, inadequate personal flotation devices,

unstable boat positioning, unsuitable access and weak

supervision.

A previous study of the same service context

documented structural, policy, operational and

cultural gaps in safety-standard implementation [25].

That diagnostic work established the need for stronger

supervision, equipment and safety awareness, but it

did not complete an integrated Formal Safety

Assessment, compare initial and residual risks across

role-based experts, or translate the controls into an

auditable Safety Management System procedure. The

present study therefore addresses a distinct research

question and uses an additional expert-judgement

dataset to develop a risk-control architecture and an

ISM Code-mapped operating procedure.

Formal Safety Assessment (FSA) offers a structured

sequence for hazard identification, risk analysis, risk-

control options, cost-benefit or feasibility assessment,

and recommendations for decision-making [14, 30].

FSA is especially useful where accident statistics are

sparse, provided that the basis, uncertainty and

limitations of expert judgement are made explicit [5,

14]. The ISM Code complements this risk-based logic

by requiring documented responsibilities, resources,

shipboard procedures, emergency preparedness,

reporting, maintenance, document control, verification

and management review [2, 8, 9, 10, 13, 19, 33]. Under

SOLAS Chapter IX, safety is not demonstrated by the

existence of a procedure alone. It must be shown

through implementation and objective evidence [13,

18].

This study asks two questions. First, which Risk

Control Options can practically reduce passenger-

transfer risk at anchorage in a remote operating

environment? Second, how can these controls be

converted into an ISM Code-based procedure that

preserves the master’s overriding authority and

clarifies the roles of the vessel, boat operator, company,

local parties and harbour master? The article

contributes an adapted FSA application for public

passenger transfer, a transparent synthesis of three

institutional perspectives, and a Layered Passenger

Transfer Safety System designed for locations where

permanent infrastructure is not yet available.

2 THEORETICAL BASIS

2.1 Passenger transfer as a socio-technical operation

Personnel-transfer research has often focused on

maritime pilots, offshore personnel or ship-to-ship

operations. These studies show that accidents are

rarely explained by a single unsafe act. They emerge

from the interaction of vessel motion, access geometry,

equipment condition, communication, workload,

training, organisational pressure and emergency

capability [1, 6, 17, 21, 23, 28, 31, 32]. A system

perspective is therefore more appropriate than an

approach that attributes failure solely to passenger

behaviour or boat-operator error [34, 35].

2.2 Technical access and operational boundaries

Pilot-transfer arrangements provide useful technical

lessons on rigging, handholds, supervision,

communication and rescue readiness, but they cannot

be copied uncritically for general passengers. A pilot

ladder is intended for a trained and medically fit

professional and is not automatically suitable for all

members of the travelling public [3, 17, 23]. For this

study, vulnerability is treated functionally: a passenger

is considered vulnerable when the available transfer

arrangement cannot be used safely without additional

assistance or an alternative arrangement. This

definition is used for operational screening only

because the study did not collect subgroup-specific

exposure or accident data. The selected access

arrangement must therefore be fit for purpose,

properly secured, illuminated, inspected and

maintained. Operational limits must also be explicit.

Without no-go criteria, a decision can be distorted by

schedule pressure, social expectations or normalisation

of deviance.

2.3 FSA, risk matrices and layered control

The IMO FSA framework is a decision-support process

rather than a single risk-analysis technique [14]. In this

study, a 5 × 5 matrix was used as the semi-quantitative

technique within FSA Step 2. Risk matrices are suitable

for prioritisation when exposure data are limited, but

their categories are study-specific and must not be

presented as universal IMO thresholds [7, 30]. Controls

were developed as layered defences. Avoiding

exposure and engineering controls were prioritised

before administrative controls and personal protective

equipment. This ordering is important because a

checklist or lifejacket does not correct an overloaded

boat, a defective access point or an uncontrolled gap.

2.4 ISM Code integration

The ISM Code connects operational controls with

organisational accountability. The master must have

clear authority to make safety decisions, while the

company must provide resources and support.

Shipboard operations must be planned, emergency

scenarios must be tested, equipment must be

maintained, and non-conformities and near misses

must generate corrective and preventive action [2, 8-10,

13, 19, 24, 26, 33]. For the present case, the relevant

interface extends beyond the ship. Boat operators,

agents and local officials may support passenger

registration, queuing and communication, but they do

not replace the legal functions of the harbour master

under Indonesian shipping law and sailing-approval

procedures [15, 22].

3 MATERIALS AND METHODS

3.1 Study design and case boundary

The research used a qualitative descriptive single-case

design with a semi-quantitative risk component. The

case boundary covered the complete passenger-

transfer chain for Pioneer Service Vessel R-72 at

Sofyanin anchorage: passenger preparation ashore,

selection and loading of the connecting boat, transit,

621

approach, ship-side transfer, head count,

documentation and post-operation learning. This

broad boundary was selected because hazards can be

created before the passenger reaches the access point,

for example through an inaccurate manifest, poor

baggage distribution or the acceptance of an unfit boat.

3.2 Evidence sources and expert panel

Three evidence streams were triangulated. First, the

study used field conditions and risk observations

documented in the earlier diagnostic case study [25].

Second, applicable Safety Management System

materials, operating records and regulatory

requirements were reviewed. Third, semi-structured

role-based expert judgement was obtained from a

master, a harbour-master representative and a certified

ISM Code auditor. The interview guide followed

established principles for developing semi-structured

qualitative instruments and for interviewing maritime

experts [20, 29]. The panel was purposive rather than

statistically representative. Each expert represented a

function that controls a different part of the system:

real-time shipboard decision-making, statutory

oversight and SMS verification.

The master held an Indonesian Nautical Expert

Certificate Level I (ANT-I), had four years of

experience on 3T routes and two years of experience

with transfer at anchorage. The harbour-master expert

was a marine inspector with six years of relevant

maritime-safety supervision and vessel-inspection

experience. The ISM expert was a certified auditor with

experience evaluating objective evidence, non-

conformities and corrective action. All three experts

provided informed consent. Summaries, scores and

control interpretations were returned for member

checking and confirmed before synthesis. Personal

identifiers were coded NK-01, SY-01 and AU-01 in the

analytical dataset.

3.3 Adapted FSA procedure

The study followed five linked stages. Step 1 identified

hazards through process mapping, document analysis

and expert elicitation. Step 2 numerically scored only

H1-H5 because these were the five hazards for which

all three expert instruments contained comparable

initial and residual ratings. H6-H15 remained in the

hazard register and informed the SOP, but they were

not assigned consolidated scores because doing so

would have required imputing ratings that were not

present in the source data. Step 3 grouped the

proposed measures into Risk Control Options with an

assigned control owner and required evidence. Step 4

used a qualitative feasibility screen because reliable

monetary loss, exposure and accident-cost data were

not available. The screen considered safety benefit,

initial and recurring cost, personnel demand,

implementation time, dependency on external parties,

feasibility in Indonesia's 3T (underdeveloped, frontier

and outermost) setting and effect on service continuity.

Priority was assigned qualitatively rather than through

a weighted numerical index: measures that directly

addressed an Extreme or High hazard, could be

implemented with low or moderate burden, and did

not depend on major external infrastructure were

placed earlier in the implementation sequence.

Measures requiring technical design, capital approval

or major infrastructure were placed in the medium- or

long-term horizon. Step 5 converted the preferred

controls into an ISM Code-based SOP structure and

decision rules. Figure 1 summarises the design.

3.4 Risk scoring and synthesis

Likelihood and severity were each scored from 1 to 5.

Severity ranged from negligible to catastrophic.

Likelihood ranged from very rare to very frequent and

was interpreted with reference to exposure, relevant

near misses and expert experience. The risk score was

calculated as:

R L S=

(1)

where R is the risk score, L is likelihood and S is

severity. The 5 × 5 matrix is not the FSA framework

itself; it is the study-specific semi-quantitative scoring

tool used within FSA Step 2. Study-specific categories

were Low (1-4), Medium (5-9), High (10-16) and

Extreme (17-25). High and Extreme scores required

additional control or suspension before the operation

could continue. These category boundaries are

decision aids for the R-72 case and should be

recalibrated if the method is applied to another vessel,

location, season or operating profile. Because the scores

were ordinal and the panel contained three

purposively selected experts, the synthesis used the

median as the central value and the minimum-

maximum range to retain disagreement. No inferential

statistics were applied.

3.5 Qualitative coding and trustworthiness

Interview and document material was coded against

FSA stages, direct causes, human factors,

organisational factors and ISM Code clauses. The

analysis deliberately retained dissent. For example, a

lower residual score from one expert was not treated as

consensus when the other two experts considered

control performance uncertain. Trustworthiness was

strengthened through source triangulation, role

triangulation, an audit trail of scoring decisions and

member checking. The principal limitation is that the

RCO package and SOP had not yet undergone a

controlled field trial at the time of analysis.

Table 1. Expert panel and analytical roles

Code

Role

Qualification and

experience

Analytical contribution

NK-

Master

ANT-I; 4 years on 3T

routes; 2 years of

anchorage transfer

Real-time go/no-go

decision, boat and vessel

condition, duties and

emergency response

SY-

Harbour

master /

marine

inspector

6 years in maritime-

safety supervision

and vessel inspection

Statutory oversight,

capacity verification, local

coordination and limits of

delegated tasks

AU-

Certified ISM

Code auditor

Relevant audit and

SMS-verification

experience

Objective evidence, ISM

clause mapping, non-

conformity, CAPA and

management review

622

Figure 1. Research design and adapted FSA workflow

4 RESULTS

4.1 Existing operation and hazard identification

The operational process comprises five stages:

preparation ashore, boat transit, approach, passenger

transfer and completion. The most critical interface

occurs when the connecting boat is alongside the ship

because the two platforms move differently and the

available gap changes rapidly. Nevertheless, the

analysis showed that the risk chain starts earlier, when

the boat is selected, capacity is interpreted, baggage is

distributed and vulnerable passengers are identified. It

also continues after transfer if near misses and

equipment defects are not reported.

The first five hazards were common to all three

scoring instruments and were therefore used for cross-

expert comparison. This decision followed the

comparability rule defined in Section 3.3: a

consolidated numerical result was reported only when

all three experts had assessed the same hazard using

comparable rating fields. Hazards H6-H15 were

retained in the register and in the SOP design, but they

were not assigned a consolidated numerical score

because comparable ratings from all three experts were

not available. This distinction avoids presenting

incomplete scoring as consensus.

Table 2. Hazard register for passenger transfer at anchorage

Hazard

scenario

Main causes

Credible

consequences

Passenger falls

overboard

Relative motion; slippery

footing; unsuitable access;

hands occupied; unclear

command

Serious injury,

drowning or death

Boat capsizes or

loses stability

Overloading; poor load

distribution; low

freeboard; weather; boat

condition

Multiple casualties,

boat loss and

suspension of

service

Collision

between boats

No queue; simultaneous

approach; communication

failure

Injury, damage and

person overboard

Passenger is

crushed or

struck

Changing gap; inadequate

fenders; poor timing;

unstable boat

Limb injury or fall

overboard

Boat loses

position

Engine, steering or line

failure; operator error;

current and waves

Impact, fall or

separation from

access

Access

arrangement

fails

Incorrect rigging; weak

securing point; corrosion;

inadequate inspection

Fall or multiple

serious injuries

PFD absent,

unsuitable or

not worn

Insufficient number;

wrong size; damage; non-

compliance

Drowning after fall

or capsizing

Baggage and

passenger move

together

Occupied hands;

restricted space;

distraction

Loss of balance,

crushing or falling

objects

Vulnerable

passenger

cannot use

access

Physical limitation;

unsuitable PFD;

improvised assistance

Fall, severe injury or

delayed evacuation

H10

Lighting or

visibility is

inadequate

Night operation; glare;

shadow; failed lighting

Misstep and failed

visual

communication

H11

Communication

fails or

crowding

develops

No radio; language

difference; non-standard

command

Unsynchronised

movement, panic or

collision

H12

Anchor drags

or ship

movement

changes

Holding-ground failure;

wind/current change; poor

monitoring

Unsafe transfer

point or boat

displacement

H13

Fatigue or

insufficient

personnel

Long operation; work-rest

issue; conflicting watch

duties

Human error and

delayed response

H14

MOB or

recovery

response is

delayed

No lookout; lifebuoy not

ready; inadequate

recovery method

Escalation from

survivable event to

fatality

H15

Manifest or

reporting is

inaccurate

Weak head count; hidden

near miss; poor document

control

Delayed missing-

person detection

and repeated hazard

4.2 Initial risk

Table 3 shows that none of the five jointly scored

hazards was initially rated Low or Medium. Falling

overboard and capsizing were Extreme, while the

remaining scenarios were High. The ranges are

analytically important because they show different

assumptions about exposure and credible consequence

rather than measurement error.

Table 3. Initial risk scores from the three expert perspectives

Hazard

SY-

NK-

AU-

Median

(range)

Category

Falling overboard

8 (6-8)

Medium

Boat capsizing

10 (5-10)

High

Collision between

boats

6 (4-6)

Medium

Crushing or impact

6 (2-6)

Medium

Loss of boat position

5 (4-8)

Medium

For H1, a residual median of 8 required fit-for-

purpose access, one passenger at a time, hands free,

correctly fitted PFDs, a dedicated lookout and a

workable recovery arrangement. For H3 and H4, most

risk reduction came from lower likelihood through

one-boat-at-a-time control, a holding area, fendering

and a single command chain. For H5, the score

depended on verified engine and steering readiness, a

competent operator, suitable securing and an abort

procedure. Documentation supported learning and

audit, but it did not substitute for physical reliability.

4.4 Risk Control Options

The eight RCO groups in Table 5 form a multi-layer

defence. Each control has a designated owner and a

form of objective evidence. A control was not treated

as implemented merely because it appeared in a draft

procedure.

Table 5. Risk Control Options, ownership and objective

evidence

RCO group

Core controls

Control

owner

Objective

evidence

RCO-

Operating

limits and

stop-work

No-go weather and

motion limits; anchor

movement; crowding;

access defect;

communication loss

Master /

transfer

PIC

Go/no-go

checklist

and decision

log

RCO-

Boat capacity

and fitness

Documented

capacity; freeboard;

hull; engine; steering;

fenders; lines; PFDs;

competent operator

Boat

operator,

agent and

vessel

Boat-

acceptance

checklist

and

manifest

RCO-

Fit-for-purpose

access

Suitable arrangement;

securing; handholds;

lighting; fendering;

inspection and

maintenance

Company

and

master

Design

basis,

inspection

and

maintenance

record

RCO-

Transfer zone

and

communication

Holding area; one

boat at a time; call-in;

clear-to-approach;

read-back; exclusion

zone

Vessel PIC

and boat

operator

Communi-

cation and

queue

record

RCO-

PFDs and

rescue

readiness

Correct sizes;

lookout; lifebuoy and

line; recovery

method; first aid;

drills

Master

and

emergency

team

Equipment

check and

drill record

RCO-

Competence

and vulnerable

passengers

Role-based staffing;

operator competence;

understandable

briefing; screening;

safe alternative or

delay

Company,

master

and shore

party

Training

record,

RACI and

passenger

assessment

RCO-

Reporting,

audit and

learning

Near miss; defect;

NCR; CAPA; internal

audit; management

review

DPA and

company

Deck log,

NCR/CAPA

and audit

trail

RCO-

Formal local

coordination

Written support for

registration, queuing,

education and

communication

without transferring

statutory authority

Harbour

master

and

authorised

local

parties

Local rule,

assignment

letter and

inspection

report

4.5 Operational feasibility and implementation sequence

A monetised GCAF or NCAF calculation was not

possible because exposure, accident-frequency and

consequence-cost data were incomplete. The

qualitative screen therefore focused on relative safety

benefit and implementation burden. The priority labels

in Table 6 were assigned by comparing each option

against the criteria specified in Section 3.3, without

converting those criteria into a composite numerical

score. An intervention was placed in an earlier horizon

when it directly reduced an Extreme or High risk,

could be implemented with low or moderate resource

burden, and was feasible without major third-party or

infrastructure dependency. Options requiring

technical design, capital approval, specialised assets or

shore infrastructure were placed later. This sequence

prevents a common failure in remote operations:

postponing low-cost high-value controls while waiting

for permanent infrastructure. It also prevents the

opposite failure, in which administrative measures are

used indefinitely to avoid necessary engineering

investment.

624

Table 6. Phased feasibility and implementation priorities

Horizon

Intervention

Safety

benefit

Cost burden

feasibility

Implementa

tion decision

Immediate

No-go and stop-

work; core boat

checks; one-boat

transfer zone;

briefing; manifest;

reporting

Very

high

Low

High

Before the

operation

Short term

PFDs in multiple

sizes;

radio/megaphone;

fenders; lighting;

lifebuoy; first aid;

drills

High

Medium

High

Within one

operating

cycle

Medium

term

Purpose-built

access; dedicated

tender; platform

improvement;

digital reporting

Very

high

Medium

-high

Medium

Following

technical

design and

budget

approval

Long term

Pontoon, landing

facility or

permanent berth

Very

high

High

Location-

dependent

Infrastructure

investment

programme

4.6 ISM Code-based SOP architecture

The SOP was designed as a controlled SMS document

rather than an isolated checklist. It covers pre-transfer

assessment, boat acceptance, go/no-go, approach,

passenger movement, functional screening of

passengers who may require assistance or an

alternative arrangement, baggage, emergency

response, completion, reporting and review. The

company and Designated Person Ashore provide

resources and verification, while the master retains the

final decision to begin, postpone or stop the operation.

Figure 3 summarises the implementation sequence and

shows that a failed acceptance criterion returns the

operation to a stop-and-reassess state rather than

allowing the transfer to continue.

Table 7. Mapping of the proposed controls to ISM Code

clauses 5-12

Clause

Management

focus

Application to the transfer

SOP

Required

objective

evidence

Master’s

responsibility

and authority

Overriding authority;

go/no-go and protected

stop-work

Decision record

and standing

orders

Resources and

personnel

Role-based staffing,

competence, briefing and

fatigue control

Manning plan,

training and rest

records

Shipboard

operations

Ship-specific, location-

aware transfer SOP

Controlled SOP,

checklist and

RACI

Emergency

preparedness

MOB, capsizing, injury,

engine/steering failure and

communication-loss

response

Drill records,

response time

and equipment

checks

Reports and

analysis

Near-miss, defect, root-

cause analysis and CAPA

NCR, CAPA and

trend report

Maintenance

Access, fenders, lighting,

radio, PFDs and recovery

equipment

Planned-

maintenance and

defect records

Documentation

Version control, manifest,

communication log and

record retention

Revision register

and controlled

forms

Company

verification

and review

Field trial, internal audit

and management review

Audit report,

minutes and

action closure

Figure 3. Implementation flow for passenger-transfer control

4.7 Layered Passenger Transfer Safety System

The synthesis produced the five-layer model in Figure

2. The first layer prevents exposure when operating

limits are not met. The second ensures technical

integrity. The third controls traffic, communication and

passenger flow. The fourth limits consequences and

supports recovery. The fifth creates accountability and

organisational learning. The model is intentionally

redundant: failure of one layer should not immediately

produce a casualty because the remaining layers

continue to function.

Figure 2. Layered Passenger Transfer Safety System derived

from the FSA and expert synthesis











































625

5 DISCUSSION

5.1 From individual caution to system control

The findings do not support the view that passenger-

transfer accidents are primarily the result of

carelessness. The same passenger action can be safe or

unsafe depending on relative motion, access geometry,

fendering, instructions, staffing and recovery

readiness. This aligns with systemic maritime-safety

research, which treats safety as an emergent property

of interacting technical and organisational controls [34,

35]. The practical implication is that briefing

passengers to “be careful” cannot compensate for an

overloaded boat or an access arrangement that is

unsuitable for the user population.

5.2 Why capsizing remains the controlling scenario

Capsizing remained High after controls because its

credible consequence is multiple fatalities and because

the reliability of overload prevention was not yet

demonstrated. The auditor’s lower residual score

assumed complete verification of capacity, manifest,

loading and boat fitness. The master and harbour-

master experts were more conservative because locally

operated boats may lack documented capacity,

baggage can be added informally and an alternative

boat may not be immediately available. The

conservative median is therefore appropriate until a

field trial demonstrates consistent compliance. This is

also an example of why residual risk should be

conditional on safeguards rather than reported as an

unconditional property of a written procedure.

5.3 The relationship between FSA and the ISM Code

FSA identifies what must be controlled and why, while

the ISM Code determines how the organisation must

make the control repeatable and auditable. The RCOs

become operationally meaningful only when they are

assigned to an owner, supported by resources and

linked to objective evidence. This finding is consistent

with accident and implementation studies showing

that the major weakness of an SMS is often the gap

between documented procedures and work as actually

performed [2, 8-10, 24, 33]. The proposed SOP therefore

includes go/no-go records, boat-acceptance checks,

communication logs, inspection records, drills, near-

miss reporting and CAPA rather than a sequence of

passenger instructions alone.

5.4 Contextual safety for remote services

Remote service continuity and safety should not be

framed as competing absolutes. The absence of a

permanent berth does not justify uncontrolled transfer,

but an immediate infrastructure solution may also be

financially and logistically unrealistic. The phased

control strategy offers a defensible bridge. Low-cost

controls with high safety benefit, including stop-work

criteria, capacity verification, queuing, communication

and reporting, can be applied immediately. Equipment

upgrades can follow in the short term, while purpose-

built access, a dedicated tender, pontoon or berth

require technical design and investment planning. The

ALARP logic remains relevant, but administrative

feasibility cannot be used to avoid an engineering

measure when the remaining risk is intolerable.

5.5 Contribution and limitations

The main conceptual contribution is the Layered

Passenger Transfer Safety System shown in Figure 2. It

combines five mutually supporting layers: operating

limits, technical integrity, controlled transfer-zone

operations, emergency resilience, and governance with

organisational learning. The model is transferable as an

analytical structure, but its numerical scores are not

automatically transferable to another vessel, route or

season. Likewise, the Low-Medium-High-Extreme

bands used in this case should not be treated as

universal IMO acceptance thresholds. A new

application should reassess the local hazards, exposure

pattern, operating limits and consequence assumptions

before adopting numerical categories. The study is

limited by a single case, three role-based experts,

incomplete historical exposure data and the absence of

a field trial. The additional hazards H6-H15 were

identified but not scored by all three experts, so they

should be included in the next validation cycle. A

controlled before-after field trial should record at least

checklist completion, boat-capacity or loading

violations, near misses, stop-work decisions,

equipment defects and closure time, and man-

overboard recovery time. These indicators would

allow the proposed controls to be evaluated against

observed operational performance rather than

procedural compliance alone.

6 CONCLUSIONS

1. Passenger transfer at anchorage is a high-risk socio-

technical operation, not a simple passenger-

movement task. In the R-72 case, falling overboard

and capsizing had Extreme initial median scores of

20, while collision, crushing or impact, and loss of

position had High initial median scores of 12.

2. A layered RCO package reduced four scenarios to

Medium. Boat capsizing remained High with a

residual median of 10, showing that the operation

cannot be declared controlled until documented

capacity, loading discipline, boat fitness and

alternative arrangements are demonstrated in

practice.

3. Eight RCO groups were formulated: operating

limits and stop-work, boat capacity and fitness, fit-

for-purpose access, transfer-zone control and

communication, PFDs and rescue readiness,

competence and vulnerable-passenger

arrangements, reporting and audit, and formal local

coordination. These controls were mapped to ISM

Code clauses 5-12 and converted into a controlled

SOP structure.

4. The master retains final go/no-go authority and

must be protected from schedule or commercial

pressure. The harbour master retains statutory

oversight, while local parties may support

registration, queuing and communication only

through clearly defined arrangements.

5. Before adoption as operational policy or local rules,

the SOP should undergo a tabletop exercise, a

controlled field trial, audit and revision. The field

626

trial should use observable performance indicators

such as checklist completion, capacity or loading

violations, near misses, stop-work decisions, defect

closure and man-overboard recovery time. Future

research should replicate the method across vessels,

seasons and anchorage environments and should

develop quantitative cost-benefit estimates when

reliable exposure and consequence data become

available.

APPENDIX A. MANDATORY STOP-WORK

CRITERIA

The following conditions require immediate

suspension or non-commencement of passenger

transfer. Restart is permitted only after the condition

has been corrected, the risk has been reassessed and the

master has authorised continuation.

1. Weather, waves, current or visibility exceed

validated vessel- and location-specific operating

limits.

2. Boat capacity, freeboard, stability or condition

cannot be verified, or overloading is observed.

3. PFDs are insufficient, incorrectly sized, defective or

not worn correctly.

4. The access arrangement, securing point, fenders,

lighting, communication or recovery equipment

fails the checklist.

5. The anchor drags, ship movement changes

unexpectedly, traffic becomes unsafe or the boat

cannot maintain position.

6. A vulnerable passenger cannot be transferred safely

using the available arrangement.

7. More than one boat enters the transfer point,

crowding develops or an operator does not follow

the PIC’s instruction.

8. Passenger transfer conflicts with cargo or baggage

handling at the same access point.

9. Personnel are insufficient, fatigued, unclear about

their roles or required watchkeeping would be

compromised.

10. A serious near miss, injury, equipment failure or

loss of communication occurs. The operation

remains stopped until reassessment is completed.

REFERENCES

[1] Arici, S.S., Akyuz, E., Arslan, O. (2020). Application of

fuzzy bow-tie risk analysis to maritime transportation:

The case of ship collision during the STS operation. Ocean

Engineering, 217, 107960.

https://doi.org/10.1016/j.oceaneng.2020.107960

[2] Batalden, B.-M., Sydnes, A.K. (2014). Maritime safety and

the ISM Code: A study of investigated casualties and

incidents. WMU Journal of Maritime Affairs, 13(1), 3-25.

https://doi.org/10.1007/s13437-013-0051-8

[3] Behforouzi, M. (2021). Implementation of smart pilotage

to safeguard pilots from pilot ladder accidents. Pomorski

Zbornik, 60(1), 65-84. https://doi.org/10.18048/2021.60.04

[4] Berlianto, W.R., Augustriandi, A., Suparno, S., Mukhtar,

S. (2025). Integrasi pelayaran perintis (pioneer shipping)

dan Tol Laut untuk mengoptimalkan return cargo di

Indonesia. OPTIMAL Jurnal Ekonomi dan Manajemen,

5(2), 634-647. https://doi.org/10.55606/optimal.v5i2.6465

[5] Browne, T., Veitch, B., Taylor, R., Smith, J., Smith, D.,

Khan, F. (2021). A knowledge elicitation study to inform

the development of a consequence model for Arctic ship

evacuations: Qualitative and quantitative data. Data in

Brief, 39, 107612. https://doi.org/10.1016/j.dib.2021.107612

[6] Camliyurt, G., Park, Y., Kim, D., Kang, W.S., Park, S.

(2023). Machine learning with multi-source data to

predict and explain marine pilot occupational accidents.

Journal of Marine Science and Technology, 31(4).

https://doi.org/10.51400/2709-6998.2709

[7] Chaal, M., Bahootoroody, A., Basnet, S., Valdez Banda,

O.A., Goerlandt, F. (2022). Towards system-theoretic risk

assessment for future ships: A framework for selecting

Risk Control Options. Ocean Engineering, 259, 111797.

https://doi.org/10.1016/j.oceaneng.2022.111797

[8] Demirci, S.M.E., Cicek, K. (2023). Innovative strategy

development approach for enhancing the effective

implementation of the International Safety Management

(ISM) Code. Transportation Research Record, 2677(1), 25-

48. https://doi.org/10.1177/03611981221098394

[9] Ghosh, S., Abeysiriwardhane, A. (2021). The influence of

information technology on the implementation of the

International Safety Management (ISM) Code: A shift

from paper-based to paperless ships. Maritime

Technology and Research, 3(3), 299-311.

https://doi.org/10.33175/mtr.2021.249024

[10] Ghosh, S., Daszuta, W. (2019). Failure of risk assessment

on ships: Factors affecting seafarer practices. Australian

Journal of Maritime & Ocean Affairs, 11(3), 185-198.

https://doi.org/10.1080/18366503.2019.1658277

[11] Hadi, E.S., Manik, P., Iqbal, M. (2018). Influence of hull

entrance angle “Perintis 750 DWT” toward ship

resistance. MATEC Web of Conferences, 159, 01057.

https://doi.org/10.1051/matecconf/201815901057

[12] Hamilton, A.B., Finley, E.P. (2020). Qualitative methods

in implementation research: An introduction. Psychiatry

Research, 283, 112629.

https://doi.org/10.1016/j.psychres.2019.112629

[13] International Maritime Organization (2017). Revised

guidelines on the implementation of the International

Safety Management (ISM) Code by Administrations,

Resolution A.1118(30). London: IMO.

https://wwwcdn.imo.org/localresources/en/KnowledgeC

entre/IndexofIMOResolutions/AssemblyDocuments/A.1

118(30).pdf

[14] International Maritime Organization (2018). Revised

guidelines for Formal Safety Assessment (FSA) for use in

the IMO rule-making process, MSC-

MEPC.2/Circ.12/Rev.2. London: IMO.

https://wwwcdn.imo.org/localresources/en/OurWork/Sa

fety/Documents/MSC-MEPC%202-Circ%2012-

Rev%202.pdf

[15] Indonesia (2008, as amended in 2024). Law of the

Republic of Indonesia No. 17 of 2008 on Shipping.

https://peraturan.bpk.go.id/Details/39060

[16] Indonesia (2021). Presidential Regulation No. 27 of 2021

on Public Service Obligations for the Transport of Goods

to and from Underdeveloped, Remote, Outermost and

Border Areas.

https://peraturan.bpk.go.id/Details/165696/perpres-no-

27-tahun-2021

[17] Jiang, Z., Xiao, Z., Feng, Y., Cao, Y. (2024). Analysis of

risk influential factors of marine pilots during

embarkation and debarkation. Journal of Marine

Engineering & Technology, 24(1), 1-14.

https://doi.org/10.1080/20464177.2024.2397847

[18] Joseph, A., Dalaklis, D. (2021). The International

Convention for the Safety of Life at Sea: Highlighting

interrelations of measures towards effective risk

mitigation. Journal of International Maritime Safety,

Environmental Affairs, and Shipping, 5(1), 1-11.

https://doi.org/10.1080/25725084.2021.1880766

[19] Junaidi, A., Yudo, H., Ab-Samat, H.A. (2024). Identifying

trends in maritime safety management system studies: A

review. TransNav, the International Journal on Marine

Navigation and Safety of Sea Transportation, 18(4), 775-

784. https://doi.org/10.12716/1001.18.04.03

627

[20] Kallio, H., Pietilä, A., Johnson, M., Kangasniemi, M.

(2016). Systematic methodological review: Developing a

framework for a qualitative semi-structured interview

guide. Journal of Advanced Nursing, 72(12), 2954-2965.

https://doi.org/10.1111/jan.13031

[21] Kaptan, M. (2021). Risk assessment of ship anchorage

handling operations using the fuzzy bow-tie method.

Ocean Engineering, 236, 109500.

https://doi.org/10.1016/j.oceaneng.2021.109500

[22] Kementerian Perhubungan Republik Indonesia (2022).

Regulation of the Minister of Transportation No. PM 28

of 2022 on the issuance of sailing approvals and approvals

for ship activities in ports. https://jdih.kemenhub.go.id/

[23] Lee, J.-W., Kim, E.-W., Lee, C.-H. (2017). A basic study on

accident-prevention measures for maritime pilots during

embarkation and debarkation. Journal of Fisheries and

Marine Sciences Education, 29(1), 137-147.

https://doi.org/10.13000/JFMSE.2017.29.1.137

[24] Mbong, T.S.-S., Bygvraa, D.A. (2021). Analysis of the

implementation of the International Safety Management

Code using motivation theory: The seafarer’s views.

International Maritime Health, 72(3), 172-178.

https://doi.org/10.5603/IMH.2021.0033

[25] Muhammad, F., Idris, M., Satria, I.D., Filemon, F.,

Siregar, M.S., Rakka, S.G.A. (2025). Evaluation of the

implementation of safety standards in the debarkation

and embarkation process of Sea Toll Vessel R-72 at

anchorage. Dinasti International Journal of Education

Management and Social Science, 7(1), 1179-1188.

https://doi.org/10.38035/dijemss.v7i1.5606

[26] Ndori, A., Sutajaya, F., Widiatmaja, A. (2023).

Implementation of the International Safety Management

Code for the safety of crew and passengers on KM

Sinabung. RSF Conference Series: Engineering and

Technology, 3(1), 88-96.

https://doi.org/10.31098/cset.v3i1.738

[27] Radwanski, K., Rutkowski, G. (2022). An analysis of the

risks during personnel transfers between units operating

on the water. Water, 14(20), 3303.

https://doi.org/10.3390/w14203303

[28] Sakar, C., Sokukcu, M. (2023). Dynamic analysis of pilot

transfer accidents. Ocean Engineering, 287, 115823.

https://doi.org/10.1016/j.oceaneng.2023.115823

[29] Sharma, D.R. (2023). Expert as interviewer:

Methodological challenges in the use of qualitative

interviews in maritime research. TransNav, the

International Journal on Marine Navigation and Safety of

Sea Transportation, 17(3), 637-642.

https://doi.org/10.12716/1001.17.03.15

[30] Trbojevic, V.M., Carr, B.J. (2000). Risk-based

methodology for safety improvements in ports. Journal of

Hazardous Materials, 71(1-3), 467-480.

https://doi.org/10.1016/S0304-3894(99)00094-1

[31] Tunçel, A.L., Akyuz, E., Arslan, O. (2023). Quantitative

risk analysis for operational transfer processes of

maritime pilots. Maritime Policy & Management, 50(3),

375-389. https://doi.org/10.1080/03088839.2021.2009133

[32] Turna, İ. (2024). A safety risk assessment for ship

boarding parties from a fuzzy Bayesian networks

perspective. Maritime Policy & Management, 51(1), 1-14.

https://doi.org/10.1080/03088839.2022.2112780

[33] Uflaz, E., Akyuz, E., Arslan, O., Çelik, E. (2022). A

quantitative effectiveness analysis to improve Safety

Management System implementation on board ship.

Safety Science, 156, 105913.

https://doi.org/10.1016/j.ssci.2022.105913

[34] Valdez Banda, O.A., Goerlandt, F. (2018). A STAMP-

based approach for designing maritime safety

management systems. Safety Science, 109, 109-129.

https://doi.org/10.1016/j.ssci.2018.05.003

[35] Xu, M., Ma, X., Zhao, Y., Qiao, W. (2023). A systematic

literature review of maritime transportation safety

management. Journal of Marine Science and Engineering,

11(12), 2311. https://doi.org/10.3390/jmse11122311