HMNZS Manawanui | 00 Frame

Introduction

At YachtPrep we help owners get the most out of what they have invested in their boats. In practice that means three things: helping them actually use the boat for the reason they bought it, protecting the crew and the vessel from loss, and building the kind of confidence that comes from knowing the boat is ready before you leave the dock.

In this series we look at the grounding of HMNZS Manawanui, a New Zealand naval vessel lost on a reef off Samoa in October 2024. It is worth the attention of anyone who takes a boat to sea. Not because a hydrographic survey ship has much in common with a private yacht, but because the reasons vessels get into trouble turn out to be remarkably consistent across both. The equipment was sound. The crew were trained. The weather was fair and the visibility was ten miles. She went on the reef anyway.

The Court of Inquiry called it human error, which is accurate and almost useless. What we want to know is something more specific: at what point could this have been stopped, by what, and who owned that control. Answering that needs a framework, so before any of the detail this post sets one out.

Everything that follows in the series — the ship, the bridge, the crew, the investigation itself — sits inside it.

The claim is simple to state and takes a series to demonstrate.

Risk management works by moving risk down a hierarchy of controls. Everything that cannot be implemented in the design is discharged into the user’s attention. What arrives at the bottom of that hierarchy is covered by nothing. It is left to a human being noticing, in the moment, that their picture of the situation has stopped matching the situation.

That noticing is the last line of defence. It is the least examined thing in the discipline.

Where risk goes when it cannot be designed out. Each column is read from the bottom up. Reality sits above everything; the three channels to it all originate with the operator.
Author’s own work.

---

Reality, and the three ways to it

Start at the top of the diagram, because everything else depends on it.

Reality is the actual state of the system and its environment. It is not directly accessible to anyone. Every frame below it — the designer’s, the operator’s, the team’s — is an attempt to determine what it is.

An operator reaches it through exactly three channels, and all three originate with them.

• Through the machine. Sensors, displays, indicators, alarms. This channel carries only what the product chooses to represent, and only where the product is looking.
• Through other people. Reports, callouts, challenges. This carries only what they notice, and only what they say.
• Directly. What can be seen, heard and felt. The only channel with no designer, no specification and no failure mode anyone engineered — which also means no one can guarantee it.

Two of the three run through a layer before arriving, which is why the diagram routes them that way. The machine channel passes through the product; the social channel passes through the team. Each layer is a filter, not a window, and the filtering is not a defect — it is what those channels are.

The consequence is that almost everything an operator knows about the world has already been interpreted by something before it reaches them. Only direct perception arrives unfiltered, and it is also the only channel nobody designed, specified or can be held to account for.

---

Layer one: design out what you can

Every serious safety framework starts the same way, with a strict order of priority. First, inherent safety by design. Second, protective measures in the device itself. Third, information — and that splits into two things people routinely conflate.

• Instruction teaches the correct action and builds capability.
• Disclosure warns that a risk remains and builds no capability at all; it transfers acceptance of the risk rather than the means to handle it.
• Specified use environment — light, noise, motion, distraction, who else is present, what else the operator is doing. A fourth product-side obligation, and the one that gets far less attention than it deserves.

Instruction and disclosure usually arrive in the same manual and they do entirely different jobs. The use environment is the designer’s assumptions about the world their device will live in; if reality falls outside them, that is a design gap, not an operator failing.

This is the strongest layer and it deserves its primacy. A control that removes a hazard needs nobody to be alert, nobody to be trained, nobody to be having a good day. It works at four in the morning in the fourteenth hour of a watch.

Manawanui has an exact instance where two basic design controls would have saved her — a conflict alert and joystick feedback. Had a message reading or announcing that manual input had been rejected, or a lever that would not move while the autopilot was engaged — would have avoided the accident with no reliance on human attention or cognition whatsoever. Nothing about attention, fatigue, training or crew coordination would have mattered. The Officer of Watch would have known instantly the steering issue, turned off the autopilot, taken the ship in hand and completed the turn. This event would likely not even be reported as a near miss because the design controls were so strong.

It is important to concede that early and completely. Most of what goes wrong should have been designed out, and saying otherwise lets designers off.

But the hierarchy has a top as well as a bottom, and what sits at the top of the product column is residual risk — what the design could not remove. It does not evaporate. It has to cross into a person.

---

The interface, and where it stops

The crossing happens at one place: the interface. It is the only engineered channel between machine and person, and it runs in both directions. Risk arrives through it. Correction goes back through it.

On Manawanui it failed both ways. It did not announce the control mode going out. And it silently discarded the astern demand coming back — accepting the input, giving no resistance, no rejection message, no sign that the ship was doing the opposite of what was asked.

Note where the interface stops in the diagram. It covers the operating layers and ends below the top row. Above it there may be no representation at all — a system acting on the world with nothing on the panel that names it. That is the 737 MAX case, where no amount of widening awareness could reach a system nobody had been told existed.

And there is a second-order problem that becomes a running theme. Every risk control that substitutes for awareness also removes a reason to be aware. Autopilot, checklist, alarm — each teaches its operator, correctly and by repetition, that this particular thing is handled. Handling it is the whole point. The cost is that the operator’s model of what needs watching shrinks to fit.

---

Layer two: the actor

What arrives has to land on a person, and three things determine whether it lands well.

• Competence — qualification, endorsement on this platform, currency.
• Training and familiarisation — what this operator has been taught about this equipment.
• Cognitive state — fatigue, stress, arousal, attentional capacity, emotional load.

That last one is internal, and it is produced by conditions acting on this particular person. It is not the same thing as the use environment, which sits on the product side because it is specified by the designer. The environment is the cause; cognitive state is the effect.

It sits directly beneath metacognition in the diagram for a reason. Metacognition is the most expensive act on the page, and the first thing fatigue takes. The last line of defence is also the least robust thing available.

The bridge of MV Edda Fonn at Frederikshavn, Denmark, before her delivery voyage to New Zealand, April 2019. © New Zealand Defence Force, Crown copyright. Published by the Royal New Zealand Navy, 3 April 2019. Reproduced for commentary and criticism. Source.

---

Layer three: the team

Aviation reached the limits of the individual decades ago and built something on top.

Crew Resource Management came out of a run of accidents in the nineteen-seventies where technically sound crews flew serviceable aircraft into the ground while everyone aboard was busy. The founding case is United 173, where an entire flight deck became absorbed in a landing gear indicator while the aircraft ran out of fuel.

The insight was unsentimental. You cannot reliably train an individual out of fixation. So you stop trying, and you build a team where someone else’s attention is deliberately allocated elsewhere. Callouts, so mental models are spoken aloud and can be checked. A duty on junior crew to challenge. A designated monitoring role whose job is not driving.

It is redundancy of attention rather than redundancy of equipment, and it is among the most effective things the safety world has produced.

It also has its own failure modes, and they are specific. Groupthink, where agreement itself starts to feel like evidence. Authority gradient, where the senior frame wins regardless of merit. Diffusion, where everyone assumes someone else is watching. And a shared mental model that has quietly come loose from reality — which from the inside is indistinguishable from a shared model that is correct, because everyone agrees and everyone is competent.

---

Layer four: the residual

Strip away everything the layers above can catch and something remains.

It is the capacity, in the middle of acting, to step outside your own reasoning and ask a specific question. Not what is wrong — that already assumes a frame, and sends you looking for a fault inside it. The question is harder: is my picture of this situation still the right picture at all?

Two things about it, both visible in the diagram.

It is always individual. There is no group version. A team can create the conditions in which one person’s noticing propagates — that is what callouts and the duty to challenge are for — but the noticing itself happens in one head.

It has two outputs, not one. The first runs back to the machine: check the mode, take it in hand, strip the automation before diagnosing anything. The second runs sideways into the group: a pattern interrupt, breaking a frame that everyone has already converged on. Those are different acts with different failure modes, and the second can fail even when the noticing worked perfectly. Roger Boisjoly perceived the Challenger hazard correctly, wrote it down six months in advance, and was overruled by his own management the night before launch. The metacognition succeeded and the transmission failed.

One more thing worth saying plainly, because it lowers the bar in a useful way. The last line of defence does not need to understand what is wrong. It only needs to notice that the picture has stopped fitting.

Sullenberger got one page into a dual-engine-failure checklist, recognised it had been written for cruise altitude and did not fit, abandoned it and reallocated to where the aircraft could physically reach. Richard de Crespigny, in a crippled A380, stopped processing an unmanageable failure list and inverted the question from what is broken to what is still working. Neither diagnosed a cause first. Both noticed a mismatch and acted on it.

---

Why the order matters

Reading these as layers rather than topics produces three things a list cannot.

• It forces honesty about what design owes. If a hazard could have been designed out, no amount of discussion about attention is relevant, and raising it is an evasion. The last layer only has standing once the ones below it have been argued and found to stop short.
• It predicts the severity of what survives. Controls catch the common, anticipatable cases first, because those are the ones you can foresee well enough to control. What reaches the top is by definition unanticipated, and unanticipated correlates with novel, complex and time-pressured. As the lower layers improve, probability falls and the conditional severity of what remains rises. Nothing routine makes it to the last line of defence.
• And it explains why better technology widens the gap rather than closing it. Classical automation produces the out-of-the-loop problem: the better it performs, the less the operator monitors, and the less able they are to take over when it stops. At least it usually fails loudly. Systems that generate confident, plausible output continuously — with no signal distinguishing confident-and-correct from confident-and-wrong, and no reliable sense of operating outside their own competence — produce something worse. Two parties, neither of which notices the frame has stopped fitting.

---

The finding that makes Manawanui worth the series

She grounded at 18:17:59. Sunset was 18:24. She struck in daylight, with visibility assessed at greater than ten nautical miles, half a mile from a reef she had been heading towards for minutes, with a lookout on the bridge.

So all three channels were open.

The window showed land. The instruments showed the heading held and the speed rising under full astern. The lookout said aloud that there was nothing astern preventing thrust. Not one of those channels failed. Every one of them delivered correct information.

Which kills the comfortable reading. It was not dark, it was not thick, the equipment was not broken — the report is explicit that there was no loss of power, no steering failure and no control failure at any point. The procedure existed and the crew had been trained on it.

Redundancy of channel is worthless against a single shared interpretation. Three independent routes to reality can all be open, all be carrying the truth, and all be read the same wrong way, because a frame had been adopted at 18:15:57 and everything arriving afterwards was read through it.

---

What this series does

It proceeds by elimination. The ship, and whether she was the wrong ship. The bridge, and what its design did and did not tell anyone. The crew, and what resource management could have caught. Then the investigation itself — which declined root cause analysis, produced twelve unranked contributory factors, and had no place to put an attentional finding except a moral one, so the officer of the watch was told he should not have been distracted.

That last observation is the hinge. The gap is not only in the ship and the crew. It is in the standards that govern design, in the method used to investigate the loss, and in the academic frameworks built to improve on that method. None of them has a place to put the state of a mind.

Which is not a criticism of any of them individually. It is the shape of the problem.

---

This series draws on the Court of Inquiry into the loss of HMNZS Manawanui, final report dated 31 March 2025, and on published accident investigations elsewhere. It is not a comment on the court martial proceedings arising from the loss.

Images and sources

The photograph on this page is a work of the United States federal government and is in the public domain; it is credited on the image. Diagrams and photographs of HMNZS Manawanui elsewhere in this series are © New Zealand Defence Force, Crown copyright, reproduced for the purposes of commentary and criticism, with the source cited on each image. No endorsement by the New Zealand Defence Force, the U.S. Navy or the Department of Defense is implied. Analysis, annotation and any errors are the author’s own.

If you hold rights in any material here and would like it amended or removed, contact contact@yachtprep.com and I will act promptly.