PowerFailuresonShipsSafetystudy
Investigationnumber:M2016-S1
2
FOREWORDOnthebasisofsection2oftheSafetyInvestigationAct(525/2011),theSafetyInvestigationAuthoritydecidedtoinitiateasafetystudyonpowerfailuresonships.SeniorresearcherSirpaKannosledtheinvestigationteamuntil24February2017,afterwhichLieutenantSeniorGrade(retired)JariAlanentookoverasinvestigationteamleader.Asmembersofthejointin-vestigationteamwereappointedCaptain(MasterofMaritimeManagement)TeemuLeppälä,ChiefEngineerTuomoLeppäläandCaptain(MasterofMaritimeManagement)JohannaVahtera.Inaddition,onsiteinvestigationswereconductedbyCaptainBengtMalmberg,Cap-tainMikkoRaustiandNavalArchitectNiklasRönnberg.ChiefEngineerandElectricalEngi-neerPekkaIlmiöwasappointedexpertonpowerfailures.ChiefMarineSafetyInvestigatorRistoHaimilawasInvestigationLeader.Thissafetystudyreportdescribestheinvestigationprocess,givesgeneralinformationaboutpowerfailuresonshipsandpresentsactsandregulationsconcerningpowerfailuresonships.Thereportsonspecificcasesaswellasajointanalysisonthemareincluded.Attheendofthisreportsafetyrecommendationsarepresented.Byimplementingthem,similaraccidentsandincidentscanbeavoidedinthefuture,ortheirconsequencescanbemitigated.Thepurposeofsafetyinvestigationisincreasingpublicsafety,preventingaccidentsandinci-dentsaswellasmitigatingdamagescausedbyaccidents.Safetyinvestigationsdonotconsiderpossibleliabilitiesorobligationstocompensatefordamages.Theuseofinvestigationreportsforanypurposeotherthantoimprovesafetymustbeavoided.Powerfailuresinnarrowfairwaysandinareaswithdensetrafficcancauseveryserioussea-andenvironmentalaccidents.TheserisksarepronouncedintheFinnishnarrowandrockyfairwaysinbothseaareasandininlandwaterways.Thesafetystudystrivedtoidentifycausesforpowerfailuresonships.Anevaluationconcerningfactorsthatdecreasedorincreasedsafetywasalsoconducted.Thesearepresentedintheincidentreportsincludedinthissafetystudy,section2.3.InformationaboutthepowerfailurecasesincludedinthissafetystudywasreceivedfromtheFinnishTransportSafetyAgency,theFinnishTransportAgency,FinnpilotPilotageLtd.andshippingcompanies.Itwasdecidedthat12casesofpowerfailures,orincidentswithsimilarconsequences,wouldbeinvestigated.Theshippingcompanieswereinformedaboutthecom-mencementoftheinvestigations.Theonsiteinvestigationswereconductedby2-3experts.Thescopeoftheinvestigationofindividualcaseswaslimitedtothecomponent-,system-andoperational-levels.Noneoftheinvestigatedcasesdidresultinaveryseriousseaaccidentorenvironmentalaccident.Reportswerepreparedontheresultsoftheonsiteinvestigations.Thereportshavebeenincludedinthissafetystudy.Afteraone-yearmonitoringperiod,theinvestigatedincidentswereanalysedusingtheBowTiemethodofanalysis.
Theincidentreportsweresenttotheconcernedshippingcompaniesforreview.Thedraftre-portwassentforreviewtotheFinnishTransportSafetyAgency,theFinnishTransportAgencyandtoFinnpilotPilotageLtd.Asummaryofthereviewshasbeenincludedinthisreport.State-mentsorreviewsbyprivatepersonsarenotpublished.
SeniorLecturerPeterBjörkrothhastranslatedtheinvestigationreporttoSwedishandEng-lish.Theinvestigationreport,aswellasasummary,ispublishedontheSafetyInvestigationAuthority'swebsite,www.turvallisuustutkinta.fi
3
GLOSSARYANDABBREVIATIONSDWT Deadweighttonnage,theship'sweightcarryingcapacity
GMDSS GlobalMaritimeDistressandSafetySystemGT Grosstonnage,theship'sinternalvolume
IMO TheInternationalMaritimeOrganisation,aUnitedNationsagencyIMOnumber Auniquenumberassignedtoallmerchantvesselsof100GTorabove. ThenumberremainsthesameforthewholelifetimeofthevesselISMCode InternationalSafetyManagementCodeCodeAninternationalsafety managementsystem
NT NetTonnageThevolumeoftheship'scargospacesSMS SafetyManagementSystemSafetyManagementSystemusedbyship- pingcompaniesandships
SOLAS InternationalConventionfortheSafetyofLifeatSeaSTCW StandardsofTraining,CertificationandWatchkeepingforSeafarers AnIMOadoptedconvention
Trafi TheFinnishTransportSafetyAgencyUPS UninterruptiblePowerSource
VTS VesselTrafficServiceSAR SearchAndRescue(SAR)servicesprovidedbythegovernmentand volunteers.GeneratorbackfeedingTheelectricityflowstothegeneratorbecauseofmalfunctioninthe powerplant.Thegeneratorthenbeginstoworkasamotor,supplied bythepowergrid.
Propulsion VesselthrustStandby Statuswhereaunitormachineisreadytobestarted
PowerFailure Situationinwhichpowergenerationordistributionistemporarilyin- terruptedorisdisturbed.
InvestigationnumberM2016-S1 Cover:SIAInvestigationreportS2/2017ISBN:978-951-836-507-8(PDF)
4
TABLEOFCONTENTS
Foreword................................................................................................................................................................................2GLOSSARYandABBREVIATIONS...............................................................................................................................3
ENSURINGTHEELECTRICITYPRODUCTIONANDDISTRIBUTIONONSHIPS...........................6DefinitionofPowerFailuresandInvestigatedCases.....................................................................6ElectricityGenerationandDistributionSystem...............................................................................6Ships'PowerDistributionSystems,PowerSourcesandtheRequirementsofthe
SOLASConvention.........................................................................................................................................................7PowerDistributionSystem................................................................................................................7MainSourceofElectricalEnergy....................................................................................................7EmergencySourceofPower..............................................................................................................7
SOLASRequirementsonOtherCriticalSystemsfortheEmergenceandConsequencesofPowerFailuresonShips........................................................................................................................................8
PropulsionSystem.................................................................................................................................8SteeringSystem.......................................................................................................................................8GMDSSEquipment.................................................................................................................................8MachineAutomationSystem............................................................................................................9RequirementsintheISMCode.........................................................................................................9RequirementsintheSTCW.............................................................................................................10FlagStateRequirements..................................................................................................................10
INVESTIGATEDPOWERFAILURES...............................................................................................................10AccesstoInformationonPowerDisruptions.................................................................................10TheInvestigationProcess.........................................................................................................................10IncidentReports............................................................................................................................................11
M/SPolarisVG,aSeriesofPowerFailures,February2016...........................................12M/SCoralCarbonic,PowerFailure,3.3.2016........................................................................14M/SMissouriborg,MainEngineFailure16.3.2016............................................................17M/VAlppila,PowerFailure,4.4.2016........................................................................................20M/VLianne,PowerFailure,23.6.2016.....................................................................................22M/SFinnsun,PowerFailure,30.6.2016...................................................................................24RMSNeudorf,PowerFailure,11.7.2016..................................................................................27M/SAmorella,PowerFailure,18.7.2016.................................................................................29M/SEgonW–MainEngineFailureandGrounding,13.9.2016....................................32M/SPrimaBallerina,PowerFailure,20.10.2016................................................................35M/SMariella,PowerFailure,5.11.2016...................................................................................38M/SViggen,PowerFailure,10.01.2017...................................................................................40
5
ANALYSIS...................................................................................................................................................................43CausesforPowerFailuresandRelatedObservations................................................................44
WornandOldComponents.............................................................................................................44EquipmentOperation........................................................................................................................44Fuel.............................................................................................................................................................45UnexpectedComponentFailure...................................................................................................45ReliabilityofAutomation.................................................................................................................45
ConsequencesofPowerFailuresandManagingthem...............................................................46NoSubstantialorLong-termEffects..........................................................................................46LossofManoeuvrability...................................................................................................................46LossofManoeuvrabilityandGrounding..................................................................................46AvoidingVerySeriousSeaAccidents.........................................................................................47
AnalysisofRescueOperations................................................................................................................47TheActivitiesoftheAuthorities............................................................................................................47
CONCLUSIONS.........................................................................................................................................................48ComponentQuality......................................................................................................................................48SufficientKnow-How..................................................................................................................................48ReliabilityofSystems..................................................................................................................................49Conditions.........................................................................................................................................................49
SAFETYRECOMMENDATIONS........................................................................................................................50ProceduresforReportingPowerFailures........................................................................................50AssessingtheNeedforDevelopingtheLegislationConcerningSafeConductofVessels
................................................................................................................................................................................50SUMMARYOFSTATEMENTSRECEIVEDONTHEDRAFTINVESTIGATIONREPORT...................52
6
ENSURINGTHEELECTRICITYPRODUCTIONANDDISTRIBUTIONONSHIPS
DefinitionofPowerFailuresandInvestigatedCasesApowerfailureisasituationinwhichpowergenerationordistributionistemporarilyinter-ruptedordisturbed.Failureoroverloadintheship'selectricitydistributionsystemcanresultinapartialorcompletelossofelectricalpower,i.e.ablackout.Thescopeandseverityofthedisturbancedependsonhowthesystemisbuilt,itsbackupsystemsandwherethedistributionsystemfailureoccurs.Thediversityofelectricitydistributionsystemsandthelargenumberofcomponentsinthem,makeitdifficulttoanticipatefaults.
Shipaccidentsandincidentsrelatedtofailuresinthedistributionofelectricitywerefollowedforaperiodof12months,beginning1February2016.Intheend12caseswereincludedinthisinvestigation.Tenofthemconcerneddistributionofelectricityandtwoofthemmainen-ginefailures.Theconsequencesofthemainenginefailuresweresimilartotheconsequencesofpowerfailures.
ElectricityGenerationandDistributionSystemShipshaveownelectricalnetworks,production,distributionandconnectedconsumersofelec-tricity.Theship'selectricalnetworkenablestheshiptooperateasanindependententityatseaandoftenalsoinport.Thelatteriftheshipisnotconnectedtoshorepowertoensureavailabil-ityofelectricityonboard.Avessel'selectricalnetworkcanbeimplementedinavarietyofways.Theintendeduseofthevessel,itstype,aswellasspecificfeaturesinthevesseldesigndeterminehowtheelectricnet-workisimplemented.IntheInternationalConventionfortheSafetyofLifeatSea(SOLAS)itisrequired,thatonvesselsininternationaltraffic,electricitycanbeproducedbytwoindependentsources,bothofwhichalonehasthecapacitytoproduceelectricalpowerenoughtomaintaintheship'sseaworthiness.Thepowerneededonboardisproducedbytheship'sowngenerators.Theyarerotatingatcon-stantspeed,usuallypoweredbydieselengines.Fromthedieselgenerators,electricityistrans-ferredtothemainelectricalgrid,whichinturndistributeselectricitytotheconsumerpoints.Therecanbeoneormorediesel-poweredgeneratorsonaship.Thenumberandsizeofgener-atorswilldependontheship'sneedforelectricalpower.Itisalsopossibletouseashaftgeneratororageneratorconnectedtothemainengine,forpro-ducingtheelectricityneededonaship.Ashaftgeneratorisageneratorthatcanbeconnecteddirectlytothepropellershaftthatisrotatedbythemainengine.Anotherpossiblearrangementistohavethemainenginerotatethepropellershaftandageneratorconnectedtoitbyareduc-tiongear.Ashaftgeneratorcanoftengeneratealltheelectricalpowerneededfortheship.Usuallytheshaftgeneratorisusedwhentheshipisenroute.Uponarrivalinportsorinnarrowfairways,theneededelectricalenergycanbeproducedwithgeneratorspoweredbyauxiliaryenginesinordertoensuresafety.Theshipmustbefittedwithanemergencypowersource,whichmaybeanemergencygenera-tororasetofbatteries.Theelectricalenergyproducedbytheemergencysourceistransferredtotheemergencyelectricpanelfromwhereitistransferredtothesafety-criticalequipmentsuchasthesteeringsystem.Therequiredemergencypowerdependsonthepowerdemandsoftheequipmentthathasbeendefinedascritical.Thispowerdemand,inturn,willdeterminethe
7
choiceofemergencypowersource.Mostshipshaveadieselgeneratorasemergencypowersource.
Ships'PowerDistributionSystems,PowerSourcesandtheRequirementsoftheSOLASConvention
PowerDistributionSystemThepowerdistributionsystemsareimplementedonvesselsfollowingtheinstructionsissuedbyclassificationsocieties.Theintendeduseofthevessel,itstypeaswellasspecialfeaturesinthevesseldesign,determinehowthepowerdistributionisrealised.Initssimplestformtherecanbeone lonedieselgeneratoronboard. A technicallymoredemandingarrangement is apowerdistributionsystemrealisedwithseveraldieselgenerators.Thisarrangementiscom-mononvesselswithahighdemandforelectricpower.Theseinclude,forexample,vesselswithelectricpropulsionorvesselswithalargeconsumptionofelectricityduetoalargenumberofpassengers.Electricitycanbeproducedalsowithageneratorconnectedtothemainengineorthepropellershaft.
MainSourceofElectricalEnergyAtpresentthemostcommonmainsourceofelectricalenergyonshipsisdieselgeneratorsets,producingalternatingcurrentfortheship'selectricalgrid.Therecanbeseveralinstalleddieselgeneratorsetsandtheyarecontrolledwiththemachineautomationsystem.Otherelectricitysourcesare,e.g.,generatorsconnecteddirectlytothemainengineandshaftgenerators.Shaftgeneratorsareconnectedtothesameshaftlineasthemainengine.Theyareconnectedtotheshafteitherdirectlyorthroughareductiongear.Ifacargo-orpassengershipininternationaltraffichasauxiliary-systemsorequipmentrun-ningonelectricalpower,itmustbefittedwithaminimumoftwogeneratorsystems.Oneofthegeneratorunitsmustbedimensionedinsuchawaythatitonitsowniscapabletomeettheelectricityrequirementoftheship'smachineryandequipment.Ships,constructedafter1July1998,onwhichtheavailabilityofmainpowerisessentialforoperatingtheship'smainpropul-sionplantandsteeringsystem,mustnotethefollowing:thepowergeneratingsystemmustbebuiltandequippedinsuchawaythat–intheeventoffailureofonegenerator–thesupplyofelectricityfortheequipmentnecessaryfortheoperationofthepropulsionplantandsteeringsystemimmediatelyisrestored.1Thisrequirementcanbemetbyfittingseveraldieselgenera-torsinparallellandwithautomatictransferswitchesforthecriticalequipment.2Thedistributionoftheloadbetweengeneratorsmustbearrangedinawaypreventinganover-loadofagenerator.3Thiscanbeachievedbyadjustingthestart-uplimitsofthegeneratorssothatwhenageneratororgeneratorsreach,forexample,an85%load,thenextgeneratorstartsupandissynchronisedintothenetworktoproducethenecessaryadditionalenergy.
EmergencySourceofPowerTheshipmustbefittedwithanemergencypowersource,whichmaybeanemergencygenera-tororasetofbatteries.Thedemandforemergencyelectricalpowerdeterminesthechoicebe-tween the options.Nowadaysmost shipshavediesel generatorunits as emergencypowersource.TheyproduceACtotheship'selectricalgrid.Adieselgeneratorisacompactsolution
1SOLAS2009:842SOLAS2009:833SOLAS2009:89-97
8
comparedwithbatteries.Greaterdemandforemergencyelectricalpower,results,inpractice,inchoosingadieselgeneratorforemergencysourceofpower.Batteriesasasourceofemergencypowerareusedonsmallvessels.Batteriesareusedtosecureradioequipment,navigationequipmentaswellasmachineautomation.Inshipswhereelectri-calpowerisnecessaryforrestoringtheoperationofthemainpropulsionplantafterapowerfailure,thecapacityoftheemergencypowersystemhastobedimensionedasfollows:electric-ityfeedforthepropulsionplantandthenecessaryequipmentrelatedtoit,hastoberestoredwithin45secondsafterthebeginningofapowerfailureiftheemergencypowersourceisagenerator.Iftheemergencypowersourceisasetofbatterieselectricityfeedhastoberestoredimmediately.4
SOLASRequirementsonOtherCriticalSystemsfortheEmergenceandCon-sequencesofPowerFailuresonShips
PropulsionSystemIncaseofdisturbancesandfaultsituations,thesafetyoftheshipissettotakeprecedenceovertheprotectionofthemachineriesandequipmentagainstdamage.Infaultsituationsthepro-pulsionsystemshouldremaininoperationaslongaspossible.Itmustalsobepossibletorestartitevenifanauxiliaryessentialforthepropulsionsystemhasmalfunctioned.Auto-stopisonlyallowedincasesthatcanleadtoseriousdamageofthepropulsionsystem.5
Whendesigningmachinerysystemsonships,theaimistoduplicateallcriticalfunctions.Clas-sificationsocietiesdohoweveracceptthatshipsonlyhaveonepropeller,oneshaftlineandonemainengine.
SteeringSystemItmustbepossibletomaintaintheship'smanoeuvrabilitywhenthepropulsionengineisrun-ningandevenafterithasstoppede.g.duetoahardwarefailure.Becauseofthis,componentsintheship'ssteeringsystem,e.g.equipmentconveyingsteeringcommandsandunitsproducingpowerforsteering,e.g.hydraulicpumps,areamongthemostimportantelementsoftheship'selectricalnetwork.Shipsmustbefittedwithamainsteeringsystemandanauxiliarysteeringsystemthatcanbetakenintousequickly.Themainsteeringgearandtheauxiliarysteeringgearmustbeconstructedandinstalledsothatafailureinonesystemdoesnotaffecttheper-formanceoftheother.6Powerunitsinthesteeringgear,suchaselectricallyoperatedhydraulicpumps,muststartau-tomaticallyafterapowerfailure.Itmustalsobepossibletotaketheminusefromthenavigatingbridge.Failureofapowerunit,orautomaticstartupfailure,canresultindecreasedorlossofpowerforturningtherudder.Disturbancesinthepowerunitsofthesteeringgearmustactivateanalarmonthenavigatingbridge.7
GMDSSEquipmentSeaareasaredividedintofourGMDSSareas,accordingtowhichtherequirementonthecom-positionoftheradioequipmentonboardisdetermined.8
4SOLAS2009:89-975SOLAS2009:89-976SOLAS2009:71-727SOLAS2009:233-2348SOLAS2009:233-234
9
Thefunctioningoftheradioequipmentintheeventofdisturbancesinthepowerdistributiononboard,issecuredwithaseparateemergencypowersupply,i.e.withasetofbatteriesfortheradioequipment.Thebatteriesmustnotbedependentonthepropulsionplantortheelectricalnetwork.Thebatteriesmustsupplytheship'sradioequipment,composedaccordingtothere-quirementsoftheGMDSS-area,withpowerforatleastsixhours.Iftheshipisequippedwithanemergencygenerator,theradioequipmentmustfunctionforatleastonehourwithpowerfrombatteries.
MachineAutomationSystemThemachineautomationsystemmustbeabletodistributethe loadonthepowergrid(thegenerators).Intheeventofageneratorfailure,themachineautomationmanagesthestart-upofthestandbygeneratorsaswellastheirsynchronisingtothenetwork.Themachineautoma-tionalsorestartstheauxiliariesnecessaryforthepropulsionplantandsteeringgear.9Whentheelectricitysupplyhasbeenrealisedusingmorethanonegenerator,themachineau-tomationsystemmust-intheeventofageneratorfailure-beabletoensurethatothergener-atorsconnectedtothenetworkremain inthenetworkwithoutgettingoverloaded.Thema-chineautomationmustfurtherbeabletoensurethatthepropulsionplantandsteeringgearareabletofunctionnormally.10
Incaseofdisturbancesinasystem,themachineautomationmusttakecareofswitchingcon-nectionstothestand-byunitsthathavebeendefinedbytheuser.11
Ifthemachineautomationsystemfails,sothatitcannotperformtherequiredfunctionsrelatingtoelectricitydistribution,thesystemcancauseinterferenceinthepowerdistribution.Suchasituationmayarise, forexample, ifthepowerplant isnotadjustedproperlye.g.concerninggeneratorsusedinparallel.Iftheship'spowercontroldoesnotworkasplanned,arapidvari-ationofthepowercontrolfromthecontrolroommayresultingreaterloadonadieselgenera-torconnectedtothenetworkandtothesubsequentopeningofageneratorcircuitbreaker.
RequirementsintheISMCodeAccordingtotheISMCode,vesselsininternationaltrafficmusthaveasafetymanagementsys-tem.
Thesafetymanagementsystemmustincludeinstructionsforrecruitmentandfamiliarisationofthecrew,aswellasinstructionsforvariousemergenciessuchasdisturbancesinthepowerdistribution.
AccordingtotheISMCode,criticalequipmentandcomponentsmustbenotedintheship'spre-ventivemaintenancesystem.Onrequest,theshipownermustbeabletopresentcriticalequip-mentandcomponentstotheclassificationsocietyortotheflagstateauthority.Failureofthatequipmentorthosecomponentsmayresultinhazardoussituations.Thelistofcriticalequip-mentmust includeat least the criticalequipmentand componentsof thepropulsionplant,steeringgearandpowerdistributionsystem.12Theshippingcompanymustdefinethecriticalityofonboardsystemsinaccordancewiththeirownactivitiesandtherebydevelopthefunctionalityofthepreventivemaintenancesystemandthesafetymanagementsystem.
9SOLAS2009:9710ISMCode:1611ISMCode:1612ISMCode:16
10
RequirementsintheSTCWTheSTCWconventionisasetofinternationalregulationsfortraining,certification(competen-cies),andwatchkeepingforseaferers.TheSTCWconventioncontainsacode,theSTCWCode,whichsetsminimumstandardsforthetrainingandcompetenceofseafarers.
Competenciesandtrainingofthecrewoncargoandpassengerships in internationaltrafficmustbeincompliancewiththeSTCWCode.
FlagStateRequirementsFlagstatesmonitorships'compliancewithregulationsthroughportstatecontrolsandinspec-tionprocedures.InFinland,theFinnishTransportSafetyAgency'sDecreeonElectricalInstallationsonShips13setsrequirementsformainandemergencypowersystemsforshipsoperatingindomestictraf-ficareas.
INVESTIGATEDPOWERFAILURES
AccesstoInformationonPowerDisruptionsAtthebeginningofthissafetystudy,theauthoritiesandshippingcompaniesweresentare-questtonotifytheSafety InvestigationAuthorityaboutpower failuresonships.There isnoobligationtonotifyabouttheminpresentlegislation.Achangeinthemaritimelawconcerningthereportingofhazardoussituationsisunderpreparation.ThechangerelatestonotifyingtheFinnishTransportSafetyAgencyaboutaccidentsandincidentsinconnectionwiththeuseofthevessel.When itenters into force,thelawalso facilitatesaccessto informationonpowersupplydisruptions,whichoftenaresocallednearmisses.InFinland information on ships'power failures is collectedby, among others,TheFinnishTransportSafetyAgency,theFinnishTransportAgency,FinnpilotPilotageLtdandtheshippingcompanies.Theyreported,inaccordancewiththerequesttheyreceived,ontheincidentsthathadcometotheirknowledge,totheSafetyInvestigationAuthority,whichdecidedtoinvesti-gate12cases.Inadditiontothese12,theSafetyInvestigationAuthoritywasinformedabouteightcasesofpowerfailuresorotherdisturbanceswithsimilareffectsaspowerfailures.Thosecaseswerenot investigated. Based on the statistics collected by the Finnish Transport Agency andFinnpilotPilotageLtd,therehaveapparentlybeenanother10powerfailuresduringthemoni-toringperiod,forwhichnoinformationwasreceived.
TheInvestigationProcessBasedonthedatafirstreceived,theSafetyInvestigationAuthoritydecidedonwhetherthecasewouldbeincludedinthesafetystudyornot.Theon-siteinvestigationwascarriedoutbygroupsof2-3peopleandtheintentionwastoinvestigateassoonaspossibleaftertheincident.Intheon-siteinvestigationsthecourseofeventswasclarifiedbyhearingthecrewandbycol-lectingnecessaryrecordingsonthevessel.Ifpossible,thefollowinginformationaboutthein-cidentswascollected:
13TRAFI/10743/03.04.01.00/2014ElectricalInstallationsonShips
11
· Timeanddurationoftheincident· Placeofincident· Weatherconditionsatthetimeoftheincident· Trafficsituationintheincidentarea· Manningatthetimeoftheincident,navigatingbridge/engineroom· Pilotorlinepilotonboard?Pilotexemption?· Descriptionofincident· Reasonsforthepowerfailure· Immediateeffectsofthepowerfailureonboard· Emergencyandback-upsystemsandtheiroperation· Measurestakenduringthepowerfailuresituationandrestoringthesystemtonormal
mode· Measurestakenbyexternalstakeholders,includingpossiblerescueoperations· Consequencesoftheincident· Theessentialpointsinthevessel'ssafetymanagementsystemandtheirimplementation
inpractice· Contactinformation:vessel,shippingcompany,classificationsocietyandagent· andallnecessaryrecordsandrecordingstosupporttheinvestigationandtoestablish
thebasicvesselinformation.Inaddition,theon-siteinvestigatorswantedtoknowwhethertherebeforethebeginningoftheincidenthadbeenanyservice,maintenanceorotherworkinprogressthatmighthaveaffectedthe case,orwhether therehadoccuredanyalarms related to the incident.Thepreventivemaintenancesystemandtheservicehistoryofcomponentsrelatedtotheincidentinsystemsthatsubstantiallyaffectedtheincidentwereexamined.Theexpertsinvolvedintheon-siteinvestigationscompiledanincidentreportafterfinishinganinvestigation.Inadditiontotheinformationobtainedintheon-siteinvestigation,safetyfind-ingsoftheinvestigatorsconcerningtheincidentwereaddedinthereport.Thesafetyobserva-tionsweredividedintopositiveandnegativefindings,sinceoneoftheobjectiveswiththesafetystudywastopindownbestpracticesandotherfactorsthatsavedthesituationandpreventedanaccident.
IncidentReportsThesafetystudystrivedtoidentifycausesforpowerfailuresonships.Anevaluationconcerningfactorsthatdecreasedorincreasedsafetywasalsoconducted.Thesefactorsarepresentedassafetyobservationsintheincidentreportsbelow.Theobservationsareoftencoveredby§al-readyexistinglegislation.Safetycouldbeimprovedbycomplyingwithpresentlegislationaswellasbycommittingtothespiritofthelegislation.
12
M/SPolarisVG,aSeriesofPowerFailures,February2016Generalinformation
Timeandplaceofincident 2.2.2016Rostock,6.2.2016Rauma,8.2.2016Rostock,and12.2.2016Rauma
Vesselname,callsignandIMOnumber
PolarisVG,OJQX,8716100
Typeofvessel Ro-rovesselFlagstate FinlandPlaceofbuildandtime J.J.Sietas,Germany,1988Maindimensions LOA123.47m;beam20.20m;
maximumdraught6.16mNT,GT,DWT 2700,7950,6494Owner VGShippingLtdShipmanager VGShippingLtdClassificationsociety BureauVeritasMainengine,power Wärtsilä6R46,5100kWAuxiliaryengine,power 2xKDHF5L912,342kW,total684kWPropulsion AdjustablepitchpropellerCargo Manydifferentcases,notknownCrew 9Meteorologicalconditions Manydifferentcases,notknown
OverviewofIncidentInFebruary2016,severalpowerfailurestookplaceonM/VPolarisVG,duringwhichthepowersupplywaslostcompletely.Thevesselwasinport,moored,duringallcasesofpowerfailures,andtheycausednodangeroussituations.Becauseinformationaboutthepowerfailureswasnotreceiveduntilconsiderablylater,accu-rateinformationaboutthesituationineachindividualcasewasnolongerpossibletoget.Thevessel’senginecrewhadchanged,andthesituationshadnotbeendocumentedindetail.Thustheinvestigationfocusedonthecausesofthefailuresandonthesolutionsthathadbeenused.
DescriptionofthepowerfailuresandtheirreasonsThevesselhasonemainengine,equippedwithashaftgenerator,andtwoauxiliaryengines,whichhavetheirowngenerators.Whenatsea,thevesselusesonlytheshaftgeneratortoproduceelectricenergy,whiletheauxiliaryenginesareinstandbymode.Infairwaysandports,theauxiliaryenginesareusedtoproduceelectricity,andtheshaftgeneratorisnotinuse.Intheincidentsinquestion,thecontrolsystemoftheauxiliaryenginesstopped,dependingonthecase,theauxiliaryengine,orengines,withoutaclearreason.Intheincidentsinvolvingseveralrunningauxiliaryengines,thegeneratorofthefaultyauxiliaryenginewasnotdiscon-nectedfromthenetwork,butremainedconnected.Theoperationalauxiliaryenginethenbe-cameoverloadedandstopped.Someoftheincidentstookplacewhenonlyoneauxiliaryen-ginewasrunningwhiletheotherwasundergoingmaintenance.
13
Troubleshootingwasdifficult.Atfirst,itwasdonemainlyonatrial-and-errorbasis.Theves-selhadbeenpurchasedsecond-handfromGermanyaboutayearearlier,andlistsoverequip-mentanddocuments,manualsandmaintenancerecords,wereincomplete.Tobeginwith,thevessel’screwreplacedtheRPMmeasurementsensorsintheauxiliaryen-ginesbecausetheysuspectedthattheenginecontrolautomationincorrectlyconveyedtoolowRPMdata.Replacingthesensorsdidnot,however,solvetheproblem.Nextanenginecontrolautomationexpertwascalledfortothevessel.Hewasabletolocatethefaulttotheauxiliaryengines'controlsystem,whichwasfromtheyear1988.Theelec-troniccardsinthesystemhadlosttheirefficiencywithtime,andwerenolongerabletopro-cessinformationproperly.Afterreplacingtheelectroniccards,theproblemdisappeared.
EffectsonboardofthepowerfailureThefailuresdidnothaveanysignificantorlong-lastingeffects,becausethevesselwasinportatthetimeoftheincidents,andusuallyoneauxiliaryenginecouldbestartedandconnectedtothenetworkquickly.
Theemergency-andbackup-systemsandtheiroperation
Thevessel’semergencygeneratorstartedautomaticallyinallcases.Onboardactivitiesduringthepowerfailure
Sincetheautomationofthevessel’semergencygeneratorworkedasplanned,thecrewbasi-callyonlyhadtorestorethesystemtonormalmode.RestoringthesystemtonormalmodeTheenginecrewstartedanauxiliaryengine,orengines,andconnectedthemtothenetwork.Thealarmswereacknowledgedandequipmentthathadstoppedandrequiredamanualstart-upwasrestarted.Mostoftheequipmentrestartedautomaticallywhentheelectricitysupplyhadreturnedtonormal.Entriesinthevessel’sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementationTheshippingcompanyhasaquality-andsafetymanagementsystem(ISO9001:2008andISM),whichincludesthecompany'ssafetyandqualitymanuals,generalandvesselspecificguidelinesfortheirships.However,inpractice,therewerenovesselspecificinstructions.In-steadthevesselsfollowedtheshippingcompany'sgeneralinstructionsforthevessels.
Inthevessels'generalinstructionsforemergencies,therewerenoinstructionsspecificallyforpowerfailures.Theissuewastoucheduponintheinstructionsforincidentsinvolvingvesselnotundercommandsituations.Afterthiscase,theshippingcompanyhasplannedtodevelopinstructionsforpowerfailuresasastepindevelopingtheSMS.Thelistofcriticalequipmentwasfoundinthegeneralinstructionsforthevessels,buttherewasnovesselspecificlist.
Deviationreportswerelatercompiledonboard,ontheshippingcompany'srequest,buttheycontainedverylittleinformationabouttheincidents.Inpractice,thevesselwasinthehabitoftakingcareofthingswiththeshippingcompanybyphone,andtomakethemandatoryre-portsforseriousincidentsafterthematterhadbeenresolved.Reportingsmallerincidentswasnotconsiderednecessary.
14
Factorsthatreducedsafety
- Thevessel’screwhadnotinternalisedthedeviationreportingpracticeanddidnotun-derstanditsimportance.Deviationreportswereonlycompiledonseriousincidentsorattherequestoftheshippingcompany,andthereportingofsmallerincidentswasnotconsiderednecessary.
- Thevesseldidnothaveanyvesselspecificinstructionsonboard.Vesselspecificin-structionsaremandatoryaccordingtothequalityandsafetymanagementsystem.Theshippingcompanyhaddelegatedtheresponsibilityfordevelopingthevesselspecificinstructionstothevessel,andhadnotensuredthattherequesthadbeencarriedout.
- Highturnoverofcrewmadesolvingtheproblemmoredifficultanditcomplicatedtheflowofinformation.
- Theelectroniccardsinthesystemhadlosttheirefficiencywithtime,andtheywerenolongerabletoprocessinformationproperly.Thepreventiveservicesystemdoesnotsupportfollowinguptheconditionoftheelectroniccards.Theonlyoptiontomanagetheriskwouldbetochangetheelectroniccardsatspecificintervals.
- Thevesselhadbeenpurchasedsecond-handfromGermanyaboutayearearlier,andthelistsoverequipmentanddocuments,manualsandmaintenancerecords,werein-complete.Furtheron,itwasnotpossibletogetusersupportfortheoldautomationsystem.
Externalfactorthatinfluencedpositivelyontheoccasion- Thevesselwasinport,moored,duringallpowerfailurecases.
M/SCoralCarbonic,PowerFailure,3.3.2016Generalinformation
Timeandplaceofincident 3.3.2016at18.34-18.49,SköldvikfairwayVesselname,callsignandIMOnumber
CoralCarbonic,PCFW,9201906
Typeofvessel GascarrierFlagstate TheNetherlandsPlaceofbuildandtime Frisia'sShipyard,theNetherlands1999Maindimensions LOA79.55metres;beam13.73m;
maximumdraught6.50mNT,GT,DWT 547,1825,1786Owner AnthonyVederRederijB.V.Shipmanager AnthonyVederRederijB.V.Classificationsociety BureauVeritasMainengine,power M.A.K6A25,1800kWAuxiliaryengine,power 2xCatepillar3306,175kW,tot.350kwPropulsion Controllablepitchpropeller,BeckerrudderCargo InballastCrew 9+pilotMeteorologicalconditions WindE,8m/s,clear
15
OverviewofIncident
Intheafternoononthe3rdofMarch2016,thegastankerCoralCarbonicwasanchoredinSköldvik,outeranchorageF.Thepilotcameonboard,theanchorwasheavedupandtheves-selsetofftowardsSköldvikoilportfollowingthenine-meterfairway.Aboutanhourafterde-parture,thevesselsufferedacompletepowerfailurewhenapproachinglightbuoySköldvik2.Thevesselthenbegantodrift.ThepilotinformedHelsinkiVTSandvesselsinthevicinityaboutthesituationovertheVHF-radio.Thevesselpreparedforanchoring.Visibility,weatherconditionsandthepositionofthevessel,however,weresuchthatthevesselcouldbeletdriftinginthefairway.Aftertenminutestheenginescouldberestarted,andthevesselwasabletocontinueitsvoyagetoport.
DescriptionofthepowerfailureanditsreasonsShortlybeforethepowerfailurethevessel’sradioequipment,sonarandthespeedlogbegantoflash.Thechiefengineerinformedfromtheengineroom,thattherewereproblemswiththefrequencies.Soonafterthis,thevesselsufferedatotalblackout,i.e.allequipmentde-pendentonelectricity,stoppedworking.Theregulatorinauxiliaryengine1stoppedworkingandcausedstrongoscillationintheen-gine'srotationspeed.Becausebothauxiliaryengineswereconnectedtothemainswitchboardatthetimeoftheincident,thestrongvoltageandfrequencyoscillationaffectedthewholepowerdistributionsystemandneitheroftheengine'scircuitbreakersopened.Aftertheauxil-iaryenginestoppage,thecircuitbreakerofthefaultyenginecouldbeopened,andtheopera-tionalenginewasrestarted.Theloadontheauxiliaryengineswasabout60kWatthetimeoftheincident,andthevoltageoscillationbetween400and440V.
EffectsonboardofthepowerfailureAsthevessel’s24VDCpowersystemisdependentonthevessel’smainelectricalsystem'stransformerfeed,themalfunctioninthemainsystemcausedagreatvoltageoscillationintheDCpowersystem.Thealarm-andcontrol-systemsofthemainengineweredisturbedbytheoscillation,themainengineoilpressuresensorstoppedworking,andthemainenginestoppedduetothelowoilpressuresignal.Whenthemainenginestopped,thevessellostitsabilitytomanoeuvre.Mostofthenavigationdevices,forexampletheradars,stoppedworking.Onthenavigatingbridge,however,oneoftheVHFradiosandtheinternaltelephoneremainedoperationalandenabledcommunication.
Theemergency-andbackup-systemsandtheiroperationThevessel’semergencygeneratorfailedtostartbecauseitsstarterrelaydidnotwork.Allthevessel's24V-dependentequipmentwaspoweredbyone24VDCpowersystem.Normallytheequipmentgotitspowerfeedfromthemainswitchboard,throughthetransformerandrecti-fier,or,intheeventofdisturbances,fromtheemergencyswitchboard.Inaddition,theDCsys-temhasabatterysupply(UPS)foremergencysituations,aswellasindividualbatteriesforafewdevices.Astheemergencygeneratorfailedtostart,theelectricalsystemdidnotgetpowerfromthemainswitchboard,orfromtheemergencyswitchboard.Thebatterysupplycapacitywasnotsufficientonitsown.ThisresultedinthatthevoltageoftheDCsystemde-creasedveryquickly,andonlythedeviceswithownbatteriesremainedoperational.
16
Onboardactivitiesduringthepowerfailure
Atthetimeoftheincidentthemasterofthevessel,awatchmanandthepilotwereonthenav-igatingbridge.Thevessel'schiefengineerandthirdengineerwereintheengineroom.Themasterturnedonthenavigationlightsforvesselsnotundercommandandtookoverthehandsteering.Thechiefmateandthewatchmanweresenttothebowtobepreparedtoanchor.ThepilotinformedtheVTSandvesselsinthevicinityabouttheincident.Thepilothadanavi-gationapplicationonatablet.Thatmadeitpossibleforthebridgeteamtofollowthedirectionthevesseldriftedin.Thevessel’schiefengineerstoppedtheauxiliaryengines,openedthecircuitbreakerofauxil-iaryengine1andrestartedauxiliaryengine2.
RestoringthesystemtonormalmodeIttook5-10minutestorestartandreconnectauxiliaryengine2tothemainswitchboard.Af-terthisthesystemsdependentonelectricitywerelargelyoperationalagain.Afterthealarmshadbeenacknowledged,themainenginewasrestartedandthevesselwasabletocontinuethevoyagetowardsport.Thefollowingweek,anexternalserviceman,commissionedbytheshippingcompany,cametothevesseltotrytoclarifythereasonsforthepowerfailureandfortheoscillationofthevoltageintheauxiliaryengine.Theregulatorinauxiliaryengine1wasfoundtobedefectiveandwasreplacedwithanew.Entriesinthevessel’sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementationThecompanyhasissuedclearinstructionsforpowerfailuresituations.Themasterfollowedthemconsistently.Therewereinstructionsforpowerfailuresituationsalsointhevessel’sengineroom.Thechiefengineerdeviatedfromtheinstructionsonpurpose,onceheobservedthattheemer-gencygeneratorfailedtostart.Hefocusedonrestartingtheauxiliaryenginesratherthanontryingtostarttheemergencygeneratormanually.
Factorsthatreducedsafety
- Thevesselwasnotundercommandduringthepowerfailure.- Thevessel’s24VDCpowersystemwascommonforalldevicesdependentonelectric-
ity,includingnavigationdevicesandalarmsystems.- ThebackupfortheDCsystemwasprimarilybasedonthefunctioningoftheemer-
gencygenerator.Thebatterybank,intendedtobeasecondarybackupincaseofanemergencygeneratorfailure,wasnotalonesufficienttomaintainthepowersupplytoalldevicesconnectedtothesystem.
- Theemergencygeneratordidnotwork.
Factorsthatincreasedsafety- Thepilothadanavigationapplicationonatabletthatwasnotdependentontheves-
sel'sdevices.Thatmadeitpossibleforthebridgeteamtomonitorthevessel’spositionandthedirectionitdrifted.
17
- Therewasapilotwithknowledgeaboutthelocalcircumstances,onboard.HetookcareofthecommunicationwiththeVTSandvesselsinthevicinity.Thevessel’screwcouldthusfocusonensuringthesafetyofthevessel.
- Theinstructionsformeasurestobetakenonthenavigatingbridgeincaseofapowerfailureareclear,andthecrewfollowedthemconsistently.
Externalfactorsthatinfluencedpositivelyontheoccasion
- Thevesselwasdriftingslowlyingoodweatherconditions.- Thewaterdepthinthesurroundingareawaslargeenoughtoallowforsafedriftingof
thevessel.
M/SMissouriborg,MainEngineFailure16.3.2016Generalinformation
Timeandplaceofincident 16.3.2016at07.13–07.22,offPoriVesselname,callsignandIMOnum-ber
Missouriborg,PFBI,9228978
Typeofvessel DrycargocarrierFlagstate TheNetherlandsPlaceofbuildandtime BijlsmaShipyard,Netherlands,2000Maindimensions LOA134.55m;beam16.5m;maximumdraught7.30mNT,GT,DWT 3493,6585,9119Owner WagenborgShippingB.VShipmanager WagenborgShippingB.VClassificationsociety BureauVeritasMainengine,power Wärtsilä8L38,5280KWPropulsion AdjustablepitchpropellerCargoinformation: CoalCrew: 9+1apprentice,pilotMeteorologicalconditions WindNW6.6m/s,temperature-2°C,skyclearOverviewofIncident
M/VMissouriborgunberthedinTahkoluoto,Pori,inthemorningof16.3.2016.Thevesselbe-ganreversingtowardstheKissanhautaturningbasinwithintheportarea.About15minutesafterdeparture,themainenginesuddenlystopped.ThepilotreportedtheincidenttotheVTS.Thevesselpreparedforanchoringandevaluatedtheneedforrequestingtugassistance.ThevesselcontinueditsasternmovementtothenorthsideofKissanhautaandthendriftedslowlyinopenwater.Itwasnotnecessarytoanchorthevessel.Therewassufficientdepthofwatertodriftfreely,andthevesselcouldbemaneuveredusingthebowthruster.Weathercondi-tionsatthetimeoftheincidentweregoodandtheportwasalmostcompletelyfreeofice.Therewasnoothervesseltrafficintheareaatthetimeoftheincident.Thecrewsucceededinrestartingthemainengineafterabout10minutes,andthevoyagewascontinuedouttosea.NB.Thisincidentconcernsamainenginefailure,notapowerfailure.Whenthevessel’smainenginefailed,thepropellernolongerrotatedandthusdidnotproducekineticenergyforthe
18
ship.However,thevesselhadtwoauxiliaryenginesrunning,whichproducedelectricityonboardduringthemainenginefailure.Thisincidentwascomparabletoapowerfailuretoitseffects,andthatiswhyitisincludedinthissafetystudy.
DescriptionandcausesforthemainenginefailureTherotationspeedofthemainengineismonitoredinitscontrolsystembytwomagneticsen-sors.Thesensorsarelocatedonthesideofthemainengine,inthemeasuringpointofthecamshaft'sgearwheel.ThesensorshaveLEDindicatorsthatflashwhentheyareinworkingorder.Oneofthesensorsisthemainsensorandtheotherisabackup.Thebackupsensorwillbeactivatedautomaticallyifthemainsensorfailsorisbroken.Bothsensorsoperateinde-pendentlyandsendrotationspeedinformationtothemainenginecontroller.Ifthecontrollerdoesnotreceiverotationspeedinformationfromeitheroneofthesensors,itwillstopthemainengine.Themainenginestoppedbecausebothsensorsweredamaged.Theplasticinsulationofboththesensorswereveryworn.Itispossiblethattheworninsulationcausedanearthfault,pre-ventingcorrectinformationonspeedofrotationfromreachingthecontroller.Whenthecon-trollerdidnotgetthemainenginerotationspeedinformation,thecontrolsystemgavethealarm"MEbothpickupsfailed"becauseofthefailingsensors.Themainenginethenimmedi-atelystopped.EffectsonboardofthemainenginefailureWhenthemainenginestopped,thepropellerstopped,andthevesselbegantodrift.Whenthespeeddecreased,theeffectoftherudderdecreasedduetothemissingslipstream.
Thevessel’selectricalsystemwasworkingnormally,so,forexample,allthenavigatingbridgeequipmentremainedoperational.Theemergency-andbackup-systemsandtheiroperationIncasethesensorforprovidingthemainenginecontrolsystemwithrotationspeedinfor-mationfails,thebackupsensorisactivated.Inthiscase,bothsensorsfailedatthesametime,i.e.thebackupsystemfailed.
OnboardactivitiesduringthemainenginefailureThemasterandthepilotwereonthenavigatingbridgeatthetimeoftheincident.Themaster,whoalsooperatedthebowthruster,didmanualsteering.Thechiefofficerandthebosunwereinthebowoftheship,readytoanchorifnecessary.Assoonasthemainenginestopped,thepilotinformedtheVTSabouttheincident.Themastercontinuedmaneuveringthevesselwiththerudderandthebowthrusteraslongasthevesselhadanyspeed.Consideringthepositionofthevesselandtheweatherconditions,itwasjudgedthattugassistancewasnotnecessary.Itwouldhavelastedapproximatelytwohoursforthetugtoarrive.Thebridgeequipmentwasoperatingnormallyanditwaspossibletomonitorthepositionofthevesselcontinuouslyduringtheincident.
Thechiefengineerwasintheenginecontrolroomandtheengineerintheengineroomwhentheenginealarmsystemalertedaboutfailureintherotationspeedsensors.Theautomationstoppedthemainengineimmediately.Basedontheenginealarm,thechiefengineerjudgedthatfaultyspeedsensorscausedthemainenginefailure.Heimmediatelybegantosortoutwhetherthereweresparepartsonboard,sothatthedamagedsensorscouldbereplacedwithnewones.
19
Restoringthesystemtonormalmode
Thenecessarysparepartswerefoundonboard,andboththemagneticsensorswerereplaced.Themainenginewasrestartedandthevesselwasmaneuverableagain.Entriesinthevessel'sSafetyManagementSystem(SMS)concerningmainenginefailureandtheirimplementationInconnectionwiththisincidentitdidnotbecomeclearwhetherthecompanyhadissuedanyinstructionsforsituationswithmainenginefailures.
Factorsthatreducedsafety- ObtainingtugboatassistanceintheportofPoriwouldhavetakentwohours.- Thepreventivemaintenancesystemwasinsufficient,becausethesimultaneouswear
ofthemain-andbackup-sensorwasnotdetected.
Factorsthatincreasedsafety- Theauxiliaryenginesremainedoperational,solimitedmaneuveringofthevessel,us-
ingthebowthrusterandrudder,waspossible.- Thebridgeequipmentwasoperationalanditwaspossibletomonitorthepositionof
thevesselcontinuouslyduringtheincident.- Thecrewwasabletoidentifyandrectifythefaultquickly.- Therewasapilotwithknowledgeaboutthelocalcircumstancesonboard.Hetookcare
ofthecommunicationwiththeVTSandvesselsinthevicinity.Thus,thevessel’screwcouldfocusonensuringthesafetyoftheship.
- Therewerenecessarysparepartsonboard.
ExternalfactorsthatinfluencedpositivelyontheoccasionThevesselwasdriftingslowlyingoodweatherconditions.
Thewaterdepthinthesurroundingareawaslargeenoughtoallowforsafedriftingforthevessel.Therewasnoothertrafficinthefairwaythatwouldhavehadtobetakenintoaccountduringtheincident.
20
M/VAlppila,PowerFailure,4.4.2016
Generalinformation
Timeandplaceofincident 4.4.2016at8.08–8.12,Ust-Lugaanchorage,RussiaVesselname,callsignandIMOnumber
Alppila,OJOF,9381706
Typeofvessel BulkcarrierFlagstate FinlandPlaceofbuildandtime ABGShipYard,India,2011Maindimensions LOA155.4m;beam25.2m;maximumdraught9.59mNT,GT,DWT 6420,14841,20499Owner ESLShippingLtdShipmanager ESLShippingLtdClassificationsociety Lloyd'sRegisterMainengine,power ManB&W6550MC-C,8580kWAuxiliaryengine,power 3xWärtsilä6L20,860kW,total2580kWPropulsion AdjustablepitchpropellerCargoinformation InballastCrew 14+2cadetsMeteorologicalconditions WindNE3m/s,temperature+1°C,rain
OverviewofIncident
4.4.2016inthemorning,M/SAlppilawasatanchorintheUst-LugaanchoragewhenanABwantedtostartoneofthevessel'sdeckcranes.Heintendedtomovesomefenders.AftertheABhadcheckedwiththeengineroomthatthemainswitchboardwasinautomaticmode,somethingthatstartingthecranerequires,heturnedtheswitchrequestingadequatepowerforstartingthecrane.Theauxiliaryengineinoperationstoppedalmostimmediately,andthevessel'spowersupplywascutoff.Thebackupauxiliaryenginenextinlinestartedaboutoneminutelater,andthevessel’spowersupplywasnormalizedinamatterofminutes.
Theincidentdidnotcauseanydanger,becausethevesselwasatanchorandnocriticalopera-tionswereinprogress.DescriptionofthepowerfailureanditsreasonsThevessel’sdeckcraneshaveaswitchforrequestingadequatepowerandforgettingpermis-sionfromthemainswitchboardtostartthecrane.Iftheloadontheauxiliaryengineinuseissuchthatitdoesnotallowforanincreaseoftheload,theautomationdoesnotgivepermis-siontostartthecranesbeforethebackupauxiliaryenginenextinlinehasstartedandiscon-nectedtothenetwork.Thereisaseparatestartbuttonforthecrane.Thecranecanonlybestartedwhentheautomationhasapprovedthepowerrequest.Thevesselhasthreeauxiliaryengines.Atthetimeofthepowerfailure,auxiliaryenginenum-ber3wasinuse.Thevoltageofauxiliaryengine3hadalreadyearlierbeennoticedtocon-stantlyvarybetweenapproximately376-405V.Thereasonforthevariationhadnotbeenfound,butthevariationhadbeennotedinthefirstengineer'sendofshiftreport.
21
Whenthecrane'spowerallocationrequestswitchwasturned,thevoltageandpossiblyalsothefrequencyofauxiliaryengine3simultaneouslydroppedbelowthealertlimit.Thedropinvoltageandfrequencymostlikelycausedthepowerfailure.Theautomationthenstoppedauxiliaryengine3toprotectthetechnology.Thestartbuttonofthecranewasnotpushedatanypoint.Theconnectionbetweenthecrane'spowerallocationrequestandthestoppingoftheauxiliaryengine,couldhowevernotbedefinitelyestablished.EffectsonboardofthepowerfailureThevessel’spowersupplywasinterruptedforfourminutes.Thepowerfailurehadnosignifi-canteffectsonboard.
Theemergency-andbackup-systemsandtheiroperation
Thebackupauxiliaryenginenextinlinestartedautomatically.Itwasnotpossibletoestablishwithcertainty,fromtheenginecontrolsystem'salarmlists,whethertheemergencygeneratorhadstarted,asitshouldhave.Onboardactivitiesduringthepowerfailure
Astheautomationofthevessel’sauxiliaryenginesworkedasplanned,thecrewonlyhadtorestorethesystemtonormalmode.Restoringthesystemtonormalmode
Afterthepowerfailure,acontrolround,consistentwiththecompany'sinstructionsforthistypeofincidents,wasmade.Duringtheround,alarmswereacknowledgedanddevicesthathadstoppedwererestarted.Duetotheuncertainoperationofauxiliaryengine3,thestartingorderoftheauxiliaryengineswaschanged,sothatauxiliaryengines1and2wouldstartbeforenumber3.
Laterthevoltageregulatorsandpotentiometersofauxiliaryengine3werereplacedwithnewones.Afterreplacingtheparts,thevoltagefluctuationsstoppedandtheauxiliaryenginerannormally.Theshippingcompanyplansyettohavethepotentiometersfine-tunedinaccordancewiththemanufacturer'sinstructions.
Entriesinthevessel’sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementation
- Thecompanyhasissuedinstructionsformeasurestobetakenonthenavigatingbridgeandintheengineroomincaseofapowerfailure.Thevessel’screwfollowedthein-structions.
- Adeviationreportontheincident,consistentwiththerequirementsinthesafetyman-agementsystem,wasprepared.Thevessel’sproposalforcorrectivemeasureswastocallforatechnicianspecialisedinvoltagecontrolandtohavehimcheckandpossiblyadjustthevoltageregulatorsofallthreegenerators.
- NochangesweremadeintheSMSorinthepreventivemaintenancesystemasaresultoftheincident.
Factorsthatreducedsafety- Thevoltagefluctuationsinauxiliaryengine3hadalreadyearlierbeennoticed,butno
activemeasureshadbeentakentoclarifytheproblem.Noattemptshadbeenmadeto
22
controltheriskcausedbythefluctuationsinthevoltage,notbychangingthestartingorderoftheauxiliaryenginesorbyothermeans.
M/VLianne,PowerFailure,23.6.2016
Generalinformation
Timeandplaceofincident 23.6.2016at11.10-11.13,LakeSaimaa,TaipalelockVesselname,callsignandIMOnumber
Lianne,V2CP4,9422275
Typeofvessel DrycargocarrierFlagstate AntiguaandBarbudaPlaceofbuildandtime UstamehmetogluShipyard,Turkey2005Maindimensions LOA79.94m,beam12.50m,maximumdraught4.75mNT,GT,DWT 958,1903,3024Owner ScheepvaartbedrijfvanDamB.V.Shipmanager ScheepvaartbedrijfvanDamB.V.Classificationsociety RegistroItalianoNavale,Mainengine,power MAK6M20,1140kWAuxiliaryengine,power 2xVolvoPentaTAMD74,135kW,total.270kWPropulsion Controllablepitchpropeller,BeckerrudderCargo InballastCrew 7+pilotMeteorologicalconditions WindSE2m/s,temperature+22°C,skyclear
OverviewofIncidentM/VLiannewasenroute,underpilot,toSiilinjärvi,northSaimaa.WhenenteringthelockinTai-palecanal,thevesselsufferedapowerfailure.Thevesselwasalreadyhalfwayintothelockatthetimeoftheincidentandhadaspeedofabout1to2knots.Thelockwallskeptthevesselparallelwiththelockwhileitslowlyglidedforwarduntiltheelectricitysupplywasbacktonormal.Thepowerfailurelastedforabout2-3minutes.Neitherthevesselnorthelockstructuressufferedanydamage.
DescriptionofthepowerfailureanditsreasonsThevesselhastwomainenginesandtwoauxiliaryengines.Normallytheshaftgenerator,con-nectedtothemainengine,produceselectricityforalldevicesofthevesselwhileatsea.Wheninfairways,theshaftgeneratorisusedforproducingelectricityforthethrusterwhiletheauxiliaryenginegeneratorsproduceelectricityfortheotherdevicesoftheship.
Inthelockthemasterbeganusingthebowthrusterbypressingthepowerbutton.Immediatelyafterthis,thecircuitbreakersoftheshaftgeneratorandtheauxiliaryenginegeneratorsopened,causingacompletepowerfailure.Theuseofthebowthrustershouldnothaveputanunusualloadontheelectricitynetwork;thiswasnormaloperationofthebowthruster. Momentsearlierthebowthrusterwasoperatingnormally.Themainengineandauxiliaryenginesremainedrunning,despitetheopeningofthecircuitbreakers.Sinceallgeneratorcircuitbreakersfeedingtheelectricitynetworkopenedatthesametime,itcanbeassumedthatbothauxiliaryenginegeneratorsandshaftgeneratorwereconnectedinparallel.
23
Thisdifferedfromwhataboveissaidaboutwhatwasthenormalelectricitydistributionarrange-mentwhileinfairways.Becauseofthis,thedisturbanceintheelectricnetworkcouldpropagatethroughthewholeelectricnetwork,causingallthecircuitbreakerstoopen.Itwasnotpossibletoestablishadefinitereasonfortheopeningofthegeneratorcircuitbreakersbasedontheavailableinformation.Onepossiblereasonmaybeanetworkoverloadduetothesimultaneouspowerneedofhighpowerconsumers,suchasthestartingaircompressorandbowthruster.Theloadvariationonthemainenginemayhavecausedthevoltageandfrequencyoftheshaftgeneratoroutputtofluctuate,caus-ingcircuitbreakerstoopen.Otherpossiblecausesmayhavebeenadisturbanceintheautomationoftheshaftgeneratorandauxiliaryenginegenerators,orintheoperationofthecircuitbreakersthemselves.EffectsonboardofthepowerfailureNeitherthevessel'sbowthrusternortherudder,workedduringthepowerfailure,andthevesselwasthusnotundercommand.
Theemergency-andbackup-systemsandtheiroperationThevesselhasnoemergencygenerator.Thevesselhasanemergencybatterysystem(UPS),which,duringapowerfailure,producespowerforemergencylighting,theGMDSSradiostation,aswellasfortheengineautomation.Theoperationoftheemergencybatterysystemduringtheincidentcouldnotbeverifiedafterwards.OnboardactivitiesduringthepowerfailureThemasterandapilotwereonthenavigatingbridgeatthetimeoftheincident.Theyobservedthemovementsoftheship.
Thechiefengineerwasinhiscabinwhentheenginealarmcausedbythepowerfailurewasacti-vated.Hewenttotheenginecontrolroomandbeganrestoringthesystemtonormalafternoticingthatthegeneratorcircuitbreakershadopened.
RestoringthesystemtonormalmodeThechiefengineerresettheprotectionrelaysofthegeneratorcircuitbreakers,andreconnectedthegeneratorstothemainelectricitynetwork.Heacknowledgedthealarmsthatthecontrolsys-temhadregisteredandverifiedtheoperationoftheengineroomequipment.Entriesinthevessel’sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementationTheshippingcompanyhadgeneralinstructionsforpowerfailuresituations,butthetechnicalde-tailsintheinstructionshadnotbeenmodifiedtobecompatiblewiththisspecificvessel.Alsothelistofcriticalequipmentwasgeneral,intendedforthewholeshippingcompany,andnotvessel specific.Equipmentmaintenancewasmonitoredwith theelectronicpreventivemainte-nancesystem.Nodeviationreportontheincidentwasmade,eveniftheshippingcompanySMSrequiresreport-ingofincidents.
Factorsthatreducedsafety- Neitherthevessel'sbowthrusternortherudder,workedduringthepowerfailure,andthe
vesselwasthusnotundercommand.
24
- Themasterandchiefengineerwerenotawareofthattheshippingcompanyhadinstruc-tionsforpowerfailuresituations.Actionsonboardwerebasedonsituation-specificsolu-tions.
- Thevessel'spersonneldidnothavesufficientunderstandingofthevessel’ssystemsandthedifferentmodesusedwhenoperatingatopenseaandinfairways.
- Theshippingcompany'sgeneralinstructionsforpowerfailuresituations,andthetechnicaldetailsinthem,hadnotbeenmodifiedtofitthisspecificvessel.
Externalfactorthatinfluencedpositivelyontheoccasion- Thefailureoccurredinasituationwhenthevessel'sspeedwaslowandthelockprevented
drifting.
M/SFinnsun,PowerFailure,30.6.2016Generalinformation
Timeandplaceofincident 30.6.2016at14.03–15.18,VuosaarifairwayVesselname,callsignandIMOnumber
Finnsun,OJPA,9468918
Typeofvessel Ro-rocargoshipFlagstate FinlandPlaceofbuildandtime JinlingShipyard,China,2012Maindimensions LOA188.4m;beam26.5m;maximumdraught6.9mNT,GT,DWT 8401,28002,10370Owner FinnlinesLtdShipmanager FinnlinesLtdClassificationsociety RI,RegistroItalianoNavaleMainengine,power 2xWärtsilä8L46F,10000kW,tot.20000kWAuxiliaryengine,power 2xMitsubishiS12R,1100kW,tot.2200kWPropulsion 2controllablepitchpropellersCargo Ro-rocargoCrew 16+1traineeMeteorologicalconditions WindESE2m/s,temperature+18°C,clear
OverviewofIncidentM/VFinnsunwasenroutetoVuosaariport30.6.2016,intheafternoon.BeforethebeginningoftheVuosaariportchannel,thevessel’sauxiliaryenginesandmainenginesstopped. Thevesselsufferedacompletepowerfailure,andlostitsmanoeuvrability.Afewminutesbeforethepowerfailure,thevesselhadshiftedfromshaftgeneratorpowerfeed,usedatopensea,toauxiliaryenginefeed,usedwheninfairways.ThevesselinformedtheVTSaboutthesituation.Visibility,weatherconditions,trafficandthepo-sitionofthevesselwereallsuchthatthevesselsafelycouldbeletdriftinginthefairway.Ittookaboutanhourand10minutesbeforethemain-andauxiliary-enginescouldberestartedandthevesselwasabletocontinueitsvoyagetoport.
25
Descriptionofthepowerfailureanditsreasons
Theshiftingofthepowerfeedfromtheshaftgeneratorstotheauxiliaryengineswentasnormal:theautomationsystemstartedtheauxiliaryengines,connectedthemtothemainswitchboardanddisconnectedtheshaftgeneratorsfromthesame.
4-5minutesaftertheshifting,theenginecontrolsystemgaveafrequencyalarmfromtheelectricitynetwork.After a few secondsbothauxiliaryengines stopped,and thepower feed to themainswitchboardwas interrupted.Atthesametime,themainenginesstopped,becausetheelectricpumps,connectedtothemainswitchboard,stoppedworking.Itwasfoundthattheauxiliaryenginesstoppedbecauseofafuelsupplydisruption,causedbywaterinthefuel.Thefuelsupplylinestotheauxiliaryengines,andthefuelinthedaytankwerecontam-inatedwithwater.Initiallyitwasthoughtthatthewaterinthedaytankhadleakedtherefromasteampipeinthetank'sheatingsystem.Thedaytankheatingwasnotinoperation,butthevalveintheheatingsystem'sreturnsidewasopen.Thesteamlinewaspressuretestedaftertheincidentandwasfoundtobeintact.Inamoredetailedinspection,itwasfoundthatthefuelhadbeencontaminatedbysteamandcondensedwaterfromanotherfuelseparator'sheatexchanger.Thisisamaintenance-freeheatexchangerthatcannotbeopened,sotheleakagecouldnotbeobservedfromtheoutside.
EffectsonboardofthepowerfailureWhenthemainenginestopped,thespeedofthevesseldecreasedtozero.Thevesselwasthusnotundercommand,eventhoughtherudder,becauseofthepowerfeedfromtheemergencygenera-tor,remainedoperationalthroughouttheincident.Thebridgeequipmentandtheengineroomau-tomationremainedoperationalduetopowerfeedfromtheUPS-systembatteriesandtheemer-gencygenerator.Thevessel'spowersupplywasinterruptedforaboutonehour.Thevesselarrivedinportaboutoneandahalfhourslaterthanscheduled.
Theemergency-andbackup-systemsandtheiroperationThevessel'semergencybatterypowersystem(UPS)andemergencygeneratoroperatednormallyandproducedelectricityforthedevicesconnectedtotheemergencyswitchboard.Ittook20sec-ondsfortheemergencygeneratortostart,andaboutaminuteforittoconnecttotheemergencyswitchboard.
OnboardactivitiesduringthepowerfailureTheengineoffice,closetotheenginecontrolroom,wasmannedatthetimeoftheincident.Whentheauxiliaryenginesstopped,thechiefengineerquicklywenttothecontrolroomandtriedtorestart the auxiliary engines,butwithout success. The engine crewbegan acknowledging thealarmsthathadcomefromtheenginecontrolsystem.Whentheemergencygeneratorhadstarted,itwaspossibletouselightingnormallyagain.Thereafterthechiefengineerproceededtotheaux-iliaryengineroomandtriedtostarttheenginesmanually fromthere,butthatdidnotsucceedeither.Enginesandauxiliarysystemswereinspectedvisually,butnodefectsweredetected.Next,thefuelfeedwasinvestigated,andwaterwasfoundinthefuelsystem.Ittookabout10minutestodeterminethecauseoftheincident.TheOOWandawatchmanwereonthenavigatingbridgeatthetimeoftheincident.Themasterandchiefmatecametothebridgesoonafter.Allthebridgeequipmentremainedoperational,sincethebackupsystemsfunctionednormally.Thecrewonthebridgewasthusabletofocusoncontrol-lingthevessel’sposition.ThevesselinformedtheVTSabouttheincident,andthedaysignalsfor
26
vesselnotundercommandwerehoisted.Therewasnoneedtoanchor,butitwouldhavebeeneasilydone,ifnecessary,becausetheanchorchainstopperswereopenandtheanchorscouldhavebeenletgofromthenavigatingbridge.Restoringthesystemtonormalmode
Thecrewbeganremovingthewaterfromthedaytank,immediatelyafterdiscoveringit.Approxi-mately20-30litresofwaterwasremoved fromthedaytank,andthe fuel linestotheauxiliaryenginesweredrainedofwater.Allfuelfiltersintheauxiliaryengineswerereplacedandthecrewthenbegantobleedouttheairfromthefuelsystem.Aboutanhourafterthefailure,thevessel’sauxiliaryenginescouldbestartedandtheelectricitysupplyreturnedtonormal.
Daytankwaterretentionwasmonitored,andsomemorewaterstillhadtoberemoved.Thedaytank'ssteampipevalveonthereturnsidewasclosed,becauseitwassuspectedthatthesteampipeinsidethetankwasleaking.Lastlytheboilersandmainengineswerestarted,andthevesselcontinueditsvoyagetotheportofVuosaari.
Itcouldlaterbeestablishedthattheoriginofthewaterinthefuelwasabrokenheatexchangerinthefuelseparator.Thebrokenheatexchangerwasreplaced.Aftertheincident,theshippingcom-panyhasinstructedalsothesister-shipstodrainthefueltanksofwatermoreoften,sothatsimilarinstancescanbedetectedinatimelyfashion.Entriesinthevessel’sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementationThevesselhadinstructions,issuedbytheshippingcompany,formeasurestobetakenonthenav-igatingbridgeandintheengineroom,incaseofapowerfailure.Thevessel’spersonnelactedinaccordancewiththeinstructions.Adeviationreportonthe incident,consistentwiththerequirements inthesafetymanagementsystem,wasprepared.
Factorsthatreducedsafety- Whenthemainenginestopped,thespeedofthevesseldecreasedtozero.Thevesselwas
thusnotundercommand,eventhoughtherudder,withpowerfeedfromtheemergencygenerator,remainedoperationalthroughouttheincident.
- Bothauxiliaryengineshaveacommondaytankandacommonfuelsupplyline.Thereisnopossibilitytouseanalternativefuelsupplyincaseofanemergency.
Factorthatincreasedsafety- Thevesselhasinstructionstochangethepowersupplyfromshaftgeneratortoauxiliary
engines45minutesbeforearrivingtopilotboardingarea,ortobeginningofportentrancefairways.
Externalfactorsthatinfluencedpositivelyontheoccasion- Thevesselwasdriftingslowlyingoodweatherconditions.- Thewaterdepthinthesurroundingareawaslargeenoughtoallowforsafedriftingforthe
vessel.- Therewasnoothertrafficinthefairwaythatwouldhavehadtobetakenintoaccountdur-
ingtheincident.
27
RMSNeudorf,PowerFailure,11.7.2016Generalinformation
Timeandplaceofincident 11.7.2016at16.20-19.10,KissaluotoS,LappeenrantaVesselname,callsignandIMOnumber
RMSNeudorf,V2A15,8920256
Typeofvessel DrycargocarrierFlagstate AntiguaandBarbudaPlaceofbuildandtime DamenShipyards,theNetherlands,1990Maindimensions LOA82.46m;beam12.50m;maximumdraught4.37mNT,GT,DWT 969,1985,2631Owner RhenusMaritimeServicesGmbHShipmanager RhenusMaritimeServicesGmbHClassificationsociety DNV-GLMainengine,power MAK6M322,1200kWAuxiliaryengine,power Caterpillar3304,110kWPropulsion AdjustablepitchpropellerCargo InballastCrew 6+1personsMeteorologicalconditions WindSW5m/s,temperature+19°C,clear
OverviewofIncidentCargovesselRMSNeudorfleftMälkiälockinSaimaaCanal,underpilotage,towardsPortofPuhosinLakeSaimaa.Havingleftthelock,thevesselslowlyincreasedspeed.Approximately10minutesafterleavingthelock,whenthefairwaycurvedslightlytostarboard,thevesselsufferedashortpower failure.Atthetimeofthe incident,therudderwasturnedtostarboard. Therudderre-mainedinposition15degreestostarboard,andthevesselcontinueditsturnoutofthefairwayarea.
Anattemptwasmadetopreventthevesselrunningagroundbyusingthemainenginefullastern.Thevesseldidnotrespondtothisquicklyenough,soittouchedgroundoffthefairwayareawithaspeedofapproximatelytwoknots.Thebowthrustercouldnotbeusedduringthepowerfailure.Thevessel'sauxiliaryenginerestartedautomaticallyafterthe failure,andthevessel'smanoeu-vringabilitywasrestoredquickly.Thevesselwasabletogetawayfromtheshallowbyitsownefforts,andsubsequentlytomoveontoanchoronanearbybay.Afteraninspectionofthedamage,itwasfoundthatthevesselhadnoleaksandthevesselgotpermissiontocontinueitsvoyagetotheportofdestinationforfurtherinspections.
ThegroundingwasreportedpromptlytoSaimaaVTSandotherauthorities.
DescriptionofthepowerfailureanditsreasonsThevessel’smainenginewasrunningandtheshaftgeneratorwasconnectedtothemainswitch-board.Theauxiliaryenginewasinstandbymode.Thevessel'sestimatedneedforelectricpoweratthetimeoftheincidentwasbetween50and70kWwhentheeffectoftheshaftgeneratorwas600kW.
28
Thecauseforthepowerfailurewasthattheshaftgeneratordisconnectedfromthemainswitch-boardforanunknownreason.Beforethepowerfailure,theenginecontrolsystemgavea"miscel-laneous"alarm,whichcauseorconnectiontothefailureisnotknown.Inretrospect,itwasnotpossibletofindanexplanationforthedisconnectinginthevessel'scontrolsystems.Thefailurehadanestimateddurationofafewminutes.Apossiblecause fortheshaftgenerator'selectricswitchtoopencanbeabreakermalfunction.Initiallyitwasconsideredonboardthatanoverloadoftheshaftgeneratorwouldhavecausedthefailure,butthelowpowerconsumptionatthetimeoftheincidentdoesnotsupportthistheory.Effectsonboardofthepowerfailure
Whenthepowerfeedfromthemainswitchboardwasinterrupted,alltheconnecteddevices,in-cludingthesteeringgearhydraulicpumps,stoppedworking.Therudderremainedinthepositionitwasinwhenthefailureoccurred.Thestandbyauxiliaryenginestartedautomaticallylessthanaminuteaftertheshaftgenerator'scircuitbreakerhadopened.Thefailuredidnotaffecttheoperationofthemainengine.
Theemergency-andbackup-systemsandtheiroperationThemainnavigationequipmentofthevesselandtheengineautomationweresecuredbya24Vbatterysupply(UPS)system,andtheyworkednormallyduringthepowerfailure.
Thevesselhasanemergencygenerator,butitdidnothavetimetostartbeforetheauxiliaryengineinstandbymodealreadystarted.OnboardactivitiesduringthepowerfailureThefirstmateandthepilotwereonthebridgeatthetimeoftheincident.Afterdetectingthattherudderdidnotwork,theytriedtostartthebowthruster.Thatwas,however,notpossiblewithouttheshaftgenerator.Atthesametimeanattemptwasmadetore-starttherudderpumps,withoutsuccess.Theytriedtostopthevesselbyusingtheenginehardastern.Alsothemastercametothebridge,havingnoticedthatthevessel’smotionchanged.Atthispoint,thevessel’srudderstartedtoworkagain.Thevesselwas,however,alreadysoclosetotheshallow,thatthegroundingnolongercouldbeprevented.
Thechiefengineerwasintheengineroomatthetimeoftheincident.Afterhavingrealisedthattheshaftgeneratorhaddisconnected fromthemainswitchboardandthattheauxiliaryenginehadstarted,heimmediatelybegantorestorethesystemtonormalmode.
After thegrounding, thevesselreversedback to the fairwayareaandanchoredon thenearbyRiutanselkä-bay,wherethecrewbeganinspectingtanksforleaks.RestoringthesystemtonormalmodeAftertheauxiliaryenginehadstarted,thepowersupplyreturnedtonormal.Thechiefengineerwasable tosynchroniseandconnect theshaftgenerator to themainswitchboardwithoutanyproblems.Becauseofthe incident,theclassificationsocietyrequiredthevesseltohaveaserviceproviderchecktheconnectionsandalarmsystemsoftheshaftgenerator.Nodefectswerefoundinthecon-trol.
29
Entriesinthevessel’sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementationTherewerenoseparateinstructionsforpowerfailuresinthevessel'sSMSmanual.Steeringmal-functionsandgroundingsweredealtwithinseparatechecklists.Therewereinformalinstructionsintheengineroomforrestoringthesystemstonormaloperation.Theincidentwasreportedtotheshippingcompanybytelephone,butadeviationreportwasnotimmediatelycompiled.
Factorsthatreducedsafety- Thesteeringgearhydraulicpumpsstoppedworkingandtherudderremainedintheposi-
tionwhereitwaswhenthefailureoccurred.- Thewearandconditionof theelectriccircuitbreakersarenotmonitoredregularly. To
managethisrisk,electriccircuitbreakersshouldbecheckedorreplacedperiodically.- InRMSNeudorf'selectricsystem,onlyonepowersupplyatatimecanbeconnectedtothe
mainswitchboard. Incaseofdisturbances,switchingpowersourcewillalwayscauseaninterruptionintheelectricitysupply.Inanarrowfairwayevenashortinterruptioncanbecritical.
- Thevessel’sbowthrusterreceivesitselectricitysupplyonlyfromtheshaftgenerator.Thepowerproducedbytheauxiliaryengineisnotsufficientforusingthebowthruster.
Externalfactorthatinfluencednegativelyontheoccasion- Saimaafairwaysareverynarrowandevensmalldeviationsfromtherouteeasilyre-
sultinaccidents.
M/SAmorella,PowerFailure,18.7.2016
Generalinformation
Timeandplaceofincident 18.7.2016at09.31-09.40,AiristoVesselname,callsignandIMOnumber
Amorella,OIWS,8601915
Typeofvessel Ro-ropassengershipFlagstate FinlandPlaceofbuildandtime Brodosplit,Croatia,1988Maindimensions LOA157.97m;beam27.6m;maximumdraft6.35mNT,GT,DWT 19689,34384,3690Owner VikingLineLtdShipmanager VikingLineLtdClassificationsociety DNV-GLMainengine,power 4xWärtsiläPielstick12PC2-6,5940kW,total23760kWAuxiliaryengine,power 4xWärtsilä32R8,2430kWtotal9720kWPropulsion 2controllablepitchpropellersCargo 2088passengers+carsCrew 181+14artistsorservicepersonnelMeteorologicalconditions WindESE1m/s,temperature18°C,clear
30
OverviewofIncident
M/VAmorelladeparted17.07.2016at08.50foritsscheduledvoyagefromTurkutoStockholmviaMariehamn.About40minutesafterdeparturethegeneratorbreakerinauxiliaryenginenumber3opened,and,asaresult,thevesselsufferedapartialpowerfailure.Oneofthemainenginesandoneauxiliaryengineremainedrunning,sothevesselmaintainedlimitedmanoeuvringcapabilityandwasabletocontinueitsvoyagealongthefairwayatslowspeed.ThepilotinformedaboutthesituationtotheVTSandvesselsinthevicinity.Thebackupauxiliaryenginesstartedwithinafewminutes.Theenginecrewgotthemainenginesthathadstoppedre-startedandthesituationreturnedtonormalinabouttenminutes.
Theincidentdidnotcauseanydangeronboardorfornearbytraffic.
DescriptionofthepowerfailureanditsreasonsWhenthevessel leftTurkumainengines2and4,andauxiliaryengines1and3wererunning.Auxiliaryengines2and4wereatstandstill.Abouthalfanhourafterdeparturemainengines1and3werestarted,afterwhichallfourmainengineswererunning.Whenallmainengineswererun-ning,theloadonthepowergridincreased.Theopeningof thegeneratorbreaker inauxiliaryengine3,and thesimultaneousshortcircuitalarminthepowergrid,causedthepowerfailure.Asaresultoftheshortcircuitalarm,thepowergrid'sdisconnectswitchopened,andthevesselsufferedapartialpowerfailure.Theauxiliaryen-ginethatremainedrunningwasoverloaded,butcontinuedtorun.Theopeningofthegeneratorbreakerinauxiliaryengine3andtheshortcircuitalarmweremostlikelycausedbyafailureofthegeneratorbreaker.Mainengine3andauxiliaryengine1remainedrunning,becausethepowersupplyfortheiroper-atingpumpswasontheportsideofthenetworktowhichauxiliaryengine1’sgeneratorwascon-nected.Accordingtothealarmhistory,mainengines1and4stoppedduetolowlubricatingoilpressure.Thelubricatingoilpumpsconnectedtothestarboardsideofthenetworkstoppedbecausetheydidnothaveanyelectricpower.Thestand-bylubricatingoilpumps,connectedtotheportsideofthenetwork,didnotstartbecauseofanerrorinthelogicoftheautomationsystemofthemachin-ery.Mainengine2stopped,becausethecoolingwaterpumpsforthecylindersdidnothaveelectricpower.Theprimaryaswellasthestand-bycoolingwaterpumpwaswronglyconnectedtothestarboardsideofthenetwork,whichwasde-energizedduetothepowerfailure.Theprimarypumpshouldhavebeenconnectedtotheportsidenetwork.
EffectsonboardofthepowerfailureSomeofthepropulsionmachineryoperatingpumpsandthreemainenginesstopped.
Secondaryelectricityconsumersdisconnectedfromthenetwork.Theairconditioning,includingventilationunits,forexample,stopped.Thevessel’smanoeuvringabilitywas limited,becauseonlythecontrollablepitchpropellerandrudderconnectedtothemainenginethatremainedrunningwereinuse.
Theincidentdidnotcauseanyobservableharmtothevessel’spassengers.Theemergency-andbackup-systemsandtheiroperation
Thevessel’semergencygeneratorfailedtostartbecausethepowergridremainedenergised.
31
Onboardactivitiesduringthepowerfailure
Atthetimeofthepowerfailurethemaster,thelinepilot,thewatchofficerandthechiefofficerwereonthenavigatingbridge.Thepowerfailurewasdetectedwhena"panicalarm",signifyingaseriousengine failure,started flashing.Whenthatalarmhadbeenacknowledged,a lotofotheralarmswereactivated.Theengineroomalsoinformedthebridgeaboutthepartialpowerfailure.ThepilotinformedtheVTSandvesselsinthevicinityaboutthesituation.AnABwassenttotheforecastletoprepareforanchoring,incasethatwouldprovenecessary.Thevesselhasatraffic-lightsymboldescribingthestateofthepowerdistributionsystem.Greenindicatesnormalmode;yellow–emergencygeneratorinput;andred–batteryinput.Accordingtotheobservationsofthebridgepersonnel,thetraffic-lightremainedgreenthroughouttheincident.Thisinformationwasimportantforthebridgepersonnelwhentheymadedecisionsconcerningmanoeuvring.Thevessel'sengineroomisalwaysmanned.Atthetimeoftheincidenttheengineeronwatchandanengineerondaywork,wereintheengineroom.Soonafterwards,thechiefengineerandtheelectricalengineercamethere.Togethertheybegantosortoutthereasonsforthefailure,acknowl-edgedthealarms,andbeganrestoringthesystemtonormalmode.
RestoringthesystemtonormalmodeHavingdetectedadisturbanceintheelectricalnetwork,theauxiliaryengineautomationstartedtheauxiliariesnextinline,i.e.auxiliaries2and4.Whentheywereconnectedtothenetwork,theenginecrewstartedthepumpsandothersupportiveequipmentofthemainengines.Afterthat,themainengineswerestarted,oneatatime.Thedisconnectswitchofthepowergridthatwasopenedbytheshortcircuitalarmwasclosedwhenthemachinerywasconsideredstable.Aftertheincidentthefaultycircuitbreakerinauxiliaryengine3'sgeneratorwasreplacedwithanew,anditsoperationwastested.Inaddition,auxiliaryenginenumber3wasputlastinrunningorderuntilitcouldbeverifiedwhetherthefaultycircuitbreakerindeedwasthereasonforthepowerfailure.Amanufacturer'sservicemanwassentfortothevesseltocheckthefaultycircuitbreaker. Theserviceman'sreportwasreceivedonboardafewdaysaftertheincident,anditwasrecommendedthatthecircuitbreakerwouldbesenttoFranceformoredetailedinspectionTheshippingcompanyandthemanufacturerhavetogethertriedtosortouttheerrorinthelogicofthemachinery’sautomationsystemthatcausedmainengines1and4tostop.Theautomationsystemwasnotabletoidentifythesituationasapowerfailure,sinceoneoftheauxiliaryengineswasrunningandtheelectricgridremainedenergised. Thedevicemanufacturer isplanningtomodifytheautomationsystemsothatitinthefuturewouldrecognisealsoapartialpowerfailure.Theshippingcompanyalsolookedintotheincorrectconnectingofthecoolingwaterpump.Thepumphadbeen incorrectlyconnectedsincethebuildingofthevessel,butnow ithasbeencor-rected.Entriesinthevessel’sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementation
TheshippingcompanySMSsystemincludedvesselspecificinstructionsformeasurestobetakenonthenavigatingbridgeandintheengineroomincaseofapowerfailure.Thebridgecrewfol-lowedtheinstructions,somethingthatsupportedtheiroperationduringtheincident.Theengineroominstructionsweremainlyaimedforsituationswithtotalpowerfailures,butalsotheywerefollowed,tosuitableparts.
32
Adeviationreportonthe incident,consistentwiththerequirements inthesafetymanagementsystem,wasprepared.
Factorsthatreducedsafety- Thebackupofcriticalsystemsdidnotworkasplanned.- Thestand-bylubricatingoilpumpsconnectedtotheportsideofthenetworkdidnotstart
becauseofanerrorinthelogicoftheautomationsystemofthemachinery.- Thecoolingwaterpumpsofmainengine2'scylindersdidnothavepowersupplybecause
theywereincorrectlyconnected.- Oneofthemainengine'scoolingwaterpumpshadbeenincorrectlyconnectedsincecom-
pletionofthevessel.Factorsthatincreasedsafety
- Onemainengine,oneauxiliaryengineandonerudderremainedoperational,sothevesselmaintainedlimitedmanoeuvrability.
- Thebridgeequipmentwasoperationalanditwaspossibletomonitorthepositionofthevesselcontinuouslyduringtheincident.
- Thevesselhasatrafficlightsymboldescribingthestateofthepowerdistributionsystem.Itassiststhebridgecrewinassessingtheseverityofthedisturbanceintheelectricitydis-tributionandinchoosingthenecessarymeasurestobetaken.
- Theinstructionsforpowerfailuressupportedthecrew'soperationinarealsituation.Externalfactorthatinfluencedpositivelyontheoccasion
- Theincidenttookplaceonastraightandawidepartofthefairway,whereavastsafewaterareasurroundedthevessel.
M/SEgonW–MainEngineFailureandGrounding,13.9.2016Generalinformation
Thetimeandplaceofinci-dent
09.13.2016at08.35,theSaimaadeeproutefairway,Härkinsalo
Vesselname,callsignandIMOnumber
EgonW,V2CE5,9279018
Typeofvessel DrycargocarrierFlagstate AntiguaandBarbudaPlaceofbuildandtime LedaShipyard,Croatia/PedersYard,Netherlands,2004Maindimensions LOA82.5m;beam12.52m;draftof4.85mNT,GT,DWT 959,2409,3500Owner AndreWieczorekGmbH&Co.KGShipmanager AndreWieczorekGmbH&Co.KGClassificationsociety BureauVeritasMainengine,power Caterpillar3512DI-TA,1249kWAuxiliaryengine,power Sisu634DSG,130kWPropulsion AdjustablepitchpropellerCargoinformation: CelluloseCrew: 6+pilotMeteorologicalconditions WindSSW6.6m/s,temperature+10°C,skyclear
33
OverviewofIncident
M/VEgonWdeparted,underpilot,fullyloadedwithcellulose,fromJoensuudeep-waterharbourtowardsGermany,intheeveningof12.09.2016.Thenextmorning,at08.32,while thevesselwas turning to starboard in the fairway southofSavonlinna,themainenginefailed.Despitecounterhelm,thevesselcontinuedtoturnanddriftedintotheshallowseastofHärkinsaloat08.35.Atthetimeoftheincidenttherewasnoothervesseltrafficinthearea.ThepilotreportedtheincidenttotheVTS,thepoliceandtherescuedepartment.Aftertheground-ingthecrewconductedadamagesurveyandinspectedthetanks.Noleaksweredetected.Therewerenoinjuredpersonsandnoenvironmentaldamagewascaused.While themainenginewasstopped, thevesselwas leaningonrocks.Thevessel’smainenginecouldnotbestartedagainwhileaground,becauseoftheriskfordamagingthepropeller.Asalvagetugtowedthevesselbacktothefairwaywherethemainenginewasstarted.Thevesselwasthentransferredtotheothersideofthefairwaywhereitanchored.Whilethevesselwasatanchoradiverinspectedthehull,afterwhichthevesselsailedtoSavonlinnaforfurtherinspections.InSavonlinnaadiverrepresentingtheclassificationsocietyfoundscratchesandsmalldentsonthevessel'shullaswellasa2-3mmtearintheforepeak'sweldingseam.ThevesselgotpermissionfromtheFinnishTransportSafetyAgency tocontinue itsvoyage toGermanyand torepair thedamagetotheduedate.Notethatthisincidentconcernsamainenginefailure,notapowerfailure.Thevessel’sauxiliaryenginewasrunningthroughouttheincidentandproducedelectricityforthevessel.Thisincidentwashowevercomparabletoapowerfailuretoitseffectsanditisthereforeincludedinthissafetystudy.
DescriptionofthemainenginefailureanditsreasonsThevesselwasturningtothesouth,NEofHärkinsalo,whenthemainenginefailed.Thevessel'sspeedwasabouttenknots,whichcorrespondstoapproximately77%power.Theenginecontrolautomationgaverunaway-andoverload-alarmsforthemainengine.Theauto-mationalsostoppedthemainengineaftergivingthealarms,toprotectitfrombeingdamaged.Theengineautomationfollowsthemainengine’srotationsensorinformationaboutthemainengine'srotationspeed.Iftherotationspeedexceedsthesetupperlimit,ittriggerstheautomationtoper-formacontrolledstoppingofthemainengine.Themainengineisalsoshutdown,iftheautoma-tiondoesnotgetanyinformationfromtherotationsensors.Thereason forthemainengine failure isconsideredtobethattheengineautomationreceivedincorrectrotationspeedinformation.Itwasfirstthoughtthatdirtyspeedsensorsinthemainen-ginewerethereasonfortheincorrectinformation.
Inlater,moredetailed,inspections,wiringinpoorconditionwasfoundinthemainengine’spowercontrolunit.Thewiringwasmostlikelythereasonfortheincorrectrotationspeedinformation.Effectsonboardofthemainenginefailure
Whenthevessel'smainenginestopped,thepropellerdidnotrotateandthusdidnotproduceaslipstreamfortherudder,resultinginlossofmanoeuvrability.
34
Thevessel'sbowthrustergetsitselectricpowerfromtheshaftgenerator.Theshaftgeneratorisdirectly,withoutswitches,connectedtothemainengine.Thepowerproducedbytheauxiliaryen-gine isnotsufficient forusingthebowthruster.Afterthemainenginestopped, itwasthusnotpossibletousethebowthrusterformanoeuvringsupport.
Theelectricpowerproducedbytheauxiliaryengine,ensuredsmoothoperationforallthevessel'sdevices,apartfromthebowthruster.Theemergency-andbackup-systemsandtheiroperation
Thevesselhasonlyonemainengine,sothereisnobackupsystem.Thevessel’semergencygeneratorfailedtostartbecausetheauxiliaryenginewasrunningandthepowergridremainedenergized.
OnboardactivitiesduringthemainenginestopDuringthevessel'smainenginestop,themasterofthevesselandthepilotwereonthebridge.Thevesselwasturningtostarboardwhenthemasternoticedthatthemainenginehadstoppedcom-pletelyunexpectedly.
Thepilothadtheconatthetimeoftheincident,andhetriedtostoptheturnbyapplyingoppositerudder, hard a port. The vessel, however, continued to turn towards the eastern shore ofHärkinsalo.Atthesametimethemastertriedtostartthemainenginefromthebridge,butwithoutsuccess.Thechiefengineerhadbreakfastinthemesshallwhenheheardthemainenginerevolutionsriseveryquicklyforafewseconds,beforethemainenginestopped.Thechiefengineerimmediatelywenttotheengineroomandsawthereceivedalarmsontheenginecontrolautomationscreen.Hethenbegantoclarifythesituation.
RestoringthesystemtonormalmodeThechiefengineertriedtostartthemainenginethreetimes,butwithoutsuccess.Afterhavingbeentothebridgetodiscussthesituationwiththemaster,hereturnedtotheengineroomandresetallmainenginesystems.Noattemptwasmadeatthisstagetostarttheengine,sincethevesselwasinshallowwaterandtherewasriskofdamagingthepropellerandthepropellershaft.Themainenginewasstartedwhenthevesselhadbeentowedbackintothefairway.ItwasnotpossibletogetaqualifiedservicetechniciantoinspectthemainenginetoSavonlinnawithinreasonabletime.Thechiefengineercleansedthemainenginespeedsensorshimself,asin-structedbytheclassificationsociety,beforedeparturefromSavonlinna.Later,inconnectionwiththehullrepairdockinginDelfzijlintheNetherlands,aservicetechnician,representingtheenginemanufacturer,visitedthevessel.Hediscoveredthattheinsulationofalotofthepowercontrolunitwiringhadbeenchafedandwaspunctured.Alldamagedwiringwasre-placedandthesystemwastested.
Entriesinthevessel'sSafetyManagementSystem(SMS)concerningmainenginefail-ure,andtheirimplementationThecompanyhasinstructionsintheSMSformainenginefailuresandtheywereavailableonboard,asrequired.Themasterreportedaboutboththemainenginefailureandthegroundingtothecompany,andcompiledtherequireddeviationreportaftertheincident.
35
Factorsthatreducedsafety
- Whenthevessel'smainenginestopped,thepropellerdidnotrotateandthusdidnotpro-duceaslipstreamfortherudder,resultinginlossofmanoeuvrability.
- Afterthemainenginestopped,itwasnotpossibletousethebowthrusterformanoeuvringsupport.
- Inpreventivemaintenancework,thewearoftheinsulationinthepowercontrolunitandthesoilingofthemainenginespeedsensorswerenotdetected.
- Thevessel'sbowthrustergetsitselectricpoweronlyfromtheshaftgenerator.Theshaftgenerator is directly,without any switches, connected to themain engine. There is nobackupsystemtoensurepowersupply.
M/SPrimaBallerina,PowerFailure,20.10.2016Generalinformation
Timeandplaceofincident 20.10.2016at0520,GedserTSS-DanishstraitsVesselname,callsignandIMOnumber
PrimaBallerina,OJPR,8609618
Typeofvessel DrycargocarrierFlagstate FinlandPlaceofbuildandtime J.J.Sietas,Germany,1986Maindimensions LOA87.88m;beam12.8m;
maximumdraught5.20mNT,GT,DWT 1240,2673,3004Owner PrimaShippingLtdShipmanager PrimaShippingLtdClassificationsociety RI,RegistroItalianoNavaleMainengine,power Wärtsilä6R32BC,1975,kWAuxiliaryengine,power 3xDeutzBF6L513R,118kWPropulsion AdjustablepitchpropellerCargo InballastCrew 8Meteorologicalconditions WindSE3m/s,temperature+9C,goodvisibility
OverviewofIncidentM/SPrimaBallerinasufferedanabout10secondslongpowerfailurewhenhershaftgeneratordisconnectedfromtheelectricitygrid.ShewasenroutetoRostock,intheGedsertrafficsepa-rationschemeintheDanishstraits.Itwasearlymorning.Thevessel’smainengineremainedrunningduringthepowerfailure.Thevessel’spropulsionwasworkingnormallyandshewasmanoeuvrable.Therewasothervesseltrafficinthevicinityatthetimeoftheincident,butitwasnotendan-geredbytheincident.
DescriptionofthepowerfailureanditsreasonsBeforethepowerfailure,thevessel'smainenginewasrunning.Theshaftgeneratorwasinuseandproducedpowertotheelectricitygrid.Oneauxiliaryenginewasinstandbymode.
36
Abouthalfaminutebeforethefailure,theenginecontrolsystemgaveanalarmonlowcontrol-airpressureinthemainengine.When thepower failureoccurred, themainengine control-airpressuredroppedbelow thealarmlimit.Whenthecontrol-airpressuredropped,theshaftgenerator'sRPMspeedwasre-ducedandthefrequencyoftheelectricitynetworkfellbelowthespecifiedlimit.Thisdevelop-mentactivatedtheautomationtodisconnecttheshaftgeneratorfromthevessel’selectricitynetwork.Theauxiliaryengineinstandbymodestarted,andconnectedtothenetwork.Thereasonforthecontrol-airpressuredropwasthebreakingofaroundrubbermembrane(ø2cm)inthealarmsensoroftheairpressuresystem.Thecompressedaircoulduncontrollablyescapeoutofthecontrol-airpressuresystem.
EffectsonboardofthepowerfailureThevessel’snavigationequipmentwentoutmomentarily,with theexceptionof theGMDSSequipment.Thevessel'sonlygyrocompassswitchedtofailuremode,whichiswhyitnolongerprovidedinformationtotheautopilot.Itwasthusnecessarytoswitchtohandrudder.Whencomparinggyrodatawiththemagneticcompassdata,itwasfoundthatthedirectiondatathegyrogave,wascorrect.Thiswasthecase,regardlessthatthegyrocompasswasinfailuremode.14
Thevessel'smainengineremainedrunning,butcontroloftheengineswitcheddowntotheenginecontrolroom.Theemergency-andbackup-systemsandtheiroperationWhentheshaftgeneratordisconnected,theauxiliaryenginethatwasinstandbymodestartedinlessthan10seconds.Therewasnotimeforthevessel’semergencygeneratortostart.
OnboardactivitiesduringthepowerfailureThechiefofficerandawatchmanwereonthenavigatingbridgeatthetimeoftheincident.Themasterwasinhiscabin,onoff-duty,butwokeupbecauseoftheincident,andcametothebridgesoonafterthepowersupplywasrestored.Thechiefofficerswitchedtohandrudder.Onthenavigatingbridge,whenthepowersupplywas restored, the radarwas restarted, the vessel's position and the traffic situationwerechecked,andthecontroloverthepropulsionpowerwasreturnedtothebridge.Thewatchmanwassenttocheckthesituation intheengineroom.Realizingthat itwasnotpossibletore-activatetheautopilot,themasterandchiefofficertookturnshandsteering.Theengineroomwasunmanned.Thechiefengineerwokeuptotheenginealarminhiscabinandwenttotheengineroom.Hediscoveredthatthecontrol-airpressurehaddecreasedandbegantroubleshootingtheproblem.Theauxiliaryengineinstandbymodehadalreadystarted,andthevessel’spowersupplyhadbeenrestored.
RestoringthesystemtonormalmodeWhenthepowersupplywasrestored,allnavigationequipment,exceptfortheautopilotandthegyrocompass,operatednormally.Ittookaboutfourhoursforthegyrotodetermineitsdi-rectiondataandforthestateofthesystemtostabilise.Afterthat,directiondatawasonceagainavailablefortheautopilot.
14(GlobalMaritimeDistressandSafetySystem),aglobaldistressandsafetysystem
37
Thechiefengineermadeamembranefortemporaryuse,andreplacedthebrokenrubbermem-braneinthealarmsensorwithit.Afterthis,thecontrol-airpressuresystemworkednormally,anditwasagainpossibletousetheshaftgenerator.InthenextFinnishportthevesselcalledat,aservicemancameonboardtocheckthegyrocom-pass.Hemovedthegyrocompass'selectricpower feedtothedistributionboard,anelectricpanel, forcriticalequipmentonthenavigatingbridge.Thatdistributionboardhasabatterybackupsystem.Entriesinthevessel’sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementation
Therewereseparateinstructions,intheshippingcompany'sSMS(SafetyManagementSystem,SecurityManagementSystem),formeasurestobetakenonthenavigatingbridge,incaseofapowerfailure.Themainengineandpropulsionremainedoperational,andthustheinstructionswerenotfullyapplicable. Aftertheincidentthemasterandthechiefofficercheckedthein-structionsaswellasotherrelatedpossiblefunctionsandtasks.
Thereisalistonthenavigatingbridgeoverallequipmentonboardthatwillremainoperationalduringpowerfailures.Therewereinstructions,dividedintodifferentphases,intheengineroom,formeasurestobetaken in case of power failure. In this incident, the automation carried out all necessarymeasuresandtherewasnoneedtousetheinstructions.Afterthepowerfailuretheactionstakenduringtheincidentwerecomparedwiththeshippingcompany's instructions. Themastercompiledadeviationreport inaccordancewiththe in-structionsoftheshippingcompany.
Thecompanyhasissuedinstructionsformeasurestobetakenonthenavigatingbridgeandintheengineroomincaseofapowerfailure.Thevessel’screwfollowedtheinstructions.Factorsthatreducedsafety
- Thewearandconditionofthemembraneinthealarmsensorofthemainengine'scon-trol-airsystemisnotmonitoredinthepreventivemaintenancesystem.
- Thevesseldoesnothavetwoindependentcompasses,displayingtruedirections.Factorsthatincreasedsafety
- Thevessel'smainenginewasrunningallthetime.- Thevesselwasmanoeuvrablewithhandrudder,inspiteofthegyrocompassfailure.
38
M/SMariella,PowerFailure,5.11.2016
Generalinformation
Timeandplaceofincident 5.11.2016at17.14,Stadsgårdskajen,StockholmVesselname,callsignandIMOnumber
Mariella,OITI,8320573
Typeofvessel Ro-ropassengershipFlagstate FinlandPlaceofbuildandtime WärtsiläshipyardTurku,Finland,1985Maindimensions LOA175.70m;beam28.40m;maximumdraught6.78NT,GT,DWT 24421,37860,3524Owner VikingLineLtdShipmanager VikingLineLtdClassificationsociety DNV-GLMainengine,power 4xWärtsiläPielstick12PC2-6V-400,tot.23000kWAuxiliaryengine,power 3xWärtsiläVasa6R32,tot.5400kWPropulsion 2controllablepitchpropellersCargo 1823passenger+carsCrew 198Meteorologicalconditions WindN4m/s,temperature+1°C,skyclear
OverviewofIncidentThevesselwaspreparingfordeparturefromStockholmandhadjustchangedfromshorepowertoitsownpowergeneration.Afewminutesafterstartingtheauxiliaryengines,oneoftheauxiliaryenginesfailedandcausedadisturbanceinthepowerdistribution.Thevesselwasberthedatthetimeoftheevent,andthemainengineshadnotyetbeenstarted.Thevessel’spowergenerationwasrestoredtonormalinaboutfiveminutes.ThevesselsetofftowardsMariehamnasscheduled.Thefailuredidnotcauseanydangeronboard.
DescriptionofthepowerfailureanditsreasonsThevesselhasfourmainenginesandthreeauxiliaryengines.Asageneralrule,thevessel’sauxil-iaryenginesproducetheelectricity.Themainengineshaveshaftgenerators,whichcanbeused,ifnecessary,toproducetheelectricityrequiredforthevessel.Thevessel’sauxiliaryengines1and2wererunningandconnectedtothepowergrid.Whenauxil-iaryengine3wasstarted,itconnectedtothenetworkandsurprisinglyshoulderedthetotalloadofthepowergrid.Thepowergridfrequencyroseandareversepowersituationfollowed.There-versepowersituationcausedauxiliaryengines1and2todisconnectfromthenetwork.Auxiliaryengine3'sRPMcontinuedtoriseuntiltheengine'smechanicaloverspeedprotectionstoppedtheengine.Auxiliaryengines1and2remainedrunning,butdidnotsupplytheelectricitynetworkwithpower-thusthepowerfailureonboard.Thepowerfailurewascausedbythefaultysignalthattheregulatorinauxiliaryengine3receivedfromtheservomotor’sautomationsystem.Asaresultofthis,theregulatorincreasedtheengine's
39
fuelsupplymorethannecessary.Thecauseofthefaultysignalwasastuckrelayswitchintheau-tomationsystem'sDPU-processingunit(DistributedProcessingUnit).Thevessel'schangingfromshorepowertoitsownelectricitygeneration,wasnotconnectedwiththepowerfailure.
EffectsonboardofthepowerfailureAllthevessel’selectricalequipmentthatwasconnectedtothemainswitchboardandnotsecuredwithabatterysupplysystem(UPS),waswithoutelectricityforabout10seconds.
Theincidentdidnotcauseanyobservableharmtothevessel’spassengers.Theemergency-andbackup-systemsandtheiroperation
Thevessel’semergencygeneratorstartedautomaticallyandtheotherbackupsystemsworkedasplanned.Automation-,alarm-andnavigation-systemswereeithersecuredwithbatteries(UPS),orreceivedpowerfromtheemergencygenerator.Onboardactivitiesduringthepowerfailure
Thenavigatingbridgewasmannedfordepartureatthetimeoftheincident.Themasternoticedthepowerfailuremainlyfromflashinglightsandalarmsonthebridge.Moredetailedinformationaboutthedisturbancewasacquiredbytelephonefromtheenginecontrolroom.
Theenginecrewwasinthecontrolroompreparingfordeparturewhenthedisturbanceoccurred.Afterthefrequencyalarm,theautomationsystemdisconnectedauxiliaryengines1and2fromthenet,stoppedauxiliaryengine3,andstartedtheemergencygenerator.Auxiliaryengines1and2remainedrunning,andthecrewintheenginecontrolroomquicklyre-connectedthemtothenetwork.Theyacknowledgedthealarmsandrestartedthesystemsthathadstopped.Thevesselinformedtheshippingcompanyabouttheincident,which,inturn,informedTheFinnishTransportSafetyAgency.
RestoringthesystemtonormalmodeTheenginecrewimmediatelybeganinvestigatingthereasonfortheoverspeedingofauxiliaryen-gine3.Theenginewasrestartedwithoutconnectingittothenetwork.Thesamefaultreoccurredandthecausewassuspectedtobemalfunctionoftheauxiliaryengineregulator.Allthreeauxiliaryengineswerenotnecessaryforthesafeoperationofthevessel,soitwasdecidedthattroubleshootingwouldcontinueafterdeparture.Thedefectiveauxiliaryenginewasnotusedduringthevoyage.Afterdeparturethevessel’screwreplacedtheregulatoronauxiliaryengine3.TheauxiliaryenginewastestedinHelsinkithefollowingdayanditwasfoundthatthefaultwasnotcausedbythereg-ulator.Thefaultwaseventuallylocatedtoarelayintheprocessingunitoftheautomationsystem.Thecircuitboardintheprocessingunitwasreplacedwithasparethathadbeenstoredonboard,andthemalfunctioningended.AninspectorfromTheFinnishTransportSafetyAgencyalsovisitedthevessel,andstatedthatthevesselcancontinuenormaloperation.
Asapreventativemeasure,itwasdecidedthatthecircuitcardsalsointheotherauxiliaryengines'processingunitswouldbereplacedwithnewones,assoonaspossible.
40
Entriesinthevessel’sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementationTherewere instructions forpower failuresituationson thenavigatingbridge.The instructionswere,however,mainlyintendedforsituationsinwhichthevesselisatsea.Intheengineroom,therewerebriefinstructionsforactionstobetakenbytheenginecrewintheeventofpowerfail-ures.Inaddition,thevesselhadinstructionsforsituationswithautomationsystemmalfunctions.Theinstructionswerelimited,however,andthereweresomeshortcomingsintheawarenessoftheirexistence.Themanagementofthesituationleanedontheprofessionalskillsandlongexpe-rienceonboard,andneitherinstructionsnorchecklistswereused.
Adeviationreportonthe incident,consistentwiththerequirements inthesafetymanagementsystem,wasprepared.Factorsthatreducedsafety
- Thecircuitcardsintheautomationsystemwerenotmonitoredinthepreventiveservicesystem.
- Theinstructionswerelimited,however,andthereweresomeshortcomingsintheaware-nessoftheirexistence.
Factorthatincreasedsafety
- Thecrew'sprofessionalskillsandlongexperienceonthevessel,contributedtothenormal-isationofthesituationandtodetectingthecauseofthefailure.
Externalfactorsthatinfluencedpositivelyontheoccasion- Thevesselwasmooredatthetimeoftheincident.
M/SViggen,PowerFailure,10.01.2017
Generalinformation
Timeandplaceofincident 10.01.2017at0726,atthearrivaltoÅva,ÅlandIslands
Vesselname,callsignandIMOnumber
Viggen,OJIQ,9173719
Typeofvessel Ro-ropassengerferryFlagstate (Finland)TheÅlandIslandsPlaceofbuildandtime UudenkaupungintyöveneLtd,Uusikaupunki-Finland,
1998Maindimensions LOA53.50m;beam12.25m;maximumdraught4.0mNT,GT,DWT 513,1512,300Owner TheGovernmentofÅlandShipmanager NordicJetlineFinlandLtd/NordicCoastLineClassificationsociety Lloyd'sRegisterMainengine,power 2xWärtsiläBL20,1320kW,tot.2640kWAuxiliaryengine,power 2xSisuValmet612DSJGM,136kW,tot.272kWPropulsion AdjustablepitchpropellerCargo 7passengers,1fulltrailer,1truck,3carsCrew 4Meteorologicalconditions WindSW9m/s,temperature+3°C,clears
41
Ashortdescriptionoftheincident
Onthe10thofJanuary2017,M/VViggen,doingscheduledferryservice,departedat0700forthefirstvoyageoftheday,fromVuosnainentoÅva.WhenapproachingtheportofÅvathevesselsuf-feredapowerfailure,approximately100metersbeforethewharf.Asaresult,thevessel’spropel-lerstoppedrotatingandthusdidnotproducekineticenergyfortheship.Thevesselglidedabout50meters,turningslightlytoport,andendeduponashoalwithaspeedofabout2-3knots.Thevessel’sbowwasstuckonthebottom.Thevessel'selectricitysupplywasnormalisedaftermaybe2minutes,whentheotherauxiliaryenginestarted.
Thecrewinspectedthevesselforexternalaswellasinternaldamage.Noleaksweredetected.Thevesselthenpulledawayfromtheshoalandmovedtothewharfat0746.ThevesselthentransferredfromÅvatoVuosnainen.Therediversinspectedtheunderwaterpartsofthevessel.Thedamagewasonlysurfacescratches.Thevesselgotpermissiontocontinuenormaloperationbyajointdecisionoftheclassificationsociety,theFinnishTransportSafetyAgencyandtheshippingcompany.
DescriptionofthepowerfailureanditsreasonsBeforethepower failurebothmainenginesandauxiliaryengine2wererunning.Theauxiliaryengineproducedthevessel’selectricalpower.Auxiliaryengine1wasinstandbymode.Theenginecontrolsystemalarmedforlowseawaterpressureandforhighcoolingwatertemper-ature.Asaresultofthealarms,theautomationoftheenginecontrolsystemshutdownauxiliaryengine2.Thisresultedinthepowerfailure.Afaultycoolingwatertemperaturesensor,whichrelayedincorrectinformationtotheautomationoftheenginecontrolsystem,stoppedauxiliaryengine2.Therearepre-setlimitsfortheenginecontrolautomation.Theautomationgivesadvancewarningforstartingthebackupauxiliaryen-ginebasedonthepre-setvalues.
EffectsonboardofthepowerfailureThevessel'smainenginesdisconnected fromthepropelleraxis.Thepropellerstoppedrotatinganddidnotproducekineticenergyforthevessel.Asaresult,thevessellostitsmanoeuvringabilityandglidedintotheshoal.Therudder,aswellasthebowandsternthrusters,wasnotoperationalduringthefailure.
Theemergency-andbackup-systemsandtheiroperationTheenginecontrolautomationstartedtheemergencygeneratorabout10secondsafterthepowerfailure. It then produced electricity for all critical equipment. The standby auxiliary engine 1startedandconnectedtothevessel'selectricitygridafterabout2minutes.Onboardactivitiesduringthepowerfailure
Themasterandadeckhandwereonthenavigatingbridgeatthetimeoftheincident.Themasterwasattheconningstationontheportsidebridgewing,whenthevesselapproachedthewharf.Whenthepowerfailurebegan,themasterturnedthevesseltostarboard,butsincetherewasnopropellerthrust,thevesseldidnotrespondtosteeringandinsteadturnedslowlytoport,endingupattheshoal.Themasterloweredtheanchoraboutonemeterusingtheremotecontrolonthebridge.Thiswasofnouseinpractice,sincethevesselalreadywasontheshoal.Thedeckhandwasjustleavingthe
42
navigatingbridgetogooutondecktoprepareformooring,butreturnedtothebridgeafterhavingnoticedthepowerfailure.ThevesseldidnotcontacttheVTS.Thechiefengineer,whowasintheengineroom,beganclarifyingthereasonforauxiliaryengine2'sstopping.Afterthis,hewenttotheenginecontrolroomtoacknowledgealarms.
Thedeckhandthathadbeenpreparingformooringondeck,checkedforpossibleexternaldamageandforpossibletankleakages.Theheavyvehiclesondeckweremovedtothestern,tolightenthebow,andthustofacilitaterefloatingofthevesselandmanoeuvringawayfromtheshoal.Whenthepowersupplyhadreturnedtonormal,themasterorderedenginecontroltothebridge,reversedthevesselawayfromtheshoal,andberthedatthewharf.
RestoringthesystemtonormalmodeThechiefengineeracknowledgedthealarmsandthemasterresetthemanoeuvringsystem,inac-cordancewiththechiefengineer'sadvice.Auxiliaryengine1,whichhadbeeninstandbymode,started.Afterthat,themainengineswereconnectedtothepropellershaft.Onthe13thofJanuary2017,aserviceman,commissionedbytheshippingcompany,cametoin-specttheproblemthathadoccurredintheenginecontrolautomation.Theservicemanoverhauledthedefectivecoolingwatertemperaturesensorthathadcausedthepowerfailure,andcheckedtheenginecontrolautomation.
Inconnectionwiththeserviceman'svisit,alsoanoverallageingofthecomponentsintheelectricalsystemandaneedformaintenancewerenoticed.Entriesinthevessel'sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementationThereareinstructionsavailableonthenavigatingbridgeformeasurestobetakenincaseofpowerfailuresandemergencyanchoring-situations.Themastercheckedtheinstructionsafterthepowerfailuretoseewhethertheiractionshadbeeninlinewiththem.Intheenginecontrolroom,therewerenoinstructionsforactionstobetakenincaseofpowerfailures,butthereisalistoftheequip-mentthatmustberestarted.Themasterinformedtheshippingcompany'soperativemanager.Thiswasinaccordancewiththeinstructionsoftheshippingcompany.Aftertheincident,adeviationreportwascompiledanddis-tributedtootherconcernedparties.Thevesselgotpermissiontocontinueoperating.Thevesselusesabrowserbasedmaintenanceandmonitoringsystem,whichisadministeredbythegovernmentofÅland.Allroutinemaintenancetaskswillbereportedtotheadministration,which then,basedon thereports,willdecideonnecessarymaintenanceandorderingofspareparts.Thevesseldoesnothavemaintenanceplansconcerningcomponents.
Factorsthatreducedsafety- Ageingandwearofcomponentsintheenginecontrolautomationhadnotbeenmonitored
sufficiently.Serviceandoverhaulinconnectionwithpowerfailuresrequirespecialisedex-pertise.Shippingcompaniesoftendependonexternaloperatorsinthesesituations.
- Themaintenanceandmonitoringsystemdoesnotmeetthemaintenanceneedsoftheves-sel.Theserviceplanforcomponentsisinadequate.
- Thepowerfailurecausedthevessel'smainenginetodisconnectfromthepropellershaft.Thepropellerthenstoppedrotatingandthusdidnotproduceaslipstreamfortherudder,resultinginlossofmanoeuvrability.
- ThevesseldidnotcontacttheVTSabouttheincident.
43
ANALYSISTheanalysisinthisinvestigationwasdoneusingtheBowTiemethod.TheBowTiediagramillustratestherisksincludedinanincidentasrelationsbetweenhazards,topevent,threatsandconsequences.Inadditiontothesefourfactorsthemodelincludespreventivebarriers,barriersmitigatingconsequencesaswellasescalationfactors,whichcanpreventbarriersfromwork-ing.
ThestartingpointfortheBowTiemethodisthetopevent,whichinthisinvestigationwasapower failure(continuityofoperationsandtheelectricitysupplytocriticalsystems). Intheanalysiscausesandbackgroundfactorsforthepowerfailureswereestablished.Alsothecon-sequencesofthepowerfailureswereestablished.Theanalysisalsolistedpreventivebarriersthatinfluenceinthebackgroundofthecausesandthathaveaneffectontheformationofthem.Thefactorsthatmitigatedtheconsequencesoftheincidentswerealsoclarified.Thesefactorspreventedtheincidentsfromescalatingintomoreseriousaccidents.Alsotheescalatingfactorsthatmadethesituationsworsewereclarified.
Figure1:BowTieDiagram
44
CausesforPowerFailuresandRelatedObservationsThecausesfortheinvestigatedpowerfailuresweregroupedontheleft-handsideintheBowTiediagram.Thecauseformostoftheinvestigatedpowerfailures(7)wasawornoroldcomponent,e.g.asensororanelectroniccard. Inoneofthe investigatedcasesthecausewasprobablyausererror.Onepowerfailurewascausedbywaterinthefuel.Anunexpectedfailureofacomponent(inthesecases,acontrollerorarelay)causedtwopowerfailures.Onecasewascausedbyun-reliablemachineautomation.Foreachcauseofapowerfailuretheanalysissoughttoidentifythepreventivebarriersandbackgroundfactorsthatwouldhavepreventedtheemergenceofapowerfailure,hadtheyoperatedproperly.
WornandOldComponents
MaintenanceSystem(1.1)Deficiencies in themaintenancesystemwere found tobe in thebackgroundofmanycasescausedbywornoroldcomponents.Itwasfoundthatwearofcomponentsisnotalwaysnoticedduringinspections.Thisisbecausecomponentsarenotalwaysinspectedduetothestructureofthesystems.Electricalsystemsrequirespecialexpertise,somethingwhichisnotalwayssuf-ficientlyavailable.DuplicationofCriticalSystems(1.2)
Internationalandnationalmaritimelegislationemphasisetheimportanceofsafeoperationofvessels.Thisincludes,interalia,duplicationofcriticalsystems.Theduplication, or ensuring, related to fuel-and emergencypower systems,wasnot ade-quatelytakenintoaccountintwocases.Accordingtochapter10.3oftheISMCode,ashippingcompanyshall-inthesafetymanagementsystem-identifythetechnicalsystemsandequip-mentofwhichasuddenfailuremayleadtoanincident.
DeviationsandRespondingtothem(1.3.)Thecrewdidnotalwaysknowhowtodetectdeviationsandhowtorespondtothem.TheISMCoderequiresthatshippingcompanieshaveadeviationreportingsystemincludedinthesafetymanagementsystem.Chapter10oftheISMCodedealswithserviceandmaintenanceofthevessel.Basedonthis,eachdeviationmustbereported,correctiveactionsmustbeperformedanddocumented.Apromptandcompetentresponsetodeviationsisanessentialpartofsecur-ingthefunctionalityofcriticalsystems.
EquipmentOperationKnowledgeofSystems(2.1)
Increwchangesship-specificknowledgeandexperienceintheuseofsystemsdonotalwaystransferfromonecrewtothenext.Inoneoftheinvestigatedcases,inadequatefamiliarisationresultedintheemergenceofapowerfailure.Shortcomingsinship-specificdocumentationalsoposedproblems. Accordingtosection6.2oftheISMCode,ashippingcompanymustensurethattheshipismannedbypersonnelwhocanmanagetheship'smaintenancetasks.Accordingtochapter6.3ofthecode,theshippingcompanymusthavemethodsforfamiliarisingnewstaffwiththeirduties.Knowledgeofsystemsisaveryimportantpartofthecrew'sknow-how.Itisalsoimportanttoconsiderhowtoensurethetransferoftacitknowledgeincrewchanges.
45
UserInterfaceClarityandInstructions(2.2)
Controlandoperatingsystemsforautomationsystems,machineryandequipmentwereoftencomplicatedandtheirmanualswereincompleteorcompletelymissing.Accordingtosection6.5oftheISMCode,ashippingcompanymustestablishprocedurestomaintaintheproficiencyleveloftheship'screw.Accordingtosection6.6oftheISMCode,theshippingcompanymustensurethattheship'screwreceivesthenecessaryinformationontheship'ssafetysystemsintheship'sworkinglanguage.
FuelFullDuplicationoftheFuelSystem(3.1)Inoneoftheinvestigatedcasesthefuelsystemwasnotfullyduplicated.Thefuelsystemshouldbeduplicatedinsuchawaythatthesystemconsistsoftwoindependententities.
FuelQualityMonitoringandMaintenanceoftheSystem(3.2)Intheabovementionedcasetherewerealsoshortcomingsinthemonitoringofthequalityofthefuel.Asaresultofthis,thewaterthathadgottenintothefuelsystemeventuallycausedapowerfailure.Thequalityofthefuelisnotmonitoredenoughonboard.Regularmaintenanceofthefuelsystemreducesthefuelrelatedrisk,which,ifrealised,canresultinsimilarsituationsaspowerfailures.
UnexpectedComponentFailureChoosingComponentsDuringConstructionorwhenRenewingSystems(4.1)Thequalityofthecomponentsandtheirsuitabilityforuseatseaisofdecisiveimportance.Thisshouldbetakenintoaccountduringtheconstructionphaseoftheshipaswellaswhenrenew-ingsystemsonboard.Inonecaseanalmostnewelectricalcomponentmalfunctionedunexpect-edly.
ReliabilityofAutomationDesign(5.1)Thereweredeficienciesinthedesignanddocumentationoftheautomationsystems.Whenas-sessingthereliabilityoftheautomation,itisimportantthatthedocumentationofitisuptodate,clearandunderstandable. It is importanttoemphasisetheeaseofmaintenanceofthesystemalreadyatthedesignstage.TestingandMaintenanceoftheAutomationSystem(5.2)
Thedifferentfunctionsoftheautomationsystemhadnotalwaysbeentestedinaccordancewithregulations.Testsaredonetodetectdeficiencies.Itisofoutmostimportancetocarefullytestautomationsystemsandalltheirfunctions,alreadywhentakingthemintouse.Accordingtochapter10.3 inthe ISMCode,alsosystemsthatarenot incontinuoususemustbetested inaccordancewithsystem-instructionsandonaregularbasis.Automationsystems’fastageingisaproblem.Systemupgrades,supportandsparepartsmaynotbeavailableforthewholelife-timeofasystem.FunctioningofBackup-andEmergencySystems(6)
Deficienciesinthebackup-andemergencysystemswerefoundinallinvestigatedcases.Failuresituations,likeseriouspowerfailures,arenotalwaystestedduetotheriskofdamagingthesystems.Accordingtochapter10.3oftheISMCode,ashippingcompanymustdesignmeasurestoensurethereliabilityofsystemswhosefailuremaycausehazardoussituations.Accordingto
46
theISMCode,themeasuresmustincludetestingofbackup-andemergencysystemsaswellasofsystemsinnon-continuoususe.Thetestingmustbedoneinaccordancewiththeinstructionsforthetest.
ConsequencesofPowerFailuresandManagingthemTheconsequencesoftheinvestigatedpowerfailuresweregroupedontheright-handsideintheBowTiediagram.Noneoftheinvestigatedcasesdidresultinaveryseriousseaaccidentorinseriousenvironmentaldamage.Infourcasesthepowerfailurehadneitheranyeffectonthevessel'smanoeuvrabilitynorothersignificantorlong-lastingeffectsontheoperationofthevessel.Infourcasesthepowerfailure,ormainenginestoppagewithsimilareffects,causedatotallossofmanoeuvrabilityand,inonecase,apartialloss.Inthreecasesthevesselgroundedeitherbecauseofapowerfailureorofamainenginestop-page.Afterinspectionsthevesselsgotpermissiontocontinuetheirvoyagesandinstructionsfortherepairs.
NoSubstantialorLong-termEffectsNoRiskofCollisionorGroundingduetoConditions(7)Infourcasestheoperationsofthevesselswerenotsignificantlycompromisedsincetheywereanchored,berthedorinsafewatersatthetimeofthepowerfailure.Inaddition,theweatherconditionsandthetrafficsituationwerefavourableatthetimeoftheincident.QuickStartupofBackup-andEmergencySystems(8.1)
Intheabove-mentionedcasesthequickstartupandfunctionalityofbackup-andemergencysystems,aswellasthecrew'scorrectactions,preventedmoreseriousconsequences.
LossofManoeuvrability
SafeProcedures(9.1)Infourcasesthepowerfailure,orthetotheeffectsequivalentmainenginestoppage,causedatotal lossofmanoeuvrabilityandthevesselbegantodrift. Inonecasemanoeuvrabilitywaspartiallylost,butthevesselremainedinthefairway.Thelossofmanoeuvrabilitylasted,de-pendingonthecase,fromafewminutestomorethananhour.Safeproceduresfortheonboardoperationsandfavourableconditionspreventedtheincidentsfromdevelopingintomoreseri-ousaccidents.
GoodLocalKnowledgeandSituationalAwareness(9.2)Thewatchkeepingcrew'sknow-howaswellasgoodsituationalawarenessandoverviewofthesituationreducedtheriskofanaccident. Intwocases involving lossofmanoeuvrabilitythelocalknowledgeofthepilotand-inonecase-thelinepilot,contributedtothepositiveoutcomeoftheincident.
LossofManoeuvrabilityandGroundingNarrowPartofFairway,ShoalsandRocksNearby(10.1and10.2)Inthreeofthegroundings,thepowerfailureormainenginestoppageoccurredinanarrowpartofthefairway.Thelimitedareawithsufficientdepthforsafenavigationandtheshortre-sponsetimeduetothespeedofthevesselwerenotsufficienttopreventagrounding.Intwo
47
cases,the lossofmanoeuvringcapacitytookplacewhenthevesselwasturning inanarrowfairway.Onecaseoccurredwhenthevesselwasapproachingport.
InadequatePowerinBackup-andEmergencySystems(10.3)Inonecaseanerrormessagefromthemachineautomationstoppedthemainengineand,atthesametime,theshaftgenerator.Thevessellostitsmanoeuvringcapabilitybecausetheeffectoftheauxiliaryenginewasnotenoughtorunthebowthruster,whichrequiredtheeffectoftheshaftgenerator.Inanothercaseittookabouttwominutestostartthebackupsystem.Duringthattimetheshipdriftedintoashoalafterhavinglostitsabilitytomanoeuvre.
Inathirdcasethebackupsystemthathadstartedwasnotenoughtopreventagroundinginaturn,inanarrowpartofthefairway.Anattemptwasmadetostopthemovementofthevesselbyoperatingthemainenginefullastern.
AvoidingVerySeriousSeaAccidentsFavourableTrafficSituation(11.1and12.1)Ineightcasestheconditions,afavourabletrafficsituationorlowspeed,preventedamorese-riousaccident.Noneofthecasesinvolveddangerouscargoandtheriskoftheenvironmentaldamageassociatedwiththem.Theconditionsandthecargoarerelevantwhenassessingtheriskcausedbypowerfailures.Apowerfailureisaseriousdeviation.
AnalysisofRescueOperationsExternalhelpforrescuingtheshipwasneededinonlyonecase.Afterthegrounding,thepilotreportedtheincidenttotheVTS,thepoliceandtherescuedepartment.Whenthemainenginewasstopped,theshipwasleaningontherocks.Theship'smainenginecouldnotbestartedagainwhileaground,becauseoftherisk fordamagingthepropeller.Asalvagetugtowedtheshipbacktothefairwaywherethemainenginewasstarted.Theshipwasthentransferredtotheothersideofthefairwaywhereitanchored.Whiletheshipwasatanchoradiverinspectedthehull,afterwhichtheshipsailedtoSavonlinnaforadditionalin-spections.Arescuevesselarrivedquicklytothesceneandtheflowofinformationamongtheinvolvedpartiesconcerningtheincidentwassmooth.Thepilotonboardthecasualtycommunicatedwithallparties,whichfacilitatedtherescueoperations.
TheActivitiesoftheAuthoritiesTheVTScentrewascontactedinalmostallinvestigatedcases.TheVTScentremonitoredthesituationandassessedtheneedforadditionalhelptogetherwiththevessel.Thecentrealsoassessedtherisksforothertrafficandtotheenvironment.VTS-centresdonotalwaysreceiveadequateinformationabouttype,causeandconsequencesofvessels'technicalproblems.InFinnpilotPilotageLtd'sdeviationreportformthereisnoseparatesectionforpowerfailures.Theyarereportedsimplyastechnicaldefects.OnthebasisofreportsreceivedfromFinnpilotitisthereforedifficulttoidentifythetypeofthetechnicalfailureandtoassesswhetherornotitincludedapartialorcompletepowerfailureoramainenginestoppage.Itisdifficulttogetaccuratedataonpowerfailures.Differentpartiesrecordpowerfailuresindifferentways. There isnocommonpracticeofreportingpower failures.Thedefinitionsofpowerfailuresshouldalsobeharmonised.
48
ThisinvestigationinvolvedtwocasesinwhichtheinspectoroftheFinnishTransportSafetyAuthorityinspectedthevesselafteritsgroundingandgaveitpermissiontocontinuetooperate.Afterthegrounding,theinspector,togetherwithrepresentativesfortheclassificationsocietyandtheshippingcompany,assessedthevessel'sseaworthinessanddecidedtoallowcontinuingitsoperating.
CONCLUSIONSBasedontheinvestigation,itcanbegenerallystatedthatobtainingaccurateinformationonpowerfailuresisdifficult.Differentpartiesrecordpowerfailuresindifferentways.Thereisnocommonpracticeofreportingpowerfailuresandthereisnodefinitionforpowerfailures.Whenlookingatthefindingsintheanalysis,itcanbeconcludedthatgoodqualityofcompo-nents,reliabilityofsystems,sufficientskillsofthecrewandfavourableconditionsarefactorscentralforpreventingpowerfailures.Thequalityofthecomponents,thereliabilityofthesys-temsandthecompetenceofthecrewcanbeinfluencedandtheimpactoftheconditionscanbeanticipated.
ComponentQualityItwasfoundthatwearofcomponentsisnotalwaysnoticedininspections.Thishappensbe-causethecomponentlevelisnotalwaysinspectedduetothestructureofthesystems.Inaddi-tion,maintenanceofelectricalsystemsrequiresspecialexpertiseandthatisnotalwayssuffi-cientlyavailableonboard.Accordingtochapter10.3oftheISMCode,ashippingcompanyshall-inthesafetymanagementsystem-identifythetechnicalsystemsandequipmentofwhichasuddenfailuremayleadtoanincident.Usersmustidentifythecriticalcomponentsoftheelectricalsystemsandplanforensuringtheirfunctionality.
Thelifespan,replacingintervalsandmaintenanceneedsofelectricalcomponentsareusuallynotplannedwith sufficientprecisionand long-termperspective.Theelectroniccardsarereplacedonlywhentheystopworkingorwhenthereliabilityofthedatatheyprovidehasdiminished.Pro-fessionalmonitoringandfunctionalitytestingofsensorsareimportantpartsofthemaintenancesystem.Whenreplacingcomponentsinsystemstheircompatibilityandfunctionalitymustbeas-sured.
Unexpectedfailurescanbeavoidedbyselectinghighqualityandmarinecompliantcomponentsbothduringtheship'sconstructionphaseandwhencomponentsarerenewed.Inaddition,goodandup-to-datedocumentationofusedandstoredcomponentsisneeded.
SufficientKnow-HowDeficiencies inship-specificdocumentation, lackofknowledgeandexperienceasaresultofcrewchangescausedproblemsintheoperationandmaintenanceofsystems.Knowledgeaboutsystemsisaveryimportantpartofthecrew'sknow-how.Theshippingcompanymustensurethattheshipismannedwithacrewwiththeskillsrequiredtocarryoutthetechnicalserviceandmaintenancetasksoftheship.Theoperatingsystemsofdifferentequipmentareoftentoocomplicatedinrelationbothtohowoftentheyareneededandtothecrew'sskills.
Anewcrewarrivingatavesseldoesnotalwayshavetimetocarefullyfamiliarisethemselveswiththeirduties.Inordertoguaranteesafeoperationofthevesselwhencarryingoutcrewchanges,
49
shippingcompaniesmusttakeintoaccounttheskillsrequiredforthepositionaswellasthequal-ificationsandworkexperiencefromsimilarpositionsofthepersonselectedforthejob.
Forthepurposesoffamiliarisation,itisimportantforthevesselstohaveclearoperatinginstruc-tionsforallsystems,atleastintheworkinglanguageoftheship.Thevesselmusthavesafeproce-duresthathavebeenimplementedinthesafetymanagementsystem,thatarebasedonriskas-sessmentandthathavebeentrainedanddrilled.Whenthisisrealised,everyoneisawareof,andknows,theirroleinsituationsinvolvingdisturbancesandemergencies.
Theshippingcompanyandthecrewmustbefamiliarwiththedeviationreportingprocedures.Theymustbeabletocompilereportsandtheymustalsoreportonnoteddeviations.Theshippingcompany'smanagementandtheship'screwmustdemonstratetheircommitmenttothereportingsystemrequiredintheISMCode,byensuringboththattheycanmanageitandthatitworks.
ReliabilityofSystemsThereweredeficienciesinthedesignanddocumentationoftheautomationsystems.Thedif-ferentfunctionsoftheautomationsystemhadnotalwaysbeentestedinaccordancewithreg-ulations.Testsaredonetodetectdeficiencies.Thefastageingofautomationsystemsisaprob-lem.Systemupgrades,supportandsparepartsmaynotbeavailableforthewholelifetimeofasystem.Duplicatingcriticalsystemsandsufficient,functioningbackup-andemergencysystemsarecen-tralwhentryingtoeitherpreventpowerfailuresinthesystems,ortomitigatetheconsequencesofthem.
Systemsmustbetestedwheninuseandwhendoingmaintenanceworkonthem.Thevesselmusthave suitableequipment for testingand thenecessarybackup files for theautomation systemonboard.Inaddition,maintenanceworkonsystemsmust,fromthepointofviewoftheuser,beaseasyaspossible.Complexfaultsituations,suchascompletepowerfailures,areusuallynottestedbecauseoftheriskofdamagingsystems.
Testingbackupsystemsaswellasdisturbancesandfaultsituationsbeforearrivingtothenarrowfairwaysinthearchipelagoorininlandwaterways,ortothepilotboardingplace,wouldimprovesafety.
Availabilityandqualitycontroloffuelneededforproducingelectricityisimportant.Waterthathadenteredthefuelsystemcausedapowerfailuresincethequalityofthefuelhadnotbeensufficientlymonitoredonboard.Theproductionofelectricalenergyrequiresarobustandreliabletechnicalsolution.
Regularmaintenanceofvessels'fuelsystemsreducesthefuelrelatedrisk,which,ifrealised,canresultinsimilarsituationsaspowerfailures.
ConditionsTheconditionsandthecargosareofimportanceintermsoftherisksinconnectionwithpowerfailures.Apowerfailureisaseriousdeviation.Monitoringchangesintheoperatingconditionsmustbeactiveandproactive,sothatthereisampletimetoreacttothem.
Lossofmanoeuvrabilityinnarrowfairwaysinthearchipelagoandininlandwaterways,or atopenseaindensetrafficareas,canresultinseriousseaorenvironmentalaccidents.Theriskofanaccidentisgreaterinsituationswheretheback-upandemergencysystemsarenotavailableforimmediatestartup,donotwork,orareofinadequatepower.
50
Pilot’sandshipcrew’scommonviewandsituationalawarenessontheoperationoftheship'ssys-temsareimportant.Thisishighlightedinthenarrowwatersofthearchipelago,wherethebriefestofpowerfailurescanleadtoaseriousseaaccidentorenvironmentalaccident.
SAFETYRECOMMENDATIONS
ProceduresforReportingPowerFailuresAccordingtotheISMCode,shippingcompaniesmust,inthesafetymanagementsystem,iden-tifythevessel'scriticalsystemsandequipmentthat,incaseofasuddenfailureorincorrectuse,canresultinahazardoussituationoraccident.Apowerfailureisaseriousdeviation.Thereisnoaggregatedorcomparable informationavailableondeviations inconnectionwithpowerfailures.TheSafetyInvestigationAuthorityrecommends,that
ThereformoftheFinnishMaritimeCode,ifimplemented,createstheconditionsfortheimple-mentationofthisrecommendation.Reportingofincidentsisrequiredinthedraftofthenewcode.It is important that the new procedures for reporting to be developed, allow for concretemeasurestobetakeninordertoaddresstheidentifiedproblem.Itisalsoimportantthatthedefinitionsneededinthereportingareclearandunderstoodinthesamewaybyvariouspar-ties.Thisrecommendation,ifimplemented,wouldalsocontributetopinpointingrisksconnectedwiththeemergingtransportsystemandtopreparingforthem.
AssessingtheNeedforDevelopingtheLegislationConcerningSafeConductofVessels
Theconditionsandthevessel’scargoareof importance forthegravenessandextentoftheconsequencesofapowerfailure.Thisisemphasisedinthenarrowfairwaysinthearchipelagoandininlandwaterways,wheresafetymarginsfornavigationoftenareverysmall.Aseaacci-dentinthesecircumstancescanalsocauseaseriousenvironmentalaccident.Thereliabilityandsufficiencyofthebackup-andemergencysystemsare,forthisreason,ofutmostimportance.TheSafetyInvestigationAuthorityrecommends,that
Procedurese.g.relyingsolelyontheuseofashaftgeneratorinnarrowfairwaysinthearchi-pelagoandininlandwaterwaysincreasetheriskforaccidents.
TheFinnishTransportSafetyAgencytogetherwiththeshippingcompanies,developpro-cedurestoobtaindetailedinformationaboutpowerfailuresforanalysingpurposes.[2017-S60]
TheFinnishTransportSafetyAgencytogetherwiththeFinnishEnvironmentInstitute,as-sesstheadequacyofandtheneedforthedevelopmentofthelegislationconcerningthesafeconductofvesselsinthearchipelagoandininlandwaterwayareas.[2017-S61]
51
Helsinki,4December2017
JariAlanen TeemuLeppälä TuomoLindell
JohannaVahtera RistoHaimila
52
SUMMARYOFSTATEMENTSRECEIVEDONTHEDRAFTINVESTIGATIONREPORTThedraftincidentreportsweresentforstatementsinJuly2017.Statementswerereceivedfromfourshippingcompanies.BasedonVikingLineLtd'sstatement,thenumberofmainenginesonM/SMariellawascorrectedinthereport.ESLShippingLtdstatedthattheparagraph"Negativesafetyaspects"didnotfullycorrespondwiththeirview,asthevoltageproblemofauxiliaryNo.3hadbeenunderscrutinyalreadyforalongerperiodoftime.Thetworemainingshippingcompaniesstatedthattheincidentreportswereclearandinlinewiththeevents.ThedraftinvestigationreportwassentforstatementsinOctober2017.Statementswerere-ceivedfromtheFinnishTransportSafetyAgencyandtheFinnishEnvironmentInstitute.Thestatementssupportedtheinvestigationandwerepositivetotherecommendations.AccordingtothestatementoftheFinnishEnvironmentInstitute,theinvestigationreportpointedout-inapraiseworthyway-thatinadditiontotheinvestigatedincidentstherehadbeenotherincidentsthathadnotbeeninvestigatedoronwhichnodatahadbeenobtained.Basedonthis,theFinnishEnvironmentInstitutewished,thatthemaritimereportingsystemwouldbedevelopedsothatasmanydisturbancesanddeviationsaspossiblewouldcometolight.TheFinnishEnvironmentInstitutealsostatedthattheysupporttherecommendationthattheneedtorevisetheregulationsconcerningsafeconductofvesselsinthearchipelagoandininlandwaterwaysmustbeevaluated.TheFinnishTransportSafetyAgencysaidintheirstatementthattherecommendationintheinvestigationtodevelopprocedurestogetherwiththeshippingcompaniesforobtaininginformationconcerningpowerfailuresalreadyhasbeenrealised.AspartofthenewreportingschemeshippingcompaniesareobligedtoreportaccidentsaswellasincidentstotheFinnishTransportSafetyAgency.TheFinnishTransportSafetyAgencyalsostatedthattheywillbeincontactwiththeFinnishEnvironmentInstituteconcerningthesecondrecommendationinthereport.