Marine Investigation Report M14C0106
The Transportation Safety Board of Canada (TSB) investigated this occurrence for the purpose of advancing transportation safety. It is not the function of the Board to assign fault or determine civil or criminal liability.
Grounding
Self-discharging bulk carrier Atlantic Erie
Port Colborne, Ontario
Summary
On 12 June 2014, at approximately 1020 Eastern Daylight Time, the self-discharging bulk carrier Atlantic Erie
ran aground 1.5 nautical miles southeast of the outer piers at Port
Colborne, Ontario, after power interruptions to the bridge. The
visibility was good at the time. After the cargo was partially
discharged, the vessel was refloated with the assistance of 2 tugs.
There were no injuries or pollution, but the vessel sustained damage.Self-discharging bulk carrier Atlantic Erie
Port Colborne, Ontario
Le présent rapport est également disponible en français.
1.0 Factual information
1.1 Particulars of the vessel
| Name of vessel | Atlantic Erie |
|---|---|
| International Maritime Organization (IMO) number | 8016639 |
| Port of registry | Halifax, Nova Scotia |
| Flag | Canada |
| Type | Self-discharging bulk carrier |
| Gross tonnage | 24 300 |
| LengthFootnote 1 | 224.50 m |
| Draft | Forward: 8.00 m Aft: 8.05 m |
| Built | 1985, Collingwood Shipyard, Ontario |
| Propulsion | 1 diesel engine (8096 kW) driving 1 controllable-pitch propeller within a steerable Kort nozzle |
| Cargo | 25 132 metric tons of petroleum coke |
| Crew | 28 |
| Registered owner | Canada Steamship Lines (The CSL Group inc.) |
| Manager | V.Ships Canada Inc. |
1.2 Description of the vessel
The Atlantic Erie is a dry bulk cargo vessel of steel construction with machinery space and accommodations located aft. The vessel has 5 cargo holds and is fitted with a self-discharging system that allows cargo to be released from the bottom of the cargo holds onto conveyor belts, transported above deck level via an elevator system, and then transferred onto a discharge boom conveyor and offloaded.
The bridge is equipped with the required navigational equipment, including 3- and 10-centimetre automatic radar plotting aids, 2 gyrocompasses, 1 magnetic compass, and 2 very high frequency (VHF) radiotelephones (Appendix B). The vessel is also equipped with a differential global positioning system (DGPS) and 2 electronic chart systems: a 3D Navigator draft information system, and an Electronic Chart Precise Integrated Navigation System (ECPINS) with a slave monitor located in the master's cabin. The ECPINS is backed up by an uninterrupted power supply. Both the ECPINS and the 3D Navigator display display the vessel heading and the course made good (CMG):Footnote 4 the CMG value is supplied by the DGPS and the vessel heading value is supplied by the gyrocompass.
1.3 History of the voyage
On 09 June 2014, the Atlantic Erie departed Chicago, Illinois, United States, bound for Sydney, Nova Scotia. By the morning of 12 June, the vessel was proceeding eastbound in Lake Erie, towards Port Colborne, Ontario, at a speed of 11.8 knots. The bridge team comprised the third officer, who was the officer of the watch (OOW), and the bridge watchman, who also acts as helmsman when the vessel is not on autopilot. Shortly after 0800,Footnote 5 the OOW called the fourth engineer, who was the engineer of the watch (EOW), and gave 1 hour's notice to prepare for manoeuvring in the upper entrance to the Welland Canal. The EOW then started the No. 3 generator and synchronized it with the No. 1 generator, which had been providing electrical power to the vessel.Around 0900, the OOW called the master to the bridge, as per the master's night orders. The master arrived on the bridge 20 minutes later and, at approximately 0940, took over the con. At 0942, the master called a Seaway Welland vessel traffic controller and reported the vessel's position at calling-in-point (CIP) 16 (Appendix C). The master then started altering course to port, towards the outer piers at Port Colborne, while gradually reducing the vessel's speed. The master also told the OOW to go on deck and prepare for the transit of the first lock in the Welland Canal. This left the master and the helmsman manning the bridge.
At approximately 0944, the vessel was 1.5 nautical miles (nm) south of the outer piers and proceeding at a speed of about 9 knots. The master called the EOW and requested the bow thruster. The EOW closed the bow thruster circuit breaker and turned on the electric thruster motor. After the bow thruster had been running for 1 minute, the EOW transferred the controls to the bridge. The bow thruster ran for approximately 1 more minute without being used, at which point its circuit breaker tripped.
The EOW called the chief engineer (CE), who was in his cabin, for instructions. The CE told the EOW to restart the bow thruster and sent the second engineer to the bow thruster compartment to investigate the problem. After calling the bridge and advising the master of the situation, the EOW reset the circuit breaker and closed it. At approximately 0950, the EOW pushed the button to restart the bow thruster motor. The voltage in the electric distribution system dropped and the No. 3 generator main circuit breaker tripped, but the No. 1 generator continued powering the main switchboard. The main engine continued to operate, and the lights remained on throughout the vessel.
The drop in voltage set off a number of power failure alarms on the bridge, including alarms for the navigation lights, the port and starboard radars, the echo sounder, the fire detection panel, and the 2 gyrocompasses. The radars defaulted to standby mode,Footnote 6 and 2 of the 3 rudder angle indicators on the bridge were disabled. The master put the engine astern and ordered the helm hard to port in order to initiate a starboard turnFootnote 7 and abort entry to the canal. In the engine control room (ECR), power failure alarms sounded for the main and auxiliary pumps. The engine room crew restarted the pumps immediately, which silenced these alarms.
Meanwhile, a smoke detector in the bow thruster compartment set off an alarm on the bridge fire detection panel. The fire detection panel indicates the location of a fire and is also connected to the magnetic holders on the fire doors.Footnote 8 The master silenced the alarm, but then received a call from a crew member on the bow informing him that there was smoke coming from the bow thruster compartment.
The master sounded the whistleFootnote 9 and activated the general alarm, which caused the fire doors to close automatically. He then attempted to make an announcement stating that this was not a drill and asked crew to proceed to their muster stations, but the announcement did not transmit throughout the vessel because the master had mistakenly picked up the handset for the VHF radiotelephone instead of the handset for the public address (PA) system.
The PA handset is near one of the VHF handsets and is similar in appearance (Photo 2). The PA handset has a white label identifying it as the PA system. The VHF handset does not have a label.Footnote 10
After hearing the general alarm and the fire doors closing, the CE left his cabinFootnote 12 and went to the bridge to inquire about the location of the fire. When the CE arrived on the bridge, the master immediately informed the CE that there had been a blackout, that they had lost power to the navigating instruments, and that he was turning the vessel around. The master did not inform the CE about the report of smoke in the bow thruster compartment, and the CE did not inquire about the fire.
1.3.1 Subsequent events in the engine control room
The CE went to the ECR immediately after speaking with the master. On his way, the CE observed that the lights were on and, once in the ECR, he observed that the main engine and steering gear were running. At approximately 0958, the CE directed the electrician to go to the emergency generator room in order to assist with completing the vessel's blackout procedure.As part of this procedure, the CE opened and closed the transfer breaker situated in the ECR. This is 1 of 2 transfer breakers that direct power between the main and emergency switchboards (Appendix D). When the transfer breaker was opened, power to the emergency switchboard was interrupted and some of the navigation equipment on the bridge, including the gyrocompasses, was de-energized. The associated power failure alarms activated again. The CE was not aware that the blackout procedure was having this effect.
Shortly after completing the blackout procedure, the CE resynchronized the No. 3 generator and started the No. 2 generator. He then synchronized the No. 2 generator with the No. 1 and the No. 3 so that the vessel's electrical system was being powered by all 3 generators.
At approximately 1001, the CE then made another attempt to restart the bow thruster, which created another drop in voltage, setting off the same power failure alarms on the bridge and in the ECR. Again, the lights remained on throughout the vessel. Following the voltage drop, the CE performed the blackout procedure again, unaware that he was de-energizing the navigation equipment and setting off power failure alarms on the bridge once more.
At approximately 1002, the second engineer informed the CE that there was a fire in the bow thruster compartment and asked him to stop making attempts to restart the bow thruster. With the consent of the CE, the electrician isolated power to the forward part of the vessel. The EOW made a safety round of the engine room and found that everything was in good order. The CE called to advise the master of this and then went forward to check the situation with the bow thruster.
1.3.2 Subsequent events on the bridge
Between 0957 and 1002, while the abovenoted actions were taking place in the ECR, the power failure alarms on the bridge sounded 3 more times following their initial activation. The bridge team did not know why the alarms were activating repeatedly. The second officer arrived on the bridge at approximately 0957 and began silencing and resetting the alarms, as per the master's orders.At approximately 1001, the master ordered the helm hard to starboard and increased the engine speed ahead in order to increase the vessel's rate of turn. The master was monitoring the vessel's turn on the ECPINS, without confirming through visual navigation. The fire team, after checking the bow thruster compartment, reported to the master that there was smoke in the compartment but no fire.
At approximately 1003, the vessel was still turning to starboard. The master ordered the helmsman to steer 180 degrees gyro (°G) so that the vessel would proceed on a southerly course, away from land. By this time, the second officer had silenced all of the alarms, and the master sent him on deck to join the fire team and assist as required.
At 1006, the helmsman, who was steering using one of the gyrocompass repeaters, informed the master that the vessel's heading was 180°G. The gyrocompass had not been verified following the power interruptions.
At approximately 1011, more alarms went off on the bridge,Footnote 13 and the master ordered the second officer to return to the bridge and silence the alarms. The second officer arrived on the bridge at approximately 1015 and began silencing the alarms. After the alarms were silenced, the master went to his cabin to retrieve his cellular phoneFootnote 14 in order to advise the company of the situation. Because the master's cabin is located 1 deck below the bridge and he expected to be gone only for a short time, the master left the bridge without transferring the con to the second officer.
Upon arriving in his cabin, the master looked at the ECPINS slave monitor and noticed that the vessel's CMG was easterly, but that the vessel-shaped marker which indicates the heading was pointing southerly (Appendix E). The master quickly returned to the bridge and requested the magnetic heading from the helmsman, who reported it to be 111°magnetic (M).Footnote 15 The master looked outside and saw that the shoreline was on the vessel's port side, instead of on its stern. He immediately ordered the helm hard to starboard in order to correct the vessel's course and increased the propeller pitch to get more power ahead. The vessel began turning to starboard but, moments later, the hull touched bottom and, at 1020, the vessel ran aground 1.5 nm southeast of the Port Colborne outer piers.
1.4 Bow thruster failure
The reason for the bow thruster's failure could not be conclusively determined. However, the TSB laboratory found that the most likely cause for the electrical issues at the time of the occurrence was a short between the windingsFootnote 16 in the bow thruster motor.Footnote 17 The bow thruster motor is not a component that requires extensive user maintenance and inspections. Although the unit was regularly inspected and maintained,Footnote 18 it is likely that aging of the internal components led to its failure, possibly due to deterioration of the insulation on the windings over time as, in general, insulation tends to be the most affected by exposure to contaminants and environmental conditions such as vibration, humidity, and temperature.Following the occurrence, the motor was sent to be serviced by a shore contracting company. Various parts were changed or renewed, the statorFootnote 19 was rewound and the windings were varnished. The whole motor was balanced, tested, and found operational. It was later put back on board.
Before starting the bow thruster on the Atlantic Erie, the practice is to ensure at least 2 generators are running in parallel. Once this is achieved, the bow thruster breaker is closed and the electric motor is started. After the motor has run for a minute or two, control of the bow thruster is transferred to the bridge. When the controls are transferred, a light illuminates on the bridge console and an officer on the bridge must accept control in order to complete the transfer. A sign posted on the ECR main switchboard states that the bow thruster is not to be started more than once every 2 hours. There are no instructions on what to do if the breaker trips.
1.5 Damage to the vessel
A post-occurrence diving inspection determined that both the shell plating and the forward transverse bulkhead, located between the forepeak tank and the bulbous bow void space, were cracked.1.6 Environmental conditions
At the time of the occurrence, the weather was overcast but the visibility was good. The wind was from the south at 10 knots.1.7 Vessel certification
The vessel was crewed, equipped, and certified in accordance with existing regulations. The Atlantic Erie had been issued a safety management system (SMS) certificate on 24 October 2013, and the company’s document of compliance (DOC) had been issued on 30 September 2010. Both certificates had been issued by Lloyd’s Register of Shipping. The latest endorsement for annual inspection was dated 27 November 2013.1.8 Personnel certification and experience
The master held a Master, Near Coastal certificate of competency issued in 1992, and had sailed as a master since 2006, serving in this capacity on the Atlantic Erie since June 2013. The master had completed 35 hours of Bridge Resource Management (BRM) training in March 2002. The master had also completed Human Element Leadership Management (HELM) trainingFootnote 20 in February 2013.The CE held a First-Class Engineer, Motor Ship certificate of competency issued in 2001 and had joined the company as CE in 2009 serving in this capacity on the Atlantic Erie since 2013. The CE had also completed HELM training in January 2013.
The second officer held a Watchkeeping Mate, Near Coastal certificate of competency issued in 1991, joining the company in 1996 and sailing as a second officer on the Atlantic Erie since 2010.
The third officer held a Master, Near Coastal certificate of competency issued in 1985, sailing as a third officer since 1977. He joined the company in 2010 and had sailed as a third officer on the Atlantic Erie since then.
The fourth engineer held a Fourth-Class Engineer, Motor Ship certificate of competency issued in February 2014. He had joined the company in 2013 and had sailed on the Atlantic Erie as a fourth engineer since April 2014.
The helmsman held a Bridge Watchman certificate issued in 2000 and had joined the company in 2007, holding the position of helmsman on the Atlantic Erie since 2008.
1.9 Electronic chart precise integrated navigation system
The ECPINS provides a visual representation of the vessel's track, along with numerical data for the vessel's headingFootnote 21 and the CMG. There is also a vessel-shaped marker on the ECPINS monitor that indicates the vessel's heading by way of the direction that the marker is pointing. The ECPINS obtains the heading from the gyrocompass and the CMG from the DGPS. Several times per second, the DGPS takes the vessel's position and plots it on a digital chart. This succession of plotted positions forms the track, which in turn provides the CMG. When the vessel is proceeding full ahead on a steady course, the CMG and the heading values are very close.Footnote 22 However, when the vessel slows down and/or turns, the difference between the CMG and heading values increases.The screenshots in Appendix F are from a recording of what the ECPINS was displaying at the time of the occurrence. They show that, as the vessel began turning to starboard and away from the entrance to the canal, the difference between the vessel's heading and the CMG started to increase, as per usual (Appendix F, Screenshot 1). As the vessel was turning, the difference between the vessel's heading and the CMG continued to increase, which is also normal (Appendix F, Screenshot 2). However, after the vessel completed the turn and had been proceeding on 180°G for approximately half a minute, the difference between the CMG and the heading continued to increase when it would normally begin to decrease. In addition, the vessel-shaped marker was pointing southerly, even though the vessel was proceeding easterly (Appendix F, Screenshot 3).
1.10 Gyrocompass
A gyrocompass supplies the vessel's heading. The gyrocompass is a north-seeking gyroscope that consists of a rotating wheel (called rotor) mounted on gimbalsFootnote 23 (Figure 1). It is encased in a housing with electronic components that keep the rotor's axis aligned with the terrestrial meridiansFootnote 24 so that the gyrocompass indicates true north.
Most vessels are fitted with gyrocompass repeaters at key locations on the bridge, such as the helm, allowing navigators to check the vessel's heading at any given time. Other navigation equipment, such as radars, the 3D Navigator, and ECPINS, obtains heading data from the gyrocompass and display this information on their respective screens.
The accuracy of a gyrocompass can be verified by using a magnetic compass, given that a magnetic compass is independent and does not require any means of power. Other navigating instruments such as the DGPS can determine the direction of the vessel, which is expressed as CMG.
The Atlantic Erie is fitted with 2 gyrocompasses, but only 1 can be used to feed the repeaters and other electronic navigational equipment at any given time. In this occurrence, power to the gyrocompass was interrupted twice by the blackout procedure. The pick-up in the gyrocompass was therefore de-energized while the vessel was turning to starboard and it could not correct the tilt applied to the rotor. As a result, the gyrocompass lost its alignment. The error affected the gyrocompass repeater that the helmsman was using to steer, as well as the ECPINS, which the master was using to monitor the vessel as it was turning away from shore.
1.10.1 Gyrocompass alarm
The 2 gyrocompasses on the Atlantic Erie are fitted with audible power failure alarms that activate on the bridge in the event that the equipment is de-energized or the voltage drops below the gyrocompasses' operational requirements. There is no way for the operator to determine whether the alarm has sounded as a result of a power failure or a voltage drop. As well, there is no alarm to indicate whether the gyrocompass has lost its alignment as a result of a power failure. The alarms cannot be acknowledged manually, but will silence automatically when the voltage returns to normal. This is different from the functionality of many of the other alarms on the bridge, which continue to activate until an operator acknowledges them manually.In this occurrence, the gyrocompass alarms were activated 4 times in total: twice by the power interruptions caused by the blackout procedure and twice by the voltage drops caused by restarting the bow thruster. Each time, the gyrocompass alarm sounded for approximately 30 seconds before silencing automatically.
1.11 Alarm design standards
According to Transport Canada, gyrocompasses must be fitted with an automatic alarm to indicate a major fault in the compass system.Footnote 25 In December 2000, the IMO's Marine Safety Committee adopted guidelines on ergonomic criteria for bridge equipment and layout.Footnote 26 These guidelines came into effect on 01 July 2002 as part of revisions to Chapter V/15, Principles relating to bridge design, design and arrangement of navigational systems and equipment and bridge procedures, of the Safety of Life at Sea (SOLAS) Convention. Among other things, these guidelines stipulate that alarms should be maintained until they are acknowledged.1.12 Power distribution system
1.12.1 Main and emergency switchboards
The distribution of power from the generators to the various systems on the Atlantic Erie is controlled by the main switchboard, which is located in the ECR. The main switchboard divides the vessel's power into smaller circuits for distribution to transformers, panel boards, control equipment, and, ultimately, to individual system loads. The main switchboard also provides switching, overcurrent, and short circuit protection such as fuses and breakers.Under normal operating conditions, the Atlantic Erie's main switchboard can be powered by 1 or more of the vessel's 3 main generators. The main switchboard normally also powers the emergency switchboard via 2 transfer breakers.Footnote 27 The emergency switchboard powers 1 steering gear motor and various navigational instruments, including the gyrocompasses (Appendix D). In the event of a blackout (a situation where all 3 main generators fail), the 2 transfer breakers will open and, after a pre-set time delay, the emergency generator will start, its circuit breaker will close automatically, and it will begin supplying the emergency switchboard.Footnote 28
The vessel also has an auto-standby system, which means that 1 of the main generators can be put on standby so that if the generator in operation fails, the standby generator will start automatically and replace the one that failed.
1.12.2 Engine room blackout procedure
Procedures in case of a blackout are defined in the Atlantic Erie's SMS, which is referred to by the company as the V.Ships Management System (VMS).Footnote 29 The engine room blackout procedure provides instructions for restarting the main engines and for resupplying power to the emergency switchboard using the main switchboard, rather than the emergency generator. Among other things, the procedure involves opening and closing the transfer breaker situated in the ECR. The CE had revised the procedure following testing of the generators conducted on 12 May 2014; the revisions included changes to the wording and formatting of the procedure, but did not alter the content.In this occurrence, the 2 drops in voltage caused by restarting the bow thruster motor were significant enough to activate power failure alarms on the bridge navigation equipment. However, both times, a main generator continued to power the main switchboard and so the vessel did not, in fact, sustain a loss of electrical power. The blackout procedure was performed after each voltage drop. Because the vessel had not lost power, the blackout procedure had the effect of de-energizing the emergency switchboard each time it was performed, which interrupted power to the bridge equipment and activated the associated alarms.
1.12.3 Load sharing between generators
Load sharing involves the division of a vessel's total electrical load between 2 or more generators operating in parallel; it is carried out to avoid overloading and stability problems on the generator sets and the electrical systems. Depending on the vessel's power requirements, the EOW will determine the number of generators needed to supply power to the main switchboard. Before a generator's maximum rated capacity is attained, the EOW will start a second generator and synchronize it with the first, allowing the load to be shared by the 2 generators. The distribution of the load is automatically achieved by the engine speed governorFootnote 30 and the automatic voltage regulator.Footnote 31Prior to the occurrence, the CE had experienced a problem with the automatic voltage regulator that had impacted the load distribution between the generators.
1.13 Bridge resource management
BRM is the effective management and use of all resources, human and technical, available to the bridge team to ensure the safe completion of the voyage. BRM includes skills, knowledge, and strategies on workload management, problem solving, decision making, teamwork, and situational awareness, especially during critical operations. Specifically, bridge team members have a responsibility to maintain overall situational awareness as well as be responsible for their individual duties. They also have a duty to work as a team to help prevent single point failure, which may occur when only 1 person is responsible for a safety-critical task and that person has no back-up to help identify possible errors. The exchange of information is necessary for the team to work together towards a common goal. Ineffective communication can result in crew members having different understandings of the unfolding situation.The company had recently implemented a Human Element Leadership Management (HELM) training program. This is a 1-week scenario-based course where masters and chief engineers are provided training on the limitations of human performance. The course is intended to help participants develop an understanding of cognitive errors, and how various stressors (fatigue, emergencies, work overload) can contribute to the occurrence of errors. The course involves 18 hours of classroom-based facilitated instruction on the following topics:
- leadership and management
- communication
- human capabilities and limitations
- decision making
- human error and human reliability
- fatigue and stress
1.14 Safety management system
Vessels that operate under the International Management Code for the Safe Operation of Ships and for Pollution Prevention (ISM Code) are required to implement an SMS, which provides a framework for managing safety risks within routine and emergency situations. The Atlantic Erie's SMS includes guidance on a number of issues relevant to this occurrence.1.14.1 Bridge organization
With respect to bridge organization, the SMS states that bridge team members must realize they have a vital part to play in the safe navigation of the vessel and that safety depends on all personnel exercising their duties to the utmost of their ability. It also specifies that, among other things, an efficient bridge organization will “minimize the risk that an error by one person will have; emphasize the need to maintain a visual lookout; and (…) require the use of all means of establishing the ship's position so that in the case of one method becoming unreliable, others are immediately available.”Footnote 321.14.2 Use of the 3D Navigator / Electronic Chart Precise Integrated Navigation System
The SMS contains information on using ECDISFootnote 33 as the primary means for navigation and specifies that in this case, “radar and visual bearing should be cross-checked using the bearing line facility of the ECDIS unit.”Footnote 34 The SMS also cautions against the risk of losing situational awareness as the navigator's role becomes increasingly passive with the use of electronic chart systems and notes that a quick glance at the system on board is not sufficient to “ensure the safety of the vessel, to confirm the integrity of the automated position fixing or to maintain awareness of hazards ahead.”Footnote 35 The section concludes by emphasizing that navigators must maintain an active role and continue to manually plot positions at regular intervals to confirm the position displayed on the electronic chart system is correct.1.14.3 Bridge equipment failures
The section of the SMS dealing with equipment failure provides suggested procedures to follow in the event of a failure of any piece of bridge equipment. These include increasing bridge manning and using hand steering. Specifically for a main gyrocompass failure, the suggested procedure is the use of a magnetic compass and the taking of additional compass errors.Footnote 36 The SMS originally contained checklists for the failure of key items of equipment, including the gyrocompasses; however, during a modification of the SMS to reduce obsolete and infrequently used procedures, the company had removed the checklist for gyrocompass failure with the plan of adding it to the shipboard contingency plan, but had not done so at the time of the occurrence. However, a power failure checklist, which requires a cross-check of the gyro and magnetic compasses, was available on board.1.14.4 Emergency procedures
The SMS also provides guidance on emergency procedures, among which the following is specified:- All emergency signals are to be backed up with information on the vessel's PA system.
- When the general alarm sounds, all personnel are to muster at their muster locations promptly and with due regard to personal safety.
- If the CE and electrician are not in the engine room when the alarm sounds, they are to make contact with the bridge before entering the engine room.
- The master is to inform the engine room of the location and type of emergency, if it is outside the machinery spaces.
1.15 TSB laboratory reports
The TSB completed the following laboratory report in support of this investigation:- LP129/2014 – Power System Analysis
Analysis
2.1 Events leading to the grounding
In this occurrence, a voltage drop on the bridge escalated into an emergency after subsequent actions in the engine control room (ECR) caused multiple brief power interruptions to the bridge navigational equipment, and the gyrocompass became misaligned. The gyrocompass was not verified following the power interruptions. The helmsman was steering the ordered course of 180°G using a gyrocompass repeater that was becoming increasingly misaligned.Footnote 37 The master, who was not using all available bridge resources to monitor the vessel's position and course, did not identify the vessel's deviation until it was too late for corrective action and the Atlantic Erie ran aground.2.1.1 Emergency response in the engine control room
After the initial voltage drop on the bridge, the chief engineer (CE) was informed that there were 2 problems requiring attention: a blackout on the bridge and a bow thruster failure. Given that the CE had recently experienced load-sharing problems with the generators, he interpreted the bow thruster failure as being connected to these problems, and not a problem with the bow thruster itself. This preliminary interpretation of the situation, combined with a desire to get the bow thruster back online quickly to assist the master in manoeuvring the vessel away from the canal, led the CE to attempt restarting the bow thruster without assessing its condition and the potential risks involved.The CE had also received a report of a blackout on the bridge, but when he proceeded to the ECR, he observed an emerging set of cues that contradicted this report (lights on, generators running). The CE's interpretation of the problem did not change as a result of these cues, and he subsequently applied the blackout procedure twice in circumstances that did not call for it. The application of the blackout procedure while the vessel was still powered caused the situation to escalate. The CE did not realize or understand the consequences of applying the blackout procedure while the vessel was still powered, possibly due to an incomplete knowledge of the vessel's power generation system, and his actions inadvertently interrupted power to the bridge.
The CE’s application of the blackout procedure and focus on the bow thruster failure as a load-sharing problem may have been a consequence of cognitive fixation. When problems arise, especially during critical operations where time pressure is present and the margins of error are limited, people tend to develop a particular interpretation of a problem/solution based on the context of the problem itself and to interpret cues that match the situation. Even if some cues are ambiguous or contradictory, people's tendency is to interpret cues in a way that complements their current understanding, because it allows them to settle on a plausible explanation and take action. Although this is efficient, the risk is that this can prevent a person from considering other explanations and actions. The tendency to become focused on one interpretation to the exclusion of others is known as cognitive fixation. Cognitive fixation is not related to problems with a person's motivation, but instead is related to the limited capacity of people in general to process new information and update their understanding or actions, which causes their original belief to persist.Footnote 38
2.1.2 Emergency response on the bridge
Following the initial voltage drop, the master was faced with a novel and unfolding series of emergencies as he attempted to steer the vessel away from confined waters. These included repeated activations of power failure alarms on the bridge for which the cause was unknown, power loss to some navigational instruments and others that defaulted to standby mode, as well as a smoke alarm in the bow thruster compartment.After receiving a report of smoke in the bow thruster compartment, the master sounded the general alarm and attempted twice to make an emergency announcement to all crew using the PA system, but both times he made mistakes, so he stopped trying to use the PA system and instead made the announcement using the vessel's internal very high frequency (VHF) system. The master likely switched to the VHF system out of concern for the time he was losing in repeated unsuccessful attempts to transmit the announcement on the PA system. However, as a consequence of the announcement being transmitted by VHF, the CE did not receive the message and was therefore not aware of the location of the fire and the danger associated with restarting the bow thruster.
Given the high workload involved in managing multiple unfolding emergencies while also navigating the vessel away from the canal, some critical aspects of the master's performance were shed unintentionally (e.g., managing bridge team resources to guard against single point failure, verifying the gyrocompass, monitoring visually, leaving the bridge without transferring the con).
In high-workload situations, individuals tend to reduce their use of peripherally relevant information, and centralize or limit their focus of attention to cues that they perceive to be most important or most relevant to a primary task.Footnote 39 If peripheral cues are ignored when they might be relevant to an important task, performance on that task may suffer. Individuals may also react by shedding or simplifying task demands and may have decreased situational awareness.
In this occurrence, both the master and CE faced an emerging complex emergency. Although they had completed Human Element Leadership Management (HELM) training just over a year previously, some important aspects of their training were not incorporated in their responses to the complex emergency. For example, the bridge-engine room communication was insufficient to update the master and CE's respective understandings of the developing situation and to allow them to work together to address the emergency. In addition, the CE did not use all available engine room resources (e.g., seeking information from other ECR team members) to update his situational awareness and assist him in taking appropriate action, nor did the master use all available bridge resources to reduce his high workload as the emergency unfolded.
2.2 Monitoring the vessel's progress
To ensure the safe passage of a vessel, navigators use visual cues and information from multiple types of navigational equipment. It is also important that navigators work as a team when monitoring the vessel's progress to minimize the chances that a single error will go undetected.In this occurrence, the accuracy of the gyrocompass was compromised by the 2 power interruptions that took place while the vessel was turning. The gyrocompass was not cross-checked with the magnetic compass following the power interruptions. The master was monitoring the vessel's progress using only the Electronic Chart Precise Integrated Navigation System (ECPINS), which was showing the vessel's heading inaccurately due to the gyrocompass misalignment, but he did not detect this error.
Although the master called the second officer to the bridge on 2 occasions, both times the second officer was tasked only with silencing the alarms and was not engaged in monitoring the vessel's progress. As a result, the master was navigating alone without another officer to help him detect errors such as the inaccurate data being provided by the ECPINS. Furthermore, at one point the master left the bridge briefly to retrieve his cellular phone without handing over the con to the second officer.
Without using all available resources and information to verify the vessel's position, the bridge team did not detect the vessel's deviation from its intended course for a period of approximately 15 minutes.
If a bridge team does not make use of all available resources, both human and technical, to monitor the vessel's progress, there is a risk that errors may go undetected, which may result in an accident.
2.3 Gyrocompass alarm design
Effective alarm design involves consideration of a number of factors, including the method by which the alarm alerts the operator of a problem, the duration of the alarm, and the way the alarm is acknowledged, among other things.In this occurrence, the bridge team was dealing with multiple activations of numerous different power failure alarms. Most of the alarms would continue to activate until the bridge team acknowledged them. However, in the case of the gyrocompass, the alarm would silence automatically whenever the voltage returned to normal. This meant that the bridge team was left without any reminder to verify the gyrocompass. Given that the bridge team was busy handling repeated activations of numerous different alarms, the design of the gyrocompass alarm was likely a factor in why verification of the gyrocompass was overlooked.
While the International Maritime Organization (IMO) brought guidelines into effect in 2002 stipulating that alarms should continue until they are acknowledged, the Atlantic Erie was constructed prior to this date and therefore the design of the gyrocompass alarm did not comply with the guidelines. This may also be the case on other vessels that were constructed prior to the date that the IMO guidelines came into force.
If an alarm does not continue to activate until acknowledged by an operator, there is a risk that the underlying problem may be overlooked and secondary effects on equipment may go unnoticed.
3.0 Findings
3.1 Findings as to causes and contributing factors
- The bow thruster circuit breaker tripped and caused a voltage drop throughout the vessel that activated a number of power failure alarms on the bridge; the alarms created a situation that resembled a blackout and was interpreted as such.
- The chief engineer responded to the developing situation by applying the vessel's blackout procedure twice, which caused additional power interruptions to the bridge; however, the chief engineer was unaware that his actions were having this effect.
- These power interruptions, combined with the vessel's turn to starboard, caused the gyrocompass to become misaligned.
- The gyrocompass was not verified for accuracy following the power interruptions, and the master was now navigating using inaccurate data from the Electronic Chart Precise Integrated Navigation System (ECPINS).
- The helmsman, who was steering using a gyrocompass repeater that had been misaligned, unknowingly placed the vessel off course.
- The master was not using all available bridge resources to monitor the vessel's progress, and the vessel proceeded off its intended course for approximately 15 minutes.
- When the master identified that the vessel was not following the intended course, he attempted to take corrective action, but it was too late to be effective, and the vessel ran aground.
3.2 Findings as to risk
- If a bridge team does not make use of all available resources, both human and technical, to monitor the vessel's progress, there is a risk that errors may go undetected, which may result in an accident.
- If an alarm does not continue to activate until acknowledged by an operator, there is a risk that the underlying problem may be overlooked and secondary effects on equipment may go unnoticed.
3.3 Other findings
- The checklist to follow in the event of a gyrocompass failure (Checklist 3.5.11) had been removed from the vessel's safety management system with the intent to add it to the shipboard contingency plan; however, this had not been done at the time of the occurrence.
- The public address and the very high frequency handsets on the bridge central console are similar in appearance, are located close together, and had been mistaken for one another in the past.
4.0 Safety action
4.1 Safety action taken
4.2 Canada Steamship Lines
Following the occurrence, the master wrote a letter that was circulated to the fleet masters. In the letter, the master provided an explanation of what had happened during the occurrence and why. The master also solicited feedback from the fleet masters as to how they might have handled the situation for the purpose of creating a forum for open discussion that might help to avoid similar occurrences in future. The master's letter was also used to develop a case study exercise based on the occurrence that has been incorporated into Human Element Leadership Management (HELM) training.HELM mentors have been hired for the 2015 season to sail in the fleet, observe and further coach the vessel's crew on HELM principles. This is a refresher for the training previously provided on the simulator.
This report concludes the Transportation Safety Board's investigation into this occurrence. The Board authorized the release of this report on 10 June 2015. It was officially released on 12 August 2015.
Appendices
Appendix A – Atlantic Erie general arrangement
Legend
A. Emergency generator room (on port side of vessel)B. Engine control room
C. Bridge
D. Bow thruster compartment
Appendix B – Bridge layout
Legend
- Radars
- Electronic Chart Precise Integrated Navigation System (ECPINS)
- 3D Navigator draft information system
- Very high frequency (VHF) radiotelephone handset
- Public address (PA) handset
- Engine telegraph table
- Bow thruster control
- Gyrocompass
- Gyrocompass repeater
- Steering console
- Helm
- Fire control panel
- Chart table
- Stairway
Appendix C – Atlantic Erie's track
Legend
A. The officer of the watch gives the engineer of the watch 1 hour's notice for manoeuvring.B. The officer of the watch calls the master to the bridge, as per the night orders.
C. The master arrives on the bridge.
D. The master takes over the con and calls a Seaway Welland vessel traffic controller to report the vessel's position at calling-in-point (CIP) 16.
Appendix D – Electrical schematic
A Circuit breaker for generator No. 1
B Circuit breaker for generator No. 2
C Circuit breaker for generator No. 3
D Circuit breaker for emergency generator
E Transfer breaker (in engine room)
F Transfer breaker (in emergency generator room)
G Circuit breaker for bow thruster
H Circuit breaker for rudder indicator
I Circuit breaker for bridge instruments
J Circuit breaker for forward steering pump
K Circuit breaker for rear steering pump
Appendix E – Course made good versus gyrocompass heading
The following image has been compiled by the TSB to show the difference between the vessel's course made good (CMG) and the gyrocompass heading as it was being displayed on the Electronic Chart Precise Integrated Navigation System (ECPINS) at the time of the occurrence. The grey (dark) vessel-shaped markers show what the master would have been seeing on the ECPINS, whereas the yellow (light) markers show the actual CMG.
| Time | Event | Gyro (°T) | Course made good (°T) | Speed (knots) |
|
|---|---|---|---|---|---|
| 1 | 0948 | Bow thruster (B/T) breaker trips after running for 1 minute. | 023 | 027 | 10.7 |
| 2 | 0950 | Engineer of the watch (EOW) resets breaker, bow thruster is started a second time, its breaker trips and the voltage drops. The No. 3 generator breaker also trips and there are numerous alarms on the bridge. | 018 | 019 | 9.9 |
| 3 | 0955 | Smoke alarm in B/T compartment, master orders full astern and hard port, sounds general alarm. | 016 | 017 | 8.3 |
| 4 | 0958 | Chief engineer (CE) arrives in engine control room, performs blackout procedure, which interrupts power to the bridge and activates numerous alarms. | 034 | 025 | 5.2 |
| 5 | 1001 | CE attempts third start of B/T, which causes another voltage drop. CE performs blackout procedure again, activating bridge alarms. Master orders hard to starboard, engine ahead. Soon after, the second engineer informs the CE of the fire in the B/T compartment. | 071 | 050 | 1.6 |
| 1003 | Master orders the helmsman to steer 180°. | 129 | 098 | 2.9 | |
| 1006 | Helmsman reports the vessel is on 180°G. | 180 | 165 | 4.8 | |
| 6 | 1016 | Master leaves bridge to get his cell phone. He checks the Electronic Chart Precise Integrated Navigation System (ECPINS) and sees that the vessel is not following 180 and is instead on an easterly route. | 180 | 130 | 4.8 |
| 1017 | Master returns to the bridge and inquires about magnetic course. He orders hard to starboard and increases engine power. | 211 | 100 | 4.8 | |
| 7 | 1020 | Vessel runs aground. |
Appendix F – Electronic Chart Precise Integrated Navigation System screenshots
Appendix G – Gyroscope response to tilting
Footnotes
- Footnote 1
-
Units of measurement in this report conform to International
Maritime Organization Standards or, where there is no such standard, are
expressed in the International System of Units.
- Footnote 2
-
Fitting a propeller within a steerable Kort nozzle improves its
efficiency by increasing thrust, which in turn improves steering, even
at low speed.
- Footnote 3
-
Each of these main generators consists of a diesel engine coupled to a 3-phase electric alternator.
- Footnote 4
-
Course made good is also known as course over the ground (COG).
- Footnote 5
-
All times are Eastern Daylight Time (Coordinated Universal Time minus 4 hours).
- Footnote 6
-
In standby mode, the radars do not display an image. The radars must be switched to transmit mode in order to display an image.
- Footnote 7
-
Given that the vessel is fitted with a Kort nozzle, an order of hard
to port while reversing engine would cause the vessel to turn to
starboard.
- Footnote 8
-
After a set time delay, if the alarm on the fire detection panel is
not acknowledged, it activates the general alarm and closes the fire
doors automatically.
- Footnote 9
-
The master sounded 7 short blasts followed by 1 long blast to indicate a general alarm.
- Footnote 10
-
The label was added to the public address (PA) handset after
multiple instances where pilots mistakenly used the PA handset instead
of the very high frequency handset.
- Footnote 11
-
The company provides some crew members with very high frequency
(VHF) handsets so that they can be reached anytime and anywhere on the
vessel. It is not known whether the chief engineer had his VHF handset
turned on and with him at the time of the announcement.
- Footnote 12
-
The chief engineer's cabin is located 2 decks below the bridge.
- Footnote 13
-
The source of these alarms could not be determined by the investigation.
- Footnote 14
-
The master normally uses his cellular phone when coverage is
available, as the satellite phone on the bridge has a delay that makes
communication difficult.
- Footnote 15
-
111°Magnetic converts to 100°True at this location.
- Footnote 16
-
A winding is a conductive copper wire covered with insulating
varnish. It is wound to form a coil that produces the magnetic field
necessary to generate torque inside an electric motor.
- Footnote 17
-
TSB Laboratory Report LP219/2014 – Power System Analysis.
- Footnote 18
-
The unit is subject to regular inspections such as the annual megger
test—the last one was carried out 4 months prior to the failure—and
class inspections, which are done every 5 years.
- Footnote 19
-
The stator is the stationary part of a rotary system found in electric motors.
- Footnote 20
-
Human Element Leadership Management (HELM) training is a week-long
scenario-based course that focuses on human performance and cognitive
errors. It is offered by a private company based in the United Kingdom
that specializes in management and safety training courses.
- Footnote 21
-
The heading refers to the vessel's direction in relation to true north.
- Footnote 22
-
Factors such as wind and current may affect the difference between
the course made good (CMG) and gyrocompass heading values. When there is
no wind or current, the CMG and gyrocompass heading values are very
close.
- Footnote 23
-
Gimbals are a system of rings or hoops arranged to maintain an
object suspended in their centre, allowing the suspended object to
remain in a horizontal position regardless of a vessel's movement.
- Footnote 24
-
A meridian is also known as a line of longitude.
- Footnote 25
-
Transport Canada, TP 3668E, Standards for Navigating Appliances and Equipment, Section 6, Standards for Gyrocompasses, 1983.
- Footnote 26
-
International Maritime Organization, MSC/Circ. 982, Guidelines on Ergonomic Criteria for Bridge Equipment and Layout, 20 December 2000.
- Footnote 27
-
A transfer breaker is used to connect switchboards that have independent power sources.
- Footnote 28
-
Section S1.5.4 (iii) of Transport Canada's publication Ships Electrical Standards, 2008 (TP 127E) specifies that a vessel's emergency generator is to start within 45 seconds of a power failure.
- Footnote 29
-
In this report, the safety management system (SMS) refers to the V.Ships Management System (VMS).
- Footnote 30
-
A speed governor controls the fuel input to a diesel engine to regulate its speed.
- Footnote 31
-
The automatic voltage regulator monitors the output voltage of the
alternator by controlling the input current for the alternator's exciter
and calculates how much current the exciter needs in order to stabilize
the output voltage at a pre-determined point.
- Footnote 32
-
The CSL Group inc., V.Ships Management System, Section 3.10.1, Bridge Team Management.
- Footnote 33
-
Within the safety management system, the term "ECDIS" is used to
refer to electronic chart systems such as the 3D Navigator and the
Electronic Chart Precise Integrated Navigation System (ECPINS).
- Footnote 34
-
The CSL Group inc., V.Ships Management System, Section 3.8.1, Position Fixing and Monitoring.
- Footnote 35
-
Ibid.
- Footnote 36
-
The CSL Group inc., V.Ships Management System, Section 3.2.9, Bridge Equipment.
- Footnote 37
-
Between 1006 and 1017, the misalignment caused the difference between the gyro heading and the CMG to increase from 15° to 111°.
- Footnote 38
-
D.D. Woods, L.J. Johannesen, R.I. Cook, and N.B. Sarter, Behind Human Error: Cognitive Systems, Computers, and Hindsight, CSERIAC (Crew System Ergonomics Information Analysis Center), 1994, SOAR 94-01. pp. 76-77.
- Footnote 39
- M. Staal, A.E. Bolton, R.A. Yaroush, and L.E. Bourne, “Cognitive Performance and Resilience to Stress,” In: B.J. Lukey and V. Tepe (eds.), Biobehavioral Resilience to Stress, Boca Raton: CRC Press, 2008, pp. 259–299.