PowerFailuresonShipsSafetystudy

Investigationnumber:M2016-S1

2

FOREWORDOnthebasisofsection2oftheSafetyInvestigationAct(525/2011),theSafetyInvestigationAuthoritydecidedtoinitiateasafetystudyonpowerfailuresonships.SeniorresearcherSirpaKannosledtheinvestigationteamuntil24February2017,afterwhichLieutenantSeniorGrade(retired)JariAlanentookoverasinvestigationteamleader.Asmembersofthejointin-vestigationteamwereappointedCaptain(MasterofMaritimeManagement)TeemuLeppälä,ChiefEngineerTuomoLeppäläandCaptain(MasterofMaritimeManagement)JohannaVahtera.Inaddition,onsiteinvestigationswereconductedbyCaptainBengtMalmberg,Cap-tainMikkoRaustiandNavalArchitectNiklasRönnberg.ChiefEngineerandElectricalEngi-neerPekkaIlmiöwasappointedexpertonpowerfailures.ChiefMarineSafetyInvestigatorRistoHaimilawasInvestigationLeader.Thissafetystudyreportdescribestheinvestigationprocess,givesgeneralinformationaboutpowerfailuresonshipsandpresentsactsandregulationsconcerningpowerfailuresonships.Thereportsonspecificcasesaswellasajointanalysisonthemareincluded.Attheendofthisreportsafetyrecommendationsarepresented.Byimplementingthem,similaraccidentsandincidentscanbeavoidedinthefuture,ortheirconsequencescanbemitigated.Thepurposeofsafetyinvestigationisincreasingpublicsafety,preventingaccidentsandinci-dentsaswellasmitigatingdamagescausedbyaccidents.Safetyinvestigationsdonotconsiderpossibleliabilitiesorobligationstocompensatefordamages.Theuseofinvestigationreportsforanypurposeotherthantoimprovesafetymustbeavoided.Powerfailuresinnarrowfairwaysandinareaswithdensetrafficcancauseveryserioussea-andenvironmentalaccidents.TheserisksarepronouncedintheFinnishnarrowandrockyfairwaysinbothseaareasandininlandwaterways.Thesafetystudystrivedtoidentifycausesforpowerfailuresonships.Anevaluationconcerningfactorsthatdecreasedorincreasedsafetywasalsoconducted.Thesearepresentedintheincidentreportsincludedinthissafetystudy,section2.3.InformationaboutthepowerfailurecasesincludedinthissafetystudywasreceivedfromtheFinnishTransportSafetyAgency,theFinnishTransportAgency,FinnpilotPilotageLtd.andshippingcompanies.Itwasdecidedthat12casesofpowerfailures,orincidentswithsimilarconsequences,wouldbeinvestigated.Theshippingcompanieswereinformedaboutthecom-mencementoftheinvestigations.Theonsiteinvestigationswereconductedby2-3experts.Thescopeoftheinvestigationofindividualcaseswaslimitedtothecomponent-,system-andoperational-levels.Noneoftheinvestigatedcasesdidresultinaveryseriousseaaccidentorenvironmentalaccident.Reportswerepreparedontheresultsoftheonsiteinvestigations.Thereportshavebeenincludedinthissafetystudy.Afteraone-yearmonitoringperiod,theinvestigatedincidentswereanalysedusingtheBowTiemethodofanalysis.

Theincidentreportsweresenttotheconcernedshippingcompaniesforreview.Thedraftre-portwassentforreviewtotheFinnishTransportSafetyAgency,theFinnishTransportAgencyandtoFinnpilotPilotageLtd.Asummaryofthereviewshasbeenincludedinthisreport.State-mentsorreviewsbyprivatepersonsarenotpublished.

SeniorLecturerPeterBjörkrothhastranslatedtheinvestigationreporttoSwedishandEng-lish.Theinvestigationreport,aswellasasummary,ispublishedontheSafetyInvestigationAuthority'swebsite,www.turvallisuustutkinta.fi

3

GLOSSARYANDABBREVIATIONSDWT Deadweighttonnage,theship'sweightcarryingcapacity

GMDSS GlobalMaritimeDistressandSafetySystemGT Grosstonnage,theship'sinternalvolume

IMO TheInternationalMaritimeOrganisation,aUnitedNationsagencyIMOnumber Auniquenumberassignedtoallmerchantvesselsof100GTorabove. ThenumberremainsthesameforthewholelifetimeofthevesselISMCode InternationalSafetyManagementCodeCodeAninternationalsafety managementsystem

NT NetTonnageThevolumeoftheship'scargospacesSMS SafetyManagementSystemSafetyManagementSystemusedbyship- pingcompaniesandships

SOLAS InternationalConventionfortheSafetyofLifeatSeaSTCW StandardsofTraining,CertificationandWatchkeepingforSeafarers AnIMOadoptedconvention

Trafi TheFinnishTransportSafetyAgencyUPS UninterruptiblePowerSource

VTS VesselTrafficServiceSAR SearchAndRescue(SAR)servicesprovidedbythegovernmentand volunteers.GeneratorbackfeedingTheelectricityflowstothegeneratorbecauseofmalfunctioninthe powerplant.Thegeneratorthenbeginstoworkasamotor,supplied bythepowergrid.

Propulsion VesselthrustStandby Statuswhereaunitormachineisreadytobestarted

PowerFailure Situationinwhichpowergenerationordistributionistemporarilyin- terruptedorisdisturbed.

InvestigationnumberM2016-S1 Cover:SIAInvestigationreportS2/2017ISBN:978-951-836-507-8(PDF)

4

TABLEOFCONTENTS

Foreword................................................................................................................................................................................2GLOSSARYandABBREVIATIONS...............................................................................................................................3

ENSURINGTHEELECTRICITYPRODUCTIONANDDISTRIBUTIONONSHIPS...........................6DefinitionofPowerFailuresandInvestigatedCases.....................................................................6ElectricityGenerationandDistributionSystem...............................................................................6Ships'PowerDistributionSystems,PowerSourcesandtheRequirementsofthe

SOLASConvention.........................................................................................................................................................7PowerDistributionSystem................................................................................................................7MainSourceofElectricalEnergy....................................................................................................7EmergencySourceofPower..............................................................................................................7

SOLASRequirementsonOtherCriticalSystemsfortheEmergenceandConsequencesofPowerFailuresonShips........................................................................................................................................8

PropulsionSystem.................................................................................................................................8SteeringSystem.......................................................................................................................................8GMDSSEquipment.................................................................................................................................8MachineAutomationSystem............................................................................................................9RequirementsintheISMCode.........................................................................................................9RequirementsintheSTCW.............................................................................................................10FlagStateRequirements..................................................................................................................10

INVESTIGATEDPOWERFAILURES...............................................................................................................10AccesstoInformationonPowerDisruptions.................................................................................10TheInvestigationProcess.........................................................................................................................10IncidentReports............................................................................................................................................11

M/SPolarisVG,aSeriesofPowerFailures,February2016...........................................12M/SCoralCarbonic,PowerFailure,3.3.2016........................................................................14M/SMissouriborg,MainEngineFailure16.3.2016............................................................17M/VAlppila,PowerFailure,4.4.2016........................................................................................20M/VLianne,PowerFailure,23.6.2016.....................................................................................22M/SFinnsun,PowerFailure,30.6.2016...................................................................................24RMSNeudorf,PowerFailure,11.7.2016..................................................................................27M/SAmorella,PowerFailure,18.7.2016.................................................................................29M/SEgonW–MainEngineFailureandGrounding,13.9.2016....................................32M/SPrimaBallerina,PowerFailure,20.10.2016................................................................35M/SMariella,PowerFailure,5.11.2016...................................................................................38M/SViggen,PowerFailure,10.01.2017...................................................................................40

5

ANALYSIS...................................................................................................................................................................43CausesforPowerFailuresandRelatedObservations................................................................44

WornandOldComponents.............................................................................................................44EquipmentOperation........................................................................................................................44Fuel.............................................................................................................................................................45UnexpectedComponentFailure...................................................................................................45ReliabilityofAutomation.................................................................................................................45

ConsequencesofPowerFailuresandManagingthem...............................................................46NoSubstantialorLong-termEffects..........................................................................................46LossofManoeuvrability...................................................................................................................46LossofManoeuvrabilityandGrounding..................................................................................46AvoidingVerySeriousSeaAccidents.........................................................................................47

AnalysisofRescueOperations................................................................................................................47TheActivitiesoftheAuthorities............................................................................................................47

CONCLUSIONS.........................................................................................................................................................48ComponentQuality......................................................................................................................................48SufficientKnow-How..................................................................................................................................48ReliabilityofSystems..................................................................................................................................49Conditions.........................................................................................................................................................49

SAFETYRECOMMENDATIONS........................................................................................................................50ProceduresforReportingPowerFailures........................................................................................50AssessingtheNeedforDevelopingtheLegislationConcerningSafeConductofVessels

................................................................................................................................................................................50SUMMARYOFSTATEMENTSRECEIVEDONTHEDRAFTINVESTIGATIONREPORT...................52

6

ENSURINGTHEELECTRICITYPRODUCTIONANDDISTRIBUTIONONSHIPS

DefinitionofPowerFailuresandInvestigatedCasesApowerfailureisasituationinwhichpowergenerationordistributionistemporarilyinter-ruptedordisturbed.Failureoroverloadintheship'selectricitydistributionsystemcanresultinapartialorcompletelossofelectricalpower,i.e.ablackout.Thescopeandseverityofthedisturbancedependsonhowthesystemisbuilt,itsbackupsystemsandwherethedistributionsystemfailureoccurs.Thediversityofelectricitydistributionsystemsandthelargenumberofcomponentsinthem,makeitdifficulttoanticipatefaults.

Shipaccidentsandincidentsrelatedtofailuresinthedistributionofelectricitywerefollowedforaperiodof12months,beginning1February2016.Intheend12caseswereincludedinthisinvestigation.Tenofthemconcerneddistributionofelectricityandtwoofthemmainen-ginefailures.Theconsequencesofthemainenginefailuresweresimilartotheconsequencesofpowerfailures.

ElectricityGenerationandDistributionSystemShipshaveownelectricalnetworks,production,distributionandconnectedconsumersofelec-tricity.Theship'selectricalnetworkenablestheshiptooperateasanindependententityatseaandoftenalsoinport.Thelatteriftheshipisnotconnectedtoshorepowertoensureavailabil-ityofelectricityonboard.Avessel'selectricalnetworkcanbeimplementedinavarietyofways.Theintendeduseofthevessel,itstype,aswellasspecificfeaturesinthevesseldesigndeterminehowtheelectricnet-workisimplemented.IntheInternationalConventionfortheSafetyofLifeatSea(SOLAS)itisrequired,thatonvesselsininternationaltraffic,electricitycanbeproducedbytwoindependentsources,bothofwhichalonehasthecapacitytoproduceelectricalpowerenoughtomaintaintheship'sseaworthiness.Thepowerneededonboardisproducedbytheship'sowngenerators.Theyarerotatingatcon-stantspeed,usuallypoweredbydieselengines.Fromthedieselgenerators,electricityistrans-ferredtothemainelectricalgrid,whichinturndistributeselectricitytotheconsumerpoints.Therecanbeoneormorediesel-poweredgeneratorsonaship.Thenumberandsizeofgener-atorswilldependontheship'sneedforelectricalpower.Itisalsopossibletouseashaftgeneratororageneratorconnectedtothemainengine,forpro-ducingtheelectricityneededonaship.Ashaftgeneratorisageneratorthatcanbeconnecteddirectlytothepropellershaftthatisrotatedbythemainengine.Anotherpossiblearrangementistohavethemainenginerotatethepropellershaftandageneratorconnectedtoitbyareduc-tiongear.Ashaftgeneratorcanoftengeneratealltheelectricalpowerneededfortheship.Usuallytheshaftgeneratorisusedwhentheshipisenroute.Uponarrivalinportsorinnarrowfairways,theneededelectricalenergycanbeproducedwithgeneratorspoweredbyauxiliaryenginesinordertoensuresafety.Theshipmustbefittedwithanemergencypowersource,whichmaybeanemergencygenera-tororasetofbatteries.Theelectricalenergyproducedbytheemergencysourceistransferredtotheemergencyelectricpanelfromwhereitistransferredtothesafety-criticalequipmentsuchasthesteeringsystem.Therequiredemergencypowerdependsonthepowerdemandsoftheequipmentthathasbeendefinedascritical.Thispowerdemand,inturn,willdeterminethe

7

choiceofemergencypowersource.Mostshipshaveadieselgeneratorasemergencypowersource.

Ships'PowerDistributionSystems,PowerSourcesandtheRequirementsoftheSOLASConvention

PowerDistributionSystemThepowerdistributionsystemsareimplementedonvesselsfollowingtheinstructionsissuedbyclassificationsocieties.Theintendeduseofthevessel,itstypeaswellasspecialfeaturesinthevesseldesign,determinehowthepowerdistributionisrealised.Initssimplestformtherecanbeone lonedieselgeneratoronboard. A technicallymoredemandingarrangement is apowerdistributionsystemrealisedwithseveraldieselgenerators.Thisarrangementiscom-mononvesselswithahighdemandforelectricpower.Theseinclude,forexample,vesselswithelectricpropulsionorvesselswithalargeconsumptionofelectricityduetoalargenumberofpassengers.Electricitycanbeproducedalsowithageneratorconnectedtothemainengineorthepropellershaft.

MainSourceofElectricalEnergyAtpresentthemostcommonmainsourceofelectricalenergyonshipsisdieselgeneratorsets,producingalternatingcurrentfortheship'selectricalgrid.Therecanbeseveralinstalleddieselgeneratorsetsandtheyarecontrolledwiththemachineautomationsystem.Otherelectricitysourcesare,e.g.,generatorsconnecteddirectlytothemainengineandshaftgenerators.Shaftgeneratorsareconnectedtothesameshaftlineasthemainengine.Theyareconnectedtotheshafteitherdirectlyorthroughareductiongear.Ifacargo-orpassengershipininternationaltraffichasauxiliary-systemsorequipmentrun-ningonelectricalpower,itmustbefittedwithaminimumoftwogeneratorsystems.Oneofthegeneratorunitsmustbedimensionedinsuchawaythatitonitsowniscapabletomeettheelectricityrequirementoftheship'smachineryandequipment.Ships,constructedafter1July1998,onwhichtheavailabilityofmainpowerisessentialforoperatingtheship'smainpropul-sionplantandsteeringsystem,mustnotethefollowing:thepowergeneratingsystemmustbebuiltandequippedinsuchawaythat–intheeventoffailureofonegenerator–thesupplyofelectricityfortheequipmentnecessaryfortheoperationofthepropulsionplantandsteeringsystemimmediatelyisrestored.1Thisrequirementcanbemetbyfittingseveraldieselgenera-torsinparallellandwithautomatictransferswitchesforthecriticalequipment.2Thedistributionoftheloadbetweengeneratorsmustbearrangedinawaypreventinganover-loadofagenerator.3Thiscanbeachievedbyadjustingthestart-uplimitsofthegeneratorssothatwhenageneratororgeneratorsreach,forexample,an85%load,thenextgeneratorstartsupandissynchronisedintothenetworktoproducethenecessaryadditionalenergy.

EmergencySourceofPowerTheshipmustbefittedwithanemergencypowersource,whichmaybeanemergencygenera-tororasetofbatteries.Thedemandforemergencyelectricalpowerdeterminesthechoicebe-tween the options.Nowadaysmost shipshavediesel generatorunits as emergencypowersource.TheyproduceACtotheship'selectricalgrid.Adieselgeneratorisacompactsolution

1SOLAS2009:842SOLAS2009:833SOLAS2009:89-97

8

comparedwithbatteries.Greaterdemandforemergencyelectricalpower,results,inpractice,inchoosingadieselgeneratorforemergencysourceofpower.Batteriesasasourceofemergencypowerareusedonsmallvessels.Batteriesareusedtosecureradioequipment,navigationequipmentaswellasmachineautomation.Inshipswhereelectri-calpowerisnecessaryforrestoringtheoperationofthemainpropulsionplantafterapowerfailure,thecapacityoftheemergencypowersystemhastobedimensionedasfollows:electric-ityfeedforthepropulsionplantandthenecessaryequipmentrelatedtoit,hastoberestoredwithin45secondsafterthebeginningofapowerfailureiftheemergencypowersourceisagenerator.Iftheemergencypowersourceisasetofbatterieselectricityfeedhastoberestoredimmediately.4

SOLASRequirementsonOtherCriticalSystemsfortheEmergenceandCon-sequencesofPowerFailuresonShips

PropulsionSystemIncaseofdisturbancesandfaultsituations,thesafetyoftheshipissettotakeprecedenceovertheprotectionofthemachineriesandequipmentagainstdamage.Infaultsituationsthepro-pulsionsystemshouldremaininoperationaslongaspossible.Itmustalsobepossibletorestartitevenifanauxiliaryessentialforthepropulsionsystemhasmalfunctioned.Auto-stopisonlyallowedincasesthatcanleadtoseriousdamageofthepropulsionsystem.5

Whendesigningmachinerysystemsonships,theaimistoduplicateallcriticalfunctions.Clas-sificationsocietiesdohoweveracceptthatshipsonlyhaveonepropeller,oneshaftlineandonemainengine.

SteeringSystemItmustbepossibletomaintaintheship'smanoeuvrabilitywhenthepropulsionengineisrun-ningandevenafterithasstoppede.g.duetoahardwarefailure.Becauseofthis,componentsintheship'ssteeringsystem,e.g.equipmentconveyingsteeringcommandsandunitsproducingpowerforsteering,e.g.hydraulicpumps,areamongthemostimportantelementsoftheship'selectricalnetwork.Shipsmustbefittedwithamainsteeringsystemandanauxiliarysteeringsystemthatcanbetakenintousequickly.Themainsteeringgearandtheauxiliarysteeringgearmustbeconstructedandinstalledsothatafailureinonesystemdoesnotaffecttheper-formanceoftheother.6Powerunitsinthesteeringgear,suchaselectricallyoperatedhydraulicpumps,muststartau-tomaticallyafterapowerfailure.Itmustalsobepossibletotaketheminusefromthenavigatingbridge.Failureofapowerunit,orautomaticstartupfailure,canresultindecreasedorlossofpowerforturningtherudder.Disturbancesinthepowerunitsofthesteeringgearmustactivateanalarmonthenavigatingbridge.7

GMDSSEquipmentSeaareasaredividedintofourGMDSSareas,accordingtowhichtherequirementonthecom-positionoftheradioequipmentonboardisdetermined.8

4SOLAS2009:89-975SOLAS2009:89-976SOLAS2009:71-727SOLAS2009:233-2348SOLAS2009:233-234

9

Thefunctioningoftheradioequipmentintheeventofdisturbancesinthepowerdistributiononboard,issecuredwithaseparateemergencypowersupply,i.e.withasetofbatteriesfortheradioequipment.Thebatteriesmustnotbedependentonthepropulsionplantortheelectricalnetwork.Thebatteriesmustsupplytheship'sradioequipment,composedaccordingtothere-quirementsoftheGMDSS-area,withpowerforatleastsixhours.Iftheshipisequippedwithanemergencygenerator,theradioequipmentmustfunctionforatleastonehourwithpowerfrombatteries.

MachineAutomationSystemThemachineautomationsystemmustbeabletodistributethe loadonthepowergrid(thegenerators).Intheeventofageneratorfailure,themachineautomationmanagesthestart-upofthestandbygeneratorsaswellastheirsynchronisingtothenetwork.Themachineautoma-tionalsorestartstheauxiliariesnecessaryforthepropulsionplantandsteeringgear.9Whentheelectricitysupplyhasbeenrealisedusingmorethanonegenerator,themachineau-tomationsystemmust-intheeventofageneratorfailure-beabletoensurethatothergener-atorsconnectedtothenetworkremain inthenetworkwithoutgettingoverloaded.Thema-chineautomationmustfurtherbeabletoensurethatthepropulsionplantandsteeringgearareabletofunctionnormally.10

Incaseofdisturbancesinasystem,themachineautomationmusttakecareofswitchingcon-nectionstothestand-byunitsthathavebeendefinedbytheuser.11

Ifthemachineautomationsystemfails,sothatitcannotperformtherequiredfunctionsrelatingtoelectricitydistribution,thesystemcancauseinterferenceinthepowerdistribution.Suchasituationmayarise, forexample, ifthepowerplant isnotadjustedproperlye.g.concerninggeneratorsusedinparallel.Iftheship'spowercontroldoesnotworkasplanned,arapidvari-ationofthepowercontrolfromthecontrolroommayresultingreaterloadonadieselgenera-torconnectedtothenetworkandtothesubsequentopeningofageneratorcircuitbreaker.

RequirementsintheISMCodeAccordingtotheISMCode,vesselsininternationaltrafficmusthaveasafetymanagementsys-tem.

Thesafetymanagementsystemmustincludeinstructionsforrecruitmentandfamiliarisationofthecrew,aswellasinstructionsforvariousemergenciessuchasdisturbancesinthepowerdistribution.

AccordingtotheISMCode,criticalequipmentandcomponentsmustbenotedintheship'spre-ventivemaintenancesystem.Onrequest,theshipownermustbeabletopresentcriticalequip-mentandcomponentstotheclassificationsocietyortotheflagstateauthority.Failureofthatequipmentorthosecomponentsmayresultinhazardoussituations.Thelistofcriticalequip-mentmust includeat least the criticalequipmentand componentsof thepropulsionplant,steeringgearandpowerdistributionsystem.12Theshippingcompanymustdefinethecriticalityofonboardsystemsinaccordancewiththeirownactivitiesandtherebydevelopthefunctionalityofthepreventivemaintenancesystemandthesafetymanagementsystem.

9SOLAS2009:9710ISMCode:1611ISMCode:1612ISMCode:16

10

RequirementsintheSTCWTheSTCWconventionisasetofinternationalregulationsfortraining,certification(competen-cies),andwatchkeepingforseaferers.TheSTCWconventioncontainsacode,theSTCWCode,whichsetsminimumstandardsforthetrainingandcompetenceofseafarers.

Competenciesandtrainingofthecrewoncargoandpassengerships in internationaltrafficmustbeincompliancewiththeSTCWCode.

FlagStateRequirementsFlagstatesmonitorships'compliancewithregulationsthroughportstatecontrolsandinspec-tionprocedures.InFinland,theFinnishTransportSafetyAgency'sDecreeonElectricalInstallationsonShips13setsrequirementsformainandemergencypowersystemsforshipsoperatingindomestictraf-ficareas.

INVESTIGATEDPOWERFAILURES

AccesstoInformationonPowerDisruptionsAtthebeginningofthissafetystudy,theauthoritiesandshippingcompaniesweresentare-questtonotifytheSafety InvestigationAuthorityaboutpower failuresonships.There isnoobligationtonotifyabouttheminpresentlegislation.Achangeinthemaritimelawconcerningthereportingofhazardoussituationsisunderpreparation.ThechangerelatestonotifyingtheFinnishTransportSafetyAgencyaboutaccidentsandincidentsinconnectionwiththeuseofthevessel.When itenters into force,thelawalso facilitatesaccessto informationonpowersupplydisruptions,whichoftenaresocallednearmisses.InFinland information on ships'power failures is collectedby, among others,TheFinnishTransportSafetyAgency,theFinnishTransportAgency,FinnpilotPilotageLtdandtheshippingcompanies.Theyreported,inaccordancewiththerequesttheyreceived,ontheincidentsthathadcometotheirknowledge,totheSafetyInvestigationAuthority,whichdecidedtoinvesti-gate12cases.Inadditiontothese12,theSafetyInvestigationAuthoritywasinformedabouteightcasesofpowerfailuresorotherdisturbanceswithsimilareffectsaspowerfailures.Thosecaseswerenot investigated. Based on the statistics collected by the Finnish Transport Agency andFinnpilotPilotageLtd,therehaveapparentlybeenanother10powerfailuresduringthemoni-toringperiod,forwhichnoinformationwasreceived.

TheInvestigationProcessBasedonthedatafirstreceived,theSafetyInvestigationAuthoritydecidedonwhetherthecasewouldbeincludedinthesafetystudyornot.Theon-siteinvestigationwascarriedoutbygroupsof2-3peopleandtheintentionwastoinvestigateassoonaspossibleaftertheincident.Intheon-siteinvestigationsthecourseofeventswasclarifiedbyhearingthecrewandbycol-lectingnecessaryrecordingsonthevessel.Ifpossible,thefollowinginformationaboutthein-cidentswascollected:

13TRAFI/10743/03.04.01.00/2014ElectricalInstallationsonShips

11

· Timeanddurationoftheincident· Placeofincident· Weatherconditionsatthetimeoftheincident· Trafficsituationintheincidentarea· Manningatthetimeoftheincident,navigatingbridge/engineroom· Pilotorlinepilotonboard?Pilotexemption?· Descriptionofincident· Reasonsforthepowerfailure· Immediateeffectsofthepowerfailureonboard· Emergencyandback-upsystemsandtheiroperation· Measurestakenduringthepowerfailuresituationandrestoringthesystemtonormal

mode· Measurestakenbyexternalstakeholders,includingpossiblerescueoperations· Consequencesoftheincident· Theessentialpointsinthevessel'ssafetymanagementsystemandtheirimplementation

inpractice· Contactinformation:vessel,shippingcompany,classificationsocietyandagent· andallnecessaryrecordsandrecordingstosupporttheinvestigationandtoestablish

thebasicvesselinformation.Inaddition,theon-siteinvestigatorswantedtoknowwhethertherebeforethebeginningoftheincidenthadbeenanyservice,maintenanceorotherworkinprogressthatmighthaveaffectedthe case,orwhether therehadoccuredanyalarms related to the incident.Thepreventivemaintenancesystemandtheservicehistoryofcomponentsrelatedtotheincidentinsystemsthatsubstantiallyaffectedtheincidentwereexamined.Theexpertsinvolvedintheon-siteinvestigationscompiledanincidentreportafterfinishinganinvestigation.Inadditiontotheinformationobtainedintheon-siteinvestigation,safetyfind-ingsoftheinvestigatorsconcerningtheincidentwereaddedinthereport.Thesafetyobserva-tionsweredividedintopositiveandnegativefindings,sinceoneoftheobjectiveswiththesafetystudywastopindownbestpracticesandotherfactorsthatsavedthesituationandpreventedanaccident.

IncidentReportsThesafetystudystrivedtoidentifycausesforpowerfailuresonships.Anevaluationconcerningfactorsthatdecreasedorincreasedsafetywasalsoconducted.Thesefactorsarepresentedassafetyobservationsintheincidentreportsbelow.Theobservationsareoftencoveredby§al-readyexistinglegislation.Safetycouldbeimprovedbycomplyingwithpresentlegislationaswellasbycommittingtothespiritofthelegislation.

12

M/SPolarisVG,aSeriesofPowerFailures,February2016Generalinformation

Timeandplaceofincident 2.2.2016Rostock,6.2.2016Rauma,8.2.2016Rostock,and12.2.2016Rauma

Vesselname,callsignandIMOnumber

PolarisVG,OJQX,8716100

Typeofvessel Ro-rovesselFlagstate FinlandPlaceofbuildandtime J.J.Sietas,Germany,1988Maindimensions LOA123.47m;beam20.20m;

maximumdraught6.16mNT,GT,DWT 2700,7950,6494Owner VGShippingLtdShipmanager VGShippingLtdClassificationsociety BureauVeritasMainengine,power Wärtsilä6R46,5100kWAuxiliaryengine,power 2xKDHF5L912,342kW,total684kWPropulsion AdjustablepitchpropellerCargo Manydifferentcases,notknownCrew 9Meteorologicalconditions Manydifferentcases,notknown

OverviewofIncidentInFebruary2016,severalpowerfailurestookplaceonM/VPolarisVG,duringwhichthepowersupplywaslostcompletely.Thevesselwasinport,moored,duringallcasesofpowerfailures,andtheycausednodangeroussituations.Becauseinformationaboutthepowerfailureswasnotreceiveduntilconsiderablylater,accu-rateinformationaboutthesituationineachindividualcasewasnolongerpossibletoget.Thevessel’senginecrewhadchanged,andthesituationshadnotbeendocumentedindetail.Thustheinvestigationfocusedonthecausesofthefailuresandonthesolutionsthathadbeenused.

DescriptionofthepowerfailuresandtheirreasonsThevesselhasonemainengine,equippedwithashaftgenerator,andtwoauxiliaryengines,whichhavetheirowngenerators.Whenatsea,thevesselusesonlytheshaftgeneratortoproduceelectricenergy,whiletheauxiliaryenginesareinstandbymode.Infairwaysandports,theauxiliaryenginesareusedtoproduceelectricity,andtheshaftgeneratorisnotinuse.Intheincidentsinquestion,thecontrolsystemoftheauxiliaryenginesstopped,dependingonthecase,theauxiliaryengine,orengines,withoutaclearreason.Intheincidentsinvolvingseveralrunningauxiliaryengines,thegeneratorofthefaultyauxiliaryenginewasnotdiscon-nectedfromthenetwork,butremainedconnected.Theoperationalauxiliaryenginethenbe-cameoverloadedandstopped.Someoftheincidentstookplacewhenonlyoneauxiliaryen-ginewasrunningwhiletheotherwasundergoingmaintenance.

13

Troubleshootingwasdifficult.Atfirst,itwasdonemainlyonatrial-and-errorbasis.Theves-selhadbeenpurchasedsecond-handfromGermanyaboutayearearlier,andlistsoverequip-mentanddocuments,manualsandmaintenancerecords,wereincomplete.Tobeginwith,thevessel’screwreplacedtheRPMmeasurementsensorsintheauxiliaryen-ginesbecausetheysuspectedthattheenginecontrolautomationincorrectlyconveyedtoolowRPMdata.Replacingthesensorsdidnot,however,solvetheproblem.Nextanenginecontrolautomationexpertwascalledfortothevessel.Hewasabletolocatethefaulttotheauxiliaryengines'controlsystem,whichwasfromtheyear1988.Theelec-troniccardsinthesystemhadlosttheirefficiencywithtime,andwerenolongerabletopro-cessinformationproperly.Afterreplacingtheelectroniccards,theproblemdisappeared.

EffectsonboardofthepowerfailureThefailuresdidnothaveanysignificantorlong-lastingeffects,becausethevesselwasinportatthetimeoftheincidents,andusuallyoneauxiliaryenginecouldbestartedandconnectedtothenetworkquickly.

Theemergency-andbackup-systemsandtheiroperation

Thevessel’semergencygeneratorstartedautomaticallyinallcases.Onboardactivitiesduringthepowerfailure

Sincetheautomationofthevessel’semergencygeneratorworkedasplanned,thecrewbasi-callyonlyhadtorestorethesystemtonormalmode.RestoringthesystemtonormalmodeTheenginecrewstartedanauxiliaryengine,orengines,andconnectedthemtothenetwork.Thealarmswereacknowledgedandequipmentthathadstoppedandrequiredamanualstart-upwasrestarted.Mostoftheequipmentrestartedautomaticallywhentheelectricitysupplyhadreturnedtonormal.Entriesinthevessel’sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementationTheshippingcompanyhasaquality-andsafetymanagementsystem(ISO9001:2008andISM),whichincludesthecompany'ssafetyandqualitymanuals,generalandvesselspecificguidelinesfortheirships.However,inpractice,therewerenovesselspecificinstructions.In-steadthevesselsfollowedtheshippingcompany'sgeneralinstructionsforthevessels.

Inthevessels'generalinstructionsforemergencies,therewerenoinstructionsspecificallyforpowerfailures.Theissuewastoucheduponintheinstructionsforincidentsinvolvingvesselnotundercommandsituations.Afterthiscase,theshippingcompanyhasplannedtodevelopinstructionsforpowerfailuresasastepindevelopingtheSMS.Thelistofcriticalequipmentwasfoundinthegeneralinstructionsforthevessels,buttherewasnovesselspecificlist.

Deviationreportswerelatercompiledonboard,ontheshippingcompany'srequest,buttheycontainedverylittleinformationabouttheincidents.Inpractice,thevesselwasinthehabitoftakingcareofthingswiththeshippingcompanybyphone,andtomakethemandatoryre-portsforseriousincidentsafterthematterhadbeenresolved.Reportingsmallerincidentswasnotconsiderednecessary.

14

Factorsthatreducedsafety

- Thevessel’screwhadnotinternalisedthedeviationreportingpracticeanddidnotun-derstanditsimportance.Deviationreportswereonlycompiledonseriousincidentsorattherequestoftheshippingcompany,andthereportingofsmallerincidentswasnotconsiderednecessary.

- Thevesseldidnothaveanyvesselspecificinstructionsonboard.Vesselspecificin-structionsaremandatoryaccordingtothequalityandsafetymanagementsystem.Theshippingcompanyhaddelegatedtheresponsibilityfordevelopingthevesselspecificinstructionstothevessel,andhadnotensuredthattherequesthadbeencarriedout.

- Highturnoverofcrewmadesolvingtheproblemmoredifficultanditcomplicatedtheflowofinformation.

- Theelectroniccardsinthesystemhadlosttheirefficiencywithtime,andtheywerenolongerabletoprocessinformationproperly.Thepreventiveservicesystemdoesnotsupportfollowinguptheconditionoftheelectroniccards.Theonlyoptiontomanagetheriskwouldbetochangetheelectroniccardsatspecificintervals.

- Thevesselhadbeenpurchasedsecond-handfromGermanyaboutayearearlier,andthelistsoverequipmentanddocuments,manualsandmaintenancerecords,werein-complete.Furtheron,itwasnotpossibletogetusersupportfortheoldautomationsystem.

Externalfactorthatinfluencedpositivelyontheoccasion- Thevesselwasinport,moored,duringallpowerfailurecases.

M/SCoralCarbonic,PowerFailure,3.3.2016Generalinformation

Timeandplaceofincident 3.3.2016at18.34-18.49,SköldvikfairwayVesselname,callsignandIMOnumber

CoralCarbonic,PCFW,9201906

Typeofvessel GascarrierFlagstate TheNetherlandsPlaceofbuildandtime Frisia'sShipyard,theNetherlands1999Maindimensions LOA79.55metres;beam13.73m;

maximumdraught6.50mNT,GT,DWT 547,1825,1786Owner AnthonyVederRederijB.V.Shipmanager AnthonyVederRederijB.V.Classificationsociety BureauVeritasMainengine,power M.A.K6A25,1800kWAuxiliaryengine,power 2xCatepillar3306,175kW,tot.350kwPropulsion Controllablepitchpropeller,BeckerrudderCargo InballastCrew 9+pilotMeteorologicalconditions WindE,8m/s,clear

15

OverviewofIncident

Intheafternoononthe3rdofMarch2016,thegastankerCoralCarbonicwasanchoredinSköldvik,outeranchorageF.Thepilotcameonboard,theanchorwasheavedupandtheves-selsetofftowardsSköldvikoilportfollowingthenine-meterfairway.Aboutanhourafterde-parture,thevesselsufferedacompletepowerfailurewhenapproachinglightbuoySköldvik2.Thevesselthenbegantodrift.ThepilotinformedHelsinkiVTSandvesselsinthevicinityaboutthesituationovertheVHF-radio.Thevesselpreparedforanchoring.Visibility,weatherconditionsandthepositionofthevessel,however,weresuchthatthevesselcouldbeletdriftinginthefairway.Aftertenminutestheenginescouldberestarted,andthevesselwasabletocontinueitsvoyagetoport.

DescriptionofthepowerfailureanditsreasonsShortlybeforethepowerfailurethevessel’sradioequipment,sonarandthespeedlogbegantoflash.Thechiefengineerinformedfromtheengineroom,thattherewereproblemswiththefrequencies.Soonafterthis,thevesselsufferedatotalblackout,i.e.allequipmentde-pendentonelectricity,stoppedworking.Theregulatorinauxiliaryengine1stoppedworkingandcausedstrongoscillationintheen-gine'srotationspeed.Becausebothauxiliaryengineswereconnectedtothemainswitchboardatthetimeoftheincident,thestrongvoltageandfrequencyoscillationaffectedthewholepowerdistributionsystemandneitheroftheengine'scircuitbreakersopened.Aftertheauxil-iaryenginestoppage,thecircuitbreakerofthefaultyenginecouldbeopened,andtheopera-tionalenginewasrestarted.Theloadontheauxiliaryengineswasabout60kWatthetimeoftheincident,andthevoltageoscillationbetween400and440V.

EffectsonboardofthepowerfailureAsthevessel’s24VDCpowersystemisdependentonthevessel’smainelectricalsystem'stransformerfeed,themalfunctioninthemainsystemcausedagreatvoltageoscillationintheDCpowersystem.Thealarm-andcontrol-systemsofthemainengineweredisturbedbytheoscillation,themainengineoilpressuresensorstoppedworking,andthemainenginestoppedduetothelowoilpressuresignal.Whenthemainenginestopped,thevessellostitsabilitytomanoeuvre.Mostofthenavigationdevices,forexampletheradars,stoppedworking.Onthenavigatingbridge,however,oneoftheVHFradiosandtheinternaltelephoneremainedoperationalandenabledcommunication.

Theemergency-andbackup-systemsandtheiroperationThevessel’semergencygeneratorfailedtostartbecauseitsstarterrelaydidnotwork.Allthevessel's24V-dependentequipmentwaspoweredbyone24VDCpowersystem.Normallytheequipmentgotitspowerfeedfromthemainswitchboard,throughthetransformerandrecti-fier,or,intheeventofdisturbances,fromtheemergencyswitchboard.Inaddition,theDCsys-temhasabatterysupply(UPS)foremergencysituations,aswellasindividualbatteriesforafewdevices.Astheemergencygeneratorfailedtostart,theelectricalsystemdidnotgetpowerfromthemainswitchboard,orfromtheemergencyswitchboard.Thebatterysupplycapacitywasnotsufficientonitsown.ThisresultedinthatthevoltageoftheDCsystemde-creasedveryquickly,andonlythedeviceswithownbatteriesremainedoperational.

16

Onboardactivitiesduringthepowerfailure

Atthetimeoftheincidentthemasterofthevessel,awatchmanandthepilotwereonthenav-igatingbridge.Thevessel'schiefengineerandthirdengineerwereintheengineroom.Themasterturnedonthenavigationlightsforvesselsnotundercommandandtookoverthehandsteering.Thechiefmateandthewatchmanweresenttothebowtobepreparedtoanchor.ThepilotinformedtheVTSandvesselsinthevicinityabouttheincident.Thepilothadanavi-gationapplicationonatablet.Thatmadeitpossibleforthebridgeteamtofollowthedirectionthevesseldriftedin.Thevessel’schiefengineerstoppedtheauxiliaryengines,openedthecircuitbreakerofauxil-iaryengine1andrestartedauxiliaryengine2.

RestoringthesystemtonormalmodeIttook5-10minutestorestartandreconnectauxiliaryengine2tothemainswitchboard.Af-terthisthesystemsdependentonelectricitywerelargelyoperationalagain.Afterthealarmshadbeenacknowledged,themainenginewasrestartedandthevesselwasabletocontinuethevoyagetowardsport.Thefollowingweek,anexternalserviceman,commissionedbytheshippingcompany,cametothevesseltotrytoclarifythereasonsforthepowerfailureandfortheoscillationofthevoltageintheauxiliaryengine.Theregulatorinauxiliaryengine1wasfoundtobedefectiveandwasreplacedwithanew.Entriesinthevessel’sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementationThecompanyhasissuedclearinstructionsforpowerfailuresituations.Themasterfollowedthemconsistently.Therewereinstructionsforpowerfailuresituationsalsointhevessel’sengineroom.Thechiefengineerdeviatedfromtheinstructionsonpurpose,onceheobservedthattheemer-gencygeneratorfailedtostart.Hefocusedonrestartingtheauxiliaryenginesratherthanontryingtostarttheemergencygeneratormanually.

Factorsthatreducedsafety

- Thevesselwasnotundercommandduringthepowerfailure.- Thevessel’s24VDCpowersystemwascommonforalldevicesdependentonelectric-

ity,includingnavigationdevicesandalarmsystems.- ThebackupfortheDCsystemwasprimarilybasedonthefunctioningoftheemer-

gencygenerator.Thebatterybank,intendedtobeasecondarybackupincaseofanemergencygeneratorfailure,wasnotalonesufficienttomaintainthepowersupplytoalldevicesconnectedtothesystem.

- Theemergencygeneratordidnotwork.

Factorsthatincreasedsafety- Thepilothadanavigationapplicationonatabletthatwasnotdependentontheves-

sel'sdevices.Thatmadeitpossibleforthebridgeteamtomonitorthevessel’spositionandthedirectionitdrifted.

17

- Therewasapilotwithknowledgeaboutthelocalcircumstances,onboard.HetookcareofthecommunicationwiththeVTSandvesselsinthevicinity.Thevessel’screwcouldthusfocusonensuringthesafetyofthevessel.

- Theinstructionsformeasurestobetakenonthenavigatingbridgeincaseofapowerfailureareclear,andthecrewfollowedthemconsistently.

Externalfactorsthatinfluencedpositivelyontheoccasion

- Thevesselwasdriftingslowlyingoodweatherconditions.- Thewaterdepthinthesurroundingareawaslargeenoughtoallowforsafedriftingof

thevessel.

M/SMissouriborg,MainEngineFailure16.3.2016Generalinformation

Timeandplaceofincident 16.3.2016at07.13–07.22,offPoriVesselname,callsignandIMOnum-ber

Missouriborg,PFBI,9228978

Typeofvessel DrycargocarrierFlagstate TheNetherlandsPlaceofbuildandtime BijlsmaShipyard,Netherlands,2000Maindimensions LOA134.55m;beam16.5m;maximumdraught7.30mNT,GT,DWT 3493,6585,9119Owner WagenborgShippingB.VShipmanager WagenborgShippingB.VClassificationsociety BureauVeritasMainengine,power Wärtsilä8L38,5280KWPropulsion AdjustablepitchpropellerCargoinformation: CoalCrew: 9+1apprentice,pilotMeteorologicalconditions WindNW6.6m/s,temperature-2°C,skyclearOverviewofIncident

M/VMissouriborgunberthedinTahkoluoto,Pori,inthemorningof16.3.2016.Thevesselbe-ganreversingtowardstheKissanhautaturningbasinwithintheportarea.About15minutesafterdeparture,themainenginesuddenlystopped.ThepilotreportedtheincidenttotheVTS.Thevesselpreparedforanchoringandevaluatedtheneedforrequestingtugassistance.ThevesselcontinueditsasternmovementtothenorthsideofKissanhautaandthendriftedslowlyinopenwater.Itwasnotnecessarytoanchorthevessel.Therewassufficientdepthofwatertodriftfreely,andthevesselcouldbemaneuveredusingthebowthruster.Weathercondi-tionsatthetimeoftheincidentweregoodandtheportwasalmostcompletelyfreeofice.Therewasnoothervesseltrafficintheareaatthetimeoftheincident.Thecrewsucceededinrestartingthemainengineafterabout10minutes,andthevoyagewascontinuedouttosea.NB.Thisincidentconcernsamainenginefailure,notapowerfailure.Whenthevessel’smainenginefailed,thepropellernolongerrotatedandthusdidnotproducekineticenergyforthe

18

ship.However,thevesselhadtwoauxiliaryenginesrunning,whichproducedelectricityonboardduringthemainenginefailure.Thisincidentwascomparabletoapowerfailuretoitseffects,andthatiswhyitisincludedinthissafetystudy.

DescriptionandcausesforthemainenginefailureTherotationspeedofthemainengineismonitoredinitscontrolsystembytwomagneticsen-sors.Thesensorsarelocatedonthesideofthemainengine,inthemeasuringpointofthecamshaft'sgearwheel.ThesensorshaveLEDindicatorsthatflashwhentheyareinworkingorder.Oneofthesensorsisthemainsensorandtheotherisabackup.Thebackupsensorwillbeactivatedautomaticallyifthemainsensorfailsorisbroken.Bothsensorsoperateinde-pendentlyandsendrotationspeedinformationtothemainenginecontroller.Ifthecontrollerdoesnotreceiverotationspeedinformationfromeitheroneofthesensors,itwillstopthemainengine.Themainenginestoppedbecausebothsensorsweredamaged.Theplasticinsulationofboththesensorswereveryworn.Itispossiblethattheworninsulationcausedanearthfault,pre-ventingcorrectinformationonspeedofrotationfromreachingthecontroller.Whenthecon-trollerdidnotgetthemainenginerotationspeedinformation,thecontrolsystemgavethealarm"MEbothpickupsfailed"becauseofthefailingsensors.Themainenginethenimmedi-atelystopped.EffectsonboardofthemainenginefailureWhenthemainenginestopped,thepropellerstopped,andthevesselbegantodrift.Whenthespeeddecreased,theeffectoftherudderdecreasedduetothemissingslipstream.

Thevessel’selectricalsystemwasworkingnormally,so,forexample,allthenavigatingbridgeequipmentremainedoperational.Theemergency-andbackup-systemsandtheiroperationIncasethesensorforprovidingthemainenginecontrolsystemwithrotationspeedinfor-mationfails,thebackupsensorisactivated.Inthiscase,bothsensorsfailedatthesametime,i.e.thebackupsystemfailed.

OnboardactivitiesduringthemainenginefailureThemasterandthepilotwereonthenavigatingbridgeatthetimeoftheincident.Themaster,whoalsooperatedthebowthruster,didmanualsteering.Thechiefofficerandthebosunwereinthebowoftheship,readytoanchorifnecessary.Assoonasthemainenginestopped,thepilotinformedtheVTSabouttheincident.Themastercontinuedmaneuveringthevesselwiththerudderandthebowthrusteraslongasthevesselhadanyspeed.Consideringthepositionofthevesselandtheweatherconditions,itwasjudgedthattugassistancewasnotnecessary.Itwouldhavelastedapproximatelytwohoursforthetugtoarrive.Thebridgeequipmentwasoperatingnormallyanditwaspossibletomonitorthepositionofthevesselcontinuouslyduringtheincident.

Thechiefengineerwasintheenginecontrolroomandtheengineerintheengineroomwhentheenginealarmsystemalertedaboutfailureintherotationspeedsensors.Theautomationstoppedthemainengineimmediately.Basedontheenginealarm,thechiefengineerjudgedthatfaultyspeedsensorscausedthemainenginefailure.Heimmediatelybegantosortoutwhetherthereweresparepartsonboard,sothatthedamagedsensorscouldbereplacedwithnewones.

19

Restoringthesystemtonormalmode

Thenecessarysparepartswerefoundonboard,andboththemagneticsensorswerereplaced.Themainenginewasrestartedandthevesselwasmaneuverableagain.Entriesinthevessel'sSafetyManagementSystem(SMS)concerningmainenginefailureandtheirimplementationInconnectionwiththisincidentitdidnotbecomeclearwhetherthecompanyhadissuedanyinstructionsforsituationswithmainenginefailures.

Factorsthatreducedsafety- ObtainingtugboatassistanceintheportofPoriwouldhavetakentwohours.- Thepreventivemaintenancesystemwasinsufficient,becausethesimultaneouswear

ofthemain-andbackup-sensorwasnotdetected.

Factorsthatincreasedsafety- Theauxiliaryenginesremainedoperational,solimitedmaneuveringofthevessel,us-

ingthebowthrusterandrudder,waspossible.- Thebridgeequipmentwasoperationalanditwaspossibletomonitorthepositionof

thevesselcontinuouslyduringtheincident.- Thecrewwasabletoidentifyandrectifythefaultquickly.- Therewasapilotwithknowledgeaboutthelocalcircumstancesonboard.Hetookcare

ofthecommunicationwiththeVTSandvesselsinthevicinity.Thus,thevessel’screwcouldfocusonensuringthesafetyoftheship.

- Therewerenecessarysparepartsonboard.

ExternalfactorsthatinfluencedpositivelyontheoccasionThevesselwasdriftingslowlyingoodweatherconditions.

Thewaterdepthinthesurroundingareawaslargeenoughtoallowforsafedriftingforthevessel.Therewasnoothertrafficinthefairwaythatwouldhavehadtobetakenintoaccountduringtheincident.

20

M/VAlppila,PowerFailure,4.4.2016

Generalinformation

Timeandplaceofincident 4.4.2016at8.08–8.12,Ust-Lugaanchorage,RussiaVesselname,callsignandIMOnumber

Alppila,OJOF,9381706

Typeofvessel BulkcarrierFlagstate FinlandPlaceofbuildandtime ABGShipYard,India,2011Maindimensions LOA155.4m;beam25.2m;maximumdraught9.59mNT,GT,DWT 6420,14841,20499Owner ESLShippingLtdShipmanager ESLShippingLtdClassificationsociety Lloyd'sRegisterMainengine,power ManB&W6550MC-C,8580kWAuxiliaryengine,power 3xWärtsilä6L20,860kW,total2580kWPropulsion AdjustablepitchpropellerCargoinformation InballastCrew 14+2cadetsMeteorologicalconditions WindNE3m/s,temperature+1°C,rain

OverviewofIncident

4.4.2016inthemorning,M/SAlppilawasatanchorintheUst-LugaanchoragewhenanABwantedtostartoneofthevessel'sdeckcranes.Heintendedtomovesomefenders.AftertheABhadcheckedwiththeengineroomthatthemainswitchboardwasinautomaticmode,somethingthatstartingthecranerequires,heturnedtheswitchrequestingadequatepowerforstartingthecrane.Theauxiliaryengineinoperationstoppedalmostimmediately,andthevessel'spowersupplywascutoff.Thebackupauxiliaryenginenextinlinestartedaboutoneminutelater,andthevessel’spowersupplywasnormalizedinamatterofminutes.

Theincidentdidnotcauseanydanger,becausethevesselwasatanchorandnocriticalopera-tionswereinprogress.DescriptionofthepowerfailureanditsreasonsThevessel’sdeckcraneshaveaswitchforrequestingadequatepowerandforgettingpermis-sionfromthemainswitchboardtostartthecrane.Iftheloadontheauxiliaryengineinuseissuchthatitdoesnotallowforanincreaseoftheload,theautomationdoesnotgivepermis-siontostartthecranesbeforethebackupauxiliaryenginenextinlinehasstartedandiscon-nectedtothenetwork.Thereisaseparatestartbuttonforthecrane.Thecranecanonlybestartedwhentheautomationhasapprovedthepowerrequest.Thevesselhasthreeauxiliaryengines.Atthetimeofthepowerfailure,auxiliaryenginenum-ber3wasinuse.Thevoltageofauxiliaryengine3hadalreadyearlierbeennoticedtocon-stantlyvarybetweenapproximately376-405V.Thereasonforthevariationhadnotbeenfound,butthevariationhadbeennotedinthefirstengineer'sendofshiftreport.

21

Whenthecrane'spowerallocationrequestswitchwasturned,thevoltageandpossiblyalsothefrequencyofauxiliaryengine3simultaneouslydroppedbelowthealertlimit.Thedropinvoltageandfrequencymostlikelycausedthepowerfailure.Theautomationthenstoppedauxiliaryengine3toprotectthetechnology.Thestartbuttonofthecranewasnotpushedatanypoint.Theconnectionbetweenthecrane'spowerallocationrequestandthestoppingoftheauxiliaryengine,couldhowevernotbedefinitelyestablished.EffectsonboardofthepowerfailureThevessel’spowersupplywasinterruptedforfourminutes.Thepowerfailurehadnosignifi-canteffectsonboard.

Theemergency-andbackup-systemsandtheiroperation

Thebackupauxiliaryenginenextinlinestartedautomatically.Itwasnotpossibletoestablishwithcertainty,fromtheenginecontrolsystem'salarmlists,whethertheemergencygeneratorhadstarted,asitshouldhave.Onboardactivitiesduringthepowerfailure

Astheautomationofthevessel’sauxiliaryenginesworkedasplanned,thecrewonlyhadtorestorethesystemtonormalmode.Restoringthesystemtonormalmode

Afterthepowerfailure,acontrolround,consistentwiththecompany'sinstructionsforthistypeofincidents,wasmade.Duringtheround,alarmswereacknowledgedanddevicesthathadstoppedwererestarted.Duetotheuncertainoperationofauxiliaryengine3,thestartingorderoftheauxiliaryengineswaschanged,sothatauxiliaryengines1and2wouldstartbeforenumber3.

Laterthevoltageregulatorsandpotentiometersofauxiliaryengine3werereplacedwithnewones.Afterreplacingtheparts,thevoltagefluctuationsstoppedandtheauxiliaryenginerannormally.Theshippingcompanyplansyettohavethepotentiometersfine-tunedinaccordancewiththemanufacturer'sinstructions.

Entriesinthevessel’sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementation

- Thecompanyhasissuedinstructionsformeasurestobetakenonthenavigatingbridgeandintheengineroomincaseofapowerfailure.Thevessel’screwfollowedthein-structions.

- Adeviationreportontheincident,consistentwiththerequirementsinthesafetyman-agementsystem,wasprepared.Thevessel’sproposalforcorrectivemeasureswastocallforatechnicianspecialisedinvoltagecontrolandtohavehimcheckandpossiblyadjustthevoltageregulatorsofallthreegenerators.

- NochangesweremadeintheSMSorinthepreventivemaintenancesystemasaresultoftheincident.

Factorsthatreducedsafety- Thevoltagefluctuationsinauxiliaryengine3hadalreadyearlierbeennoticed,butno

activemeasureshadbeentakentoclarifytheproblem.Noattemptshadbeenmadeto

22

controltheriskcausedbythefluctuationsinthevoltage,notbychangingthestartingorderoftheauxiliaryenginesorbyothermeans.

M/VLianne,PowerFailure,23.6.2016

Generalinformation

Timeandplaceofincident 23.6.2016at11.10-11.13,LakeSaimaa,TaipalelockVesselname,callsignandIMOnumber

Lianne,V2CP4,9422275

Typeofvessel DrycargocarrierFlagstate AntiguaandBarbudaPlaceofbuildandtime UstamehmetogluShipyard,Turkey2005Maindimensions LOA79.94m,beam12.50m,maximumdraught4.75mNT,GT,DWT 958,1903,3024Owner ScheepvaartbedrijfvanDamB.V.Shipmanager ScheepvaartbedrijfvanDamB.V.Classificationsociety RegistroItalianoNavale,Mainengine,power MAK6M20,1140kWAuxiliaryengine,power 2xVolvoPentaTAMD74,135kW,total.270kWPropulsion Controllablepitchpropeller,BeckerrudderCargo InballastCrew 7+pilotMeteorologicalconditions WindSE2m/s,temperature+22°C,skyclear

OverviewofIncidentM/VLiannewasenroute,underpilot,toSiilinjärvi,northSaimaa.WhenenteringthelockinTai-palecanal,thevesselsufferedapowerfailure.Thevesselwasalreadyhalfwayintothelockatthetimeoftheincidentandhadaspeedofabout1to2knots.Thelockwallskeptthevesselparallelwiththelockwhileitslowlyglidedforwarduntiltheelectricitysupplywasbacktonormal.Thepowerfailurelastedforabout2-3minutes.Neitherthevesselnorthelockstructuressufferedanydamage.

DescriptionofthepowerfailureanditsreasonsThevesselhastwomainenginesandtwoauxiliaryengines.Normallytheshaftgenerator,con-nectedtothemainengine,produceselectricityforalldevicesofthevesselwhileatsea.Wheninfairways,theshaftgeneratorisusedforproducingelectricityforthethrusterwhiletheauxiliaryenginegeneratorsproduceelectricityfortheotherdevicesoftheship.

Inthelockthemasterbeganusingthebowthrusterbypressingthepowerbutton.Immediatelyafterthis,thecircuitbreakersoftheshaftgeneratorandtheauxiliaryenginegeneratorsopened,causingacompletepowerfailure.Theuseofthebowthrustershouldnothaveputanunusualloadontheelectricitynetwork;thiswasnormaloperationofthebowthruster. Momentsearlierthebowthrusterwasoperatingnormally.Themainengineandauxiliaryenginesremainedrunning,despitetheopeningofthecircuitbreakers.Sinceallgeneratorcircuitbreakersfeedingtheelectricitynetworkopenedatthesametime,itcanbeassumedthatbothauxiliaryenginegeneratorsandshaftgeneratorwereconnectedinparallel.

23

Thisdifferedfromwhataboveissaidaboutwhatwasthenormalelectricitydistributionarrange-mentwhileinfairways.Becauseofthis,thedisturbanceintheelectricnetworkcouldpropagatethroughthewholeelectricnetwork,causingallthecircuitbreakerstoopen.Itwasnotpossibletoestablishadefinitereasonfortheopeningofthegeneratorcircuitbreakersbasedontheavailableinformation.Onepossiblereasonmaybeanetworkoverloadduetothesimultaneouspowerneedofhighpowerconsumers,suchasthestartingaircompressorandbowthruster.Theloadvariationonthemainenginemayhavecausedthevoltageandfrequencyoftheshaftgeneratoroutputtofluctuate,caus-ingcircuitbreakerstoopen.Otherpossiblecausesmayhavebeenadisturbanceintheautomationoftheshaftgeneratorandauxiliaryenginegenerators,orintheoperationofthecircuitbreakersthemselves.EffectsonboardofthepowerfailureNeitherthevessel'sbowthrusternortherudder,workedduringthepowerfailure,andthevesselwasthusnotundercommand.

Theemergency-andbackup-systemsandtheiroperationThevesselhasnoemergencygenerator.Thevesselhasanemergencybatterysystem(UPS),which,duringapowerfailure,producespowerforemergencylighting,theGMDSSradiostation,aswellasfortheengineautomation.Theoperationoftheemergencybatterysystemduringtheincidentcouldnotbeverifiedafterwards.OnboardactivitiesduringthepowerfailureThemasterandapilotwereonthenavigatingbridgeatthetimeoftheincident.Theyobservedthemovementsoftheship.

Thechiefengineerwasinhiscabinwhentheenginealarmcausedbythepowerfailurewasacti-vated.Hewenttotheenginecontrolroomandbeganrestoringthesystemtonormalafternoticingthatthegeneratorcircuitbreakershadopened.

RestoringthesystemtonormalmodeThechiefengineerresettheprotectionrelaysofthegeneratorcircuitbreakers,andreconnectedthegeneratorstothemainelectricitynetwork.Heacknowledgedthealarmsthatthecontrolsys-temhadregisteredandverifiedtheoperationoftheengineroomequipment.Entriesinthevessel’sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementationTheshippingcompanyhadgeneralinstructionsforpowerfailuresituations,butthetechnicalde-tailsintheinstructionshadnotbeenmodifiedtobecompatiblewiththisspecificvessel.Alsothelistofcriticalequipmentwasgeneral,intendedforthewholeshippingcompany,andnotvessel specific.Equipmentmaintenancewasmonitoredwith theelectronicpreventivemainte-nancesystem.Nodeviationreportontheincidentwasmade,eveniftheshippingcompanySMSrequiresreport-ingofincidents.

Factorsthatreducedsafety- Neitherthevessel'sbowthrusternortherudder,workedduringthepowerfailure,andthe

vesselwasthusnotundercommand.

24

- Themasterandchiefengineerwerenotawareofthattheshippingcompanyhadinstruc-tionsforpowerfailuresituations.Actionsonboardwerebasedonsituation-specificsolu-tions.

- Thevessel'spersonneldidnothavesufficientunderstandingofthevessel’ssystemsandthedifferentmodesusedwhenoperatingatopenseaandinfairways.

- Theshippingcompany'sgeneralinstructionsforpowerfailuresituations,andthetechnicaldetailsinthem,hadnotbeenmodifiedtofitthisspecificvessel.

Externalfactorthatinfluencedpositivelyontheoccasion- Thefailureoccurredinasituationwhenthevessel'sspeedwaslowandthelockprevented

drifting.

M/SFinnsun,PowerFailure,30.6.2016Generalinformation

Timeandplaceofincident 30.6.2016at14.03–15.18,VuosaarifairwayVesselname,callsignandIMOnumber

Finnsun,OJPA,9468918

Typeofvessel Ro-rocargoshipFlagstate FinlandPlaceofbuildandtime JinlingShipyard,China,2012Maindimensions LOA188.4m;beam26.5m;maximumdraught6.9mNT,GT,DWT 8401,28002,10370Owner FinnlinesLtdShipmanager FinnlinesLtdClassificationsociety RI,RegistroItalianoNavaleMainengine,power 2xWärtsilä8L46F,10000kW,tot.20000kWAuxiliaryengine,power 2xMitsubishiS12R,1100kW,tot.2200kWPropulsion 2controllablepitchpropellersCargo Ro-rocargoCrew 16+1traineeMeteorologicalconditions WindESE2m/s,temperature+18°C,clear

OverviewofIncidentM/VFinnsunwasenroutetoVuosaariport30.6.2016,intheafternoon.BeforethebeginningoftheVuosaariportchannel,thevessel’sauxiliaryenginesandmainenginesstopped. Thevesselsufferedacompletepowerfailure,andlostitsmanoeuvrability.Afewminutesbeforethepowerfailure,thevesselhadshiftedfromshaftgeneratorpowerfeed,usedatopensea,toauxiliaryenginefeed,usedwheninfairways.ThevesselinformedtheVTSaboutthesituation.Visibility,weatherconditions,trafficandthepo-sitionofthevesselwereallsuchthatthevesselsafelycouldbeletdriftinginthefairway.Ittookaboutanhourand10minutesbeforethemain-andauxiliary-enginescouldberestartedandthevesselwasabletocontinueitsvoyagetoport.

25

Descriptionofthepowerfailureanditsreasons

Theshiftingofthepowerfeedfromtheshaftgeneratorstotheauxiliaryengineswentasnormal:theautomationsystemstartedtheauxiliaryengines,connectedthemtothemainswitchboardanddisconnectedtheshaftgeneratorsfromthesame.

4-5minutesaftertheshifting,theenginecontrolsystemgaveafrequencyalarmfromtheelectricitynetwork.After a few secondsbothauxiliaryengines stopped,and thepower feed to themainswitchboardwas interrupted.Atthesametime,themainenginesstopped,becausetheelectricpumps,connectedtothemainswitchboard,stoppedworking.Itwasfoundthattheauxiliaryenginesstoppedbecauseofafuelsupplydisruption,causedbywaterinthefuel.Thefuelsupplylinestotheauxiliaryengines,andthefuelinthedaytankwerecontam-inatedwithwater.Initiallyitwasthoughtthatthewaterinthedaytankhadleakedtherefromasteampipeinthetank'sheatingsystem.Thedaytankheatingwasnotinoperation,butthevalveintheheatingsystem'sreturnsidewasopen.Thesteamlinewaspressuretestedaftertheincidentandwasfoundtobeintact.Inamoredetailedinspection,itwasfoundthatthefuelhadbeencontaminatedbysteamandcondensedwaterfromanotherfuelseparator'sheatexchanger.Thisisamaintenance-freeheatexchangerthatcannotbeopened,sotheleakagecouldnotbeobservedfromtheoutside.

EffectsonboardofthepowerfailureWhenthemainenginestopped,thespeedofthevesseldecreasedtozero.Thevesselwasthusnotundercommand,eventhoughtherudder,becauseofthepowerfeedfromtheemergencygenera-tor,remainedoperationalthroughouttheincident.Thebridgeequipmentandtheengineroomau-tomationremainedoperationalduetopowerfeedfromtheUPS-systembatteriesandtheemer-gencygenerator.Thevessel'spowersupplywasinterruptedforaboutonehour.Thevesselarrivedinportaboutoneandahalfhourslaterthanscheduled.

Theemergency-andbackup-systemsandtheiroperationThevessel'semergencybatterypowersystem(UPS)andemergencygeneratoroperatednormallyandproducedelectricityforthedevicesconnectedtotheemergencyswitchboard.Ittook20sec-ondsfortheemergencygeneratortostart,andaboutaminuteforittoconnecttotheemergencyswitchboard.

OnboardactivitiesduringthepowerfailureTheengineoffice,closetotheenginecontrolroom,wasmannedatthetimeoftheincident.Whentheauxiliaryenginesstopped,thechiefengineerquicklywenttothecontrolroomandtriedtorestart the auxiliary engines,butwithout success. The engine crewbegan acknowledging thealarmsthathadcomefromtheenginecontrolsystem.Whentheemergencygeneratorhadstarted,itwaspossibletouselightingnormallyagain.Thereafterthechiefengineerproceededtotheaux-iliaryengineroomandtriedtostarttheenginesmanually fromthere,butthatdidnotsucceedeither.Enginesandauxiliarysystemswereinspectedvisually,butnodefectsweredetected.Next,thefuelfeedwasinvestigated,andwaterwasfoundinthefuelsystem.Ittookabout10minutestodeterminethecauseoftheincident.TheOOWandawatchmanwereonthenavigatingbridgeatthetimeoftheincident.Themasterandchiefmatecametothebridgesoonafter.Allthebridgeequipmentremainedoperational,sincethebackupsystemsfunctionednormally.Thecrewonthebridgewasthusabletofocusoncontrol-lingthevessel’sposition.ThevesselinformedtheVTSabouttheincident,andthedaysignalsfor

26

vesselnotundercommandwerehoisted.Therewasnoneedtoanchor,butitwouldhavebeeneasilydone,ifnecessary,becausetheanchorchainstopperswereopenandtheanchorscouldhavebeenletgofromthenavigatingbridge.Restoringthesystemtonormalmode

Thecrewbeganremovingthewaterfromthedaytank,immediatelyafterdiscoveringit.Approxi-mately20-30litresofwaterwasremoved fromthedaytank,andthe fuel linestotheauxiliaryenginesweredrainedofwater.Allfuelfiltersintheauxiliaryengineswerereplacedandthecrewthenbegantobleedouttheairfromthefuelsystem.Aboutanhourafterthefailure,thevessel’sauxiliaryenginescouldbestartedandtheelectricitysupplyreturnedtonormal.

Daytankwaterretentionwasmonitored,andsomemorewaterstillhadtoberemoved.Thedaytank'ssteampipevalveonthereturnsidewasclosed,becauseitwassuspectedthatthesteampipeinsidethetankwasleaking.Lastlytheboilersandmainengineswerestarted,andthevesselcontinueditsvoyagetotheportofVuosaari.

Itcouldlaterbeestablishedthattheoriginofthewaterinthefuelwasabrokenheatexchangerinthefuelseparator.Thebrokenheatexchangerwasreplaced.Aftertheincident,theshippingcom-panyhasinstructedalsothesister-shipstodrainthefueltanksofwatermoreoften,sothatsimilarinstancescanbedetectedinatimelyfashion.Entriesinthevessel’sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementationThevesselhadinstructions,issuedbytheshippingcompany,formeasurestobetakenonthenav-igatingbridgeandintheengineroom,incaseofapowerfailure.Thevessel’spersonnelactedinaccordancewiththeinstructions.Adeviationreportonthe incident,consistentwiththerequirements inthesafetymanagementsystem,wasprepared.

Factorsthatreducedsafety- Whenthemainenginestopped,thespeedofthevesseldecreasedtozero.Thevesselwas

thusnotundercommand,eventhoughtherudder,withpowerfeedfromtheemergencygenerator,remainedoperationalthroughouttheincident.

- Bothauxiliaryengineshaveacommondaytankandacommonfuelsupplyline.Thereisnopossibilitytouseanalternativefuelsupplyincaseofanemergency.

Factorthatincreasedsafety- Thevesselhasinstructionstochangethepowersupplyfromshaftgeneratortoauxiliary

engines45minutesbeforearrivingtopilotboardingarea,ortobeginningofportentrancefairways.

Externalfactorsthatinfluencedpositivelyontheoccasion- Thevesselwasdriftingslowlyingoodweatherconditions.- Thewaterdepthinthesurroundingareawaslargeenoughtoallowforsafedriftingforthe

vessel.- Therewasnoothertrafficinthefairwaythatwouldhavehadtobetakenintoaccountdur-

ingtheincident.

27

RMSNeudorf,PowerFailure,11.7.2016Generalinformation

Timeandplaceofincident 11.7.2016at16.20-19.10,KissaluotoS,LappeenrantaVesselname,callsignandIMOnumber

RMSNeudorf,V2A15,8920256

Typeofvessel DrycargocarrierFlagstate AntiguaandBarbudaPlaceofbuildandtime DamenShipyards,theNetherlands,1990Maindimensions LOA82.46m;beam12.50m;maximumdraught4.37mNT,GT,DWT 969,1985,2631Owner RhenusMaritimeServicesGmbHShipmanager RhenusMaritimeServicesGmbHClassificationsociety DNV-GLMainengine,power MAK6M322,1200kWAuxiliaryengine,power Caterpillar3304,110kWPropulsion AdjustablepitchpropellerCargo InballastCrew 6+1personsMeteorologicalconditions WindSW5m/s,temperature+19°C,clear

OverviewofIncidentCargovesselRMSNeudorfleftMälkiälockinSaimaaCanal,underpilotage,towardsPortofPuhosinLakeSaimaa.Havingleftthelock,thevesselslowlyincreasedspeed.Approximately10minutesafterleavingthelock,whenthefairwaycurvedslightlytostarboard,thevesselsufferedashortpower failure.Atthetimeofthe incident,therudderwasturnedtostarboard. Therudderre-mainedinposition15degreestostarboard,andthevesselcontinueditsturnoutofthefairwayarea.

Anattemptwasmadetopreventthevesselrunningagroundbyusingthemainenginefullastern.Thevesseldidnotrespondtothisquicklyenough,soittouchedgroundoffthefairwayareawithaspeedofapproximatelytwoknots.Thebowthrustercouldnotbeusedduringthepowerfailure.Thevessel'sauxiliaryenginerestartedautomaticallyafterthe failure,andthevessel'smanoeu-vringabilitywasrestoredquickly.Thevesselwasabletogetawayfromtheshallowbyitsownefforts,andsubsequentlytomoveontoanchoronanearbybay.Afteraninspectionofthedamage,itwasfoundthatthevesselhadnoleaksandthevesselgotpermissiontocontinueitsvoyagetotheportofdestinationforfurtherinspections.

ThegroundingwasreportedpromptlytoSaimaaVTSandotherauthorities.

DescriptionofthepowerfailureanditsreasonsThevessel’smainenginewasrunningandtheshaftgeneratorwasconnectedtothemainswitch-board.Theauxiliaryenginewasinstandbymode.Thevessel'sestimatedneedforelectricpoweratthetimeoftheincidentwasbetween50and70kWwhentheeffectoftheshaftgeneratorwas600kW.

28

Thecauseforthepowerfailurewasthattheshaftgeneratordisconnectedfromthemainswitch-boardforanunknownreason.Beforethepowerfailure,theenginecontrolsystemgavea"miscel-laneous"alarm,whichcauseorconnectiontothefailureisnotknown.Inretrospect,itwasnotpossibletofindanexplanationforthedisconnectinginthevessel'scontrolsystems.Thefailurehadanestimateddurationofafewminutes.Apossiblecause fortheshaftgenerator'selectricswitchtoopencanbeabreakermalfunction.Initiallyitwasconsideredonboardthatanoverloadoftheshaftgeneratorwouldhavecausedthefailure,butthelowpowerconsumptionatthetimeoftheincidentdoesnotsupportthistheory.Effectsonboardofthepowerfailure

Whenthepowerfeedfromthemainswitchboardwasinterrupted,alltheconnecteddevices,in-cludingthesteeringgearhydraulicpumps,stoppedworking.Therudderremainedinthepositionitwasinwhenthefailureoccurred.Thestandbyauxiliaryenginestartedautomaticallylessthanaminuteaftertheshaftgenerator'scircuitbreakerhadopened.Thefailuredidnotaffecttheoperationofthemainengine.

Theemergency-andbackup-systemsandtheiroperationThemainnavigationequipmentofthevesselandtheengineautomationweresecuredbya24Vbatterysupply(UPS)system,andtheyworkednormallyduringthepowerfailure.

Thevesselhasanemergencygenerator,butitdidnothavetimetostartbeforetheauxiliaryengineinstandbymodealreadystarted.OnboardactivitiesduringthepowerfailureThefirstmateandthepilotwereonthebridgeatthetimeoftheincident.Afterdetectingthattherudderdidnotwork,theytriedtostartthebowthruster.Thatwas,however,notpossiblewithouttheshaftgenerator.Atthesametimeanattemptwasmadetore-starttherudderpumps,withoutsuccess.Theytriedtostopthevesselbyusingtheenginehardastern.Alsothemastercametothebridge,havingnoticedthatthevessel’smotionchanged.Atthispoint,thevessel’srudderstartedtoworkagain.Thevesselwas,however,alreadysoclosetotheshallow,thatthegroundingnolongercouldbeprevented.

Thechiefengineerwasintheengineroomatthetimeoftheincident.Afterhavingrealisedthattheshaftgeneratorhaddisconnected fromthemainswitchboardandthattheauxiliaryenginehadstarted,heimmediatelybegantorestorethesystemtonormalmode.

After thegrounding, thevesselreversedback to the fairwayareaandanchoredon thenearbyRiutanselkä-bay,wherethecrewbeganinspectingtanksforleaks.RestoringthesystemtonormalmodeAftertheauxiliaryenginehadstarted,thepowersupplyreturnedtonormal.Thechiefengineerwasable tosynchroniseandconnect theshaftgenerator to themainswitchboardwithoutanyproblems.Becauseofthe incident,theclassificationsocietyrequiredthevesseltohaveaserviceproviderchecktheconnectionsandalarmsystemsoftheshaftgenerator.Nodefectswerefoundinthecon-trol.

29

Entriesinthevessel’sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementationTherewerenoseparateinstructionsforpowerfailuresinthevessel'sSMSmanual.Steeringmal-functionsandgroundingsweredealtwithinseparatechecklists.Therewereinformalinstructionsintheengineroomforrestoringthesystemstonormaloperation.Theincidentwasreportedtotheshippingcompanybytelephone,butadeviationreportwasnotimmediatelycompiled.

Factorsthatreducedsafety- Thesteeringgearhydraulicpumpsstoppedworkingandtherudderremainedintheposi-

tionwhereitwaswhenthefailureoccurred.- Thewearandconditionof theelectriccircuitbreakersarenotmonitoredregularly. To

managethisrisk,electriccircuitbreakersshouldbecheckedorreplacedperiodically.- InRMSNeudorf'selectricsystem,onlyonepowersupplyatatimecanbeconnectedtothe

mainswitchboard. Incaseofdisturbances,switchingpowersourcewillalwayscauseaninterruptionintheelectricitysupply.Inanarrowfairwayevenashortinterruptioncanbecritical.

- Thevessel’sbowthrusterreceivesitselectricitysupplyonlyfromtheshaftgenerator.Thepowerproducedbytheauxiliaryengineisnotsufficientforusingthebowthruster.

Externalfactorthatinfluencednegativelyontheoccasion- Saimaafairwaysareverynarrowandevensmalldeviationsfromtherouteeasilyre-

sultinaccidents.

M/SAmorella,PowerFailure,18.7.2016

Generalinformation

Timeandplaceofincident 18.7.2016at09.31-09.40,AiristoVesselname,callsignandIMOnumber

Amorella,OIWS,8601915

Typeofvessel Ro-ropassengershipFlagstate FinlandPlaceofbuildandtime Brodosplit,Croatia,1988Maindimensions LOA157.97m;beam27.6m;maximumdraft6.35mNT,GT,DWT 19689,34384,3690Owner VikingLineLtdShipmanager VikingLineLtdClassificationsociety DNV-GLMainengine,power 4xWärtsiläPielstick12PC2-6,5940kW,total23760kWAuxiliaryengine,power 4xWärtsilä32R8,2430kWtotal9720kWPropulsion 2controllablepitchpropellersCargo 2088passengers+carsCrew 181+14artistsorservicepersonnelMeteorologicalconditions WindESE1m/s,temperature18°C,clear

30

OverviewofIncident

M/VAmorelladeparted17.07.2016at08.50foritsscheduledvoyagefromTurkutoStockholmviaMariehamn.About40minutesafterdeparturethegeneratorbreakerinauxiliaryenginenumber3opened,and,asaresult,thevesselsufferedapartialpowerfailure.Oneofthemainenginesandoneauxiliaryengineremainedrunning,sothevesselmaintainedlimitedmanoeuvringcapabilityandwasabletocontinueitsvoyagealongthefairwayatslowspeed.ThepilotinformedaboutthesituationtotheVTSandvesselsinthevicinity.Thebackupauxiliaryenginesstartedwithinafewminutes.Theenginecrewgotthemainenginesthathadstoppedre-startedandthesituationreturnedtonormalinabouttenminutes.

Theincidentdidnotcauseanydangeronboardorfornearbytraffic.

DescriptionofthepowerfailureanditsreasonsWhenthevessel leftTurkumainengines2and4,andauxiliaryengines1and3wererunning.Auxiliaryengines2and4wereatstandstill.Abouthalfanhourafterdeparturemainengines1and3werestarted,afterwhichallfourmainengineswererunning.Whenallmainengineswererun-ning,theloadonthepowergridincreased.Theopeningof thegeneratorbreaker inauxiliaryengine3,and thesimultaneousshortcircuitalarminthepowergrid,causedthepowerfailure.Asaresultoftheshortcircuitalarm,thepowergrid'sdisconnectswitchopened,andthevesselsufferedapartialpowerfailure.Theauxiliaryen-ginethatremainedrunningwasoverloaded,butcontinuedtorun.Theopeningofthegeneratorbreakerinauxiliaryengine3andtheshortcircuitalarmweremostlikelycausedbyafailureofthegeneratorbreaker.Mainengine3andauxiliaryengine1remainedrunning,becausethepowersupplyfortheiroper-atingpumpswasontheportsideofthenetworktowhichauxiliaryengine1’sgeneratorwascon-nected.Accordingtothealarmhistory,mainengines1and4stoppedduetolowlubricatingoilpressure.Thelubricatingoilpumpsconnectedtothestarboardsideofthenetworkstoppedbecausetheydidnothaveanyelectricpower.Thestand-bylubricatingoilpumps,connectedtotheportsideofthenetwork,didnotstartbecauseofanerrorinthelogicoftheautomationsystemofthemachin-ery.Mainengine2stopped,becausethecoolingwaterpumpsforthecylindersdidnothaveelectricpower.Theprimaryaswellasthestand-bycoolingwaterpumpwaswronglyconnectedtothestarboardsideofthenetwork,whichwasde-energizedduetothepowerfailure.Theprimarypumpshouldhavebeenconnectedtotheportsidenetwork.

EffectsonboardofthepowerfailureSomeofthepropulsionmachineryoperatingpumpsandthreemainenginesstopped.

Secondaryelectricityconsumersdisconnectedfromthenetwork.Theairconditioning,includingventilationunits,forexample,stopped.Thevessel’smanoeuvringabilitywas limited,becauseonlythecontrollablepitchpropellerandrudderconnectedtothemainenginethatremainedrunningwereinuse.

Theincidentdidnotcauseanyobservableharmtothevessel’spassengers.Theemergency-andbackup-systemsandtheiroperation

Thevessel’semergencygeneratorfailedtostartbecausethepowergridremainedenergised.

31

Onboardactivitiesduringthepowerfailure

Atthetimeofthepowerfailurethemaster,thelinepilot,thewatchofficerandthechiefofficerwereonthenavigatingbridge.Thepowerfailurewasdetectedwhena"panicalarm",signifyingaseriousengine failure,started flashing.Whenthatalarmhadbeenacknowledged,a lotofotheralarmswereactivated.Theengineroomalsoinformedthebridgeaboutthepartialpowerfailure.ThepilotinformedtheVTSandvesselsinthevicinityaboutthesituation.AnABwassenttotheforecastletoprepareforanchoring,incasethatwouldprovenecessary.Thevesselhasatraffic-lightsymboldescribingthestateofthepowerdistributionsystem.Greenindicatesnormalmode;yellow–emergencygeneratorinput;andred–batteryinput.Accordingtotheobservationsofthebridgepersonnel,thetraffic-lightremainedgreenthroughouttheincident.Thisinformationwasimportantforthebridgepersonnelwhentheymadedecisionsconcerningmanoeuvring.Thevessel'sengineroomisalwaysmanned.Atthetimeoftheincidenttheengineeronwatchandanengineerondaywork,wereintheengineroom.Soonafterwards,thechiefengineerandtheelectricalengineercamethere.Togethertheybegantosortoutthereasonsforthefailure,acknowl-edgedthealarms,andbeganrestoringthesystemtonormalmode.

RestoringthesystemtonormalmodeHavingdetectedadisturbanceintheelectricalnetwork,theauxiliaryengineautomationstartedtheauxiliariesnextinline,i.e.auxiliaries2and4.Whentheywereconnectedtothenetwork,theenginecrewstartedthepumpsandothersupportiveequipmentofthemainengines.Afterthat,themainengineswerestarted,oneatatime.Thedisconnectswitchofthepowergridthatwasopenedbytheshortcircuitalarmwasclosedwhenthemachinerywasconsideredstable.Aftertheincidentthefaultycircuitbreakerinauxiliaryengine3'sgeneratorwasreplacedwithanew,anditsoperationwastested.Inaddition,auxiliaryenginenumber3wasputlastinrunningorderuntilitcouldbeverifiedwhetherthefaultycircuitbreakerindeedwasthereasonforthepowerfailure.Amanufacturer'sservicemanwassentfortothevesseltocheckthefaultycircuitbreaker. Theserviceman'sreportwasreceivedonboardafewdaysaftertheincident,anditwasrecommendedthatthecircuitbreakerwouldbesenttoFranceformoredetailedinspectionTheshippingcompanyandthemanufacturerhavetogethertriedtosortouttheerrorinthelogicofthemachinery’sautomationsystemthatcausedmainengines1and4tostop.Theautomationsystemwasnotabletoidentifythesituationasapowerfailure,sinceoneoftheauxiliaryengineswasrunningandtheelectricgridremainedenergised. Thedevicemanufacturer isplanningtomodifytheautomationsystemsothatitinthefuturewouldrecognisealsoapartialpowerfailure.Theshippingcompanyalsolookedintotheincorrectconnectingofthecoolingwaterpump.Thepumphadbeen incorrectlyconnectedsincethebuildingofthevessel,butnow ithasbeencor-rected.Entriesinthevessel’sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementation

TheshippingcompanySMSsystemincludedvesselspecificinstructionsformeasurestobetakenonthenavigatingbridgeandintheengineroomincaseofapowerfailure.Thebridgecrewfol-lowedtheinstructions,somethingthatsupportedtheiroperationduringtheincident.Theengineroominstructionsweremainlyaimedforsituationswithtotalpowerfailures,butalsotheywerefollowed,tosuitableparts.

32

Adeviationreportonthe incident,consistentwiththerequirements inthesafetymanagementsystem,wasprepared.

Factorsthatreducedsafety- Thebackupofcriticalsystemsdidnotworkasplanned.- Thestand-bylubricatingoilpumpsconnectedtotheportsideofthenetworkdidnotstart

becauseofanerrorinthelogicoftheautomationsystemofthemachinery.- Thecoolingwaterpumpsofmainengine2'scylindersdidnothavepowersupplybecause

theywereincorrectlyconnected.- Oneofthemainengine'scoolingwaterpumpshadbeenincorrectlyconnectedsincecom-

pletionofthevessel.Factorsthatincreasedsafety

- Onemainengine,oneauxiliaryengineandonerudderremainedoperational,sothevesselmaintainedlimitedmanoeuvrability.

- Thebridgeequipmentwasoperationalanditwaspossibletomonitorthepositionofthevesselcontinuouslyduringtheincident.

- Thevesselhasatrafficlightsymboldescribingthestateofthepowerdistributionsystem.Itassiststhebridgecrewinassessingtheseverityofthedisturbanceintheelectricitydis-tributionandinchoosingthenecessarymeasurestobetaken.

- Theinstructionsforpowerfailuressupportedthecrew'soperationinarealsituation.Externalfactorthatinfluencedpositivelyontheoccasion

- Theincidenttookplaceonastraightandawidepartofthefairway,whereavastsafewaterareasurroundedthevessel.

M/SEgonW–MainEngineFailureandGrounding,13.9.2016Generalinformation

Thetimeandplaceofinci-dent

09.13.2016at08.35,theSaimaadeeproutefairway,Härkinsalo

Vesselname,callsignandIMOnumber

EgonW,V2CE5,9279018

Typeofvessel DrycargocarrierFlagstate AntiguaandBarbudaPlaceofbuildandtime LedaShipyard,Croatia/PedersYard,Netherlands,2004Maindimensions LOA82.5m;beam12.52m;draftof4.85mNT,GT,DWT 959,2409,3500Owner AndreWieczorekGmbH&Co.KGShipmanager AndreWieczorekGmbH&Co.KGClassificationsociety BureauVeritasMainengine,power Caterpillar3512DI-TA,1249kWAuxiliaryengine,power Sisu634DSG,130kWPropulsion AdjustablepitchpropellerCargoinformation: CelluloseCrew: 6+pilotMeteorologicalconditions WindSSW6.6m/s,temperature+10°C,skyclear

33

OverviewofIncident

M/VEgonWdeparted,underpilot,fullyloadedwithcellulose,fromJoensuudeep-waterharbourtowardsGermany,intheeveningof12.09.2016.Thenextmorning,at08.32,while thevesselwas turning to starboard in the fairway southofSavonlinna,themainenginefailed.Despitecounterhelm,thevesselcontinuedtoturnanddriftedintotheshallowseastofHärkinsaloat08.35.Atthetimeoftheincidenttherewasnoothervesseltrafficinthearea.ThepilotreportedtheincidenttotheVTS,thepoliceandtherescuedepartment.Aftertheground-ingthecrewconductedadamagesurveyandinspectedthetanks.Noleaksweredetected.Therewerenoinjuredpersonsandnoenvironmentaldamagewascaused.While themainenginewasstopped, thevesselwas leaningonrocks.Thevessel’smainenginecouldnotbestartedagainwhileaground,becauseoftheriskfordamagingthepropeller.Asalvagetugtowedthevesselbacktothefairwaywherethemainenginewasstarted.Thevesselwasthentransferredtotheothersideofthefairwaywhereitanchored.Whilethevesselwasatanchoradiverinspectedthehull,afterwhichthevesselsailedtoSavonlinnaforfurtherinspections.InSavonlinnaadiverrepresentingtheclassificationsocietyfoundscratchesandsmalldentsonthevessel'shullaswellasa2-3mmtearintheforepeak'sweldingseam.ThevesselgotpermissionfromtheFinnishTransportSafetyAgency tocontinue itsvoyage toGermanyand torepair thedamagetotheduedate.Notethatthisincidentconcernsamainenginefailure,notapowerfailure.Thevessel’sauxiliaryenginewasrunningthroughouttheincidentandproducedelectricityforthevessel.Thisincidentwashowevercomparabletoapowerfailuretoitseffectsanditisthereforeincludedinthissafetystudy.

DescriptionofthemainenginefailureanditsreasonsThevesselwasturningtothesouth,NEofHärkinsalo,whenthemainenginefailed.Thevessel'sspeedwasabouttenknots,whichcorrespondstoapproximately77%power.Theenginecontrolautomationgaverunaway-andoverload-alarmsforthemainengine.Theauto-mationalsostoppedthemainengineaftergivingthealarms,toprotectitfrombeingdamaged.Theengineautomationfollowsthemainengine’srotationsensorinformationaboutthemainengine'srotationspeed.Iftherotationspeedexceedsthesetupperlimit,ittriggerstheautomationtoper-formacontrolledstoppingofthemainengine.Themainengineisalsoshutdown,iftheautoma-tiondoesnotgetanyinformationfromtherotationsensors.Thereason forthemainengine failure isconsideredtobethattheengineautomationreceivedincorrectrotationspeedinformation.Itwasfirstthoughtthatdirtyspeedsensorsinthemainen-ginewerethereasonfortheincorrectinformation.

Inlater,moredetailed,inspections,wiringinpoorconditionwasfoundinthemainengine’spowercontrolunit.Thewiringwasmostlikelythereasonfortheincorrectrotationspeedinformation.Effectsonboardofthemainenginefailure

Whenthevessel'smainenginestopped,thepropellerdidnotrotateandthusdidnotproduceaslipstreamfortherudder,resultinginlossofmanoeuvrability.

34

Thevessel'sbowthrustergetsitselectricpowerfromtheshaftgenerator.Theshaftgeneratorisdirectly,withoutswitches,connectedtothemainengine.Thepowerproducedbytheauxiliaryen-gine isnotsufficient forusingthebowthruster.Afterthemainenginestopped, itwasthusnotpossibletousethebowthrusterformanoeuvringsupport.

Theelectricpowerproducedbytheauxiliaryengine,ensuredsmoothoperationforallthevessel'sdevices,apartfromthebowthruster.Theemergency-andbackup-systemsandtheiroperation

Thevesselhasonlyonemainengine,sothereisnobackupsystem.Thevessel’semergencygeneratorfailedtostartbecausetheauxiliaryenginewasrunningandthepowergridremainedenergized.

OnboardactivitiesduringthemainenginestopDuringthevessel'smainenginestop,themasterofthevesselandthepilotwereonthebridge.Thevesselwasturningtostarboardwhenthemasternoticedthatthemainenginehadstoppedcom-pletelyunexpectedly.

Thepilothadtheconatthetimeoftheincident,andhetriedtostoptheturnbyapplyingoppositerudder, hard a port. The vessel, however, continued to turn towards the eastern shore ofHärkinsalo.Atthesametimethemastertriedtostartthemainenginefromthebridge,butwithoutsuccess.Thechiefengineerhadbreakfastinthemesshallwhenheheardthemainenginerevolutionsriseveryquicklyforafewseconds,beforethemainenginestopped.Thechiefengineerimmediatelywenttotheengineroomandsawthereceivedalarmsontheenginecontrolautomationscreen.Hethenbegantoclarifythesituation.

RestoringthesystemtonormalmodeThechiefengineertriedtostartthemainenginethreetimes,butwithoutsuccess.Afterhavingbeentothebridgetodiscussthesituationwiththemaster,hereturnedtotheengineroomandresetallmainenginesystems.Noattemptwasmadeatthisstagetostarttheengine,sincethevesselwasinshallowwaterandtherewasriskofdamagingthepropellerandthepropellershaft.Themainenginewasstartedwhenthevesselhadbeentowedbackintothefairway.ItwasnotpossibletogetaqualifiedservicetechniciantoinspectthemainenginetoSavonlinnawithinreasonabletime.Thechiefengineercleansedthemainenginespeedsensorshimself,asin-structedbytheclassificationsociety,beforedeparturefromSavonlinna.Later,inconnectionwiththehullrepairdockinginDelfzijlintheNetherlands,aservicetechnician,representingtheenginemanufacturer,visitedthevessel.Hediscoveredthattheinsulationofalotofthepowercontrolunitwiringhadbeenchafedandwaspunctured.Alldamagedwiringwasre-placedandthesystemwastested.

Entriesinthevessel'sSafetyManagementSystem(SMS)concerningmainenginefail-ure,andtheirimplementationThecompanyhasinstructionsintheSMSformainenginefailuresandtheywereavailableonboard,asrequired.Themasterreportedaboutboththemainenginefailureandthegroundingtothecompany,andcompiledtherequireddeviationreportaftertheincident.

35

Factorsthatreducedsafety

- Whenthevessel'smainenginestopped,thepropellerdidnotrotateandthusdidnotpro-duceaslipstreamfortherudder,resultinginlossofmanoeuvrability.

- Afterthemainenginestopped,itwasnotpossibletousethebowthrusterformanoeuvringsupport.

- Inpreventivemaintenancework,thewearoftheinsulationinthepowercontrolunitandthesoilingofthemainenginespeedsensorswerenotdetected.

- Thevessel'sbowthrustergetsitselectricpoweronlyfromtheshaftgenerator.Theshaftgenerator is directly,without any switches, connected to themain engine. There is nobackupsystemtoensurepowersupply.

M/SPrimaBallerina,PowerFailure,20.10.2016Generalinformation

Timeandplaceofincident 20.10.2016at0520,GedserTSS-DanishstraitsVesselname,callsignandIMOnumber

PrimaBallerina,OJPR,8609618

Typeofvessel DrycargocarrierFlagstate FinlandPlaceofbuildandtime J.J.Sietas,Germany,1986Maindimensions LOA87.88m;beam12.8m;

maximumdraught5.20mNT,GT,DWT 1240,2673,3004Owner PrimaShippingLtdShipmanager PrimaShippingLtdClassificationsociety RI,RegistroItalianoNavaleMainengine,power Wärtsilä6R32BC,1975,kWAuxiliaryengine,power 3xDeutzBF6L513R,118kWPropulsion AdjustablepitchpropellerCargo InballastCrew 8Meteorologicalconditions WindSE3m/s,temperature+9C,goodvisibility

OverviewofIncidentM/SPrimaBallerinasufferedanabout10secondslongpowerfailurewhenhershaftgeneratordisconnectedfromtheelectricitygrid.ShewasenroutetoRostock,intheGedsertrafficsepa-rationschemeintheDanishstraits.Itwasearlymorning.Thevessel’smainengineremainedrunningduringthepowerfailure.Thevessel’spropulsionwasworkingnormallyandshewasmanoeuvrable.Therewasothervesseltrafficinthevicinityatthetimeoftheincident,butitwasnotendan-geredbytheincident.

DescriptionofthepowerfailureanditsreasonsBeforethepowerfailure,thevessel'smainenginewasrunning.Theshaftgeneratorwasinuseandproducedpowertotheelectricitygrid.Oneauxiliaryenginewasinstandbymode.

36

Abouthalfaminutebeforethefailure,theenginecontrolsystemgaveanalarmonlowcontrol-airpressureinthemainengine.When thepower failureoccurred, themainengine control-airpressuredroppedbelow thealarmlimit.Whenthecontrol-airpressuredropped,theshaftgenerator'sRPMspeedwasre-ducedandthefrequencyoftheelectricitynetworkfellbelowthespecifiedlimit.Thisdevelop-mentactivatedtheautomationtodisconnecttheshaftgeneratorfromthevessel’selectricitynetwork.Theauxiliaryengineinstandbymodestarted,andconnectedtothenetwork.Thereasonforthecontrol-airpressuredropwasthebreakingofaroundrubbermembrane(ø2cm)inthealarmsensoroftheairpressuresystem.Thecompressedaircoulduncontrollablyescapeoutofthecontrol-airpressuresystem.

EffectsonboardofthepowerfailureThevessel’snavigationequipmentwentoutmomentarily,with theexceptionof theGMDSSequipment.Thevessel'sonlygyrocompassswitchedtofailuremode,whichiswhyitnolongerprovidedinformationtotheautopilot.Itwasthusnecessarytoswitchtohandrudder.Whencomparinggyrodatawiththemagneticcompassdata,itwasfoundthatthedirectiondatathegyrogave,wascorrect.Thiswasthecase,regardlessthatthegyrocompasswasinfailuremode.14

Thevessel'smainengineremainedrunning,butcontroloftheengineswitcheddowntotheenginecontrolroom.Theemergency-andbackup-systemsandtheiroperationWhentheshaftgeneratordisconnected,theauxiliaryenginethatwasinstandbymodestartedinlessthan10seconds.Therewasnotimeforthevessel’semergencygeneratortostart.

OnboardactivitiesduringthepowerfailureThechiefofficerandawatchmanwereonthenavigatingbridgeatthetimeoftheincident.Themasterwasinhiscabin,onoff-duty,butwokeupbecauseoftheincident,andcametothebridgesoonafterthepowersupplywasrestored.Thechiefofficerswitchedtohandrudder.Onthenavigatingbridge,whenthepowersupplywas restored, the radarwas restarted, the vessel's position and the traffic situationwerechecked,andthecontroloverthepropulsionpowerwasreturnedtothebridge.Thewatchmanwassenttocheckthesituation intheengineroom.Realizingthat itwasnotpossibletore-activatetheautopilot,themasterandchiefofficertookturnshandsteering.Theengineroomwasunmanned.Thechiefengineerwokeuptotheenginealarminhiscabinandwenttotheengineroom.Hediscoveredthatthecontrol-airpressurehaddecreasedandbegantroubleshootingtheproblem.Theauxiliaryengineinstandbymodehadalreadystarted,andthevessel’spowersupplyhadbeenrestored.

RestoringthesystemtonormalmodeWhenthepowersupplywasrestored,allnavigationequipment,exceptfortheautopilotandthegyrocompass,operatednormally.Ittookaboutfourhoursforthegyrotodetermineitsdi-rectiondataandforthestateofthesystemtostabilise.Afterthat,directiondatawasonceagainavailablefortheautopilot.

14(GlobalMaritimeDistressandSafetySystem),aglobaldistressandsafetysystem

37

Thechiefengineermadeamembranefortemporaryuse,andreplacedthebrokenrubbermem-braneinthealarmsensorwithit.Afterthis,thecontrol-airpressuresystemworkednormally,anditwasagainpossibletousetheshaftgenerator.InthenextFinnishportthevesselcalledat,aservicemancameonboardtocheckthegyrocom-pass.Hemovedthegyrocompass'selectricpower feedtothedistributionboard,anelectricpanel, forcriticalequipmentonthenavigatingbridge.Thatdistributionboardhasabatterybackupsystem.Entriesinthevessel’sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementation

Therewereseparateinstructions,intheshippingcompany'sSMS(SafetyManagementSystem,SecurityManagementSystem),formeasurestobetakenonthenavigatingbridge,incaseofapowerfailure.Themainengineandpropulsionremainedoperational,andthustheinstructionswerenotfullyapplicable. Aftertheincidentthemasterandthechiefofficercheckedthein-structionsaswellasotherrelatedpossiblefunctionsandtasks.

Thereisalistonthenavigatingbridgeoverallequipmentonboardthatwillremainoperationalduringpowerfailures.Therewereinstructions,dividedintodifferentphases,intheengineroom,formeasurestobetaken in case of power failure. In this incident, the automation carried out all necessarymeasuresandtherewasnoneedtousetheinstructions.Afterthepowerfailuretheactionstakenduringtheincidentwerecomparedwiththeshippingcompany's instructions. Themastercompiledadeviationreport inaccordancewiththe in-structionsoftheshippingcompany.

Thecompanyhasissuedinstructionsformeasurestobetakenonthenavigatingbridgeandintheengineroomincaseofapowerfailure.Thevessel’screwfollowedtheinstructions.Factorsthatreducedsafety

- Thewearandconditionofthemembraneinthealarmsensorofthemainengine'scon-trol-airsystemisnotmonitoredinthepreventivemaintenancesystem.

- Thevesseldoesnothavetwoindependentcompasses,displayingtruedirections.Factorsthatincreasedsafety

- Thevessel'smainenginewasrunningallthetime.- Thevesselwasmanoeuvrablewithhandrudder,inspiteofthegyrocompassfailure.

38

M/SMariella,PowerFailure,5.11.2016

Generalinformation

Timeandplaceofincident 5.11.2016at17.14,Stadsgårdskajen,StockholmVesselname,callsignandIMOnumber

Mariella,OITI,8320573

Typeofvessel Ro-ropassengershipFlagstate FinlandPlaceofbuildandtime WärtsiläshipyardTurku,Finland,1985Maindimensions LOA175.70m;beam28.40m;maximumdraught6.78NT,GT,DWT 24421,37860,3524Owner VikingLineLtdShipmanager VikingLineLtdClassificationsociety DNV-GLMainengine,power 4xWärtsiläPielstick12PC2-6V-400,tot.23000kWAuxiliaryengine,power 3xWärtsiläVasa6R32,tot.5400kWPropulsion 2controllablepitchpropellersCargo 1823passenger+carsCrew 198Meteorologicalconditions WindN4m/s,temperature+1°C,skyclear

OverviewofIncidentThevesselwaspreparingfordeparturefromStockholmandhadjustchangedfromshorepowertoitsownpowergeneration.Afewminutesafterstartingtheauxiliaryengines,oneoftheauxiliaryenginesfailedandcausedadisturbanceinthepowerdistribution.Thevesselwasberthedatthetimeoftheevent,andthemainengineshadnotyetbeenstarted.Thevessel’spowergenerationwasrestoredtonormalinaboutfiveminutes.ThevesselsetofftowardsMariehamnasscheduled.Thefailuredidnotcauseanydangeronboard.

DescriptionofthepowerfailureanditsreasonsThevesselhasfourmainenginesandthreeauxiliaryengines.Asageneralrule,thevessel’sauxil-iaryenginesproducetheelectricity.Themainengineshaveshaftgenerators,whichcanbeused,ifnecessary,toproducetheelectricityrequiredforthevessel.Thevessel’sauxiliaryengines1and2wererunningandconnectedtothepowergrid.Whenauxil-iaryengine3wasstarted,itconnectedtothenetworkandsurprisinglyshoulderedthetotalloadofthepowergrid.Thepowergridfrequencyroseandareversepowersituationfollowed.There-versepowersituationcausedauxiliaryengines1and2todisconnectfromthenetwork.Auxiliaryengine3'sRPMcontinuedtoriseuntiltheengine'smechanicaloverspeedprotectionstoppedtheengine.Auxiliaryengines1and2remainedrunning,butdidnotsupplytheelectricitynetworkwithpower-thusthepowerfailureonboard.Thepowerfailurewascausedbythefaultysignalthattheregulatorinauxiliaryengine3receivedfromtheservomotor’sautomationsystem.Asaresultofthis,theregulatorincreasedtheengine's

39

fuelsupplymorethannecessary.Thecauseofthefaultysignalwasastuckrelayswitchintheau-tomationsystem'sDPU-processingunit(DistributedProcessingUnit).Thevessel'schangingfromshorepowertoitsownelectricitygeneration,wasnotconnectedwiththepowerfailure.

EffectsonboardofthepowerfailureAllthevessel’selectricalequipmentthatwasconnectedtothemainswitchboardandnotsecuredwithabatterysupplysystem(UPS),waswithoutelectricityforabout10seconds.

Theincidentdidnotcauseanyobservableharmtothevessel’spassengers.Theemergency-andbackup-systemsandtheiroperation

Thevessel’semergencygeneratorstartedautomaticallyandtheotherbackupsystemsworkedasplanned.Automation-,alarm-andnavigation-systemswereeithersecuredwithbatteries(UPS),orreceivedpowerfromtheemergencygenerator.Onboardactivitiesduringthepowerfailure

Thenavigatingbridgewasmannedfordepartureatthetimeoftheincident.Themasternoticedthepowerfailuremainlyfromflashinglightsandalarmsonthebridge.Moredetailedinformationaboutthedisturbancewasacquiredbytelephonefromtheenginecontrolroom.

Theenginecrewwasinthecontrolroompreparingfordeparturewhenthedisturbanceoccurred.Afterthefrequencyalarm,theautomationsystemdisconnectedauxiliaryengines1and2fromthenet,stoppedauxiliaryengine3,andstartedtheemergencygenerator.Auxiliaryengines1and2remainedrunning,andthecrewintheenginecontrolroomquicklyre-connectedthemtothenetwork.Theyacknowledgedthealarmsandrestartedthesystemsthathadstopped.Thevesselinformedtheshippingcompanyabouttheincident,which,inturn,informedTheFinnishTransportSafetyAgency.

RestoringthesystemtonormalmodeTheenginecrewimmediatelybeganinvestigatingthereasonfortheoverspeedingofauxiliaryen-gine3.Theenginewasrestartedwithoutconnectingittothenetwork.Thesamefaultreoccurredandthecausewassuspectedtobemalfunctionoftheauxiliaryengineregulator.Allthreeauxiliaryengineswerenotnecessaryforthesafeoperationofthevessel,soitwasdecidedthattroubleshootingwouldcontinueafterdeparture.Thedefectiveauxiliaryenginewasnotusedduringthevoyage.Afterdeparturethevessel’screwreplacedtheregulatoronauxiliaryengine3.TheauxiliaryenginewastestedinHelsinkithefollowingdayanditwasfoundthatthefaultwasnotcausedbythereg-ulator.Thefaultwaseventuallylocatedtoarelayintheprocessingunitoftheautomationsystem.Thecircuitboardintheprocessingunitwasreplacedwithasparethathadbeenstoredonboard,andthemalfunctioningended.AninspectorfromTheFinnishTransportSafetyAgencyalsovisitedthevessel,andstatedthatthevesselcancontinuenormaloperation.

Asapreventativemeasure,itwasdecidedthatthecircuitcardsalsointheotherauxiliaryengines'processingunitswouldbereplacedwithnewones,assoonaspossible.

40

Entriesinthevessel’sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementationTherewere instructions forpower failuresituationson thenavigatingbridge.The instructionswere,however,mainlyintendedforsituationsinwhichthevesselisatsea.Intheengineroom,therewerebriefinstructionsforactionstobetakenbytheenginecrewintheeventofpowerfail-ures.Inaddition,thevesselhadinstructionsforsituationswithautomationsystemmalfunctions.Theinstructionswerelimited,however,andthereweresomeshortcomingsintheawarenessoftheirexistence.Themanagementofthesituationleanedontheprofessionalskillsandlongexpe-rienceonboard,andneitherinstructionsnorchecklistswereused.

Adeviationreportonthe incident,consistentwiththerequirements inthesafetymanagementsystem,wasprepared.Factorsthatreducedsafety

- Thecircuitcardsintheautomationsystemwerenotmonitoredinthepreventiveservicesystem.

- Theinstructionswerelimited,however,andthereweresomeshortcomingsintheaware-nessoftheirexistence.

Factorthatincreasedsafety

- Thecrew'sprofessionalskillsandlongexperienceonthevessel,contributedtothenormal-isationofthesituationandtodetectingthecauseofthefailure.

Externalfactorsthatinfluencedpositivelyontheoccasion- Thevesselwasmooredatthetimeoftheincident.

M/SViggen,PowerFailure,10.01.2017

Generalinformation

Timeandplaceofincident 10.01.2017at0726,atthearrivaltoÅva,ÅlandIslands

Vesselname,callsignandIMOnumber

Viggen,OJIQ,9173719

Typeofvessel Ro-ropassengerferryFlagstate (Finland)TheÅlandIslandsPlaceofbuildandtime UudenkaupungintyöveneLtd,Uusikaupunki-Finland,

1998Maindimensions LOA53.50m;beam12.25m;maximumdraught4.0mNT,GT,DWT 513,1512,300Owner TheGovernmentofÅlandShipmanager NordicJetlineFinlandLtd/NordicCoastLineClassificationsociety Lloyd'sRegisterMainengine,power 2xWärtsiläBL20,1320kW,tot.2640kWAuxiliaryengine,power 2xSisuValmet612DSJGM,136kW,tot.272kWPropulsion AdjustablepitchpropellerCargo 7passengers,1fulltrailer,1truck,3carsCrew 4Meteorologicalconditions WindSW9m/s,temperature+3°C,clears

41

Ashortdescriptionoftheincident

Onthe10thofJanuary2017,M/VViggen,doingscheduledferryservice,departedat0700forthefirstvoyageoftheday,fromVuosnainentoÅva.WhenapproachingtheportofÅvathevesselsuf-feredapowerfailure,approximately100metersbeforethewharf.Asaresult,thevessel’spropel-lerstoppedrotatingandthusdidnotproducekineticenergyfortheship.Thevesselglidedabout50meters,turningslightlytoport,andendeduponashoalwithaspeedofabout2-3knots.Thevessel’sbowwasstuckonthebottom.Thevessel'selectricitysupplywasnormalisedaftermaybe2minutes,whentheotherauxiliaryenginestarted.

Thecrewinspectedthevesselforexternalaswellasinternaldamage.Noleaksweredetected.Thevesselthenpulledawayfromtheshoalandmovedtothewharfat0746.ThevesselthentransferredfromÅvatoVuosnainen.Therediversinspectedtheunderwaterpartsofthevessel.Thedamagewasonlysurfacescratches.Thevesselgotpermissiontocontinuenormaloperationbyajointdecisionoftheclassificationsociety,theFinnishTransportSafetyAgencyandtheshippingcompany.

DescriptionofthepowerfailureanditsreasonsBeforethepower failurebothmainenginesandauxiliaryengine2wererunning.Theauxiliaryengineproducedthevessel’selectricalpower.Auxiliaryengine1wasinstandbymode.Theenginecontrolsystemalarmedforlowseawaterpressureandforhighcoolingwatertemper-ature.Asaresultofthealarms,theautomationoftheenginecontrolsystemshutdownauxiliaryengine2.Thisresultedinthepowerfailure.Afaultycoolingwatertemperaturesensor,whichrelayedincorrectinformationtotheautomationoftheenginecontrolsystem,stoppedauxiliaryengine2.Therearepre-setlimitsfortheenginecontrolautomation.Theautomationgivesadvancewarningforstartingthebackupauxiliaryen-ginebasedonthepre-setvalues.

EffectsonboardofthepowerfailureThevessel'smainenginesdisconnected fromthepropelleraxis.Thepropellerstoppedrotatinganddidnotproducekineticenergyforthevessel.Asaresult,thevessellostitsmanoeuvringabilityandglidedintotheshoal.Therudder,aswellasthebowandsternthrusters,wasnotoperationalduringthefailure.

Theemergency-andbackup-systemsandtheiroperationTheenginecontrolautomationstartedtheemergencygeneratorabout10secondsafterthepowerfailure. It then produced electricity for all critical equipment. The standby auxiliary engine 1startedandconnectedtothevessel'selectricitygridafterabout2minutes.Onboardactivitiesduringthepowerfailure

Themasterandadeckhandwereonthenavigatingbridgeatthetimeoftheincident.Themasterwasattheconningstationontheportsidebridgewing,whenthevesselapproachedthewharf.Whenthepowerfailurebegan,themasterturnedthevesseltostarboard,butsincetherewasnopropellerthrust,thevesseldidnotrespondtosteeringandinsteadturnedslowlytoport,endingupattheshoal.Themasterloweredtheanchoraboutonemeterusingtheremotecontrolonthebridge.Thiswasofnouseinpractice,sincethevesselalreadywasontheshoal.Thedeckhandwasjustleavingthe

42

navigatingbridgetogooutondecktoprepareformooring,butreturnedtothebridgeafterhavingnoticedthepowerfailure.ThevesseldidnotcontacttheVTS.Thechiefengineer,whowasintheengineroom,beganclarifyingthereasonforauxiliaryengine2'sstopping.Afterthis,hewenttotheenginecontrolroomtoacknowledgealarms.

Thedeckhandthathadbeenpreparingformooringondeck,checkedforpossibleexternaldamageandforpossibletankleakages.Theheavyvehiclesondeckweremovedtothestern,tolightenthebow,andthustofacilitaterefloatingofthevesselandmanoeuvringawayfromtheshoal.Whenthepowersupplyhadreturnedtonormal,themasterorderedenginecontroltothebridge,reversedthevesselawayfromtheshoal,andberthedatthewharf.

RestoringthesystemtonormalmodeThechiefengineeracknowledgedthealarmsandthemasterresetthemanoeuvringsystem,inac-cordancewiththechiefengineer'sadvice.Auxiliaryengine1,whichhadbeeninstandbymode,started.Afterthat,themainengineswereconnectedtothepropellershaft.Onthe13thofJanuary2017,aserviceman,commissionedbytheshippingcompany,cametoin-specttheproblemthathadoccurredintheenginecontrolautomation.Theservicemanoverhauledthedefectivecoolingwatertemperaturesensorthathadcausedthepowerfailure,andcheckedtheenginecontrolautomation.

Inconnectionwiththeserviceman'svisit,alsoanoverallageingofthecomponentsintheelectricalsystemandaneedformaintenancewerenoticed.Entriesinthevessel'sSafetyManagementSystem(SMS)concerningpowerfailuresandtheirimplementationThereareinstructionsavailableonthenavigatingbridgeformeasurestobetakenincaseofpowerfailuresandemergencyanchoring-situations.Themastercheckedtheinstructionsafterthepowerfailuretoseewhethertheiractionshadbeeninlinewiththem.Intheenginecontrolroom,therewerenoinstructionsforactionstobetakenincaseofpowerfailures,butthereisalistoftheequip-mentthatmustberestarted.Themasterinformedtheshippingcompany'soperativemanager.Thiswasinaccordancewiththeinstructionsoftheshippingcompany.Aftertheincident,adeviationreportwascompiledanddis-tributedtootherconcernedparties.Thevesselgotpermissiontocontinueoperating.Thevesselusesabrowserbasedmaintenanceandmonitoringsystem,whichisadministeredbythegovernmentofÅland.Allroutinemaintenancetaskswillbereportedtotheadministration,which then,basedon thereports,willdecideonnecessarymaintenanceandorderingofspareparts.Thevesseldoesnothavemaintenanceplansconcerningcomponents.

Factorsthatreducedsafety- Ageingandwearofcomponentsintheenginecontrolautomationhadnotbeenmonitored

sufficiently.Serviceandoverhaulinconnectionwithpowerfailuresrequirespecialisedex-pertise.Shippingcompaniesoftendependonexternaloperatorsinthesesituations.

- Themaintenanceandmonitoringsystemdoesnotmeetthemaintenanceneedsoftheves-sel.Theserviceplanforcomponentsisinadequate.

- Thepowerfailurecausedthevessel'smainenginetodisconnectfromthepropellershaft.Thepropellerthenstoppedrotatingandthusdidnotproduceaslipstreamfortherudder,resultinginlossofmanoeuvrability.

- ThevesseldidnotcontacttheVTSabouttheincident.

43

ANALYSISTheanalysisinthisinvestigationwasdoneusingtheBowTiemethod.TheBowTiediagramillustratestherisksincludedinanincidentasrelationsbetweenhazards,topevent,threatsandconsequences.Inadditiontothesefourfactorsthemodelincludespreventivebarriers,barriersmitigatingconsequencesaswellasescalationfactors,whichcanpreventbarriersfromwork-ing.

ThestartingpointfortheBowTiemethodisthetopevent,whichinthisinvestigationwasapower failure(continuityofoperationsandtheelectricitysupplytocriticalsystems). Intheanalysiscausesandbackgroundfactorsforthepowerfailureswereestablished.Alsothecon-sequencesofthepowerfailureswereestablished.Theanalysisalsolistedpreventivebarriersthatinfluenceinthebackgroundofthecausesandthathaveaneffectontheformationofthem.Thefactorsthatmitigatedtheconsequencesoftheincidentswerealsoclarified.Thesefactorspreventedtheincidentsfromescalatingintomoreseriousaccidents.Alsotheescalatingfactorsthatmadethesituationsworsewereclarified.

Figure1:BowTieDiagram

44

CausesforPowerFailuresandRelatedObservationsThecausesfortheinvestigatedpowerfailuresweregroupedontheleft-handsideintheBowTiediagram.Thecauseformostoftheinvestigatedpowerfailures(7)wasawornoroldcomponent,e.g.asensororanelectroniccard. Inoneofthe investigatedcasesthecausewasprobablyausererror.Onepowerfailurewascausedbywaterinthefuel.Anunexpectedfailureofacomponent(inthesecases,acontrollerorarelay)causedtwopowerfailures.Onecasewascausedbyun-reliablemachineautomation.Foreachcauseofapowerfailuretheanalysissoughttoidentifythepreventivebarriersandbackgroundfactorsthatwouldhavepreventedtheemergenceofapowerfailure,hadtheyoperatedproperly.

WornandOldComponents

MaintenanceSystem(1.1)Deficiencies in themaintenancesystemwere found tobe in thebackgroundofmanycasescausedbywornoroldcomponents.Itwasfoundthatwearofcomponentsisnotalwaysnoticedduringinspections.Thisisbecausecomponentsarenotalwaysinspectedduetothestructureofthesystems.Electricalsystemsrequirespecialexpertise,somethingwhichisnotalwayssuf-ficientlyavailable.DuplicationofCriticalSystems(1.2)

Internationalandnationalmaritimelegislationemphasisetheimportanceofsafeoperationofvessels.Thisincludes,interalia,duplicationofcriticalsystems.Theduplication, or ensuring, related to fuel-and emergencypower systems,wasnot ade-quatelytakenintoaccountintwocases.Accordingtochapter10.3oftheISMCode,ashippingcompanyshall-inthesafetymanagementsystem-identifythetechnicalsystemsandequip-mentofwhichasuddenfailuremayleadtoanincident.

DeviationsandRespondingtothem(1.3.)Thecrewdidnotalwaysknowhowtodetectdeviationsandhowtorespondtothem.TheISMCoderequiresthatshippingcompanieshaveadeviationreportingsystemincludedinthesafetymanagementsystem.Chapter10oftheISMCodedealswithserviceandmaintenanceofthevessel.Basedonthis,eachdeviationmustbereported,correctiveactionsmustbeperformedanddocumented.Apromptandcompetentresponsetodeviationsisanessentialpartofsecur-ingthefunctionalityofcriticalsystems.

EquipmentOperationKnowledgeofSystems(2.1)

Increwchangesship-specificknowledgeandexperienceintheuseofsystemsdonotalwaystransferfromonecrewtothenext.Inoneoftheinvestigatedcases,inadequatefamiliarisationresultedintheemergenceofapowerfailure.Shortcomingsinship-specificdocumentationalsoposedproblems. Accordingtosection6.2oftheISMCode,ashippingcompanymustensurethattheshipismannedbypersonnelwhocanmanagetheship'smaintenancetasks.Accordingtochapter6.3ofthecode,theshippingcompanymusthavemethodsforfamiliarisingnewstaffwiththeirduties.Knowledgeofsystemsisaveryimportantpartofthecrew'sknow-how.Itisalsoimportanttoconsiderhowtoensurethetransferoftacitknowledgeincrewchanges.

45

UserInterfaceClarityandInstructions(2.2)

Controlandoperatingsystemsforautomationsystems,machineryandequipmentwereoftencomplicatedandtheirmanualswereincompleteorcompletelymissing.Accordingtosection6.5oftheISMCode,ashippingcompanymustestablishprocedurestomaintaintheproficiencyleveloftheship'screw.Accordingtosection6.6oftheISMCode,theshippingcompanymustensurethattheship'screwreceivesthenecessaryinformationontheship'ssafetysystemsintheship'sworkinglanguage.

FuelFullDuplicationoftheFuelSystem(3.1)Inoneoftheinvestigatedcasesthefuelsystemwasnotfullyduplicated.Thefuelsystemshouldbeduplicatedinsuchawaythatthesystemconsistsoftwoindependententities.

FuelQualityMonitoringandMaintenanceoftheSystem(3.2)Intheabovementionedcasetherewerealsoshortcomingsinthemonitoringofthequalityofthefuel.Asaresultofthis,thewaterthathadgottenintothefuelsystemeventuallycausedapowerfailure.Thequalityofthefuelisnotmonitoredenoughonboard.Regularmaintenanceofthefuelsystemreducesthefuelrelatedrisk,which,ifrealised,canresultinsimilarsituationsaspowerfailures.

UnexpectedComponentFailureChoosingComponentsDuringConstructionorwhenRenewingSystems(4.1)Thequalityofthecomponentsandtheirsuitabilityforuseatseaisofdecisiveimportance.Thisshouldbetakenintoaccountduringtheconstructionphaseoftheshipaswellaswhenrenew-ingsystemsonboard.Inonecaseanalmostnewelectricalcomponentmalfunctionedunexpect-edly.

ReliabilityofAutomationDesign(5.1)Thereweredeficienciesinthedesignanddocumentationoftheautomationsystems.Whenas-sessingthereliabilityoftheautomation,itisimportantthatthedocumentationofitisuptodate,clearandunderstandable. It is importanttoemphasisetheeaseofmaintenanceofthesystemalreadyatthedesignstage.TestingandMaintenanceoftheAutomationSystem(5.2)

Thedifferentfunctionsoftheautomationsystemhadnotalwaysbeentestedinaccordancewithregulations.Testsaredonetodetectdeficiencies.Itisofoutmostimportancetocarefullytestautomationsystemsandalltheirfunctions,alreadywhentakingthemintouse.Accordingtochapter10.3 inthe ISMCode,alsosystemsthatarenot incontinuoususemustbetested inaccordancewithsystem-instructionsandonaregularbasis.Automationsystems’fastageingisaproblem.Systemupgrades,supportandsparepartsmaynotbeavailableforthewholelife-timeofasystem.FunctioningofBackup-andEmergencySystems(6)

Deficienciesinthebackup-andemergencysystemswerefoundinallinvestigatedcases.Failuresituations,likeseriouspowerfailures,arenotalwaystestedduetotheriskofdamagingthesystems.Accordingtochapter10.3oftheISMCode,ashippingcompanymustdesignmeasurestoensurethereliabilityofsystemswhosefailuremaycausehazardoussituations.Accordingto

46

theISMCode,themeasuresmustincludetestingofbackup-andemergencysystemsaswellasofsystemsinnon-continuoususe.Thetestingmustbedoneinaccordancewiththeinstructionsforthetest.

ConsequencesofPowerFailuresandManagingthemTheconsequencesoftheinvestigatedpowerfailuresweregroupedontheright-handsideintheBowTiediagram.Noneoftheinvestigatedcasesdidresultinaveryseriousseaaccidentorinseriousenvironmentaldamage.Infourcasesthepowerfailurehadneitheranyeffectonthevessel'smanoeuvrabilitynorothersignificantorlong-lastingeffectsontheoperationofthevessel.Infourcasesthepowerfailure,ormainenginestoppagewithsimilareffects,causedatotallossofmanoeuvrabilityand,inonecase,apartialloss.Inthreecasesthevesselgroundedeitherbecauseofapowerfailureorofamainenginestop-page.Afterinspectionsthevesselsgotpermissiontocontinuetheirvoyagesandinstructionsfortherepairs.

NoSubstantialorLong-termEffectsNoRiskofCollisionorGroundingduetoConditions(7)Infourcasestheoperationsofthevesselswerenotsignificantlycompromisedsincetheywereanchored,berthedorinsafewatersatthetimeofthepowerfailure.Inaddition,theweatherconditionsandthetrafficsituationwerefavourableatthetimeoftheincident.QuickStartupofBackup-andEmergencySystems(8.1)

Intheabove-mentionedcasesthequickstartupandfunctionalityofbackup-andemergencysystems,aswellasthecrew'scorrectactions,preventedmoreseriousconsequences.

LossofManoeuvrability

SafeProcedures(9.1)Infourcasesthepowerfailure,orthetotheeffectsequivalentmainenginestoppage,causedatotal lossofmanoeuvrabilityandthevesselbegantodrift. Inonecasemanoeuvrabilitywaspartiallylost,butthevesselremainedinthefairway.Thelossofmanoeuvrabilitylasted,de-pendingonthecase,fromafewminutestomorethananhour.Safeproceduresfortheonboardoperationsandfavourableconditionspreventedtheincidentsfromdevelopingintomoreseri-ousaccidents.

GoodLocalKnowledgeandSituationalAwareness(9.2)Thewatchkeepingcrew'sknow-howaswellasgoodsituationalawarenessandoverviewofthesituationreducedtheriskofanaccident. Intwocases involving lossofmanoeuvrabilitythelocalknowledgeofthepilotand-inonecase-thelinepilot,contributedtothepositiveoutcomeoftheincident.

LossofManoeuvrabilityandGroundingNarrowPartofFairway,ShoalsandRocksNearby(10.1and10.2)Inthreeofthegroundings,thepowerfailureormainenginestoppageoccurredinanarrowpartofthefairway.Thelimitedareawithsufficientdepthforsafenavigationandtheshortre-sponsetimeduetothespeedofthevesselwerenotsufficienttopreventagrounding.Intwo

47

cases,the lossofmanoeuvringcapacitytookplacewhenthevesselwasturning inanarrowfairway.Onecaseoccurredwhenthevesselwasapproachingport.

InadequatePowerinBackup-andEmergencySystems(10.3)Inonecaseanerrormessagefromthemachineautomationstoppedthemainengineand,atthesametime,theshaftgenerator.Thevessellostitsmanoeuvringcapabilitybecausetheeffectoftheauxiliaryenginewasnotenoughtorunthebowthruster,whichrequiredtheeffectoftheshaftgenerator.Inanothercaseittookabouttwominutestostartthebackupsystem.Duringthattimetheshipdriftedintoashoalafterhavinglostitsabilitytomanoeuvre.

Inathirdcasethebackupsystemthathadstartedwasnotenoughtopreventagroundinginaturn,inanarrowpartofthefairway.Anattemptwasmadetostopthemovementofthevesselbyoperatingthemainenginefullastern.

AvoidingVerySeriousSeaAccidentsFavourableTrafficSituation(11.1and12.1)Ineightcasestheconditions,afavourabletrafficsituationorlowspeed,preventedamorese-riousaccident.Noneofthecasesinvolveddangerouscargoandtheriskoftheenvironmentaldamageassociatedwiththem.Theconditionsandthecargoarerelevantwhenassessingtheriskcausedbypowerfailures.Apowerfailureisaseriousdeviation.

AnalysisofRescueOperationsExternalhelpforrescuingtheshipwasneededinonlyonecase.Afterthegrounding,thepilotreportedtheincidenttotheVTS,thepoliceandtherescuedepartment.Whenthemainenginewasstopped,theshipwasleaningontherocks.Theship'smainenginecouldnotbestartedagainwhileaground,becauseoftherisk fordamagingthepropeller.Asalvagetugtowedtheshipbacktothefairwaywherethemainenginewasstarted.Theshipwasthentransferredtotheothersideofthefairwaywhereitanchored.Whiletheshipwasatanchoradiverinspectedthehull,afterwhichtheshipsailedtoSavonlinnaforadditionalin-spections.Arescuevesselarrivedquicklytothesceneandtheflowofinformationamongtheinvolvedpartiesconcerningtheincidentwassmooth.Thepilotonboardthecasualtycommunicatedwithallparties,whichfacilitatedtherescueoperations.

TheActivitiesoftheAuthoritiesTheVTScentrewascontactedinalmostallinvestigatedcases.TheVTScentremonitoredthesituationandassessedtheneedforadditionalhelptogetherwiththevessel.Thecentrealsoassessedtherisksforothertrafficandtotheenvironment.VTS-centresdonotalwaysreceiveadequateinformationabouttype,causeandconsequencesofvessels'technicalproblems.InFinnpilotPilotageLtd'sdeviationreportformthereisnoseparatesectionforpowerfailures.Theyarereportedsimplyastechnicaldefects.OnthebasisofreportsreceivedfromFinnpilotitisthereforedifficulttoidentifythetypeofthetechnicalfailureandtoassesswhetherornotitincludedapartialorcompletepowerfailureoramainenginestoppage.Itisdifficulttogetaccuratedataonpowerfailures.Differentpartiesrecordpowerfailuresindifferentways. There isnocommonpracticeofreportingpower failures.Thedefinitionsofpowerfailuresshouldalsobeharmonised.

48

ThisinvestigationinvolvedtwocasesinwhichtheinspectoroftheFinnishTransportSafetyAuthorityinspectedthevesselafteritsgroundingandgaveitpermissiontocontinuetooperate.Afterthegrounding,theinspector,togetherwithrepresentativesfortheclassificationsocietyandtheshippingcompany,assessedthevessel'sseaworthinessanddecidedtoallowcontinuingitsoperating.

CONCLUSIONSBasedontheinvestigation,itcanbegenerallystatedthatobtainingaccurateinformationonpowerfailuresisdifficult.Differentpartiesrecordpowerfailuresindifferentways.Thereisnocommonpracticeofreportingpowerfailuresandthereisnodefinitionforpowerfailures.Whenlookingatthefindingsintheanalysis,itcanbeconcludedthatgoodqualityofcompo-nents,reliabilityofsystems,sufficientskillsofthecrewandfavourableconditionsarefactorscentralforpreventingpowerfailures.Thequalityofthecomponents,thereliabilityofthesys-temsandthecompetenceofthecrewcanbeinfluencedandtheimpactoftheconditionscanbeanticipated.

ComponentQualityItwasfoundthatwearofcomponentsisnotalwaysnoticedininspections.Thishappensbe-causethecomponentlevelisnotalwaysinspectedduetothestructureofthesystems.Inaddi-tion,maintenanceofelectricalsystemsrequiresspecialexpertiseandthatisnotalwayssuffi-cientlyavailableonboard.Accordingtochapter10.3oftheISMCode,ashippingcompanyshall-inthesafetymanagementsystem-identifythetechnicalsystemsandequipmentofwhichasuddenfailuremayleadtoanincident.Usersmustidentifythecriticalcomponentsoftheelectricalsystemsandplanforensuringtheirfunctionality.

Thelifespan,replacingintervalsandmaintenanceneedsofelectricalcomponentsareusuallynotplannedwith sufficientprecisionand long-termperspective.Theelectroniccardsarereplacedonlywhentheystopworkingorwhenthereliabilityofthedatatheyprovidehasdiminished.Pro-fessionalmonitoringandfunctionalitytestingofsensorsareimportantpartsofthemaintenancesystem.Whenreplacingcomponentsinsystemstheircompatibilityandfunctionalitymustbeas-sured.

Unexpectedfailurescanbeavoidedbyselectinghighqualityandmarinecompliantcomponentsbothduringtheship'sconstructionphaseandwhencomponentsarerenewed.Inaddition,goodandup-to-datedocumentationofusedandstoredcomponentsisneeded.

SufficientKnow-HowDeficiencies inship-specificdocumentation, lackofknowledgeandexperienceasaresultofcrewchangescausedproblemsintheoperationandmaintenanceofsystems.Knowledgeaboutsystemsisaveryimportantpartofthecrew'sknow-how.Theshippingcompanymustensurethattheshipismannedwithacrewwiththeskillsrequiredtocarryoutthetechnicalserviceandmaintenancetasksoftheship.Theoperatingsystemsofdifferentequipmentareoftentoocomplicatedinrelationbothtohowoftentheyareneededandtothecrew'sskills.

Anewcrewarrivingatavesseldoesnotalwayshavetimetocarefullyfamiliarisethemselveswiththeirduties.Inordertoguaranteesafeoperationofthevesselwhencarryingoutcrewchanges,

49

shippingcompaniesmusttakeintoaccounttheskillsrequiredforthepositionaswellasthequal-ificationsandworkexperiencefromsimilarpositionsofthepersonselectedforthejob.

Forthepurposesoffamiliarisation,itisimportantforthevesselstohaveclearoperatinginstruc-tionsforallsystems,atleastintheworkinglanguageoftheship.Thevesselmusthavesafeproce-duresthathavebeenimplementedinthesafetymanagementsystem,thatarebasedonriskas-sessmentandthathavebeentrainedanddrilled.Whenthisisrealised,everyoneisawareof,andknows,theirroleinsituationsinvolvingdisturbancesandemergencies.

Theshippingcompanyandthecrewmustbefamiliarwiththedeviationreportingprocedures.Theymustbeabletocompilereportsandtheymustalsoreportonnoteddeviations.Theshippingcompany'smanagementandtheship'screwmustdemonstratetheircommitmenttothereportingsystemrequiredintheISMCode,byensuringboththattheycanmanageitandthatitworks.

ReliabilityofSystemsThereweredeficienciesinthedesignanddocumentationoftheautomationsystems.Thedif-ferentfunctionsoftheautomationsystemhadnotalwaysbeentestedinaccordancewithreg-ulations.Testsaredonetodetectdeficiencies.Thefastageingofautomationsystemsisaprob-lem.Systemupgrades,supportandsparepartsmaynotbeavailableforthewholelifetimeofasystem.Duplicatingcriticalsystemsandsufficient,functioningbackup-andemergencysystemsarecen-tralwhentryingtoeitherpreventpowerfailuresinthesystems,ortomitigatetheconsequencesofthem.

Systemsmustbetestedwheninuseandwhendoingmaintenanceworkonthem.Thevesselmusthave suitableequipment for testingand thenecessarybackup files for theautomation systemonboard.Inaddition,maintenanceworkonsystemsmust,fromthepointofviewoftheuser,beaseasyaspossible.Complexfaultsituations,suchascompletepowerfailures,areusuallynottestedbecauseoftheriskofdamagingsystems.

Testingbackupsystemsaswellasdisturbancesandfaultsituationsbeforearrivingtothenarrowfairwaysinthearchipelagoorininlandwaterways,ortothepilotboardingplace,wouldimprovesafety.

Availabilityandqualitycontroloffuelneededforproducingelectricityisimportant.Waterthathadenteredthefuelsystemcausedapowerfailuresincethequalityofthefuelhadnotbeensufficientlymonitoredonboard.Theproductionofelectricalenergyrequiresarobustandreliabletechnicalsolution.

Regularmaintenanceofvessels'fuelsystemsreducesthefuelrelatedrisk,which,ifrealised,canresultinsimilarsituationsaspowerfailures.

ConditionsTheconditionsandthecargosareofimportanceintermsoftherisksinconnectionwithpowerfailures.Apowerfailureisaseriousdeviation.Monitoringchangesintheoperatingconditionsmustbeactiveandproactive,sothatthereisampletimetoreacttothem.

Lossofmanoeuvrabilityinnarrowfairwaysinthearchipelagoandininlandwaterways,or atopenseaindensetrafficareas,canresultinseriousseaorenvironmentalaccidents.Theriskofanaccidentisgreaterinsituationswheretheback-upandemergencysystemsarenotavailableforimmediatestartup,donotwork,orareofinadequatepower.

50

Pilot’sandshipcrew’scommonviewandsituationalawarenessontheoperationoftheship'ssys-temsareimportant.Thisishighlightedinthenarrowwatersofthearchipelago,wherethebriefestofpowerfailurescanleadtoaseriousseaaccidentorenvironmentalaccident.

SAFETYRECOMMENDATIONS

ProceduresforReportingPowerFailuresAccordingtotheISMCode,shippingcompaniesmust,inthesafetymanagementsystem,iden-tifythevessel'scriticalsystemsandequipmentthat,incaseofasuddenfailureorincorrectuse,canresultinahazardoussituationoraccident.Apowerfailureisaseriousdeviation.Thereisnoaggregatedorcomparable informationavailableondeviations inconnectionwithpowerfailures.TheSafetyInvestigationAuthorityrecommends,that

ThereformoftheFinnishMaritimeCode,ifimplemented,createstheconditionsfortheimple-mentationofthisrecommendation.Reportingofincidentsisrequiredinthedraftofthenewcode.It is important that the new procedures for reporting to be developed, allow for concretemeasurestobetakeninordertoaddresstheidentifiedproblem.Itisalsoimportantthatthedefinitionsneededinthereportingareclearandunderstoodinthesamewaybyvariouspar-ties.Thisrecommendation,ifimplemented,wouldalsocontributetopinpointingrisksconnectedwiththeemergingtransportsystemandtopreparingforthem.

AssessingtheNeedforDevelopingtheLegislationConcerningSafeConductofVessels

Theconditionsandthevessel’scargoareof importance forthegravenessandextentoftheconsequencesofapowerfailure.Thisisemphasisedinthenarrowfairwaysinthearchipelagoandininlandwaterways,wheresafetymarginsfornavigationoftenareverysmall.Aseaacci-dentinthesecircumstancescanalsocauseaseriousenvironmentalaccident.Thereliabilityandsufficiencyofthebackup-andemergencysystemsare,forthisreason,ofutmostimportance.TheSafetyInvestigationAuthorityrecommends,that

Procedurese.g.relyingsolelyontheuseofashaftgeneratorinnarrowfairwaysinthearchi-pelagoandininlandwaterwaysincreasetheriskforaccidents.

TheFinnishTransportSafetyAgencytogetherwiththeshippingcompanies,developpro-cedurestoobtaindetailedinformationaboutpowerfailuresforanalysingpurposes.[2017-S60]

TheFinnishTransportSafetyAgencytogetherwiththeFinnishEnvironmentInstitute,as-sesstheadequacyofandtheneedforthedevelopmentofthelegislationconcerningthesafeconductofvesselsinthearchipelagoandininlandwaterwayareas.[2017-S61]

51

Helsinki,4December2017

JariAlanen TeemuLeppälä TuomoLindell

JohannaVahtera RistoHaimila

52

SUMMARYOFSTATEMENTSRECEIVEDONTHEDRAFTINVESTIGATIONREPORTThedraftincidentreportsweresentforstatementsinJuly2017.Statementswerereceivedfromfourshippingcompanies.BasedonVikingLineLtd'sstatement,thenumberofmainenginesonM/SMariellawascorrectedinthereport.ESLShippingLtdstatedthattheparagraph"Negativesafetyaspects"didnotfullycorrespondwiththeirview,asthevoltageproblemofauxiliaryNo.3hadbeenunderscrutinyalreadyforalongerperiodoftime.Thetworemainingshippingcompaniesstatedthattheincidentreportswereclearandinlinewiththeevents.ThedraftinvestigationreportwassentforstatementsinOctober2017.Statementswerere-ceivedfromtheFinnishTransportSafetyAgencyandtheFinnishEnvironmentInstitute.Thestatementssupportedtheinvestigationandwerepositivetotherecommendations.AccordingtothestatementoftheFinnishEnvironmentInstitute,theinvestigationreportpointedout-inapraiseworthyway-thatinadditiontotheinvestigatedincidentstherehadbeenotherincidentsthathadnotbeeninvestigatedoronwhichnodatahadbeenobtained.Basedonthis,theFinnishEnvironmentInstitutewished,thatthemaritimereportingsystemwouldbedevelopedsothatasmanydisturbancesanddeviationsaspossiblewouldcometolight.TheFinnishEnvironmentInstitutealsostatedthattheysupporttherecommendationthattheneedtorevisetheregulationsconcerningsafeconductofvesselsinthearchipelagoandininlandwaterwaysmustbeevaluated.TheFinnishTransportSafetyAgencysaidintheirstatementthattherecommendationintheinvestigationtodevelopprocedurestogetherwiththeshippingcompaniesforobtaininginformationconcerningpowerfailuresalreadyhasbeenrealised.AspartofthenewreportingschemeshippingcompaniesareobligedtoreportaccidentsaswellasincidentstotheFinnishTransportSafetyAgency.TheFinnishTransportSafetyAgencyalsostatedthattheywillbeincontactwiththeFinnishEnvironmentInstituteconcerningthesecondrecommendationinthereport.