Marine Investigation Report M02W0135

On 04 August 2002, the passenger vessel Statendam embarked passengers in Vancouver, British Columbia, for a one-week cruise to Alaska and back. At 2025 Pacific daylight time, about three and a half hours after departure, the main circuit breaker for one of the diesel generators suffered a catastrophic failure. This started fires in the main switchboard room and the adjacent engine control room. The crew successfully extinguished both fires using portable CO₂ extinguishers, and the vessel returned to Vancouver under tow. There were no injuries.

1.1 Particulars of the Vessel

Name	"STATENDAM"
Official number	C 1498
Port of registry	Rotterdam, the Netherlands
Flag	The Netherlands
Type	Passenger vessel
Gross tonnageFootnote 1	55 451
LengthFootnote 2	219.4 m
Draught	Forward: 7.5 m	Aft: 7.6 m
Built	1992, Montfalcone, Italy
Propulsion	Sulzer diesel-electric 24 000 kW, twin controllable pitch propellers
Crew	602
Passengers	Maximum: 1629, Carried: 1498
Managers	Holland America Line Westours Inc., Seattle, Washington, United States

1.1.1 Description of the vessel

The Statendam was built in 1992 by Fincantieri Navali Italiani S.p.A, Italy, for Holland America Line Westours Inc. (Holland America Line). The vessel, first of four similar vessels known as the Statendam class, was designed and built to Lloyd's Register of Shipping rules. At the time of its construction, the Statendam was required to, and did, comply with the SOLAS^{Footnote 3} and its 1981 and 1983 amendments. The vessel is designed for unrestricted international voyages and holds Lloyd's Register highest construction certification (+100A1).

The vessel's propulsion system consists of three 8-cylinder and two 12-cylinder Sulzer diesel engines, driving 6.6 kV alternators for a total available power of 34 560 kW. Two electric propulsion motors of 12 000 kW each drive two controllable pitch propellers to give a maximum sea speed of about 21.7 knots (kn). To achieve optimum operating and mechanical efficiencies and to comply with local air pollution regulations, different combinations of engines are used to provide different power and speed requirements (see Appendix B).

Each propeller has its own high-performance Becker-type rudder, turned by a pair of electro-hydraulic steering gears. The vessel also has two bow thrusters and one stern thruster of 1720 kW each.

The Statendam has an enclosed wheelhouse with propulsion and steering controls located on the centre, port, and starboard consoles.

The engine room is located on the lowermost deck of the ship. Crew cabins, workshops, offices, refrigerated chambers, and various storage compartments are situated on decks above the engine-room deck. Passenger cabins, lounges, dining, and entertainment areas are arranged on higher decks. The ship can carry a maximum of 1629 passengers and 602 crew in 633 cabins.

The vessel is equipped with a fixed carbon dioxide (CO₂) smothering system. Its bottles and central control station are in a dedicated CO₂ room on the uppermost deck (see Figure 1). The vessel is divided transversely and vertically by fire zones 1 through 6 and horizontally by compartments A through H. Piping systems extend from the CO₂ room to these compartments and can selectively release CO₂ into them. The zoning arrangement allows the system to provide segregated fire protection to several different spaces, including the engine control room (ECR) and forward engine room.

The vessel has a diesel engine-driven emergency generator located in an emergency generator room, which is also on the uppermost deck. The emergency switchboard is in the emergency generator room. The emergency generator is rated at 800 kW, which is sufficient to supply power to all essential services in an emergency. Essential services include equipment for navigation, communication, steering, firefighting, and emergency lighting throughout the vessel.^{Footnote 4}

1.1.2 Engine room

The engine room, which is located on decks D and C, contains the five diesel generator (DG) sets, two propulsion electric motors, sewage plant, fresh-water generators, boilers, incinerators, oily-water separators, air compressors, purifiers, and various pumps with their associated storage tanks, piping systems, and control valves. It is divided into six sections by transverse watertight bulkheads, and openings are closed off by watertight doors.

1.1.3 Main switchboard and main switchboard room

The output from the main DGs is routed through a dedicated switchboard room, which is located on the C-deck level of the engine room (see figures 3 and 4 in Appendix C). The main switchboard room (MSR) contains 6.6 kV and 440 V switchboards and their associated bus bars, control and protection switchgear. Step-down transformers are located in a dedicated transformer room, which is forward of the MSR and at the same level.

The voltage produced by the DGs is connected to the 6.6 kV bus bars through five gas-filled circuit breakers.^{Footnote 5} The bus bars are in two parts, interconnected by a bus-tie breaker, with DGs 1 and 2 connected to one side, and DGs 3, 4, and 5 connected to the other. In turn, the 6.6 kV bus bars are connected, by similar gas-filled circuit breakers, to such 6.6 kV consumers as the cyclo-converters for the propulsion electric motors, the stern and bow thrusters, the air conditioning compressors, the motor generator sets for stabilized 440 V supply, and the transformers. Under normal conditions, the system is operated with the bus-tie breaker closed. This effectively forms a single bus bar that receives all the incoming power and feeds all the outgoing consumers.

To reduce cabling length, the MSR is located close to the generators and within the vertical and horizontal boundaries of the engine room. The MSR is constructed of welded steel. It has two doors opening into it from the engine room and two doors opening from it into the transformer room. The MSR shares a bulkhead with the transformer room and the fuel injector test room, while its deckhead forms part of the deck of the ECR above.

The vessel's CO₂ smothering system is arranged so that the MSR is part of the forward engine room zone. The MSR does not have an independent smothering system of the type provided for small high-risk spaces, such as paint lockers and galleys.

1.1.4 Engine control room

From the ECR, every item of machinery and machinery equipment in the ship can be remotely started, operated, monitored, and stopped. DGs, pumps, compressors, boilers, process control systems, temperatures, and pressures are all monitored and manipulated from various control stations in the ECR. Together with the wheelhouse, it is one of the two nerve centres of the entire vessel and is critical to the vessel's safe and smooth operation.

The ECR is located on deck B, outside the boundaries of the engine room and immediately above the 6.6 kV MSR. It is much larger in area than the MSR and almost the entire deckhead of the MSR forms a portion of the deck of the ECR. Cabling rising up from the MSR goes through suitable deck penetrations before it is laid out on cable trays about 100 mm above the ECR deck. From there, it is routed to various control switchgear, and electronic control and monitoring systems.

1.1.5 Structural fire protection between main switchboard room and adjacent compartments

The level of fire protection provided by a division is described by a class designation (see the following table), which is assigned considering the following two factors:

• the length of time during which the division is capable of preventing the passage of smoke and/or flame (structural boundary), and
• the length of time during which the division is capable of limiting the temperature rise of the unexposed side to within prescribed values (thermal boundary).

Structural Boundary	Thermal Boundary
	0 min	15min	30min	60min
0 min	C (must be non-combustible)	-	-	-
30 min (flame only)	B-0	B-15	B-30	-
60 min (smoke and flame)	A-0	A-15	A-30	A-60

Thus, an A-60 division retards the transmission of heat and does not allow the average temperature on the unexposed side to rise by more than 139°C over a period of 60 minutes. Similarly, an A-30 bulkhead retards the transmission of heat for 30 minutes and an A-0 bulkhead, for 0 minutes. All A-class divisions prevent the propagation of smoke and flame for at least 60 minutes.

According to Chapter II-2, Part B, Regulation 26 of the SOLAS, the ECR is considered a Category 1 space, and the MSR and the transformer rooms are considered Category 10 spaces. Consequently, the deckhead separating the MSR from the ECR, and the bulkheads separating the MSR from the transformer and fuel injector rooms were constructed to A-0 class fire protection standards.

1.1.6 6.6 kV main circuit breaker

The circuit breaker safely allows the DG to electrically connect to, or disconnect from, the bus bars, as and when required. It contains spring-activated moving and fixed contacts, and the mechanical linkages, cams, and levers associated with the operating mechanism. To suppress the considerable electric arc produced by opening the contacts, all the breaking parts of the circuit breaker are enclosed within a hermetically sealed epoxy-resin chamber, containing pressurized^{Footnote 6} sulphur hexachloride (SF6) gas.

Three sets of poles connect the generated three-phase voltage of each DG, with the three phases of the (live) bus bars. In this circuit breaker design, the three poles are housed in a single epoxy-resin case that contains pressurized SF6 gas. Each pole assembly contains the fixed, main, and arcing contacts, along with their mechanical operating elements. The arcing contacts are enclosed in arcing chambers.

Each circuit breaker is mounted on rails and can be withdrawn from, or inserted into, the bus bars by a rack and pinion arrangement. The rear of the assembly has six female socket terminals (three each on the incoming and main bus bar sides) into which the male ends of the bus bars fit. The bus bars themselves are strips of copper bar, 75 mm wide and 4 mm thick, suitably shaped at the mating ends.

Safety interlocks prevent breaker closure if there is a loss of SF6 gas charge along with connections to the engine-room alarm and monitoring system. On the front panel, a pressure gauge indicates the SF6 charge^{Footnote 7} and a mechanical counter records cycles of operation.

The DG circuit breakers are designed with a breaking capacity of 12.5 kA and a "short time withstand current rating" of 14.5 kA for three seconds. This is more than 10 times the normal rated current of 1.25 kA, giving the protection relays sufficient time to interrupt the circuit. Similarly, the bus-tie breaker has a breaking capacity of 31.5 kA.

1.1.7 Automatic control system for the diesel generators

The engine room is highly automated. At the time of the occurrence, it was designated as an "unmanned machinery space."^{Footnote 8} Although it was fit to operate that way, it was not; there was a full complement of watchkeepers monitoring the machinery at all times.

The DG sets are fitted with a load-dependency monitoring system that automatically calls up or shuts down the DGs depending on the electric load demanded by the consumers. The load-dependency feature can be disabled by the operator, in which case the DGs have to be manually started and stopped.

Once an engine has been selected and started by an operator, if the automatic paralleling system is enabled, it synchronises the incoming alternator with the bus bars. When the incoming alternator operates in parallel with other alternators, it arranges the load sharing so that the bus bar load is shared either equally or at a level assigned by the operator.

The main circuit breaker and the electrical side of each DG set are monitored by a protection system that can trip the circuit breaker and activate a lock-out relay in the event of a fault. The alternators are protected against the consequences of reverse power, over-current, and under-voltage, etc. (see Appendix B). If the circuit breaker of a DG is stopped by the protection system, it cannot be closed until the fault is rectified and the lock-out relay has been reset.

The protection relays have indicator buttons that pop out when they are activated. If a circuit breaker trips for any reason, the fault condition that generated the trip can be easily determined by inspecting that particular protection relay and locating the activated indicator button. While the lock-out relay has to be manually reset, the individual protection relays reset automatically once the fault condition has been cleared and the lock-out relay reset.

Various parameters on the diesel engine drive of the alternator are also monitored. These are specified by the rules of the flag state and the applicable classification society. These parameters include pressures and temperatures for lubricating oil, cooling water, and exhaust gas, etc. Deviations above or below pre-set values generate audio-visual alarms and can initiate automatic engine shutdowns. An automatic engine shutdown can be critical, in which case the engine is stopped immediately without giving the automatic power management system time to call up and parallel a standby DG. It can be non-critical, in which case the engine is stopped after 60 seconds, allowing the standby DG enough time to start and synchronise itself with the bus bars.

Since the non-critical shutdown system is time-dependent, its "timer" is automatically reset to zero if the fault condition is rectified (or disappears) before the 60 seconds are up. In this case, the engine will not stop.

The monitoring system is connected to an event logger that can continuously record events. Every alarm condition and significant event encountered is automatically recorded in its database. However, since the circuit breaker protection relays have their own fault indication system (in the form of indicator buttons or flags), not all of them are connected to the event logger.

1.2 History of the voyage

On 04 August 2002, the Statendam barked passengers in Vancouver, British Columbia, for a week's cruise to Alaska and return. During the trip north, company management had arranged for the vessel to conduct fuel consumption trials at various speeds and engine combinations. Consultants from a private firm boarded the vessel in Vancouver to carry out these tests for the duration of the 36-hour trip to Sitka, Alaska.

At approximately 1545 Pacific daylight time,^{Footnote 9} the engine-room staff received the one hour's notice of readiness for departure. The 12-to-4 watch was present in the engine room with a second and a third engineer, and an oiler. The chief engineer, chief electrician, and the three second-electricians were on day work and did not have any watchkeeping duties. They were engaged in various tasks around the vessel.

The second engineer informed the chief engineer of the one hour's notice, then began preparing the DGs and main propulsion system for departure. This entailed starting and paralleling four DGs on to the 6.6 kV switchboard. (While three engines are normally sufficient, the number of engines used is left to the master's discretion. The decision about how many engines to use may depend on vessel traffic, weather conditions, and operational demands, etc.)

DG 2 was started at 1625^{Footnote 10} and by 1627 it had synchronised itself automatically and was sharing load in parallel with DGs 3 and 4, which were already on the board. Soon after, the monitoring system sensed a low cylinder oil flow condition. After generating the appropriate warning alarms, it initiated a 60-second shutdown and automatically shut down DG 2, opening its main circuit breaker at 1630. The second engineer determined that this was due to either a malfunction in the cylinder lubricating oil pump unit, or to a loose electrical connection in the cylinder lube oil flow sensor and, with the help of the third engineer, worked to rectify the fault.

The other DGs were then started and, with four of them running in parallel, the vessel departed Vancouver at 1655. Two British Columbia coast pilots were on board and the full away signal was given at 1724.

In the meantime, the 4-to-8 watch, comprising a second and a fourth engineer, and an oiler, had come on duty in the engine room at 1630, taking over from the 12-to-4 watch. The chief engineer had also come down to the ECR and during the ensuing events was either there or in his office, which was located adjacent to and abaft the ECR. None of the four electricians were present in the ECR at this time, nor did company rules require them to be.

At 1733, DG 2 was started for testing and allowed to synchronise and parallel itself with the bus bars. It was discovered that the fault had not been rectified, and the cylinder oil low flow alarm and shutdown were still fluctuating between a normal and an alarm condition. After about five minutes of parallel operation, it was manually taken off load from the ECR and allowed to run on no load for another five minutes before stopping at 1743. By this time, the vessel was northbound through the Strait of Georgia at a speed of about 11 kn. Power consumption was about 40 per cent of the total available on the bus bars. Since the engineers had been unable to find a mechanical fault with the cylinder oil pump and had determined that the cylinder oil flow was normal, they concluded that the alarm was due either to a faulty sensor or to its electrical connection.

The vessel was then brought up to its full sea speed to start the programme of fuel consumption tests. Accordingly, DG 2 was restarted and four minutes later, at 1747, was back on line. An additional 20-second time delay was now imposed on the 60-second non-critical shutdown. Just before restarting DG 2, with four DGs on load, the Statendam's speed was about 16.5 kn and power consumption was about 61 per cent of the total available.

At 1805, after it had been running for about 18 minutes, the DG 2 electrical protection system sensed a fault and immediately tripped its circuit breaker and lock-out relay without allowing it to gradually transfer its load to the other generators. The vessel was now travelling at about 18.8 kn, and the total power consumption was about 78 per cent of the total available from the remaining four DGs. Following the DG 2 tripping, the load on DGs 1 and 3 reached 85 per cent of their deliverable power limit, which set off a high-power alarm. The propulsion power management system then automatically reduced the load on the propulsion electric motors and, thereby, on the DGs. The chief engineer, who was in his office, and the chief electrician, who was elsewhere on the vessel, were not informed of this trip, nor was there an attempt to analyse the reason behind it. One of the engineers reset the lock-out relay at 1810. By 1814, DG 2 had been restarted and was back on line supplying power to the main bus bars.

With all five DGs now on load, the vessel continued to accelerate. At 1820, it was travelling at a speed of about 19.2 kn; total power consumed was now 63 per cent of the available power. Between 1810 and 1819, the chief engineer and chief electrician came into the ECR independently. At 1820, the electrical protection system sensed an overload condition for DG 2 and the bus-tie breaker of the switchboard. Milliseconds later, to prevent instability in the bus bars, the bus-tie breaker opened, which was followed by tripping of various 6.6 kV consumers and the 440 V switchboard. The circuit breakers for DGs 1, 2, 4, and 5 also opened (chronologically in this order). By 1821, the Statendam had lost all propulsive power and most of the hotel services. DG 3 remained connected to the bus bars and continued to supply power to its side of the bus bars. Consequently, the vessel did not suffer a total blackout.

In the wheelhouse, the master ascertained that the vessel was in no immediate danger of running aground and did not pose a navigational hazard of any kind. The Statendam was in the Strait of Georgia about four miles off Gower Point, British Columbia, the closest point ashore (see Figure 2). The master informed Marine Communications and Traffic Services (MCTS) of the situation, giving the vessel's position, although he did not broadcast a PAN PAN message.^{Footnote 11} Appropriate announcements were made in a timely manner to the passengers and crew, reassuring them and apprising them of the situation. There was no panic.

Meanwhile, the engine-room staff, including the electricians and off-duty personnel, had gathered in the ECR. They proceeded to reset the main circuit breaker protection trip relays, restart the DGs, and restore full electrical supply to the engine room, main propulsion motors, and accommodation areas. Approximately 50 minutes later, at 1913, DG 4 was restarted and connected to the same side of the switchboard as DG 3. At 1929, the overload trip on the bus-tie breaker was reset and an unsuccessful attempt was made to close the bus-tie breaker and connect the two sides of the bus bars. However, its monitoring circuits sensed an abnormality and it immediately tripped out on overload. Closing the bus-tie breaker also produced a similar overload alarm condition on the DG 2 circuit breaker. Significantly, DG 2 was not running at this time and its circuit breaker was open. This was neither investigated nor analysed by the ship's engineers or the electricians. A second attempt was made to close the bus-tie breaker. This was successful and the other DGs were now progressively started up and paralleled. At about 1956, when sufficient power was available to run the main propulsion motors, the vessel got under way again, slowly accelerating to 16.5 kn as more DGs were put on line, with DG 5 coming on at 2018.

At this stage, the master and the chief engineer, consistent with their Safety Management System (SMS) procedures, called staff at the company head office, including the electrical superintendent. The information exchanged between the chief engineer and the electrical superintendent was minimal and limited to a brief account of the events after 1820. The electrical superintendent did not ask why the circuit breakers tripped, nor did the chief engineer offer this information. The causes of the trips were not investigated at this stage, nor was advice tendered or solicited.

Once the other DGs had been restarted, the chief engineer and the chief electrician discussed the situation and decided to impose a 75 per cent load limit on DG 2 and restart it. At 2025, DG 2 was restarted and allowed to parallel itself automatically. A few seconds later, a loud bang was heard, following which the bus-tie breaker and breakers for DGs 1, 2, 4, and 5 tripped off the board, once again leaving the vessel without propulsion power and without most of its hotel services. DG 3 continued to run, as before supplying limited power through one side of the 6.6 kV switchboard.

Approximately three minutes after the DGs tripped, an engine-room oiler reported to the ECR that there was smoke near DG 3, and the engineer notified the bridge. When the engineers investigated, they discovered that the MSR was filled with dense black smoke. Meanwhile, the fire detection system in the wheelhouse also indicated the MSR fire. The fire alarm was immediately sounded, and fire teams mustered at a marshalling area outside the ECR. Very soon after, the engineers in the control room noticed that it was filling with smoke. The source was traced to burning electrical cables located in the cable space beneath the floor plates. The fire in the control room was put out promptly using portable CO₂ fire extinguishers. An engineer wearing suitable breathing apparatus continued to crew the control room.

Concurrent with firefighting in the control room, a fire team entered the MSR to fight the fire there, using portable CO₂ fire extinguishers. Visibility was limited, and although the source of the heat was in the room, they could not see any flames. Various fire teams entered the MSR in uninterrupted relays, allowing tired fire teams to recuperate. Portable CO₂ fire extinguishers were continuously discharged. As the smoke dissipated and visibility improved, the fire teams advanced deeper into the room. Eventually, the source of heat was located in the console containing the circuit breaker for DG 2, in the cabinets immediately adjacent, and in the consoles above and below. As the fire was being fought, DG 3 continued to supply 6.6 kV power to the B bus of the switchboard, located approximately one metre from the firefighting activities. At some point, steel crowbars were used to pry open some of the front and back panels of the damaged circuit breaker enclosures, to allow CO₂ to be directed to the base of the fire and cool the hot metal in the area. The fire was extinguished by 2130, and the area cooled down and ventilated by 2230. In all, 58 portable CO₂ extinguishers were expended in fighting the fire and cooling the switchboard.

Later, after the urgency of extinguishing the fire was over, the engineers and electricians set about trying to bring as much of the plant to normal operation as was possible. The circuit breakers for DGs 1 and 2, and the bus-tie breaker appeared to be badly damaged. At about 0300, DG 4 was restarted and brought on line in parallel with DG 3. However, DG 4 was subsequently shut down, and DG 3 remained the sole DG supplying electric power.

After the fire was discovered and propulsion power was lost, the master again determined that the Statendam was in no immediate danger of any kind, had plenty of sea-room, and did not pose a navigational hazard. After temporarily recovering propulsive power, the vessel had travelled about 18 miles west and was now about 6 miles southwest of White Islets. As before, reassuring announcements were periodically made to the passengers and crew. In addition, contingency plans were made, in the event that the fire got out of control. Accordingly, the lifeboat crews were put on standby, and the boats were prepared for immediate launching, but were not lowered to the embarkation decks. Passengers were asked to return to their cabins and wait for instructions.

At 2033, MCTS was informed that the vessel had lost all power and that tug assistance might be requested following evaluation of the situation. At 2048, the pilot informed MCTS about the fire, wind and sea conditions, and the ship's rate of drift. The tug Harken 10 was dispatched. At 2224, the Harken 10 arrived on the scene and began towing the Statendam towards Vancouver. As the tow proceeded, four more tugs arrived. With their assistance, the Statendam arrived at berth 3 of Canada Place, on 05 August 2002 at 0515.

1.3 Injuries to persons

There was no injury to passengers or crew.

1.4 Damage

1.4.1 Damage to the main switchboard and engine control room

After DG 2 was restarted at 2025, its main circuit breaker failed with the violent release of a large amount of thermal energy. An electrical arc was generated, which seriously damaged circuit breakers, relays, and switchgear in the panels on either side, above, and below. The bus bars in the immediate vicinity were vaporized, and there was considerable damage to the high-tension and control cables. Radiant heat from the MSR was rapidly transmitted to the ECR through the MSR deckhead, where it ignited electrical cables located beneath the deck plates.

1.4.2 Damage to the eEnvironment

There was no damage to the environment.

1.5 Personnel

The Statendam carried 25 nautical and engineering officers.

The engine department had 13 officers. In addition to the chief engineer, there were four second-engineers, two third-engineers, two fourth-engineers, one chief electrician, and three second-electricians.

1.6 Certification

1.6.1 Vessel

The Statendam was certificated to the requirements for a vessel of its class and type. The certificates were all valid and current.

1.6.2 Personnel

The officers and crew on board were certificated in accordance with the International Convention on Standards of Training, Certification and Watchkeeping for Seafarers, 1978, as amended in 1995 (STCW Convention).

In addition, the senior engineer officers had been trained in engine-room resource management. They had been instructed in how to work cooperatively and in coordination with the other engineers on watch in the engine room and how to use all available resources in the most efficient and optimum manner. Effective communication between engine-room staff, and between the engine room and the wheelhouse, was also covered in the training.

1.7 ISM code and the Statendam's Safety Management System

Holland America Line developed a Safety Management System (SMS) for the Statendam to meet the requirements of the ISM Code.^{Footnote 12} Accordingly, Lloyd's Register of Shipping, on behalf of the Netherlands Shipping Inspectorate, issued a Document of Compliance and a Safety Management Certificate to the company and to the Statendam. The SMS is subject to renewal every five years with an interim inspection every two and a half years by an external audit and an annual verification by the company through internal audits.

In accordance with the ISM Code, the Statendam's SMS includes procedures for reporting, investigating, and analysing accidents and hazardous occurrences, so that suitable corrective action can be taken to avoid recurrence and to improve safety. Procedures had also been set up to address identified operational risks and safety-critical equipment and systems.

1.7.1 Rapid reporting system

As required by the ISM Code, the company established a reporting system^{Footnote 13} that requires systematically analysing accidents and incidents. In this way, policies and procedures can be evaluated and, if necessary, developed further, and the experiences and lessons learned can be shared with the fleet.

One of the components of this system is a Rapid Reporting System. It lists types of incidents that require prompt verbal sharing of incident-critical information between the master/chief engineer on the vessel and the Vice President, Marine Operations or other designated company officials ashore.

The purpose of this system is not only to ensure information sharing between the vessel and the company, but also to enable the company to take such action as may be necessary to ameliorate the perceived effects of the incident and to provide such guidance as is deemed necessary.

1.7.2 Initiatives towards blackout prevention and plant recovery

While procedures were established to address identified operational risks, the SMS also sought to identify, correct, and learn from non-conformities, safety-critical incidents, and near misses.

Thus, blackouts (and DG shutdowns, which can lead to blackouts) aboard the vessels are viewed very seriously. Company management attempts to learn from every such incident so that recurrences can, as far as possible, be avoided, and when they do occur, optimum plant recovery can be achieved with minimum delay and confusion.

Accordingly, since 1997, the "designated person" and his staff had investigated every reported blackout and the resulting analysis and recommendations had been shared with the ships' crews in the company fleet. Additionally, various Technical, Operational and Administrative Directives and Fleet Alerts pertaining to blackout prevention and recovery (BOPR) had been issued to the fleet.

In 2000/2001, the American Bureau of Shipping was commissioned to do a fleet survey and analysis, and provide recommendations for BOPR.

At all recent Fleet Senior Management conferences, the company's technical management team had reviewed BOPR measures with the attending chief engineers.

In 2001, a senior-level BOPR group was set up at the company's technical management headquarters in Seattle, Washington, United States. The group developed a BOPR plan with three phases. The objective of phase 1 was to "get the word out." Phases 2 and 3 dealt with systems and practical training. At the time of the accident, phase 1 had been completed. All past blackouts had been reviewed and, as a result, six "Lessons Learned" had been issued to the fleet.

In accordance with the ISM Code, all the documents associated with the BOPR, such as Lessons Learned and the Directives and Alerts, were kept in binders, copies of which were available in the chief engineer's office, the ECR, and the wheelhouse. The ship's engineers were required to read these documents. Under the chief engineer's direction, informal operational meetings were held at which these topics were discussed.

New employees were required to read the binders, and engineers returning from leave were required to read the documents added during their absence. However, the engineers were not required to sign off that they had done so.

1.7.3 Holland America Line's personnel training initiatives

In accordance with the ISM Code, the company employed seafarers who were qualified and medically fit according to the standards set by the STCW Code.^{Footnote 14} The company had identified areas where it felt this minimum standard needed to be supplemented by additional training for selected ranks of crew members. This additional training included courses in engine-room resource management, law, sexual harassment, workplace safety, and team building.

Since early 1991, Holland America Line had taken delivery of nine new vessels fitted with medium-voltage generation and distribution equipment, and electric propulsion. The company selected senior engineers and electricians to stand by a vessel and oversee its construction and commissioning. The equipment manufacturers, ABB and SEGELEC, trained and familiarized these employees with the ship's 6.6 kV electrical system, and the automation and control systems. In addition, course material was prepared and distributed, and the intention was to have these officers train the incoming generation of ship's crew, who in turn would train the ones who followed them.

Aboard the Statendam, this system of succession training worked well in the beginning, but fell into disuse after the initial years. At the time of the accident, neither the engineers nor the electricians had been trained in the ship's electrical generation, distribution, and application systems.

Since 1999 and continuing to date, Holland America Line has employed a full-time automation and control system specialist to work on maintenance, upgrades, failure analysis, and crew training for automation and control system software.

In 2002 and before the accident, a chief engineer from the fleet was assigned to develop phases 2 and 3 of the BOPR programme. These phases consist of Systems Training and Practical Training in the medium-voltage power generation, distribution, and propulsion systems aboard their vessels.

1.7.4 Emergency preparedness and firefighting

The vessel's SMS had established a Fire and Emergency Organization that specified procedures for identifying and responding to shipboard emergencies. Regular training exercises and drills were carried out for practice and to permit the ship's crew to identify, evaluate, and address any shortcomings in these procedures. This would enable them to perform more efficiently and be better prepared for emergencies.

In addition, verbal instruction was given once a month on a variety of possible safety-critical emergencies. These included firefighting procedures for fires to generators and switchboards.

1.8 STCW Code, Certificates of Competency, and knowledge of electro-technology

The STCW Code establishes the minimum level of essential knowledge and proficiency required of seafarers, enumerates the different ways it can be attained, and specifies the criteria required to evaluate it.^{Footnote 15} To be awarded a Class 1 (chief engineer) or Class 2 (second engineer) Certificate of Competency, a candidate has to pass oral and written examinations (conducted by flag state administrations) in various subjects, one of which is electro-technology.

The STCW Code considers the chief and second engineers to be sufficiently competent to operate, maintain, and repair all electrical, electronic, and control equipment aboard a vessel.

Traditionally, voltage generation aboard ships has been low voltage, with 440 V being the most common. The majority of vessels today are equipped with such generation and distribution systems. However, with the advent of more stringent air pollution regulations and restrictions on the NO_x and SO_x^{Footnote 16} emission levels, there is a trend towards electric propulsion and medium-voltage generation of 6.6 kV and 11 kV. While these generation and distribution systems have become almost mandatory in cruise ships, which frequently ply ecologically sensitive waters, they are also increasingly used in specialized vessels, drill ships, and some very large crude carriers and container ships.

Such vessels are switching from the traditional low-voltage (or below 600 V) generation with internal combustion engines providing main propulsion, to electrical propulsion using what is known in the industry as a power station configuration, that is, a number of diesel engines and gas turbines driving 6.6 kV or 11 kV generators that are connected to the main switchboard. Electronic power and frequency converters then provide power to low-speed, high-torque propulsion motors to directly turn a controllable pitch propeller.

All this electrical equipment is under the supervision of the ship's engineering department. These engineers must be competent in:

• the structural characteristics of water-cooled, medium-voltage synchronous generators and propulsion motors;
• the theoretical and design characteristics of water- and air-cooled power converters and converter transformers;
• medium-voltage circuit breakers and switchgear;
• medium-voltage switchboard protective devices;
• insulation monitoring, cabling, insulation breakdown, and flashovers;
• the safe use of test equipment and safe work procedures for working in close proximity to medium-voltage energized equipment;
• safe practices for equipment isolation before working on de-energized equipment; and
• interlocking mechanisms on medium-voltage doors and tag out procedures, etc.

The knowledge of electro-technology required for certification, as laid out by many flag state administrations (such as Canada, the United Kingdom, Australia, and the Netherlands), is largely focused on 440 V generation, distribution, and application systems. However, many of these administrations, recognizing the trends and their associated requirements, are beginning to include overviews of the operation and management of medium- and high-voltage systems in their curriculum. In response to industry needs, many training institutions are also developing courses in medium- and high-voltage technology and applications.

1.9 Role of the electrical officer

In addition to employing a chief engineer and three second-engineers who were qualified to Class 1 and Class 2 levels of competency in electrical knowledge, the company employed dedicated electrical officers. The Statendam had a chief electrician and three junior electricians. The chief engineer was in charge of all the electrical and electronic equipment and machinery on the vessel. While the chief electrician supervised the junior electricians, he himself was responsible to the chief engineer, who as department head, held collective authority over everyone in the engine room.

The watchkeeping engineers could also directly task the electricians at any time to troubleshoot and fix any operational malfunctions that occurred during a watch.

A major responsibility in the chief electrician's job description was troubleshooting and solving problems related to the safety, alarm, and control devices for the main switchboard, and the main and auxiliary engines and systems. This included, but was not limited to, the ship's 6.6 kV distribution system. The chief electrician, along with the other electricians, was also required to be knowledgeable about the operational environment and capable of repairing and maintaining all the electrical machinery and electronic equipment.

It was the company's practice to have maintenance that required in-depth or expert knowledge carried out by representatives of the equipment manufacturer. (In the case of the 6.6 kV circuit breakers, this was ABB.) Further, if technical expertise was urgently required when the vessel was at sea, shore-based technical experts (such as manufacturers' representatives) could be contacted for advice as required.

Neither the STCW Code nor the flag state administration specify the level of proficiency required of electrical officers. Consequently, Holland America Line had developed its own qualifications standard for these officers, and they were assessed accordingly before being hired or promoted.

To supplement their knowledge, especially about vessel-specific equipment and systems, the electrical officers had been part of the company's initial training programme when they were overseeing the new constructions.

2.1 DG 2 main circuit breaker failure

One of the primary functions of a circuit breaker is to monitor the circuit to which it is connected and to safely interrupt the flow of electric current to that circuit when its design parameters are exceeded. This can happen when the system is incorrectly operated, when there is an abnormality present within the circuit breaker, or when there are fault conditions in the circuitry either upstream or downstream of the breaker.

On the Statendam, the main circuit breaker for DG 2 failed catastrophically, and its mechanical counter was destroyed. However, the other four DG circuit breakers had clocked an average of 1100 cycles. Each circuit breaker is designed for trouble-free performance and can go through many thousands of open-and-close cycles without suffering any appreciable wear on its fixed and moving parts. The SF6 gas chamber is also quite robust and not readily prone to damage or leakage.

The DG 2 circuit breaker tripped twice, at 1805 and at 1820. The reason for the tripping at 1805 is uncertain - the event logger did not record the cause, and the engineer who reset the lock-out relay did not check which protection relay had been activated. The event logger recorded the cause of the second tripping at 1820 as an overload. At this time, the total power being consumed was about 63 per cent of the total available. Since the load sharing between the alternators was equal or within acceptable operational parameters, this means that only 63 per cent of the total power available from DG 2 was being used - a figure below any overload setting. This would indicate that these trips were caused by an abnormality present either within the circuit breaker itself or within its protection relays.

At 2025:57, approximately 35 seconds after the engine was restarted, the DG 2 circuit breaker failed catastrophically. The violent release of thermal energy associated with the failure vaporized many of its components and caused considerable collateral damage. Consequently, a forensic examination of the circuit breaker or its protection relays to determine the cause of the failure could not be done. Therefore, establishing a causation scenario is the result of eliminating the less likely scenarios and considering the data gathered from the event logger.

A direct short circuit across two (or three) phases on the bus bars would produce extremely high current levels and would cause every generator and motor on load at the time to feed into this short circuit. The current values generated would be far in excess of any designed parameters and would trip the circuit breaker on over-current.

Since the failure of the DG 2 circuit breaker occurred even before it closed and started transmitting any power - indeed just as the process of synchronisation with the bus bars had begun - in all probability there was a dead short within it. This is substantiated by the catastrophic nature of the circuit breaker failure and is consistent with a mechanical linkage coming loose and falling across two phases just as the operating mechanism for the circuit breaker was working towards closing the contacts.

The dead short generated an arc and DGs 1, 3, 4, and 5 immediately started supplying short circuit current to it. This led to the bus-tie breaker, as well as the circuit breakers for DGs 1, 4, and 5, tripping out on overload. The arc shattered the epoxy-resin case and the accompanying flash, aided by the sudden release of pressurized SF6 gas, carried the generated thermal energy ahead of it and in all directions.

2.1.1 Detailed analysis of the DG 2 and bus-tie circuit breaker trips

2.1.1.1 First two DG 2 shutdowns

The first two DG 2 shutdowns at 1630 and 1743, one caused by a non-critical fault on the engine and the other planned, can be considered mechanical shutdowns. There is no information to suggest that the three electrical shutdowns that followed were connected, but since they are all related to DG 2, they do bear a certain relevance in understanding the sequence of events leading up to the final shutdown.

2.1.1.2 First DG 2 circuit breaker opening and its resetting

The first DG 2 circuit breaker opening and resetting occurred at 1805, when the vessel was travelling at a speed of about 18.8 kn and the total power consumed was about 78 per cent. The monitoring and protection circuits sensed an abnormality, opened the DG 2 circuit breaker (without first unloading the generator) and activated the lock-out relay.

The event logger does not indicate the nature of the fault that caused this particular trip. A list of the different protection devices installed around the circuit breaker and designed for protecting the circuit is shown in Appendix A. While any of these relays could have tripped the DG 2 circuit breaker, not all of them are connected to the event logger, although they are all connected to the lock-out relay. However, the overload protection relay is connected to the event logger, and the fact that there are no records that this relay was activated indicates that the DG 2 circuit breaker did not trip on overload the first time.

2.1.1.3 Second DG 2 circuit breaker opening and subsequent loss of propulsion and hotel services

The next tripping of the circuit breaker was at 1820 when its monitoring circuits detected an overload. The protection relay system for the bus-tie breaker also detected an overload, and both these circuit breakers opened and their lock-out relays were activated. The exact reason for this overload cannot be established - the total power consumed at this time was only about 63 per cent of the total available. One possible explanation is the presence of a short circuit fault, which generated the high short circuit current. The opening of the bus-tie breaker allowed this short circuit current to be quickly reduced to below overload levels and the DG 2 overload protection relay reset itself.

As a result, there were disturbances in the bus bar voltage. These were sensed by the protection relays of the cyclo-converters for the propulsion motors, which consequently opened their respective circuit breakers.

The event logger shows the under-voltage protection circuit for DG 1 registering an alarm about 11 seconds after the bus-tie breaker opened. Following this, its protection relays opened the DG 1 circuit breaker. This would suggest that, after the bus-tie breaker opened, DG 1 remained the only generator supplying to the short circuit, since it was on the same side of the bus bars as DG 2 and this caused it to suffer a (transient) voltage dip. Significantly, DG 2 was still connected to the bus bars, and its circuit breaker opened after the circuit breaker for DG 1, indicating that the short circuit fault was present on the DG 2 side.

About 20 seconds after the DG 2 circuit breaker opened, the protection circuits for DGs 4 and 5 also sensed the instability in the system and tripped their circuit breakers. By this time, the instability had cleared, leaving only DG 3 connected to one side of the bus bars.

DG 3 remained connected to the switchboard, since all the fault conditions were now removed. It remained connected because tripping the bus-tie breaker, and all the other DGs and major consumers, reduced electric demand to a level that could easily be sustained by DG 3.

The circuit breakers for the 6.6 kV and 440 V transformers, as well as most of the other electrical consumers, also tripped at this time.

2.1.1.4 Attempts to reset the bus-tie breaker

Immediately after the bus-tie breaker was closed at 1929, it tripped out again as its protection relay sensed an abnormal overload condition. Closing the bus-tie breaker also immediately generated an overload condition on the DG 2 circuit breaker. Significantly, DG 2 was not running at this time, and the overload alarm cleared as soon as the bus-tie breaker opened. This would indicate that there was a fault in the DG 2 circuit and that this fault could be sensed by its protection system when voltage was applied to its side of the bus bars. Once the voltage was removed, after the bus-tie breaker opened again, the fault also disappeared.

2.1.1.5 Second DG 2 circuit breaker resetting and its subsequent failure after restart of DG 2

The DG 2 lock-out relay was reset at 1932, and DG 2 was restarted at 2025:25. By 2025:42, DG 2 revolutions had stabilized and the process of synchronisation with the bus bars had begun. This would normally have taken about 30 to 35 seconds,^{Footnote 17} but 15 seconds later, at 2025:57, and even before the circuit breaker could close, its monitoring circuits sensed an overload and triggered an alarm. Milliseconds later, the circuit breakers for DGs 1, 3, 4, and 5, as well as the bus-tie breaker, registered overload alarms. This was due to a short circuit within the DG 2 circuit breaker, which caused all the other DGs as well as the consumers to feed into this fault, resulting in very high current levels. Soon after, the DG 2 circuit breaker failed catastrophically.

Opening the bus-tie breaker disconnected the two sides of the bus bars, clearing the overload on DGs 3 and 5 so that they returned to normal. The event logger shows DG 2 also clearing its overload, though this is probably a false indication caused by damage to the control circuitry associated with the DG 2 circuit breaker. The overload on DG 1 also cleared itself. This could have been due to the higher resistance offered by the arc at the DG 2 circuit breaker, as a result of which the over-current on DG 1 reduced to below alarm level. Low voltage was detected in that side of the bus bars supplied by DGs 1 and 2. Since DG 1 was the only generator connected to the bus bars, this voltage dip could have been caused by the over-current.

The overloads produced so much instability in the bus bars that the circuit breakers of DGs 1, 4, and 5 opened. The events of the previous circuit breaker trips now repeated themselves in an almost identical fashion, and, once again, the vessel lost all propulsive power and hotel services.

Once again, and for the same reasons as before, DG 3 remained connected to the switchboard.

2.2 Engine-room staff and analysis of the DG 2 shutdowns and circuit breaker trips

All but the smallest vessels rely on electricity for directly or indirectly running the propulsion plant. A disruption of this electric supply - a blackout - can cause the propulsion plant to stop, which may have serious consequences in restricted or high-traffic density waters or in heavy seas. Seafarers recognize the danger, and engineers are trained to recover propulsion quickly after a blackout. The ISM Code also recognizes this and requires the development of vessel-specific contingency plans and drills,^{Footnote 18} to enable the ship's crew to effectively and safely deal with such situations.

During departure preparation and subsequent to the vessel's departure, between 1545 and 2025, DG 2 was started and then restarted five times, only to have it either stop, or trip off the switchboard and stop, for various mechanical or electrical reasons.

The first shutdown was presumed to be due to a fault in the cylinder lubricating oil pump unit, and after the engineers worked to rectify it, DG 2 was restarted to prove the efficacy of the repair. However, since the fault condition remained, even after the cylinder oil pump and flow were found to be working satisfactorily, the cylinder oil low flow fault was determined to be due to a faulty sensor or electrical connection. The chief engineer was informed of this, and he and his staff then elected to keep DG 2 operational. They hoped to circumvent a possible shutdown by imposing an additional 20-second time delay on the automation and alarm system. This would give the shutdown timer an extra 20 seconds to reset itself to zero, as the defective sensor continuously cycled the cylinder oil low flow fault condition from ON to OFF.

The tripping of the DG 2 circuit breaker at 1805 was due to an electric fault. The first step to determine the fault that caused a breaker to trip is to check which protection relay has been activated. However, there was no attempt to find out which of these had activated the lock-out relay and caused the circuit breaker to open. Moreover, contrary to the vessel's SMS, the chief engineer was not informed of this occurrence and remained unaware of it until well into the next day.

Because one of the vessel's senior engineers, present in the engine room at the time, reset the lock-out relay and restarted DG 2 at 1813 without doing any fault finding, an opportunity to determine the cause for the DG 2 circuit breaker failure was lost.

The fourth DG 2 shutdown was accompanied by a loss of propulsion and most hotel services. The sequence of alarms and faults is well documented by the event logger. It indicates that, whereas DG 2 was the first to sense an overload condition, the bus-tie breaker was the first to open, followed by the breakers for DG 1 and then DG 2. It is worth noting that the overload.current rating for the bus-tie breaker is 2.5 times more than that of the DGs. This should have indicated to the engineers that something was seriously amiss; however no attempt was made to analyse the situation.

Further information became available to the engineers when attempts were made to close the bus-tie breaker after DG 4 had been restarted and put on the switchboard, only to have it generate an overload condition on the stationary DG 2. This too was not analysed and another opportunity to examine the situation and remedy the fault was lost. On the whole, the information available to the engineers indicated a fault with the DG 2 distribution system, but it was not adequately analysed, and consequently this fault was not identified.

Even though DG 2 was only supplying 63 per cent of its rated power (as derived from available data) at the time its circuit breaker tripped on overload at 1820, the Statendam 's senior engineers assumed that DG 2 was operating beyond its rated capacity. To prevent another tripping of the circuit breaker on overload, they reduced the DG 2 load limit setting to 75 per cent and restarted it. This, it was reasoned, would limit the load on DG 2 to 75 per cent of its rated capacity, thereby preventing another overload condition.

Just prior to the failure of DG 2, the other four DGs were all running on load. All hotel services had been restored with this engine configuration, and the vessel was capable of attaining a speed of 19 kn. Although the vessel's speed at this time was 16.5 kn, the senior engineers felt a pressing need to reconnect DG 2 so that the ship could travel at its maximum designed speed of 21.5 kn as soon as possible. DG 2 was then restarted for a fifth time and on auto, so that it would come on load soon after its revolutions stabilized. Starting DG 2 on manual control, on the other hand, would have given the engineers the opportunity to study its operational parameters and determine if there were any abnormalities present. Within a few seconds of restarting DG 2, its main circuit breaker failed catastrophically.

2.2.1 Actions of the senior engineers and the electricians

The Statendam 's electrical officers were directly tasked with troubleshooting and repairing all the electrical equipment aboard the vessel, under the ultimate responsibility of the chief engineer. In this instance, the ship's electricians (and senior engineers) continued to reset the circuit breakers without first establishing the cause of the tripping, even though the company had issued five directives pertaining to BOPR between 1998 and 2002, and taken the wide range of control measures outlined in section 1.7. The fundamental intent of the BOPR was (and is) to emphasize the need to carry out a causal investigation to ascertain the reasons for a blackout, accidental DG shutdown, or circuit breaker trip.

The vessel did not have a history of problems with the circuit breakers consistently tripping out. Consequently, the actions of the senior engineers and electricians in automatically resetting the breakers being a case of reacting to the tripping as something of just nuisance value can be ruled out. Furthermore, in this instance, there was no navigation-related emergency, in which lack of propulsive power had the potential to jeopardize the safety of the vessel.

Thus, repeatedly resetting the DG 2 circuit breaker (at 1813 and 1932) and the bus-tie breaker (at 1929 and 1930), without first establishing the cause of their tripping, suggests that company directives were not being followed, and that the engineers and electricians did not fully appreciate the level of risk associated with such a practice, namely that repeatedly resetting medium-voltage circuit breakers, without ascertaining the cause of their tripping, can result in adverse consequences. Such an appreciation would have resulted in a more cautious approach to resetting the breakers. The engineering staff based their actions on their perceptions of the prevailing circumstances, rather than on the exposure to risk.

2.3 Factors affecting perforpmance

2.3.1 Senior engineer officers and their knowledge of 6.6 kV electrical systems

The chief engineer and the four second-engineers were certificated to STCW 95 standards and held either certificates of competency, or certificates of equivalent competency^{Footnote 19} issued by the Netherlands Shipping Inspectorate.

Their theoretical background knowledge of electrical generation and distribution was based on 440 V systems. While serving aboard vessels equipped with 6.6 kV systems and electric propulsion, such as the Statendam, they had added to this basic knowledge through practical observation as they operated these systems and equipment. They had not, however, received formal training in them, nor had their knowledge of 6.6 kV systems been formally assessed.

The STCW Code requires that engineer officers at the management level, that is, chief and second engineer officers, be sufficiently competent in fault finding and diagnostics and be able to accurately identify the effect of component malfunctions on the associated plant or system.

Aboard the Statendam, even though planned maintenance was routinely carried out and the DG 2 circuit breaker was theoretically very far away from the point where appreciable wear and tear could have caused it to malfunction, the nature of mechanical things is that they break down.

To effectively diagnose problems of any sort, one has to draw on a basic foundation of theoretical knowledge, reinforced by wide practical and operational experience. The absence of one automatically reduces the influence of the other. This holds true when identifying the effect of component malfunctions on themselves or on the rest of the system. Thus, for example, while one of the effects of not correctly troubleshooting an intermittently malfunctioning overload protection relay could eventually be irreparable damage to that relay, it could also damage its associated circuit breaker(s), the alternator windings, and possibly even the driving diesel engine. Suitable breadth of knowledge and operational experience also enables the problem solver or decision maker to do an efficient risk assessment of the consequences of the malfunction, thereby establishing the basis for making a judicious decision.

Neither the chief engineer nor any of the senior engineers had the benefit of either theoretical or practical education in 6.6 kV generation, distribution, and application, or of vessel-specific training in 6.6 kV generation, distribution, and application. Furthermore, there were gaps in their knowledge of such systems. This is evidenced by their incorrectly concluding that imposing a 75 per cent load limit on DG 2 would solve the problem of its circuit breaker tripping out on overload. In fact, some basic analysis would have shown them that DG 2 was only drawing 63 per cent of its rated load. Instead, to get the vessel under way at maximum (or near maximum) design speed, the engineers and electricians repeatedly reset main circuit and bus-tie breakers without conducting pertinent fault finding or evaluating risk.

2.3.2 Operational pressures and engineering staff decision making

A modern cruise ship often carries over a thousand vacationing passengers. Cruise itineraries are planned well in advance and in great detail, and they are frequently tied in with sight-seeing trips ashore.

Passengers are a cruise ship company's source of revenue. Ensuring that they have pleasant memories of their holiday, with a minimum of discomfort, becomes an important part of the crew's mind set. Commercial and scheduling pressures, direct or indirect, can exert a significant influence on the vessel's senior officers, sometimes blurring the distinction between passenger discomfort and safety. This may lead to situations where the need to ensure the comfort of passengers influences the decision-making process.

While safe operation of a vessel is a combined effort by all the crew, it especially includes those involved in the decision-making process. With a programme of fuel consumption test planned, the Statendam 's senior engineers felt that the tests had to be completed before the company representatives carrying out the tests disembarked at the next port of call. They felt the need to adhere to the programme as much as possible.

The vessel's SMS shows that safety was considered paramount, and the company's institution of the BOPR programme indicates that they viewed blackouts and circuit breaker trips as a serious threat to safety. However, the prevailing circumstances appear to have influenced the engineering staff's decisions on the night of the incident.

2.4 Safety Management System

2.4.1 Internal and external communication

2.4.1.1 Engine-room management and information exchange within the vessel

The chief engineer managed the engine room and was responsible for the safe and efficient running of all the machinery aboard the vessel. He delegated work and responsibilities to, and received feedback from, his staff. All significant problems and machinery malfunctions were to be reported to him, and he was required to ensure that proper steps were taken to troubleshoot and problem solve in the engine department. In a crisis situation, he would be required to take on the role and responsibility of an on scene commander.

The DG 2 tripping at 1805 was not reported to the chief engineer as a malfunction. Additionally, subsequent to the tripping of DG 2 and loss of propulsion and hotel services at 1820, the engineers and electricians engaged in re-establishing power did not inform the chief engineer of the parameters that had caused the tripping of each breaker, that the tie-breaker had tripped while being reset, or that the DG 2 breaker overload alarm had gone off without the generator running or the breaker being closed. On the other hand, the chief engineer did not attempt to become fully informed of the events in the engine room by requesting all the appropriate available data. This deprived him of important information that he could have used to accurately troubleshoot.

Consequently, the chief engineer did not have a good appreciation of the situation. He could not effectively diagnose the fault that caused the DG to trip off the switchboard nor fully describe the events to the shore-based electrical superintendent.

2.4.1.2 Information exchange between the vessel and the company

Vessels such as the Statendam are designed and built to a high degree of technical sophistication with multiple redundancies. Failures, such as seen in this occurrence, are comparatively rare. The fact that failures had occurred ought to have alerted both shipboard and shore staff of an unusual event.

In fulfilling its ISM Code requirements, Holland America Line had set up a Rapid Reporting System as part of its SMS. One of its objectives is to immediately offer to the vessel the considerable expertise and resources available to the company. These range from arranging workshop and technical support, to speedily securing and dispatching urgently needed spares. More importantly, guidance and expert advice are immediately tendered and action to contain the effects of an incident quickly taken.

The effectiveness of any such system depends upon the people using it. In this case, the information passed by the chief engineer to the electrical superintendent (who had expert knowledge of the vessel's electrical systems) was confined to generalities about the loss of propulsive power and the tripping of the DG at 1820. The superintendent, in turn, did not query the chief engineer in any detail and elected to rely on the information that the situation was under control. Knowledge of the earlier (1805) incident might have given the electrical superintendent an opportunity to

• seek additional information and analysis of the data from the event recorder,
• evaluate the risk profile, and
• determine the need to proceed with caution and only after thorough investigation.

This would have provided the superintendent relevant information, essential to fulfilling his obligations under the SMS.

Thus, although the reporting element of the Rapid Reporting System was met, the information exchange between the vessel and the company was incomplete, effectively negating the benefits of the system. Internal and external communications were deficient in pertinent contextual data, and neither the chief engineer nor the shore-based electrical superintendent had or sought sufficient information to effectively diagnose the faults leading to the failure of the DG 2 breaker.

2.4.2 Crew training

Holland America Line had a system whereby the senior engineer officers who were standing by the construction of a new ship were trained in the vessel's 6.6 kV electrical systems. These officers would then train the next generation of incoming officers and so on. This procedure appears to have been followed in the initial years of the ship's operation. However, it had fallen into disuse. The training and the training procedures had neither been documented nor incorporated into training programmes, nor had the training programmes been identified in the ship's SMS.

2.4.3 Emergency preparedness and fire in the main switchboard room

Firefighting training drills were held weekly under the aegis of the vessel's fire and emergency organization. However, while these drills had, over time, simulated various fire scenarios in different parts of the ship, an electrical fire in the MSR had never been simulated. Although the ship's SMS had established procedures for fighting engine-room fires, there were no set procedures for fighting electrical fires. Thus, the firefighting operation was based on the engineering staff's personal experience and knowledge, which was limited because such on-board fires are rare.

Since emergency situations are inherently stressful and timely action is crucial, individuals may selectively focus on the available information and not accurately assess all the risks associated with the situation. Training and practice reduce the potential for error by letting crews practice their response to emergency situations to better appreciate the risks involved. "In this way, when faced with emergencies, crew response will be more automatic (consistent) in keeping with the risk profile and require less interpretation and decision making."^{Footnote 20}

Given the magnitude of the vessel's electrical/electronic components, a good safety policy requires that the SMS establish procedures for fighting electrical fires and that simulation of an electrical fire in the MSR be an important constituent of the drills practised aboard the vessel. Such a simulation would have provided the ship's senior staff an opportunity to evaluate the response, critique the approach, and identify the shortcomings, thereby better preparing them to fight such fires.

2.4.3.1 Firefighting process

The firefighting crews were effective in extinguishing the fire. However, electrical fires are particularly dangerous not only because melting or burning insulation can cause conductors to short circuit, but because exposed conductors can electrocute anyone coming into contact with them. The first rule of fighting an electric fire is thus to isolate it from all sources of electrical supply.

On the Statendam, the emergency generator, positioned outside the engine-room space, was designed to supply sufficient power for the safe emergency operation of the entire vessel through the emergency switchboard. However, it was not used for this purpose. Instead, DG 3 was kept running all through the firefighting operations, in the belief that shutting it down would unnecessarily panic or discomfort the passengers. The decision to keep DG 3 operating and supplying power to the vessel meant that firefighting teams entered the MSR, a narrow confined space, in conditions of near-zero visibility because of the smoke, knowing that a section of the switchboard was live and knowing that other sections had been badly damaged, yet not knowing to what extent the damage had affected the live section of the switchboard. (At one point, they used steel crowbars to pry open the panel doors of the damaged switchboard.) This decision exposed the crew to undue risk because they did not adhere to the primary principle of fighting a shipboard electrical fire: isolate the fire from all sources of electrical supply before directly confronting it.

2.4.4 Performance of the Safety Management System

The overall responsibility for the administration and safe operation of each ship rests with the vessel's owner, or the owner's legal representative. To achieve this, the ISM Code requires that companies establish SMS's that enable safe practices within a safe working environment, establish safeguards against all identified risks, and continuously strive to improve shipboard safety.

To achieve these objectives, companies are required, among other things, to

• establish safe procedures for shipboard operations, and
• identify training requirements and ensure, through internal and external audit processes, that training is provided to the personnel concerned.

When effectively implemented, such measures provide multiple defences against unsafe acts and conditions. The Statendam 's SMS appeared to have most of the required elements of a system that should have been effective in preventing the occurrence. These included, among others, detailed procedures for communications, an extensive BOPR programme, and regular practice drills for various emergency situations.

However, some of the procedures were either not in place or not properly followed. Notably:

• The system of succession training in ship-specific 6.6 kV systems had lapsed, and neither the senior engineers nor the electricians had received such training.
• In spite of the importance given to it by the company, neither the engineers nor the electricians followed the directives concerning blackout prevention.
• Internal communications among the shipboard engineering staff were not effective in ensuring that critical information concerning the events leading up to the ultimate failure of the DG 2 breaker was communicated to the chief engineer.
• Information regarding the events leading up to the failure of the DG 2, exchanged between the vessel and the office, was ineffective in allowing for a proper evaluation by the electrical superintendent.
• The vessel's emergency preparedness plans did not include practice and training drills for MSR fires.
• The main switchboard was not electrically isolated; firefighting operations exposed the firefighters to undue risk when they came near damaged, live electrical equipment at a potential difference of 6.6 kV.

The weaknesses identified in the training and audit programmes, and the shortcomings in the emergency preparedness plan indicate that there were certain inadequacies in the performance of the Statendam 's SMS.

2.5 CO₂ smothering system and main switchboard room

Using the fixed CO₂ smothering system to extinguish the fire was also considered during the firefighting. It was not used because the MSR is located inside the engine room and falls within fire zone 1. Releasing CO₂ into the entire engine room would not only have caused DG 3 to shut down, but it would also have used up most of the vessel's stock of CO₂ bottles. Therefore, it was considered a last resort, to be used only after all other methods had proved unsuccessful.

It is common on vessels to provide smaller high-risk spaces, such as paint lockers and galleys, with independent smothering systems. The MSR was not provided with such a system. Providing the MSR with such a system, or its own independent connection to the main CO₂ smothering system, would have provided an effective and safer firefighting alternative.

2.6 The electrician in modern day shipping

With advances in electronics technology, ships have become increasingly electrical because of the high efficiency and reliability of electronics. Computer-based automation systems and electronics control most of the processes aboard a vessel; electro-hydraulic systems drive all the power-intensive mechanical systems; pure electrical systems control most of the low-power systems. Not only is electric propulsion rapidly growing in application, even the internal combustion engine has moved towards electrical and electronic control of its fuel injection, scavenging, and cylinder lubrication processes.

Electrification and computerization is not an overnight phenomenon, and it has expanded to the point that companies the world over feel the need to employ dedicated electricians to service and maintain this equipment.

Many shipping companies, classification societies, and port state control administrations in Canada and in some flag states were contacted to ascertain whether Holland America Line's practice of hiring electricians was an isolated case. While the number of companies polled was not large enough to identify trends or to accurately quantify by means of extrapolation, a significant percentage of companies, perhaps greater than 30 per cent, employ electricians whether the ships' voltage systems are 6.6 kV or 440 V.

2.6.1 Marine industry practice of employing electricians

The STCW Code sets minimum standards of educational and experiential competence required for chief and second engineers. They include an electro-technology component. However, there is neither competency requirement nor educational standard set for electricians.

The chief and second engineers possess the requisite electro-technological knowledge and vessel owners and operators expect engineers to operate and maintain the vessel's electrical equipment and systems.

While some companies assign these tasks to their shipboard engineers, it is also common practice for other companies to employ dedicated electrical officers specifically to carry out this work. In such cases, responsibility could be assigned to either the chief engineer or to the electricians.

In the case of the Statendam, four electricians were employed aboard the vessel. At the Holland America Line corporate management level, electrical superintendents are employed to manage the electrical part of the day-to-day technical operations of the fleet, as well as to develop the BOPR programme. These electrical superintendents have been taken from the fleet, where they were employed as chief electricians aboard the company's vessels, rather than employing chief engineers for this purpose. Given the significance of the electrical systems to the safe operation of the vessel and consistent with SMS objectives, electricians engaged in the operation and maintenance of these systems ought to demonstrate a minimum level of competency, to an internationally recognized standard. In the marine environment, neither the industry nor the STCW Code sets standards for shipboard electricians.

Other shipping companies operate in a similar manner and this further highlights the distinct role played by electricians in present-day merchant shipping - both aboard today's vessels and in a company's corporate structure. This is shown by the wide range of electrician designations being used, such as electrical engineer for standard vessels, electro-technology officer, electronics engineer, automation electrician, senior electrician, electrician, gas engineer electrician, assistant electrician, and electrical superintendent. These are specifically geared to the job and skill requirements of their fleets.

Currently, a number of flag state administrations^{Footnote 21} do not require electricians aboard vessels to possess certificates of competency in the marine environment, nor do they lay out a minimum level of required electrical knowledge for marine electricians. Additionally, there are no uniform internationally applicable marine industry standards for the guidance of owners/operators seeking to employ electricians aboard their vessels.

Consequently, shipping companies that choose to employ electricians have to establish their own standards based on their internal operational requirements. Several national standards for industrial or shore electricians are readily available, and these are modified and adopted for the marine environment.

2.6.2 Dynamics of decision making and safety

As ships have become increasingly specialized, they have become technically more complex and automated. Most of their processes and systems contain interconnected and interdependent electronic, electrical, and mechanical components. Frequently, electricians must work independently on electrical tasks, while the shipboard engineers work on the mechanical equipment and systems. The job description of the Statendam 's electricians illustrates this since they were required to troubleshoot, repair, and maintain all the electrical and electronic equipment.

For decision making, a team approach to resolve problems is most effective. To arrive at a sound safety-critical decision, the chief engineer, as manager and responsible for all the machinery and equipment aboard a vessel, should seek advice from personnel with expertise. This process relies on the professional competence of crew members and the chief engineer's assessment of their capabilities.

Without an international marine standard, the professional competence of marine electricians varies and is governed by non-uniform national standards or by standards developed by the employer. These standards may be unknown to the chief engineer who takes the company-appointed electrician at "face value." The chief engineer may defer to the electrician's specialized knowledge (which in the absence of a uniform standard may be deficient in some areas) and thereby may arrive at a safety-compromising decision.

Given the evolution of electricians' responsibility and given their safety-significant role in shipboard operations, the absence of a uniform international standard of certification may compromise the safe operation of vessels.

2.7 Structural fire protection

2.7.1 Between the main switchboard room and adjacent compartments

The MSR is located within the vertical and horizontal boundaries of the propulsion machinery space with three adjacent compartments: the engine control room, the transformer room and the fuel injector test room (see figures 3 and 4 at Appendix C).

Traditionally, areas that contain both combustible material and a source of combustion have been considered the greatest fire risk. Because pressurized petroleum products are near hot engine surfaces, machinery spaces are areas considered at greatest risk. Consequently, the SOLAS requires bulkheads for machinery spaces to have fire-retardant properties varying from A-60 to A-0, depending on the nature of the adjacent compartment.

On first consideration, MSRs containing medium-voltage electrical switchgear (such as that on the Statendam ) do not appear to contain large amounts of combustible material capable of sustaining a fire long enough to threaten a neighbouring compartment. Accordingly, these MSRs are considered category 10 spaces with "little or no fire risk" and divisions separating them from other spaces only require a fire integrity of A-0.

However, such spaces do contain cables, switchgear, and associated equipment, which may routinely be conducting electrical power of 30 MW or more.

As demonstrated by this occurrence, in the event of a catastrophic failure of a circuit breaker - either directly, or as a result of the failure of other electrical switchgear - the resulting arc has the potential to release enough thermal energy to establish a fire in unprotected contiguous compartments.

The cabling in the ECR caught fire as a result of the radiant heat emanating from the MSR located directly under it. The transmission of heat was almost instantaneous because there was no fire-retardant thermal insulation on the MSR deckhead.

Medium-voltage generation and distribution of 6.6 kV, or even 11 kV, is increasingly common in passenger cruise ships, special purpose ships like drill ships and research vessels, ro-ro ferries, very large crude carriers, and large container vessels. A risk assessment of such circuit breaker failures shows that, while they are rare, their consequences can be extremely severe. In specifying A-0 insulation around the MSR, past and current SOLAS structural fire protection requirements do not reflect the fire risk inherent in electrical systems that regularly transmit very high levels of power.

3.1 Findings as to causes and contributing factors

1. In all probability, a "dead short" within the diesel generator 2 circuit breaker generated an arc that shattered its epoxy-resin case. The resulting heat and flame, accompanied by the sudden release of pressurized sulphur hexachloride (SF6) gas, ignited the fire.
2. The lack of fire-retardant insulation between the main switchboard room (MSR) and the engine control room (ECR) allowed radiant heat to be rapidly transmitted to the ECR. This caused cables above the ECR deck to ignite and spread the fire.

3.2 Findings as to risk

1. Current International Convention for the Safety of Life at Sea (SOLAS) requirements for structural fire protection around MSRs do not reflect the fire risk inherent in electrical systems that transmit high levels of power.
2. The ship's carbon dioxide (CO₂) smothering system did not have an independent connection to the MSR, thereby depriving the vessel of an effective and safer means to fight fires in this compartment.
3. Despite the significance of electrical systems to the safe operation of vessels, there is no requirement for electricians operating and maintaining these systems to demonstrate minimal competency to an internationally recognized standard, and such requirements are a principle recognized by the International Maritime Organization in the Seafarer's Training, Certification and Watchkeeping (STCW) Code.
4. The weaknesses identified in the training and audit programmes, and the shortcomings identified in the emergency preparedness plan indicate that there were certain inadequacies in the performance of the Statendam 's Safety Management System.
5. The failure to isolate electrical power during firefighting exposes the crew to undue risk.

4.1 Action taken

4.1.1 Transportation Safety Board of Canada

On 26 November 2002, the TSB sent a Marine Safety Advisory (MSA 09/02) to the Netherlands Shipping Inspectorate Enforcement Branch, Transport Canada (TC), the International Association of Classification Societies, Holland America Line Westours Inc. (Holland America Line) and Fincantieri Navali Italiani S.p.A. outlining the inadequacy of structural fire protection between the main switchboard room (MSR) and the engine control room (ECR) on the Statendam and on its three sister ships. In response, the Netherlands Shipping Inspectorate Enforcement Branch indicated that it has instituted an investigation into the structural fire protection on Dutch-flagged passenger vessels similar to the Statendam . TC indicated that, while the International Convention for the Safety of Life at Sea (SOLAS) structural fire protection requirements addressing the boundaries between compartments such as MSRs and other areas do not reflect inherent risks, it will discuss TSB's concerns informally with other maritime administrations to gauge global feeling regarding the issue.

A second MSA (03/03) was sent to the Dutch Ministry of Transport (Head of Shipping), Holland America Line, and TC describing the deficiencies in engineers' electro-technical training in 6.6 kV systems. In response, the Dutch Ministry of Transport indicated that the MSA was under consideration. Holland America Line provided a list of 6.6 kV electrical training and blackout prevention initiatives taken since 1991.

4.1.2 Holland America Line

In the fall of 2002, a chief engineer from the fleet was assigned to work full time on further developing the blackout prevention and recovery (BOPR) programme, including system-specific training to be held in 2003. In October 2002, Holland America Line introduced an Engine Watch Officer Qualification Programme to provide specific hands-on training for newly hired or promoted engineers, and in early 2003, a chief electrician from the fleet was selected to develop a "fault tree analysis document" for medium-voltage electrical generation.

As a result of this effort, simplified ship and system-specific drawings and instructions for the medium-voltage and mechanical systems are being developed.

The equipment manufacturer, ABB, has been contracted to provide system philosophy and hands-on training to senior engineer and electrical officers throughout the fleet. Training is done aboard the company's vessels. To date, one batch of 16 officers has received this training.

4.2 Action required

4.2.1 Structural fire protection and fire-extinguishing system

On first consideration, switchboard rooms containing medium-voltage electrical switchgear (such as that on the Statendam ) do not appear to contain large amounts of combustible material capable of sustaining a fire long enough to threaten a neighbouring compartment. However, such spaces do contain cables, switchgear, and associated equipment, which may routinely be conducting electrical power of 30 MW or more. As demonstrated by this occurrence, in the event of a catastrophic failure of a circuit breaker - either directly, or consequentially as a result of the failure of other electrical switchgear - the resulting arc has the potential to release enough thermal energy to establish a fire in uninsulated contiguous compartments.

Structural fire protection is the primary method of containing heat within a compartment; however, current SOLAS^{Footnote 22} requirements for structural fire protection around MSRs do not address the fire risk inherent in electrical systems that transmit high levels of power. As a result, the Statendam had no fire/thermal insulation between the MSR and the ECR one deck above. The failure of the main breaker resulted in a high energy electrical discharge with characteristics similar to a bolt of lightning. The associated radiant heat was rapidly transmitted through the bare steel deckhead, igniting control room electrical cables in the ECR.

The number of vessels, particularly cruise ships, equipped with diesel-electric propulsion, continues to grow as owners embrace the benefits of improved operating efficiencies and lower operating costs. Holland America Line has eight ships similar to the Statendam in MSR arrangement. A review of passenger cruise ships due to be delivered between 2005 and 2008 indicates that the majority will feature electric propulsion.^{Footnote 23}

The TSB notes that, internationally, there has been at least one other medium-voltage circuit breaker failure that resulted in a switchboard fire.

• On 29 December 1993, the gas turbine/electric ro-ro ship Union Rotorua experienced a fire in its main 6.6 kV switchboard while 27 miles south of Sydney, Australia. Initial firefighting efforts proved ineffective and the fixed CO₂ system was used to extinguish the fire.

The proper functioning of the switchboard is essential for the safe operation of the vessel. A malfunction in the switchboard at an inopportune time has the potential for serious consequences, jeopardizing the safety of the personnel and the vessel, and endangering the environment. Instances are on record in which switchboard fires - irrespective of the type or size of vessel or the technology in use - have resulted in extensive damage or loss of life. Other examples of such fires include:

• On 26 May 1990, the passenger vessel Regent Star experienced a main switchboard fire that disabled the vessel in the Delaware River, United States.
• On 18 June 1995, the passenger vessel Celebration experienced an electrical fire in the main control room 35 miles from San Salvador Island, Bahamas. The fire was extinguished with the fixed halon system.
• On 26 May 1999, the passenger vessel Sun Vista experienced a switchboard fire while transiting Malacca Strait, forcing all passengers and crew to abandon ship. The vessel subsequently sank.
• On 06 June 2000, a fire broke out in the main switchboard of the Alaska Marine Highway System ferry Columbia, while 30 nautical miles southwest of Juneau, Alaska, disabling the vessel.^{Footnote 24}

Once started, shipboard fires can spread rapidly and exponentially. Restricting their spread, containing them to their place of origin, and extinguishing them quickly with the least possible risk to life are critically important considerations in designing safe vessels. The capacity of structural fire protection and fixed fire-extinguishing systems to adequately restrict and extinguish a fire is vital.

Traditionally, areas that contain both combustible material and a source of combustion have been considered the greatest fire risk. Because pressurized petroleum products are near hot engine surfaces, machinery spaces are areas considered at greatest risk. Consequently, the SOLAS requires bulkheads for machinery spaces to have fire-retardant properties varying from A-60 to A-0, depending on the nature of the adjacent compartment.

It is also common on vessels to provide smaller high-risk spaces, such as paint lockers, purifier rooms, pump rooms, and galleys, with independent smothering systems. Aboard the Statendam and its sister ships, the MSR was not provided with an independent CO₂ system.

Fixed systems (such as CO₂) are the most effective way to extinguish fires contained within an enclosed space by structural fire protection. This is particularly so in enclosed spaces containing electrical equipment, such as an MSR, where other fire-extinguishing efforts in the presence of live, damaged conductors may endanger crew members. In the case of the Statendam, without a dedicated fixed extinguishing system to protect the MSR, the vessel was deprived of an effective and a safer means of fighting fires in this compartment, and the firefighting crew, the vessel, and, eventually, the passengers were exposed to undue risk.

The engine-room space and its equipment have incorporated technology that brings economic benefits, and so medium-voltage electric propulsion is the propulsion system of choice for large passenger vessels. However, current SOLAS regulations do not require either thermal insulation or fixed extinguishing systems for machinery spaces such as switchboard rooms. They also leave the determination of fire hazards and the means of extinguishing fires to individual flag state administrations.^{Footnote 25} This approach may lead to inconsistent fire risk assessments, resulting in varying safety levels between flag state administrations and vessels. Recognizing these possible shortcomings, the Board is concerned that some vessels are at risk, and others may be built without sufficient attention to the fire risks inherent in MSRs.

The Board is aware that some international initiatives have been taken to address fire safety on large passenger vessels. In 2000, the working group on Large Passenger Ship Safety of the International Maritime Organization (IMO) Marine Safety Committee (MSC) reported to MSC 73 noting "that the rapid extinguishment was another key element for avoiding fires from becoming catastrophic."

At the May 2001 meeting of the MSC (MSC 74), the committee directed the Fire Protection Sub-committee to evaluate 19 fire-protection tasks for both existing and future large passenger vessels. The objective was to improve fire protection and prevention measures, thus improving ship survivability. The areas of concern included main vertical and horizontal zone requirements, and how to link fire prevention and protection measures to the fire risk of specific spaces not generally covered by the existing general categorization and regulations. Subsequently, at the next meeting of the Fire Protection Sub-committee, the United States tabled a paper^{Footnote 26} analysing gaps in IMO instruments pertaining to fire safety on large passenger vessels. The paper recommended that the Fire Protection Sub-committee consider measures to "develop enhanced structural and active fire protection requirements for traditional high risk areas (e.g. laundry areas, carpenter shops, solvent cleaning rooms) and for spaces with fire hazards involving innovative designs not envisaged by SOLAS chapter II-2."

The marine community is rapidly embracing novel designs and technological changes. However, the SOLAS lacks a mechanism for continuous risk assessment to increase safety levels that reflect the principles outlined in the SOLAS. Switchboard rooms containing high levels of energy are one such example. The Board is concerned that current and future vessels built with innovative designs and advanced technology without adequate structural fire protection and fire-extinguishing systems for spaces containing high levels of energy will continue to place crews and passengers at undue risk. The Board therefore recommends that:

4.3 Safety concern

4.3.1 International competency standards for electrical officers

During the events leading up to the failure of the Statendam 's main circuit breaker, none of the senior engineering or electrical officers demonstrated sufficient knowledge or expertise in troubleshooting problems with medium-voltage propulsion plants. At the time of the accident, neither the engineers nor the electricians had been trained in the ship's electrical generation, distribution, and application systems.

Vessels are increasingly dependent on electrical and electronic systems. Introducing such technology has increased the job scope, stretching marine engineers to be specialists in both the mechanical and electro-technical disciplines. Marine engineers trained and certificated to STCW 95^{Footnote 27} standards ostensibly possess competence in electro-technology. However, modern complex electrical installations require specialized training for marine engineers whose training and experience are limited to conventional or older vessels. Recognizing this, many companies choose to employ dedicated electrical officers even though the safe-manning regulations of many flag state administrations do not require that they do so. Depending on the complexity of the installed systems, other companies are separating the electrical responsibilities by differentiating between electrical and electronic engineering officers. This allows both marine and electrical engineering officers to concentrate on their specialities. As a result, electrical officers have become key members of the shipboard team. The cruise industry is rapidly expanding with more and larger electrically propelled vessels being built, requiring more electro-technology trained officers.

Aboard large passenger vessels, the medical staff (doctors and nurses) and electrical officers are the only professional crew not required to hold certification pursuant to STCW 95. Recognizing the role played by the medical staff on board vessels, the working group on Large Passenger Ship Safety recommended to MSC 79 that the owners and operators of passenger vessels establish medical standards, including standards for physicians, based on guidelines and standards acceptable to the flag state administration or published by an internationally recognized organization. To standardize medical experience requirements and certification of physicians on board, members of the International Council of Cruise Lines have agreed to implement the guidelines of the American College of Emergency Physicians.

There are no internationally accepted minimum standards for training, expertise, or certification for shipboard electrical officers. Accordingly, the Board is concerned that, despite their significant role in the safe operation of modern vessels and, consequently, in ensuring passenger and crew safety, neither the IMO nor the international shipping community have specified standards of competency or knowledge for electrical officers. A copy of this report will be submitted to the IMO for its consideration.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 17 February 2005.

Appendix A - Main circuit breaker electrical characteristics

1. Rated voltage - 12 kV
2. Rated normal current - 1.25 kA
3. Rated breaking capacity (at 12 kV) - 12.5 kA
4. Short-time withstand current (3 s) - 14.5 kA

The main circuit breaker has the following protection relays connected to its trip and lock-out relay:

1. Generator differential
2. Over-temperature
3. Thermal image and inverse time negative over-current
4. Voltage restrained over-current
5. Reverse power
6. Loss of excitation
7. Earth fault over-voltage
8. AC over-voltage
9. Earth fault directional
10. Automatic voltage regulator failure

Electrical characteristics of bus-tie breaker:

1. Rated voltage - 12 kV
2. Rated normal current - 3.15 kA
3. Rated breaking capacity (at 12kV) - 31.5 kA
4. Short-time withstand current (3 s) - 31.5 kA

The bus-tie breaker has the following protection relays connected to its trip and lock-out relay:

1. AC over-voltage
2. Voltage restrained over-current

Appendix B - Statendam-Speed versus Power

SPEED (kn)	POWER CONSUMPTION (kW) 80 per cent	POWER AVAILABLE (kW) 100 per cent	12 CYL.	8 CYL.
21.5	26 680	33 350	2	3
19.6	22 240	27 800	2	2
19.0	20 000	25 000	1	3
17.5	17 800	22 250	2	1
17.0	15 560	19 450	1	2
13.5	11 120	13 900	1	1

Hotel: 3.6 MW

Appendix C - Figures and photos

Appendix D - Glossary

AC

alternating current

BOPR

blackout prevention and recovery

CO2

carbon dioxide

cyl.

cylinder(s)

DG

diesel generator

ECR

engine control room

IMO

International Maritime Organization

ISM

Code International Safety Management Code

kA

kilo-ampere(s)

kn

knot(s)

kPa

kilopascal(s)

kV

kilovolt(s)

kW

kilowatt(s)

m

metre(s)

MCTS

Marine Communications and Traffic Services

min

minute(s)

mm

millimetre(s)

MSA

Marine Safety Advisory

MSC

Marine Safety Committee

MSR

main switchboard room

MW

megawatt(s)

NOx

oxides of nitrogen

s

second(s)

SF6

sulphur hexachloride

SMS

Safety Management System

SOLAS

International Convention for the Safety of Life at Sea

SOx

oxides of sulphur

STCW

International Convention on Standards of Training, Certification and Watchkeeping for Seafarers, 1978, as amended in 1995

STCW

Code Seafarer's Training, Certification and Watchkeeping (STCW) Code

TC

Transport Canada

TSB

Transportation Safety Board of Canada

V

volt(s)

°C

degree(s) Celsius