Marine Investigation Report M04C0037

On 15 August 2004 at 1525 eastern daylight time, while exiting Iroquois Lock in the St. Lawrence Seaway, the bulk carrier Federal Maas struck Bridge 12 at the lower end of the lock. The vessel sustained damage to its port bridge wing. Damage to Bridge 12, which was not fully raised, was minimal and the lock was closed to traffic for approximately four hours.

Particulars of the vessel

History of the voyage

On 11 August 2004, the Federal Maas departed Burns Harbour, Chicago, United States, bound for Montréal, Quebec, en route to Algeria, with 19 798 tonnes of corn. The vessel had an uneventful voyage downbound through the Great Lakes/St. Lawrence Seaway, arriving at Iroquois Lock at 1500 eastern daylight time^{Footnote 2} on August 15. As the Federal Maas approached Iroquois Lock, the head structures operator (HSO) and two canal structures operators (CSOs) went to the control kiosk at the upper (west) end of the lock (see Figure 2). One of the CSOs opened the upper gates, raised the arrester wire boom, activated the green navigation light, and waited as the vessel proceeded into the lock. In order to ensure that the vessel could be tied up quickly in the event of propulsion or steering equipment failure, both CSOs walked along the lock wall with the vessel. The HSO accompanied CSO 1 to the forward end of the vessel and assisted in securing the vessel's No. 2 wire to a bit and "spot" the vessel into position. CSO 1 then returned to the stern of the vessel to help with the tie up, before proceeding to the upper control kiosk.

Image

The HSO proceeded to the lower control kiosk and, using the computer control station within, initiated the opening of Bridge 12.^{Footnote 3} Before the bridge reached its full open position, the upper approach lights were switched from green to red by CSO 1 from the upper control kiosk using the lock computer control system. Shortly afterward, CSO 1 informed the HSO that the upper end of the lock was ready to close, meaning that the green approach light had been switched to red.

At about this time, the pilot on board the vessel requested that the HSO read the forward draught marks. The HSO proceeded out of the lower control kiosk. The bells on Bridge 12 had stopped, indicating that the bridge was no longer in motion. CSO 2, stationed at the upper control kiosk, then opened the lower gates and arrester boom, and the vessel was cast off, with the HSO releasing the No. 2 wire at the bow.

The vessel exited the lock proceeding at 1.5 knots along the lower approach wall. Both the pilot and master were on the starboard side of the vessel's bridge; as such, Bridge 12 was not clearly in view. As the vessel's accommodation structure passed Bridge 12, the port bridge wing struck the centre of the span of Bridge 12.

The vessel was secured along the approach wall, and navigation through the lock was suspended for four hours while the damage to Bridge 12 was assessed and temporary repairs were made to the vessel.

Image

Damage to the vessel and Bridge 12

Damage to the vessel was confined to the port extendable section of the bridge wing and aft bridge wing bulwark. Damage to Bridge 12 was minor, and was limited to a light fixture and associated wiring at mid span.

Image

Environmental conditions

Weather was clear at the time of the occurrence, with calm winds and visibility estimated at 10 miles.

Lock control system

Until 2001, the lock was operated from a control tower located at the lower end of the lock. At that time, a new control system was installed that comprised three computer control stations, one at each end of the lock, and a centralized station in a building midway along the lock.

Image

Closed-circuit television (CCTV) cameras were installed to allow lock operators to view all equipment. Following an accident in 2003 at Lock No. 3 in the Welland Canal, during which a ship arrester was lowered onto the Federal Saguenay,^{Footnote 4} programming changes were made to the control systems at Seaway locks including Iroquois Lock. The changes made by the St. Lawrence Seaway Management Corporation (SLSMC) were as follows:

• When the "end fully open" signal is obtained, a white message "end open and locked" is to be displayed on the screen. When ready to operate the equipment at this end of the lock, the operator must click on "unlock upper/lower end" and answer Yes or No when prompted. The operator has 30 seconds to initiate the desired operation or the end will revert to locked status.
• After the lock is full, the gates and bridge will open. When all movement is complete, the "upper end locked" message appears and the upper end is then locked. At this time, the following equipment cannot be moved: upper and lower gates, upper and lower ship arresters, and bridges.

The changes were not fully tested or simulated before the control system was put in use at the lock stations. Following the implementation of these modifications, the staff noted that, when the lock was opened and the message "end opened and locked" was displayed, equipment at both ends was locked out. The system was again modified such that one end was able to operate should the opposite end be locked out.

Following this modification, another problem was noted by the staff at Iroquois Lock. In order to operate the upper end, the red light must be on. However, when the upper navigation lights are switched from green to red while the bridge is in motion, the bridge immediately stops, regardless of its position. This deficiency was noted by SLSMC staff and, on 05 August 2004, all operating shifts were informed verbally and a warning note was posted on the computer control stations (see Photo 3); however, no formal information concerning the problem or modified procedures was passed on to the affected operating staff.

Image

Before the computer control modifications in 2004, a bell would sound until Bridge 12 was in its fully raised position. Subsequent to the modifications, however, the bell stops ringing when the bridge stops moving, regardless of its position. As the bridge opens, the mimic display at the control stations shows a bridge animation that diminishes in size relative to the angle of bridge opening. The display is such that the animation is not readily discernable during the final 10 degrees of bridge opening; however, the percentage of bridge opening is indicated at all times, throughout its range of motion. There are no interlocks to prevent the gates or arrester boom from opening should the bridge not be fully raised.

Lock staffing

Iroquois Lock is crewed by three Seaway employees: an HSO and two CSOs. In this instance, in addition to overseeing all lock operations, the HSO was also tasked to do the following:

• guide the vessel into position;
• raise the bridge;
• read and report the vessel's draught to the pilot; and
• let go the vessel's forward mooring wires.

To complete these tasks, the HSO must be away from the central control room. At times, the locking duties are rotated among the lock staff to ensure that the required skills are maintained by all lock personnel. Either an HSO or a CSO must be in an operation station whenever equipment is in motion; however, procedure dictates that the bridge may not be operated from the upper control kiosk.

Computer control system

Once the vessel was secured in the lock, the opening of Bridge 12 was initiated by the HSO. Before the bridge reached its full open position, the upper approach lights were switched from green to red by CSO 1 from the upper control kiosk using the lock computer control system. As a consequence, the undesirable programming characteristic of the lock computer control system resulted in the warning bells ceasing and the bridge stopping at 92 per cent of its fully raised position.

Four indications are available to the lock operator to indicate that the bridge is fully raised:

1. the computer mimic display indicates full open;
2. the numeric display indicating the percentage that the bridge is open;
3. the "end fully open and locked" notification; and
4. a white light at the centre span of the bridge and the ship arrester.

When the bridge is in motion, a bell sounds on the bridge structure, indicating to operating staff that the bridge is in motion. When it stops moving, the bell stops, regardless of the position of the bridge. As the bridge opens, in addition to the digital numeric readout, the mimic display at the control stations shows an animation that diminishes in size relative to the angle of bridge opening. The display is such that the animation is not readily discernable during the final 10 degrees of bridge opening, and therefore careful attention to the digital readout is critical.

The computer-initiated interruption of the bridge coincided with the pilot on the Federal Mass requesting that the HSO read the vessel's draught. This request distracted the HSO, who did not check the white light on the central span to verify that the bridge was fully open. Additionally, the master and the pilot did not confirm that the bridge was fully open before the vessel commenced exiting the lock.

Interlocks are commonly used in machinery installations to ensure that an operation cannot be carried out unless preset safe conditions are present. There is no interlock between the bridge and the arrester boom and gates at Iroquois Lock. It is possible to operate the lower end of the lock (that is, raise the lower arrester boom/wire and open the lower gates) without the bridge being fully open. If for any reason^{Footnote 5} Bridge 12 did not open fully, it would be possible for a vessel to attempt to enter or exit the lock and strike the bridge.

Lock operations

In the absence of physical interlocks that prevent a vessel from exiting the lock before all obstructions have been cleared, the supervisory role of the HSO takes on added importance. At the time of the occurrence, the traffic control lights, lock gates, arrester wires, lights, and Bridge 12 were being operated by two separate lock personnel, at opposite ends of the lock. The HSO was multi-tasking, requiring him to work outside the control room to assist with the lockage of the vessel. Consequently, there was no person dedicated solely to monitoring the operation of the lock.

The central control station at the centre of the lock provides the operator a clear view of the upper and lower ends of the lock, as well as computer displays of the machinery status and CCTV displays from various camera locations in the lock area. Similar computer and CCTV displays are located at the upper and lower kiosks; however, the placement of the CCTV cameras provided a less-than-optimum view of the entire lock. Additionally, the bridge is not visible from the upper control kiosk and the view from the lower kiosk is such that the difference between 92 per cent and 100 per cent open is not readily discernable. Viewed down the lock from the central control location, the difference in elevation angle is more evident.

As two people are required to put mooring lines 1 and 3 onto their bits, the level of staffing is such that, to minimize the lockage time of the vessel for safety purposes, the HSO must leave the central control station to physically assist in the lockage operation. The advantages provided from such a central control station are therefore negated. Such an approach has the potential for the HSO to not fully appreciate the existing and developing situation, thereby compromising the vessel's safe transit through the lock.

The HSO does not have a clear view of the entire lock from either the lower or upper end control stations, and must rely on instrumentation as well as the other staff members to provide feedback on the disposition of the vessel and lock machinery. The locking procedure is known to the lock crew; however, no written checklists are used to ensure that lock machinery is operated in the appropriate sequence. Although the lock staff had been previously briefed on the computer control problem, the procedures for operating the lock had not been modified to reduce the possibility of the programming flaw affecting the operation of the bridge, or mitigate any consequences resulting therefrom. In the absence of formal checklists and modified procedures, the tasking of the HSO to physically participate in the lockage of the vessel hampered his ability to fully appreciate the situation.

Findings as to causes and contributing factors

1. A known programming fault in the lock control system resulted in Bridge 12 stopping before the fully raised position.
2. Although visual and audible cues were available, the head structures operator (HSO) became distracted and did not notice that the bridge had not opened fully.
3. There was no formal checklist and, because procedures were not modified, the tasking of the HSO to physically participate in the lockage of the vessel hampered his ability to fully appreciate the situation.

Findings as to risk

1. There is no mechanical barrier to prevent gates and arrester booms from operating if the bridge is not fully raised. This allows vessels to enter or exit the lock and potentially strike the bridge.

Safety action taken

On 12 November 2004, a Marine Safety Information letter (MSI 08/04) was sent to the St. Lawrence Seaway Management Corporation (SLSMC), noting that there is no interlock between the bridge and the arrester boom/gates, and that it is still possible to raise or lower the arrester boom/wire and open the lower gates without the bridge being fully open. The MSI also highlighted that, because there were only three persons on duty at the time, the head structures operator (HSO) was multi-tasking and was required to work outside the control room to assist with the lockage of the vessel. As such, there was no person dedicated solely to monitoring the operation of the lock and the position of Bridge 12.

In response, the SLSMC indicated that it had initiated an internal investigation into the occurrence, which would include recommendations for improvement. The completed investigation included recommendations addressing control systems, equipment, operating procedures, and change management. For example:

• the visibility of the bridge span mimic has been modified to eliminate the animation that reduces the size of the mimic as the bridge rises;
• the interlock sequence was modified to ensure that a change from a green to a red navigation light does not stop the equipment during its operation;
• an additional interlock has been added whereby Bridge 12 (Iroquois) must be fully raised before a green light (allowing a vessel to proceed into the lock) is displayed for a downbound vessel;
• the audible tone will keep sounding while the equipment is between fully open and fully closed;
• a "cast-off" light, for use by the lock crew, will be activated when all end equipment is fully open;
• a simulator system is available for evaluating and testing changes off-line before the commissioning of control system changes;
• operating procedures have been reviewed and a walk-through mode procedure is in place at Iroquois Lock;
• the entire change-management process for control system changes has been examined and will be completed during the 2007-2008 fiscal year.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 07 June 2007.