Marine Investigation Report M13M0287

On 07 November 2013 at 1200 Atlantic Standard Time, the roll on/roll off passenger ferry Princess of Acadia, which was carrying a total of 87 passengers and crew, sustained a main generator blackout and grounded while approaching the ferry terminal at Digby, Nova Scotia. No pollution or injuries were reported.

Particulars of the vessel

Description of the vessel

The Princess of Acadia is a domestic passenger ferry that operates between Digby, Nova Scotia and Saint John, New Brunswick. It has been providing service on this 6-hour round-trip route since its construction in 1971. The vessel has 5 decks, including 1 vehicle deck fitted with forward and aft doors/ramps and a platform deck for additional vehicle stowage (Appendix A).

Spaces designated for passenger use are located on the upper deck and boat deck, and consist of 2 interior lounges (1 on the upper deck and forward boat deck), an open-air lounge on the boat deck aft, a cafeteria, and washrooms. Company policy prohibits passengers from accessing the vehicle deck during a voyage, unless accompanied by a crew member. Crew spaces include officer and crew messes, lockers, and kitchen facilities on the upper deck, as well as crew cabins, lockers, and lounges on the boat deck and navigating bridge deck.

The bridge, located just forward of amidships on the navigating bridge deck, is comprised of a main bridge console and port and starboard bridge wing consoles, each fitted with main engine and bow thruster controls. The bridge wings provide improved visibility for manoeuvring the vessel upon arrival or departure at the ferry terminals.

The bridge is fitted with the following navigational equipment: an auto pilot, a depth sounder, 2 radars with automatic radar plotting aid capability, a GPS, an automatic identification system (AIS),^{Footnote 2} and an electronic charting system (ECS) powered by an uninterrupted power supply.^{Footnote 3} The ECS has remote monitors located on each bridge wing to assist the master when docking the vessel. The vessel is also fitted with 2 very high frequency (VHF) digital selective calling radios, an internal phone system, and a public address (PA) system. Additionally, there is an intercom talkback system^{Footnote 4} and telegraph system for communication between the engine control room and the bridge. Hand-held VHF radios are also available to be carried by designated personnel during all operations, and especially during emergencies. The vessel was not equipped with a voyage data recorder (VDR).^{Footnote 5}

The vessel has 2 spade-type rudders and a transom stern.^{Footnote 6} Propulsion is provided by 2 controllable-pitch propellers, each driven by 2 main diesel engines through a gearbox and clutch arrangement. The vessel normally operates on 2 main engines when steaming and 4 main engines when in confined waters and docking. The vessel has a service speed^{Footnote 7} of 18 knots and is fitted with a 596 kW controllable-pitch bow thruster. Two main generators must be online to handle the high power load required to start turning the electric thruster motor. A protective interlock^{Footnote 8} prevents the bow thruster from starting or operating on one generator.

Main electrical power is produced by 3 diesel generators rated at 650 kW each. Under normal operations, these generators power the main switchboard, which then powers the emergency switchboard through a tie-in breaker.^{Footnote 9} The vessel also has a 200 kW emergency diesel generator that will automatically power the emergency switchboard to operate all emergency and normal lighting, navigational aids, the emergency fire pump, the governor controls, 1 steering pump, a battery charger for transitional lighting,^{Footnote 10} and the feedback breaker^{Footnote 11} to the main switchboard. In the event of a complete loss of electrical power, the vessel has a bank of 20 six-volt batteries to provide transitional power and lighting.

In 1976, the Minister of Transport took ownership of the Princess of Acadia. The vessel was then operated by Marine Atlantic until 1997, when the operation of the vessel was contracted to Bay Ferries Ltd.

History of the voyage

On 07 November 2013, the Princess of Acadia departed Saint John at 0900^{Footnote 12} as scheduled, en route to Digby. Upon departure, the No. 1 and No. 2 main generators, 4 main engines, and bow thruster were all online, and the bridge team consisted of the master, the second mate acting as officer of the watch (OOW), and a helmsman. The relief master,^{Footnote 13} who works as the night shift master from 1900 to 0700, and the on-leave master, who was returning home from a vacation, were also on board the vessel.

Shortly after departing, the bow thruster was turned off, as was the normal practice, but the chief engineer (CE) kept both main generators and all 4 main engines online because strong southerly winds were expected and the vessel had previously experienced fuel problems during rough weather.^{Footnote 14} By 0917, the vessel was on a course of 175° true (T), which was more westerly than the usual course of 160°T, to provide the passengers with a smoother crossing.

Around 1145, the master and on-leave master returned to the bridge. The master took charge of the watch and began altering course to starboard to follow the charted route. The master initiated standby^{Footnote 15} when the vessel was east of Point Prim light entering the Digby Gut (Appendix B), and the crew members proceeded to their stations. The vessel's electrician proceeded to the stern mooring station, which was his standby position, to supervise the mooring of the vessel upon arrival.

Shortly before 1150, when the vessel was about 0.75 nautical mile (nm) from the terminal and proceeding at 21.3 knots, the master began reducing pitch to dead slow ahead on the combinator controls^{Footnote 16} to slow the vessel's speed. At 0.6 nm from the terminal and proceeding at 20.4 knots, the vessel speed started to decrease more rapidly. At this time, the vessel was still slightly east of the course line and was setting to port due to strong southwest winds and the flood tide. An easterly set is normal inside the Digby Gut during a flood tide, especially when the tide is running at full current, as it was at the time of this occurrence.

About a minute later, the vessel was approximately 0.3 nm from the terminal and proceeding at 11.8 knots. The master called the engine control room to start the bow thruster and to send the engine room assistant to standby at the vehicle deck stern door for docking. The fourth engineer, who was the engineer on watch, acknowledged the order, and the master moved to the starboard bridge wing controls, where he accessed docking mode on the ECS to monitor the vessel's position, set, course, and speed. The OOW advised the master that the engine room personnel were starting the bow thruster and the engine room assistant was proceeding to the stern door.

Meanwhile, in the engine room, the fourth engineer started the bow thruster. Immediately after, there was a series of bangs as the circuit breakers^{Footnote 17} for the No. 2 main generator and bow thruster opened. At the same time, the No. 1 main generator voltage decreased until the breaker opened due to under-voltage protection^{Footnote 18} and, at 1151:20, the vessel had lost all power to the electrical switchboards. The main engines were still running and the propeller shafts remained clutched in, but the controllable-pitch propeller (CPP) pumps^{Footnote 19} had stopped operating. At this point, the vessel's transitional emergency lighting activated, but the remote ECS monitors, steering and gyro repeater were disabled. The OOW contacted the engine room to request power. The wheelsman advised the master there was no steering, and the master ordered him to switch to emergency steering.

Shortly after the lights went out, the emergency generator started automatically and began powering the emergency switchboard; this restored lighting, navigational aids, and critical equipment that included 1 steering pump, but did not restore the remote ECS monitors or the gyro repeaters. The relief master, who had recently arrived on the bridge, relieved the wheelsman and switched to emergency steering. The master ordered him to steer to port, away from the terminal, and the relief master applied port rudder. At 1151:50, the vessel's speed was 8.1 knots, and the master set the pitch to slow astern in order to stop the vessel's forward motion. The OOW had retrieved the company's emergency response manual and reviewed the primary and secondary responses for a blackout with the master.

Meanwhile, in the engine control room, the CE attempted to close the breaker for the No. 1 generator while also responding to calls for power from the bridge on the talkback system. The engine room assistant arrived back in the engine room and began rounds to check for any problems. The CE eventually determined that the No. 1 generator was not producing power and attempted to supply power to the main switchboard by closing the main breaker for the No. 2 generator, but it would not close. He then disconnected the breaker for the No. 2 generator and reconnected it to the switchboard, but this did not reset the breaker.

At approximately 1154, when the Princess of Acadia was about 0.1 nm north-northeast of the dock, the vessel started moving astern at a speed of approximately 0.3 knot. The master then set the pitch control to half ahead. Shortly after, the master alerted the bridge team that the vessel propeller pitch was indicating astern, but the combinator controls were set for forward. He then ordered the need for power to the bridge team, as it was now apparent that the vessel was moving astern.

The master, OOW, relief master, and on-leave master each initiated various calls to the engine control room on the talkback system requesting power. The engine room team, which at this point included the CE, fourth engineer, electrician, and engine room assistant, responded to the calls for power and confirmed that they were working to re-establish power.

A deckhand stationed aft on the vessel was calling out the distance from the stern to the shore. As the vessel gained astern speed on a course toward the shore, the master ordered that both anchors be released in an attempt to stop the vessel. The on-leave master again called the engine control room requesting power and informing them that the situation was critical. The CE requested that the engine room assistant and fourth engineer start the No. 3 generator and begin increasing the engine rpm manually in order to bring it up to speed so that it could be used to power the main switchboard.

On the bridge, the master again advised the OOW that he had no power and the OOW placed another call to the engine control room requesting power. By this time, the bosun had released the port anchor and was paying out the anchor chain.

At 1156:25, the Princess of Acadia reached an astern speed of 3.7 knots, and an impact was felt on the vessel as it began grounding near the shoreline, at which point the master ordered the engine room to declutch the shafts. Just before the port shaft declutched, the port propeller made contact with the bottom. At approximately 1157, the vessel was aground about 0.1 nm NNW of the Digby terminal in position 44°39.8′ N, 065°45.5′ W (Photo 2).

Events following the grounding

Immediately following the grounding, the OOW reviewed the on-scene commander checklist for grounding with the master. The master ordered the crew to take up the slack on the anchor chains and check the vessel for water ingress and damage. About 2 minutes later, the master contacted Marine Communications and Traffic Services Saint John (Fundy Traffic) and advised that the vessel had sustained a power failure and, upon further discussion, that the vessel had run aground approximately 500 yards from the dock (Figure 1). The master reported that they were in no immediate danger, but required tug assistance to get to the dock. At about 1202, Fundy Traffic requested information for passengers and crew on board and asked whether the vessel had any water ingress. The OOW replied that the vessel was presently being checked for water ingress on board and reported the number of passengers and crew indicated on the manifest.

Following the master's orders, the passenger services supervisor (PSS) told the stewards to sweep the passenger areas by walking around on the upper and boat decks and directing passengers toward the main lounge area.^{Footnote 20} Once the passengers were gathered, the PSS went to the bridge and reported to the master, who explained the situation and instructed him to inform the passengers. The PSS subsequently returned to the lounge and advised the passengers that the vessel was aground but in no immediate danger. He also spoke to the passengers in French and asked if anyone required instructions/information in that language and if anyone required special assistance. He then responded to several general questions from the passengers.

The PSS counted the passengers, arriving at the number of 61. He checked the passenger manifest that had been provided to him prior to departure, but that document indicated that 63 passengers were on board. The PSS went to the bridge and reported the discrepancy of the passenger count to the master. While the passenger services crew started searching the vessel, the PSS enlisted the aid of a female passenger who was known to the crew and familiar with the vessel to search the female washrooms. The missing passengers were located within 15 or 20 minutes.

Passengers were required to stay in the lounge area and were accompanied by a passenger services crew member if they needed to leave to use the washroom or go outside on deck to smoke. Passengers were also offered food and beverages during this time. Approximately half an hour later, the on-leave master arrived in the lounge and addressed the passengers, advising them there was no danger and that they were free to move about the vessel.

Following the grounding, the CE continued attempts to restore power in the engine room. The CE closed the feedback breaker to power the main switchboard using the emergency generator, but the emergency generator overloaded and power to the emergency switchboard was lost. The second engineer, who had been awoken by the PSS's announcement to passengers, arrived in the engine room and attempted to get the No. 1 generator to produce voltage, but it was non-responsive, so he eventually moved to No. 2 generator breaker to assist the CE. Meanwhile, the CE had closed the breaker for No. 3 generator, which restored electrical power to the main switchboard and informed the bridge of having done so. He then restored power to the emergency switchboard by closing the tie-in breaker.

Next, the CE matched the cycles and voltage on the No. 2 generator with the No. 3 generator in order to parallel them. He then pressed the close button for No. 2 breaker, but it still did not actuate. The second engineer began trying to get the breaker for the No. 2 generator to function. He eventually pushed in the reset button^{Footnote 21} and told the CE to try closing the breaker. This time the breaker closed, and the No. 2 generator also began supplying electrical power to the main switchboard. At approximately 1212, the CE notified the bridge that all systems were operational and the vessel was ready to start the bow thruster when needed.

By around 1318, the tide had risen about 3.8 m and the vessel came afloat during strong southwest winds blowing off the shore. With the assistance of the tug Whitby, the vessel weighed anchor and proceeded under its own power to the ferry terminal, eventually docking at 1433, at which time the passengers disembarked.

Damage to the vessel

The aftermost part of the vessel's keel was scratched as a result of the grounding, and 1 of the blades on the starboard propeller was bent forward. The 4 port propeller blade tips were all damaged and required smoothing (Photo 3).

Personnel certification and experience

The master, officers, and crew on the Princess of Acadia all held the required certificates of competency for the vessel and voyage being undertaken. The bridge officers had completed bridge resource management training and held Transport Canada-approved Specialized Passenger Safety Management (Ro-Ro Vessels) and Passenger Safety Management endorsements.

The master held a Master, Near Coastal certificate of competency and had first sailed on the Princess of Acadia in 1978. He began serving as mate/relieving master on the vessel in 1988. In 2001, he began serving as relief master on one of the company's fast ferries, returning to the Princess of Acadia as relief master in 2005.

The officer of the watch held a Chief Mate, Near Coastal certificate of competency and a Watchkeeping Mate certificate of competency. He had sailed on the Princess of Acadia since 1975 and had served as OOW for more than 20 years.

The relief master held a Master Near Coastal certificate of competency. He had joined the vessel in 1982 and was promoted to chief officer in 1990. In 2001, he began serving as mate on one of the company's fast ferries, returning to the Princess of Acadia in 2011. He had served as relief master on the vessel since 2012.

The CE held a Chief Engineer Motorship certificate of competency. He had served off and on as a chief engineer on the Princess of Acadia for 14 years.

The second engineer held a Chief Engineer Combined certificate of competency and had served on the vessel since 2007. He had previously served for 38 years as chief engineer on oil tankers operating out of Saint John.

The fourth engineer held a Fourth Class Engineer Motorship certificate of competency and had joined the vessel in 1991, serving as fourth engineer since 1994.

The electrician was certified as a marine and construction electrician in 1987 and had joined the vessel as electrician in 1997.

The on-leave master began sailing on the vessel as deckhand in 1979 and was promoted to master in 1991. He held a Master Mariner certificate of competency and had also served as master on the company's fast ferries.

The PSS had served on the vessel for 38 years, including approximately 10 years in the position of PSS.

Vessel certification

The vessel was crewed, equipped, and certified in accordance with existing regulations. Canadian regulations do not require the Princess of Acadia to have a safety management system (SMS) and, because the vessel was certified for domestic voyages only, the vessel was not subject to the International Convention on the Safety of Life at Sea.^{Footnote 22} The Princess of Acadia had voluntarily implemented an SMS in 1997.

At the time of the occurrence, the Princess of Acadia voluntarily participated in the Delegated Statutory Inspection Program. As part of this program, Transport Canada (TC) required the vessel to comply with the International Safety Management Code for the Safe Operation of Ships and for Pollution Prevention (ISM Code). The vessel had a valid safety management certificate^{Footnote 23} issued by Lloyd's Register.

On 08 January 2013, the vessel had been fully delegated to Lloyd's Register for regulatory oversight. On delegated vessels, TC retains the right to monitor the statutory vessel inspections for conformity and continues as the authority to identify minimum safe manning and issue 5-year safe manning documents.

Environmental conditions

Low tide in Digby was 0.8 m at 0747, with the next high tide of 8.7 m occurring at 1358. At the time of the occurrence, the tide was 4.6 m above chart datum and flooding. Rain was passing through the area, and the vessel recorded southwest winds at 20 to 25 knots.

Engine room manning

At the time of the occurrence, the vessel was manned in accordance with the TC minimum safe manning document. Although it was not specified in this document that an electrician be a part of the crew on board, Bay Ferries Ltd. required this on the Princess of Acadia.

Under normal steaming operations, the engine room is manned by the fourth engineer and the engine room assistant, with the electrician working in the engine room when required or to complete scheduled maintenance tasks.^{Footnote 24} The CE or a senior engineer is on call if needed.

During standby stations in confined waters, the CE joins the fourth engineer in the engine room, and both the engine room assistant and the electrician are required to perform duties for the deck department, away from the engine room. The engine room assistant operates the hydraulic loading/unloading doors, and the electrician supervises the stern mooring operations.

Prior to Bay Ferries operating the Princess of Acadia, the electrician would be stationed in the engine control room with the CE and fourth engineer when the vessel was on standby in confined waters. The engine room assistant would be stationed in the engine room.

Main generator excitation brushes

Certain types of generators are fitted with exciter^{Footnote 25} brushes, which are used to excite the rotor and produce alternating current. Each main generator on the Princess of Acadia was fitted with 2 pairs of excitation brushes. The brushes were made of graphite with a Shore hardness rating of 15.^{Footnote 26} Each brush fits into a metal brush holder with a spring that forces the brush to make contact with the rotor.

Exciter brushes can sometimes become jammed in the brush holder, preventing them from making continuous contact with the rotor. This can result in the brush arcing and unstable voltage. Arcing can cause the brush to heat up and deteriorate at a faster rate, resulting in carbon build-up. Brushes are also susceptible to breaking when in use.

In 1998, the company began using a softer graphite brush in the generators to reduce wear on the rotor slip ring. A post-occurrence examination of the No. 1 generator found that 1 of the brushes was approximately 80% deteriorated and had marks that indicated that arcing had occurred (Photo 4).

Propeller pitch control

Propeller pitch control is required to maintain a vessel's direction and speed. On the Princess of Acadia, the pitch on the propeller was controlled via hydraulic pressure produced by the CPP pumps. Under normal conditions, an operator can control the propeller pitch from 1 of 3 propulsion control stations located on the bridge or a single propulsion control station located in the engine control room.

If the main switchboard loses power, the CPP pumps turn off and the pitch of the propeller blades moves to the default position. The CPP system had been modified in 1993 by the original equipment manufacturer (OEM) such that the pitch would default astern if CPP hydraulic pressure was lost. The on-board CPP system manual, however, still indicated that the default pitch position was ahead.

On the Princess of Acadia, the CPP pumps are not directly powered by the emergency switchboard. In order to restore power to the CPP pumps during a main switchboard blackout, either a main generator must be used to power the main switchboard or the power from the emergency switchboard must be fed back to the main switchboard. Before back-feeding power from the emergency switchboard, breakers for non-essential equipment must be opened in order to prevent overloading and tripping the emergency generator breaker. Once power is fed back to the main switchboard, the CPP pumps can then be restarted and the propeller pitch can be controlled. Until main switchboard power is restored, the pitch cannot be controlled by the bridge or engine room.

Propeller pitch alarms

Propeller pitch alarms are a feature of most pitch control systems and are designed to alert the operator to potential problems, such as loss of pitch control.

On the Princess of Acadia, there were audible and visual alarms in the engine room to indicate low hydraulic pressure on the CPP system and there were also audible and visual “wrong way” alarms in the engine room that indicated when the propeller pitch was positioned opposite to the requested pitch. These alarms required power from the main switchboard in order to work.

There were no audible or visual alarms on the bridge to indicate whether the CPP system was operating correctly. There were also no alarms or indicators on the bridge to show whether the CPP pumps were on or off, nor for the mode of power on which the vessel was operating. These alarms or indicators were not required by regulation.

Post-occurrence testing

Following this occurrence, the relief chief engineer and the occurrence master spent 3 nights running tests on the CPP system and emergency generator. These tests confirmed that if the propeller pitch control levers were exactly in the neutral (0 pitch) position when the CPP pumps stopped, the propeller pitch would initially remain at neutral. However, if the levers were set to a position other than neutral with the CPP pumps stopped, the propeller pitch would begin defaulting astern.

On-board practice for restoring main switchboard power

On the Princess of Acadia, the opening of a generator breaker and subsequent loss of power to the main switchboard had occurred approximately twice a year, sometimes in conjunction with start-up of the bow thruster. The normal practice in this situation was to close the breaker or quickly start another main generator and close its breaker, depending on the status of the tripped generator. Occasionally, when the bow thruster was being started, the breakers on both generators opened simultaneously, but there had been no adverse consequences, as one of the generator breakers could usually be quickly closed to restore power to the main switchboard.

Safety management system

In marine operations there are numerous ways to identify, assess, and mitigate risks. One internationally recognized method for doing this is an SMS, which provides a formal framework for identifying and mitigating risk. An SMS ensures “a structured, consistent and risk-driven method to identify and close critical safety gaps, adopt safety best practices, and clearly demonstrate commitment to, as well as accountability and due diligence for, safety.”^{Footnote 27}

Risk management under an SMS is an ongoing cycle that helps vessel operators identify, analyze, mitigate, and follow-up on existing and potential risks (Figure 2). One of the safety management objectives of a company is to assess all identified risks to its vessels, personnel, and the environment, and to establish appropriate safeguards.

An effective SMS helps to ensure safe practices in vessel operations, a safe working environment, and should also serve to continuously improve the safety management skills of personnel ashore and on board vessels, including preparing for emergencies. The SMS should also ensure compliance with mandatory rules and regulations.

The SMS documentation on board the Princess of Acadia consisted of the following:

• a safety management manual that included the 12 sections required by the ISM Code;
• an emergency response manual;
• a shipboard operations manual;
• binders containing bridge and engine room standing orders; and
• a training manual.

The SMS manual identifies the Superintendent of Marine Operations as the designated person ashore (DPA) for the vessel. The DPA is the person based ashore with direct access to the highest levels of management. The DPA is authorized to go directly to the Chief Executive Officer if a safety concern is imminent. Among other SMS responsibilities, the DPA “ensures that all reported non-compliance, accidents, and incidents are investigated and action is taken to address the issues and/or prevent reoccurrence.”^{Footnote 28}

Section 9.2 of the SMS manual refers to hazardous occurrence investigations and states that all accident reports of non-conformities, defects, and hazardous occurrences are to be investigated by the master, and that corrective actions that are implemented or planned are to be noted on the report. It also states that accident reports are to be monitored by the DPA. Two accident reporting forms were also included in the appendix of the SMS. One form was entitled “Vessel Accident Report,” and required the master to describe fully how the accident had occurred and provide the investigation results, which were to include the probable or determined root cause and recommended corrective action. This form is no longer used on board. The other form, entitled “Vessel Incident/ Accident/ Non-conformity,” replaced the Vessel Accident Report form and required the following 3 sections to be filled out: accident details, investigation results, and recommended corrective action. This form would then be reviewed by the DPA.

Previous incident with controllable-pitch propeller pumps

About 5 months prior to this occurrence, the master, the on-leave master, second mate, and fourth engineer experienced an incident upon departure: the vessel inadvertently started moving astern after the engine room had passed the controls to the bridge without turning on the CPP pumps. In the moments prior to the incident, the master had requested that the engine room clutch in the 2 main engines and start the bow thruster. When the engines were clutched in, the master moved the starboard engine/pitch control forward. The engine speed increased, but the propeller pitch went astern. As the vessel began to move astern, the master set the port engine control ahead and the starboard control to zero pitch in an attempt to stop the astern movement. The master also requested that the mooring team hold the vessel in position with the lines, but they were unable to do so. The master then ordered the engine room to declutch the engines. By this time, the vessel had moved approximately 12 m astern.

Following the incident, the on-leave master completed the “Vessel Incident / Accident / Non-conformity” report, which was circulated on board and to management ashore. The recommended corrective action stated on the report indicated that the CE had posted a note on the CPP pumps to “reassur[e] they are on when clutching in” and included an entry in the CE handover notes to remind them to check “the pitch and rmps [sic] prior to departure.” The corrective action also stated that “de-clutching with mooring lines still on the bollards controlled this incident.”

The TSB investigation found that a note stating “Clutching in Main Engines - Make sure all systems are operational before clutching in and transferring to bridge control” was posted above the CPP pumps controls on the main engine control console (Photo 5). There was no note posted on the CPP pumps.

Vessel emergency response procedures

The Princess of Acadia's emergency response procedures were documented in the emergency response manual. The manual consisted primarily of on-scene commander checklists for 21 on-board emergency scenarios.

Blackout

One of the on-scene commander checklists in the emergency response manual is for a blackout/engine failure and includes primary and secondary steps for the master to take when responding to a blackout emergency (Appendix C). The first 2 steps on this checklist are (1) employ emergency steering procedures, and (2) exhibit “not under command” shapes or lights. The OOW is responsible for reviewing the checklist with the master, who then implements the actions that need to be taken.

The engine room staff also had an engine room procedure on hand for restoring power after a blackout. The procedures identified 4 possible causes for blackouts (human error, a loss of fuel supply, a loss of exciter voltage due to worn or dirty brushes, or water in the fuel supply) and listed steps to take in each case (Appendix D). In all 4 cases, the engine room procedure states that the emergency generator will automatically start and begin powering the emergency switchboard. The procedure for restoring power after a blackout caused by water in the fuel supply includes instructions on how to supply emergency power to the main switchboard using the emergency generator.

Passenger safety

The company's emergency response manual also provided specific guidance on passenger safety-related issues, advising the on-scene commander to “keep passengers advised and updated.” Several other checklists, such as those for fire, collision, flooding, and grounding, included an item advising to “sound the emergency alarm.”

Some of the on-scene commander checklists included other specific guidance on passenger safety-related tasks. The checklist for abandoning ship included 2 pertinent items: (a) passengers were to be mustered at designated locations ensure that handicapped passengers received special assistance and (b) the vessel must be searched to locate personnel not accounted for at the muster prior to abandoning ship. The checklist in case of fire includes an item for “passengers to be mustered to the appropriate safe haven(s)” and the checklist in case of explosion calls for passengers to be advised of the nature of the emergency and to be mustered at the emergency stations, as necessary.

The emergency duty roster, or muster list, specified the emergency tasks and duties to be performed by each crew member in both a fire/prepare-to-abandon situation and an abandon-ship situation. For the fire/prepare to abandon stage of an emergency, the muster list distributed the following passenger safety-related emergency duties among the passenger services crew:

• Take charge of assembling passengers: identify persons requiring assistance, inform bridge and give passenger and crew count (in all cases, this task was assigned to the PSS).
• Sweep cabins and washrooms and isolate areas on lower deck.
• Sweep boat deck.
• Sweep upper deck.
• Assist person in charge to muster passengers as directed and as required (at muster station A or B).
• Set up first-aid station (at muster station A or B, depending on passenger/crew complement).
• Take charge of calming/informing/grouping/counting passengers (at muster station A or B).
• Assist as directed and required (at muster station A or B).

In order to ensure that crew members were aware of their assigned emergency task, each crew member was provided a duty card with their task(s) specified on it. These cards would be handed out or changed depending on which muster list was in effect.

The muster list also provided various general instructions, including the following:

• The emergency signal for the fire/prepare to abandon stage was described as a prolonged ringing of the general alarm bells, followed by a succession of 7 or more short blasts, followed by 1 long blast on the vessel's whistle.
• The deck officer on watch was responsible for sounding the alarm, closing watertight doors and fire doors, and stopping fans as required.
• Team leaders were responsible for taking a head count of crew in their party and informing the bridge.
• Once the emergency signal was sounded, the deck patrol was responsible for helping passengers to get from the vehicle deck to the muster station.

The company had also developed and implemented a shipboard operations manual that had a section describing evacuation procedures for the vessel. Among other things, these procedures included the following:

• Emergency signals: upon hearing the emergency duties signal (general alarm bell) followed by a public address announcement to indicate the nature and location of the emergency, crew members are to muster at their emergency station, whereas team leaders are to carry out a head count and then report to the bridge.
• Communication with passengers in an emergency: the procedures indicate that the master will make a public address announcement to passengers and crew, as necessary, telling them proceed to a designated safe area.
• Emergency duty roster and duty cards: the document states that crew emergency duty assignments are found on the emergency duty roster (muster list) and describes the process whereby each crew member will be given a duty card identifying their specific emergency duty.

Evacuation procedures: on-board practice

The PSS employed on board the Princess of Acadia had been with the vessel for more than 30 years. During that time, practices had evolved for the conduct of the emergency tasks related to passenger safety and these practices were incorporated into the fire and boat drills. For example, it was the practice for passenger services crew members to don a reflective vest so as to be easily identifiable to passengers in an emergency situation. Also, the practice for sweeping the passenger spaces on the upper deck and boat deck involved 2 crew members working as a team, equipped with a portable radio for communication and tape for marking the doors of spaces that had been cleared of passengers. In this occurrence, not all passenger services crew donned reflective vests, nor was the tape put into use when the crew swept the vessel for passengers.

With respect to emergency procedures on the Princess of Acadia, as they pertain to passenger safety functions, some were implemented as on-board practices only, while others were documented in the vessel's emergency duty roster, emergency response manual, and training manual.

Training

To meet regulatory requirements^{Footnote 29} with respect to passenger safety, all of the vessel's officers and crew members had participated in a TC-approved training course in passenger vessel safety management. This training provides crew members with an understanding of measures necessary for the safe operation of passenger vessels and covers topics such as crowd management, crisis management, and human behaviour.

The company had also developed and implemented a training manual specific to the Princess of Acadia that formed part of the vessel's SMS. Crew members were expected to have knowledge of the training manual and to know where copies were located on board. The manual addressed a variety of topics, such as

• the vessel's emergency duty roster,
• the locations of fire control and lifesaving plans,
• emergency signals,
• locations of emergency equipment and embarkation stations,
• information about watertight doors,
• information about the hazards of exposure, such as hypothermia and cold shock, and
• information about emergency equipment such as immersion suits, lifejackets, lifeboats and rescue boats.

Vessel emergency drills

The vessel's emergency response manual also contained a section establishing when and how various emergency drills should take place, stating that “the master is responsible for the training efficiency of crew members in their duties with regard to all emergency scenarios,” and that “these emergency drills should be made as realistic as possible without endangering the safety of the ship, equipment and personnel.” The vessel's SMS stated that the DPA is responsible for monitoring the effectiveness of the emergency drills program.

The emergency response manual specified that blackout/engine failure drills were to be conducted annually at the dock by each crew and that grounding drills were to be conducted every 2 years. The crew participated in weekly fire and abandon ship drills (otherwise known as boat drills) as well as several other types of drills that were designed to test various response procedures, such as bunker spills, collisions, explosions, or man overboard, but on a less frequent basis. For the purpose of the fire and boat drills, the passenger services crew simulated their duties during mock scenarios without actual or simulated passengers.

There were no records of blackout drills held during 2012 and 2013 in the company documentation obtained during the TSB investigation. The emergency drill schedule record form on board the Princess of Acadia indicates that blackout/engine failure drills were last conducted on 21 April 2011 during the TC annual inspection and again on 17 May 2011 during a Lloyd's inspection. Both drills were conducted while the vessel was at the dock.

Regulatory requirements for passenger safety procedures and drills

The Fire and Boat Drills Regulations were amended in 2010 to require that passenger vessel muster lists assign passenger safety emergency duties to specific crew. The regulations specify certain duties to be included in the muster list, such as

• warning passengers of the emergency,
• ensuring passengers have donned their lifejackets correctly,
• assembling passengers at their designated muster stations,
• locating passengers who are unaccounted for and rescuing them,
• keeping order in the passageways and stairways, and
• ensuring that a supply of blankets is taken to the survival craft.

Furthermore, the master of a passenger vessel is required to ensure that procedures are in place for locating passengers who are unaccounted for and rescuing them during an emergency, and that crew members practice their passenger safety-related duties during drills.

During the annual inspection of a vessel, the inspector^{Footnote 30} verifies that the documented muster list is on board and witnesses the conduct of a fire and boat drill, ensuring that the tasks and duties specified on the muster list are performed. However, the inspector does not verify that the muster list contains the information required by regulation. On 08 January 2013, at the last annual inspection prior to the occurrence, attended by both TC marine safety inspectors and Lloyd's Register inspectors, the muster list was verified as being on board and a satisfactory drill was observed.

Planned maintenance system

A planned maintenance system is a paper or software-based system that can assist vessel owners and operators in carrying out methodical and timely inspections and maintenance. Such a system can be used to establish maintenance and inspection intervals and to define the methods for maintenance tasks. In addition, it is used for maintenance tracking and trending, both of which are necessary for assessing performance of equipment, procedures, and maintenance schedules and for planning risk-based preventative maintenance.

The Princess of Acadia had a computerized planned maintenance system that had been in use on board since the 1990s. The planned maintenance records were submitted to the company monthly. The planned maintenance system specified, among other things, monthly inspections of each generator, which included checking the exciter brushes in each generator for excessive wear and ensuring that they were free in their holders.

It was the practice of the crew to inspect the exciter brushes weekly. Maintenance records in the 5 months prior to the occurrence included 1 record of the brush inspection in September 2013.

Lloyd's Register statutory inspections

Recognized organizations,^{Footnote 31} such as Lloyd's Register, carry out annual inspections and periodic inspections at defined intervals to ensure the vessel is in class and to issue statutory safety certificates. One of the items included for a periodic electrical inspection is testing of fuses and over-current protection devices, such as generator breakers, every 5 years.^{Footnote 32} Over-current protective devices require testing with specialized equipment to meet OEM specifications and in most situations, this testing is contracted out to factory service representatives.

In 2004, TC partially delegated the vessel inspections to Lloyd's Register. In 2007, as part of the vessel's periodic inspection, Lloyd's Register records indicate that over-current testing of the generator breakers on the Princess of Acadia had been satisfactorily completed by a private company. The Princess of Acadia was due for its next periodic testing of the over-current protective devices, which included generator breakers, in 2012; however, there was no record of the over-current test. Lloyd's Register records indicate that the periodic survey had been completed to the satisfaction of the attending surveyor.

Post-occurrence testing of the No. 1 generator breaker found the over-current protective device was inoperative.

Previous occurrences involving passenger safety procedures and drills

Joseph and Clara Smallwood

Following an occurrence in May 2003 involving a fire on a cargo deck on the roll-on/roll-off passenger ferry Joseph and Clara Smallwood,^{Footnote 33} the TSB investigation revealed that crew members did not possess the knowledge or skills to adequately perform their emergency duties, and the Board subsequently expressed its concern about the adequacy of passenger safety procedures and training.

Queen of the North

During the March 2006 sinking of the roll-on/roll-off passenger ferry Queen of the North,^{Footnote 34} 2 passengers remained unaccounted for following evacuation procedures and were never found. The TSB investigation found that those responsible for passengers had difficulties establishing and reconciling the total count and identifying those missing. The Board subsequently recommended that

The TSB investigation also noted that drills did not cover the full range of skills necessary to muster and control large numbers of passengers. Given the risks associated with poorly coordinated preparations for evacuating large number of passengers, the Board recommended that

As part of TC's response to these recommendations, the Fire and Boat Drills Regulations were amended to require that the muster list duties for passenger vessels include locating passengers who are unaccounted for in an emergency and rescuing them. The amendment also required that procedures and realistic drills relating to these duties be implemented. The Board assessed the responses to both recommendations as Fully Satisfactory in July 2010.

Nordik Express

In August 2007, the passenger vessel Nordik Express^{Footnote 35} struck Entrée Island, Quebec, damaging its hull below the waterline. The subsequent TSB investigation identified several shortcomings with respect to duties relating to passenger safety, including the following:

• The bridge crew did not sound an alarm, leaving the crew members responsible for passenger safety to improvise their response.
• The emergency duty lists did not address tasks related to the preparatory stages of an evacuation.
• A passenger count was not performed.

Jiimaan

In October 2012, the roll-on/roll-off passenger ferry Jiimaan^{Footnote 36} grounded on the approach to Kingsville Harbour on Lake Erie in Ontario. The TSB investigation into this occurrence determined that the shipboard plans and procedures for mustering and accounting for passengers were not comprehensive and drills were only conducted with crew members, which meant that crew were not able to practice passenger management duties in a realistic way.

Furthermore, it was determined that TC inspections did not verify that the passenger-safety related duties or procedures required by the regulations were included in the shipboard procedures. The Board subsequently issued the following Safety Concern:

The Board is concerned that, if TC marine safety inspectors do not assess muster lists and evacuation plans for compliance and adequacy and TC does not provide interpretive guidelines, compliance with passenger safety regulations may be inadequate, thereby negating the potential safety benefits of such regulations.

Louis Jolliet

On 16 May 2013, the passenger vessel Louis Jolliet^{Footnote 37} ran aground off Sainte-Pétronille, Île d'Orléans, Quebec, while on a cruise with 57 passengers on board. The TSB investigation determined that key crew members were not familiar with their emergency duties. The investigation also determined that the emergency procedures in place for the vessel had shortcomings with respect to passenger safety management, and crew members had not practiced such procedures in a realistic way. Although the task of securing the safety of the passengers was accomplished on the day of the occurrence, the Louis Jolliet was certified to carry up to 1000 passengers, highlighting the need for comprehensive and detailed procedures, training, and drills in passenger safety management. The investigation also highlighted the need for effective oversight of passenger safety by TC.

Events leading to the grounding

The Princess of Acadia was approaching the Digby ferry terminal in confined waters when the bow thruster was started and the main and emergency switchboards blacked out, causing the controllable-pitch propeller (CPP) pumps to stop operating. Once the CPP pumps stopped, the propeller pitch defaulted toward full astern and, with the main engines still running and the propeller shafts clutched in, the vessel began to slow down, stop, and then back toward the nearby shoreline.

The master was not aware that pitch control had been lost at the time of the blackout and only became aware that the vessel was not under command approximately 2 ½ minutes before the grounding, when the vessel began moving astern. Following the blackout, the bridge team made repeated requests to the engine room for power, but did not specify that they needed pitch control. The engine room crew focused on closing the main generator circuit breakers to restore power to the main switchboard and did not communicate to the bridge that they were having difficulty closing the breakers.

In the limited time prior to the grounding, the master was waiting for the engine room to restore power, as they had done in the past when the vessel had sustained a main switchboard blackout. The propeller shafts remained clutched in with the main engines running until the master ordered the engines de-clutched as the vessel went aground.

Cause of the blackout

There were 2 main generators powering the main switchboard when the bow thruster was started; however, the No. 1 main generator was losing excitation due to a deteriorated brush, causing the generator to produce less power. The No. 2 generator was unable to produce the additional power required to start the bow thruster, and the breaker tripped from current overload, causing the interlock to activate and disable the bow thruster. Simultaneously, the deteriorated brush likely began arcing, which would have shorted out that set of brushes and caused the voltage on the No. 1 generator to drop until the under-voltage trip opened the breaker, resulting in a loss of power to the main and emergency switchboards.

Maintenance management

To ensure vessel equipment is fully operational, all maintenance and inspections must be performed according to an established schedule that is continuously updated to reflect actual equipment needs and take into account any modified or replaced equipment. Vessel maintenance and inspections must also be documented with detailed and complete records to enable tracking of all maintenance, condition of equipment, and breakdowns. This historical data is needed to analyse equipment failures and determine if the equipment, scheduled maintenance, or operating procedures require modification. Historical maintenance data also allows for analysis of trends and enables effective preventative maintenance to be carried out.

On the Princess of Acadia, the company had switched to using softer exciter brushes in order to reduce costly maintenance of the rotor slip rings. Although the records from the planned maintenance program indicated that the brushes were only checked once every few months, the crew practice was to check the brushes on a more frequent basis. However, without records to document each time that the brushes were maintained, the intervals at which these tasks were performed would not be obtainable by the crew.

When a change of equipment, such as the switch to softer brushes, is made, it is important that the new equipment be inspected more frequently and that the results of these inspections be documented to build a maintenance history. This can assist in determining if any adjustments to the planned maintenance system are needed. In this case, the switch to softer brushes may have introduced new maintenance needs. However, maintenance and inspections of the brushes were not consistently documented, hampering the crew's ability to accurately determine when the brushes should be replaced.

If maintenance and inspections of vessel equipment are not documented with detailed and complete records, there is an increased risk that tracking of equipment reliability and related maintenance will be ineffective for determining overall maintenance needs.

If maintenance schedules are not updated when critical equipment is modified or replaced, there is a risk that this equipment will not be serviced when necessary and, as a result, will not be fully operational when needed.

Communication between the bridge and engine control room

During an emergency such as a blackout, it is important that the bridge and engine room exchange critical information so that key personnel have a full understanding of the situation and can make informed decisions. Each department must quickly inform the other department what they need, what is happening at their station, what problems they are experiencing, and what risks are present.

In this occurrence, although there were numerous calls made between the bridge team and the engine room team, neither was communicating effectively. After the blackout, it was paramount that the master knew, as soon as possible, that there was little progression to restore power to the main switchboard. It was also paramount that the chief engineer knew, as soon as possible, that the master needed power to the CPP pumps. However, the bridge did not immediately advise the engine room that the vessel had begun backing toward the shore and that they did not have pitch control. Also, the engine room did not advise the master that the emergency generator was powering the vessel, and that the main generator breakers would not close.

Without exchanging this critical information, the engine room was not aware of the urgency of the situation (i.e., that the vessel was backing astern toward the shore) until shortly before the grounding and remained focused on closing the main generator breakers to restore power to the main switchboard, only attempting to use the emergency power to back-feed the main switchboard after the vessel had grounded. At the same time, the bridge team was not aware that the engine room was having difficulty restoring power. The bridge team was waiting for power to be restored quickly by the engine room, as had occurred in the past, and therefore the propeller shafts remained clutched in with the main engines running until the vessel started to ground.

Clear and direct responses were crucial to alert both departments that drastic action was required to either urgently feed emergency power to the main switchboard and restore power the CPP pumps or else immediately stop the main propulsion.

If bridge and engine room personnel do not exchange critical information during an emergency, there is a risk that key personnel will not be fully aware of the situation and may make ineffective decisions.

Vessel emergency response procedures

It is the responsibility of the vessel owner or representative to ensure an adequate response to an emergency affecting the vessel. Emergency procedures are most effective when they assign specific crew members to specific tasks, when they indicate exactly when and where a crew member is to report during an emergency, and when they include all the necessary actions required for a timely and coordinated emergency response. It is also important that emergency procedures are documented and designed to facilitate quick action on the part of crew members, given the time-sensitive nature of most emergencies.

Blackout

On the Princess of Acadia, detailed and robust blackout procedures were especially important because a main switchboard blackout impacts the propulsion capabilities of the vessel.

The on-scene commander checklist for blackout/engine failure contained primary and secondary steps to take to respond to a blackout emergency. Although a primary response is to exhibit “not under command” shapes or lights, the checklist did not indicate why the master may be unable to command the movements of the vessel (i.e., that pitch control is lost when the CPP pumps stop operating and that the propeller pitch is designed to default to full astern until power was restored to the main switch board and the CPP pumps were restarted). The checklist did not give any direction to the master that the vessel's propulsion may need to be unclutched or stopped if the bridge no longer has control of propeller pitch and the vessel's movements are standing the vessel into danger. The checklist also did not indicate a need to sound the emergency alarm when the main switchboard blacked out, even though the vessel would then begin operating on the emergency generator.

The engine room blackout procedures were written as a set of steps to follow in the event that 1 generator is powering the main switchboard and trips offline. The procedures did not specifically cover situations where 2 generators trip offline simultaneously, as in this occurrence. Furthermore, the engine room blackout procedures were not focused on helping the engine room team to restore power as quickly as possible. Rather than providing immediate solutions for how to restore power to the main switchboard (e.g., back-feed the emergency switchboard to the main switchboard), the procedures focused the engine room team first on identifying the cause of the blackout, which may, in some cases, take an extended period of time.

The engine room blackout procedures also did not make reference to the fact that the pitch control would be lost during a main switchboard blackout. Although the procedures included the steps required to feed emergency power back to the main switchboard, they did not state specifically that the CPP pumps needed to be restarted in order to restore full command of the vessel's movements on the bridge.

Lastly, the engine room blackout procedures did not highlight the event as an emergency response situation. The procedures did not specify where engine room crew, including the electrician and engine room assistant, were to report during a blackout, nor did they designate specific duties to anyone. The bridge emergency blackout response and engine room blackout procedures did not interface bridge-engine room communications or coordinate their actions to correct the emergency and mitigate all potential risks.

Neither the bridge nor the engine room had effective procedures to respond to the blackout of the main switchboard.

Passenger safety

The documented emergency procedures in effect on the Princess of Acadia at the time of the occurrence had shortcomings with respect to the passenger safety management elements, specifically with respect to the preparatory phases of abandoning ship. The investigation identified that the vessel's muster list, emergency response manual, evacuation procedures, and training manual did not offer any specific details on

• the process by which all spaces of the ship would be swept and cleared of passengers;
• how and by whom people with injuries or disabilities would be assisted;
• how a head count of passengers at the muster station would be accomplished and reconciled with the number of passengers on board;
• when, how, and by whom any missing passengers would be located and rescued; and
• who was assigned to distribute lifejackets to the passengers and when that should be done.

Given the circumstances of the occurrence, these shortcomings were not detrimental to the response to the emergency, and the tasks necessary to ensure the safety of passengers were accomplished successfully. For example, the crew were able to complete a count of passengers and accomplish a search of the vessel to resolve the discrepancy between the number of passengers on board and the number recorded in the manifest.

Also, under the leadership of the longstanding passenger services supervisor (PSS), several good practices had been established for the management of passenger safety in an emergency, but these practices had not been documented. Without documenting procedures for the full range of passenger safety management tasks, the company has no means to ensure that these duties would be organized and practiced on a consistent basis, or that good practices and knowledge are retained should key crew members leave the vessel.

In this occurrence, there were several shortcomings identified with respect to the procedures for responding to a blackout and for managing passenger safety in an emergency. If crew members do not have formal written procedures that facilitate quick and effective action, there is a risk that they will not respond effectively in an emergency.

Drills

Regularly practiced, hands-on drills are the most effective method of training crew members and they help to identify areas that may need improvement. In addition, debriefing the performance of the drill at safety meetings gives any crew member the opportunity to raise concerns over any risks that may still exist within the system, such as the loss of the CPP system when on emergency power.

Although the company safety management system (SMS) required that a blackout drill be carried out annually, there were no records of blackout drills in the company documentation for the previous 2 years. Fire and boat drills on board the Princess of Acadia were practiced regularly; however, they were conducted only with crew members and did not use passengers or crew acting as passengers. Consequently, the crew members were not able to practice their passenger management duties in a realistic way. These factors are significant considering that there may be up to 572 passengers on board, with a passenger services team consisting of only 11 crew members.

If drills are not practiced regularly and do not realistically simulate an emergency, there is a risk that crew members will not be able to respond effectively during an emergency.

Sounding of the general alarm

The sounding of emergency alarms on board a vessel warns everyone on board to immediately protect themselves, proceed to their designated station, and perform their emergency duties. The alarm must be sounded as soon as the emergency happens or sooner if it is apparent that there exists a risk to the vessel or personnel. All emergencies must be considered serious and potentially dangerous.

In this occurrence, no emergency alarms were sounded. Without an alarm to activate the emergency plans and procedures, the crew members were not alerted that there was an emergency and therefore did not proceed to their emergency stations. On his own initiative, the PSS gathered and readied some of the passenger services crew after the vessel blacked out. However, without an alarm, there were other crew members who did not immediately proceed to their stations where they could be accounted for and prepared to participate in the response as required.

Following the blackout, the engine room assistant, the vessel's electrician, the second engineer, and the night shift fourth engineer eventually went to the engine room after noticing indications that something may be wrong; however, initially there were only 2 crew members (the chief engineer and the fourth engineer) in the engine room to respond to the emergency. This limited the number of qualified crew members available to assist with troubleshooting the blackout and taking the steps necessary to restore power. Furthermore, when additional engine room personnel finally arrived in the engine room, they did not have a full understanding of the emergency situation and, without designated duties, their responses were ad hoc.

If an alarm is not sounded to indicate an emergency at the earliest possible stage, there is a risk that the passengers/crew will not be ready to respond to the situation.

Safety management

Effective safety management is an ongoing process that involves identifying hazards, assessing risks, and putting measures in place to maintain risk at the lowest practicable level. Although the Princess of Acadia's SMS required hazardous occurrences to be reported and subsequent investigations to be undertaken, it did not provide guidance to assist the master in conducting these investigations, nor did it specify a process for proactively identifying risks.

The Transportation Safety Board of Canada (TSB) investigation identified the following risks that existed on the Princess of Acadia at the time of the occurrence:

• The emergency procedures and drills were not focused on the steps to take to quickly restore power to the propeller pitch pumps and, as such, were not optimized for time-sensitive risk scenarios such as a blackout occurring in confined waters.
• Neither the on-scene commander checklist for a blackout/engine failure nor the engine room blackout procedures included information to ensure control of the vessel's propulsion when operating on emergency power.
• The bow thruster was routinely started in confined waters, despite the possibility that this could lead to a loss of vessel control where there is limited sea room.
• The electrician and engine room assistant were posted on the deck when the vessel was docking, which meant they were not immediately available to help in the engine room should the vessel encounter a problem, such as a blackout, in confined waters.
• Incomplete maintenance records and no tracking or trending of maintenance on the exciter brushes reduced the company's ability to assess performance of the equipment, modify the maintenance schedule, and plan risk-based preventative maintenance.

With respect to hazardous occurrence investigations, the SMS did not provide the master with guidance on how to undertake investigations that included a focus on proactive risk management, nor did the accident reporting forms included in the SMS manual require the master to identify risks associated with hazardous occurrences. The investigation conducted following the 06 June incident was consistent with the company's procedures and approved by the designated person ashore (DPA); however, the scope of the investigation was focused only on the mechanical cause for why the master did not have command of the vessel and did not address the larger issue of why the vessel went astern. The investigation thereby missed identifying the risk associated with clutching in the propeller shafts without the CPP pumps operating; the risk being that the propeller pitch defaults toward full astern and the vessel will go astern if the shafts are clutched in and the CPP pumps are not running.

If an SMS does not provide guidance for the master to proactively identify risks and investigate hazardous occurrences, underlying risks may not be addressed.

Adequacy of regulatory oversight

Previous TSB investigations^{Footnote 38} have identified deficiencies and associated risks in the preparedness of Canadian passenger vessel crews to muster and account for passengers in an emergency situation. In response to TSB recommendations to address the issue, Transport Canada (TC) made regulations requiring that the muster list of a passenger vessel include tasks specific to passenger safety and include procedures that are developed to carry out those tasks.

In this occurrence, a documented muster list, emergency response manual and evacuation procedures were kept on board the Princess of Acadia and these were verified by TC marine safety inspectors during annual inspections, fulfilling the requirements for the certification of the vessel. However, the documents included none of the specific passenger safety-related duties or procedures required by the regulations, with the exception of “assembling the passengers at their designated muster stations.”

If TC oversight to ensure compliance with regulations regarding passenger safety emergency procedures is ineffective, there is a risk that these procedures will not achieve their intended purpose.

Findings as to causes and contributing factors

1. After the vessel entered confined waters, the bow thruster was started and a deteriorated exciter brush caused a main generator to lose power, resulting in a blackout of the electrical switchboards.
2. The vessel continued making way but was not under command because the controllable-pitch propeller pumps had stopped and the propeller pitch had defaulted toward full astern.
3. The master was not informed that engine room personnel was having difficulty restoring power to the main switchboard and the engine room was not aware of the urgency of the situation, which impeded an effective response to the emergency.
4. Neither the bridge nor the engine room had effective procedures to respond to the blackout of the main switchboard.
5. About 2½ minutes prior to grounding, the vessel began backing toward the shore and the propeller shafts remained clutched in until the vessel started to ground.

Findings as to risk

1. If maintenance and inspections of vessel equipment are not documented with detailed and complete records, there is an increased risk that tracking of equipment reliability and related maintenance will be ineffective for determining overall maintenance needs.
2. If maintenance schedules are not updated when critical equipment is modified or replaced, there is a risk that this equipment will not be serviced when necessary and, as a result, will not be fully operational when needed.
3. If bridge and engine room personnel do not exchange critical information during an emergency, there is a risk that key personnel will not be fully aware of the situation and may make ineffective decisions.
4. If crew members do not have formal written procedures that facilitate quick and effective action, there is a risk that they will not respond effectively in an emergency.
5. If drills are not practiced regularly and do not realistically simulate an emergency, there is a risk that crew members will not be able to respond effectively during an emergency.
6. If an alarm is not sounded to indicate an emergency at the earliest possible stage, there is a risk that the passengers/crew will not be ready to respond to the situation.
7. If a safety management system does not provide guidance for the master to proactively identify risks and investigate hazardous occurrences, underlying risks may not be addressed.
8. If Transport Canada oversight to ensure compliance with regulations regarding passenger safety emergency procedures is ineffective, there is a risk that these procedures will not achieve their intended purpose.

Other findings

1. There was no record of an over-current test for the vessel's main generator breakers, despite that fact that Lloyd's Register records indicated that the periodic survey had been completed to the satisfaction of the attending surveyor.

Safety action taken

Lloyd's Register

Following the occurrence, Lloyd's Register changed the frequency of testing for the generator breakers on the Princess of Acadia to yearly, citing the age and usage of the breakers.

Bay Ferries Ltd.

Bay Ferries Ltd. has implemented the following changes:

• When the vessel arrives in Digby, Nova Scotia, the company has stated that the bow thruster must be on and tested at Checkpoint 1 Delta, which is located 3 nm outside of the Digby Gut.
• The engine room assistant is now required to stay in the engine room until the vessel secures to the dock in Digby.
• An uninterrupted power supply has been installed to provide battery back-up to the gyro compass to ensure that navigational equipment continues to receive the vessel's gyro heading after a short power outage.
• A simplified voyage data recorder (VDR) has been installed, which will record 12 hours of bridge audio and data from the radars, automatic identification system, and other available sensors.

This report concludes the Transportation Safety Board's investigation into this occurrence. The Board authorized the release of this report on 17 December 2014 . It was officially released on 29 January 2015.

Appendix A – Vessel's general arrangement

Appendix B – Occurrence route

Appendix C – On-scene commander emergency response checklist for a blackout/engine failure

Appendix D – Engine room blackout procedures