Marine Investigation Report M14C0106

On 12 June 2014, at approximately 1020 Eastern Daylight Time, the self-discharging bulk carrier Atlantic Erie ran aground 1.5 nautical miles southeast of the outer piers at Port Colborne, Ontario, after power interruptions to the bridge. The visibility was good at the time. After the cargo was partially discharged, the vessel was refloated with the assistance of 2 tugs. There were no injuries or pollution, but the vessel sustained damage.

1.1 Particulars of the vessel

1.2 Description of the vessel

The Atlantic Erie is a dry bulk cargo vessel of steel construction with machinery space and accommodations located aft. The vessel has 5 cargo holds and is fitted with a self-discharging system that allows cargo to be released from the bottom of the cargo holds onto conveyor belts, transported above deck level via an elevator system, and then transferred onto a discharge boom conveyor and offloaded.

Image

Propulsion is provided by a 6-cylinder diesel engine driving a controllable-pitch propeller rotating within a steerable Kort nozzle.^{Footnote 2} Electrical power is supplied by 3 generators^{Footnote 3} (2 are rated at 1206 kW each and 1 is rated at 700 kW). There is also 1 emergency generator situated in the emergency generator room. The entrance to the emergency generator room is on the exterior of the vessel, 2 decks above the main deck (Appendix A). The vessel is fitted with an electric bow thruster with a controllable-pitch propeller. The bow thruster has a 746 kW motor that is situated in an enclosed space within the forepeak compartment. Two main generators must be online to handle the high-power load required to start the motor.

The bridge is equipped with the required navigational equipment, including 3- and 10-centimetre automatic radar plotting aids, 2 gyrocompasses, 1 magnetic compass, and 2 very high frequency (VHF) radiotelephones (Appendix B). The vessel is also equipped with a differential global positioning system (DGPS) and 2 electronic chart systems: a 3D Navigator draft information system, and an Electronic Chart Precise Integrated Navigation System (ECPINS) with a slave monitor located in the master's cabin. The ECPINS is backed up by an uninterrupted power supply. Both the ECPINS and the 3D Navigator display display the vessel heading and the course made good (CMG):^{Footnote 4} the CMG value is supplied by the DGPS and the vessel heading value is supplied by the gyrocompass.

1.3 History of the voyage

On 09 June 2014, the Atlantic Erie departed Chicago, Illinois, United States, bound for Sydney, Nova Scotia. By the morning of 12 June, the vessel was proceeding eastbound in Lake Erie, towards Port Colborne, Ontario, at a speed of 11.8 knots. The bridge team comprised the third officer, who was the officer of the watch (OOW), and the bridge watchman, who also acts as helmsman when the vessel is not on autopilot. Shortly after 0800,^{Footnote 5} the OOW called the fourth engineer, who was the engineer of the watch (EOW), and gave 1 hour's notice to prepare for manoeuvring in the upper entrance to the Welland Canal. The EOW then started the No. 3 generator and synchronized it with the No. 1 generator, which had been providing electrical power to the vessel.

Around 0900, the OOW called the master to the bridge, as per the master's night orders. The master arrived on the bridge 20 minutes later and, at approximately 0940, took over the con. At 0942, the master called a Seaway Welland vessel traffic controller and reported the vessel's position at calling-in-point (CIP) 16 (Appendix C). The master then started altering course to port, towards the outer piers at Port Colborne, while gradually reducing the vessel's speed. The master also told the OOW to go on deck and prepare for the transit of the first lock in the Welland Canal. This left the master and the helmsman manning the bridge.

At approximately 0944, the vessel was 1.5 nautical miles (nm) south of the outer piers and proceeding at a speed of about 9 knots. The master called the EOW and requested the bow thruster. The EOW closed the bow thruster circuit breaker and turned on the electric thruster motor. After the bow thruster had been running for 1 minute, the EOW transferred the controls to the bridge. The bow thruster ran for approximately 1 more minute without being used, at which point its circuit breaker tripped.

The EOW called the chief engineer (CE), who was in his cabin, for instructions. The CE told the EOW to restart the bow thruster and sent the second engineer to the bow thruster compartment to investigate the problem. After calling the bridge and advising the master of the situation, the EOW reset the circuit breaker and closed it. At approximately 0950, the EOW pushed the button to restart the bow thruster motor. The voltage in the electric distribution system dropped and the No. 3 generator main circuit breaker tripped, but the No. 1 generator continued powering the main switchboard. The main engine continued to operate, and the lights remained on throughout the vessel.

The drop in voltage set off a number of power failure alarms on the bridge, including alarms for the navigation lights, the port and starboard radars, the echo sounder, the fire detection panel, and the 2 gyrocompasses. The radars defaulted to standby mode,^{Footnote 6} and 2 of the 3 rudder angle indicators on the bridge were disabled. The master put the engine astern and ordered the helm hard to port in order to initiate a starboard turn^{Footnote 7} and abort entry to the canal. In the engine control room (ECR), power failure alarms sounded for the main and auxiliary pumps. The engine room crew restarted the pumps immediately, which silenced these alarms.

Meanwhile, a smoke detector in the bow thruster compartment set off an alarm on the bridge fire detection panel. The fire detection panel indicates the location of a fire and is also connected to the magnetic holders on the fire doors.^{Footnote 8} The master silenced the alarm, but then received a call from a crew member on the bow informing him that there was smoke coming from the bow thruster compartment.

The master sounded the whistle^{Footnote 9} and activated the general alarm, which caused the fire doors to close automatically. He then attempted to make an announcement stating that this was not a drill and asked crew to proceed to their muster stations, but the announcement did not transmit throughout the vessel because the master had mistakenly picked up the handset for the VHF radiotelephone instead of the handset for the public address (PA) system.

The PA handset is near one of the VHF handsets and is similar in appearance (Photo 2). The PA handset has a white label identifying it as the PA system. The VHF handset does not have a label.^{Footnote 10}

Image

Upon realizing that he had picked up the wrong handset, the master turned off the general alarm and began making the announcement using the PA handset. However, the announcement did not transmit again, this time because the master had not pressed the “all call” button on the PA system. At this point, the master stopped trying to use the PA and instead made the emergency announcement using the vessel's internal VHF frequency.^{Footnote 11} The master also called the second officer to the bridge for assistance with silencing the alarms.

After hearing the general alarm and the fire doors closing, the CE left his cabin^{Footnote 12} and went to the bridge to inquire about the location of the fire. When the CE arrived on the bridge, the master immediately informed the CE that there had been a blackout, that they had lost power to the navigating instruments, and that he was turning the vessel around. The master did not inform the CE about the report of smoke in the bow thruster compartment, and the CE did not inquire about the fire.

1.3.1 Subsequent events in the engine control room

The CE went to the ECR immediately after speaking with the master. On his way, the CE observed that the lights were on and, once in the ECR, he observed that the main engine and steering gear were running. At approximately 0958, the CE directed the electrician to go to the emergency generator room in order to assist with completing the vessel's blackout procedure.

As part of this procedure, the CE opened and closed the transfer breaker situated in the ECR. This is 1 of 2 transfer breakers that direct power between the main and emergency switchboards (Appendix D). When the transfer breaker was opened, power to the emergency switchboard was interrupted and some of the navigation equipment on the bridge, including the gyrocompasses, was de-energized. The associated power failure alarms activated again. The CE was not aware that the blackout procedure was having this effect.

Shortly after completing the blackout procedure, the CE resynchronized the No. 3 generator and started the No. 2 generator. He then synchronized the No. 2 generator with the No. 1 and the No. 3 so that the vessel's electrical system was being powered by all 3 generators.

At approximately 1001, the CE then made another attempt to restart the bow thruster, which created another drop in voltage, setting off the same power failure alarms on the bridge and in the ECR. Again, the lights remained on throughout the vessel. Following the voltage drop, the CE performed the blackout procedure again, unaware that he was de-energizing the navigation equipment and setting off power failure alarms on the bridge once more.

At approximately 1002, the second engineer informed the CE that there was a fire in the bow thruster compartment and asked him to stop making attempts to restart the bow thruster. With the consent of the CE, the electrician isolated power to the forward part of the vessel. The EOW made a safety round of the engine room and found that everything was in good order. The CE called to advise the master of this and then went forward to check the situation with the bow thruster.

1.3.2 Subsequent events on the bridge

Between 0957 and 1002, while the abovenoted actions were taking place in the ECR, the power failure alarms on the bridge sounded 3 more times following their initial activation. The bridge team did not know why the alarms were activating repeatedly. The second officer arrived on the bridge at approximately 0957 and began silencing and resetting the alarms, as per the master's orders.

At approximately 1001, the master ordered the helm hard to starboard and increased the engine speed ahead in order to increase the vessel's rate of turn. The master was monitoring the vessel's turn on the ECPINS, without confirming through visual navigation. The fire team, after checking the bow thruster compartment, reported to the master that there was smoke in the compartment but no fire.

At approximately 1003, the vessel was still turning to starboard. The master ordered the helmsman to steer 180 degrees gyro (°G) so that the vessel would proceed on a southerly course, away from land. By this time, the second officer had silenced all of the alarms, and the master sent him on deck to join the fire team and assist as required.

At 1006, the helmsman, who was steering using one of the gyrocompass repeaters, informed the master that the vessel's heading was 180°G. The gyrocompass had not been verified following the power interruptions.

At approximately 1011, more alarms went off on the bridge,^{Footnote 13} and the master ordered the second officer to return to the bridge and silence the alarms. The second officer arrived on the bridge at approximately 1015 and began silencing the alarms. After the alarms were silenced, the master went to his cabin to retrieve his cellular phone^{Footnote 14} in order to advise the company of the situation. Because the master's cabin is located 1 deck below the bridge and he expected to be gone only for a short time, the master left the bridge without transferring the con to the second officer.

Upon arriving in his cabin, the master looked at the ECPINS slave monitor and noticed that the vessel's CMG was easterly, but that the vessel-shaped marker which indicates the heading was pointing southerly (Appendix E). The master quickly returned to the bridge and requested the magnetic heading from the helmsman, who reported it to be 111° magnetic (M).^{Footnote 15} The master looked outside and saw that the shoreline was on the vessel's port side, instead of on its stern. He immediately ordered the helm hard to starboard in order to correct the vessel's course and increased the propeller pitch to get more power ahead. The vessel began turning to starboard but, moments later, the hull touched bottom and, at 1020, the vessel ran aground 1.5 nm southeast of the Port Colborne outer piers.

1.4 Bow thruster failure

The reason for the bow thruster's failure could not be conclusively determined. However, the TSB laboratory found that the most likely cause for the electrical issues at the time of the occurrence was a short between the windings^{Footnote 16} in the bow thruster motor.^{Footnote 17} The bow thruster motor is not a component that requires extensive user maintenance and inspections. Although the unit was regularly inspected and maintained,^{Footnote 18} it is likely that aging of the internal components led to its failure, possibly due to deterioration of the insulation on the windings over time as, in general, insulation tends to be the most affected by exposure to contaminants and environmental conditions such as vibration, humidity, and temperature.

Following the occurrence, the motor was sent to be serviced by a shore contracting company. Various parts were changed or renewed, the stator^{Footnote 19} was rewound and the windings were varnished. The whole motor was balanced, tested, and found operational. It was later put back on board.

Before starting the bow thruster on the Atlantic Erie, the practice is to ensure at least 2 generators are running in parallel. Once this is achieved, the bow thruster breaker is closed and the electric motor is started. After the motor has run for a minute or two, control of the bow thruster is transferred to the bridge. When the controls are transferred, a light illuminates on the bridge console and an officer on the bridge must accept control in order to complete the transfer. A sign posted on the ECR main switchboard states that the bow thruster is not to be started more than once every 2 hours. There are no instructions on what to do if the breaker trips.

1.5 Damage to the vessel

A post-occurrence diving inspection determined that both the shell plating and the forward transverse bulkhead, located between the forepeak tank and the bulbous bow void space, were cracked.

1.6 Environmental conditions

At the time of the occurrence, the weather was overcast but the visibility was good. The wind was from the south at 10 knots.

1.7 Vessel certification

The vessel was crewed, equipped, and certified in accordance with existing regulations. The Atlantic Erie had been issued a safety management system (SMS) certificate on 24 October 2013, and the company's document of compliance (DOC) had been issued on 30 September 2010. Both certificates had been issued by Lloyd's Register of Shipping. The latest endorsement for annual inspection was dated 27 November 2013.

1.8 Personnel certification and experience

The master held a Master, Near Coastal certificate of competency issued in 1992, and had sailed as a master since 2006, serving in this capacity on the Atlantic Erie since June 2013. The master had completed 35 hours of Bridge Resource Management (BRM) training in March 2002. The master had also completed Human Element Leadership Management (HELM) training^{Footnote 20} in February 2013.

The CE held a First-Class Engineer, Motor Ship certificate of competency issued in 2001 and had joined the company as CE in 2009 serving in this capacity on the Atlantic Erie since 2013. The CE had also completed HELM training in January 2013.

The second officer held a Watchkeeping Mate, Near Coastal certificate of competency issued in 1991, joining the company in 1996 and sailing as a second officer on the Atlantic Erie since 2010.

The third officer held a Master, Near Coastal certificate of competency issued in 1985, sailing as a third officer since 1977. He joined the company in 2010 and had sailed as a third officer on the Atlantic Erie since then.

The fourth engineer held a Fourth-Class Engineer, Motor Ship certificate of competency issued in February 2014. He had joined the company in 2013 and had sailed on the Atlantic Erie as a fourth engineer since April 2014.

The helmsman held a Bridge Watchman certificate issued in 2000 and had joined the company in 2007, holding the position of helmsman on the Atlantic Erie since 2008.

1.9 Electronic chart precise integrated navigation system

The ECPINS provides a visual representation of the vessel's track, along with numerical data for the vessel's heading^{Footnote 21} and the CMG. There is also a vessel-shaped marker on the ECPINS monitor that indicates the vessel's heading by way of the direction that the marker is pointing. The ECPINS obtains the heading from the gyrocompass and the CMG from the DGPS. Several times per second, the DGPS takes the vessel's position and plots it on a digital chart. This succession of plotted positions forms the track, which in turn provides the CMG. When the vessel is proceeding full ahead on a steady course, the CMG and the heading values are very close.^{Footnote 22} However, when the vessel slows down and/or turns, the difference between the CMG and heading values increases.

The screenshots in Appendix F are from a recording of what the ECPINS was displaying at the time of the occurrence. They show that, as the vessel began turning to starboard and away from the entrance to the canal, the difference between the vessel's heading and the CMG started to increase, as per usual (Appendix F, Screenshot 1). As the vessel was turning, the difference between the vessel's heading and the CMG continued to increase, which is also normal (Appendix F, Screenshot 2). However, after the vessel completed the turn and had been proceeding on 180°G for approximately half a minute, the difference between the CMG and the heading continued to increase when it would normally begin to decrease. In addition, the vessel-shaped marker was pointing southerly, even though the vessel was proceeding easterly (Appendix F, Screenshot 3).

1.10 Gyrocompass

A gyrocompass supplies the vessel's heading. The gyrocompass is a north-seeking gyroscope that consists of a rotating wheel (called rotor) mounted on gimbals^{Footnote 23} (Figure 1). It is encased in a housing with electronic components that keep the rotor's axis aligned with the terrestrial meridians^{Footnote 24} so that the gyrocompass indicates true north.

Image

When a vessel turns, torque is applied to the rotor's vertical axis, which causes the rotor to tilt in relation to its housing. Under normal operating conditions, a voltage transformer (called pick-up) located above the rotor senses this tilt by identifying differences in the magnetic fields on either side of the rotor. The pick-up then sends an electric current to neutralize the difference in the magnetic fields, thereby minimizing the tilt of the rotor. However, if power to the pick-up is interrupted, even briefly, when the vessel is turning, the pick-up cannot send the electric current necessary to counteract the tilt, and the rotor may lose its orientation altogether and come to rest against the bumpers (Appendix G). From the time power is restored, it may take between 90 and 120 minutes for the gyrocompass to realign with true north. A power interruption that occurs while the vessel is proceeding on a steady course will not have the same effect, given that the existing momentum of the rotor will keep it aligned for several minutes after power is lost, provided the rotor is not subjected to a tilt.

Most vessels are fitted with gyrocompass repeaters at key locations on the bridge, such as the helm, allowing navigators to check the vessel's heading at any given time. Other navigation equipment, such as radars, the 3D Navigator, and ECPINS, obtains heading data from the gyrocompass and display this information on their respective screens.

The accuracy of a gyrocompass can be verified by using a magnetic compass, given that a magnetic compass is independent and does not require any means of power. Other navigating instruments such as the DGPS can determine the direction of the vessel, which is expressed as CMG.

The Atlantic Erie is fitted with 2 gyrocompasses, but only 1 can be used to feed the repeaters and other electronic navigational equipment at any given time. In this occurrence, power to the gyrocompass was interrupted twice by the blackout procedure. The pick-up in the gyrocompass was therefore de-energized while the vessel was turning to starboard and it could not correct the tilt applied to the rotor. As a result, the gyrocompass lost its alignment. The error affected the gyrocompass repeater that the helmsman was using to steer, as well as the ECPINS, which the master was using to monitor the vessel as it was turning away from shore.

1.10.1 Gyrocompass alarm

The 2 gyrocompasses on the Atlantic Erie are fitted with audible power failure alarms that activate on the bridge in the event that the equipment is de-energized or the voltage drops below the gyrocompasses' operational requirements. There is no way for the operator to determine whether the alarm has sounded as a result of a power failure or a voltage drop. As well, there is no alarm to indicate whether the gyrocompass has lost its alignment as a result of a power failure. The alarms cannot be acknowledged manually, but will silence automatically when the voltage returns to normal. This is different from the functionality of many of the other alarms on the bridge, which continue to activate until an operator acknowledges them manually.

In this occurrence, the gyrocompass alarms were activated 4 times in total: twice by the power interruptions caused by the blackout procedure and twice by the voltage drops caused by restarting the bow thruster. Each time, the gyrocompass alarm sounded for approximately 30 seconds before silencing automatically.

1.11 Alarm design standards

According to Transport Canada, gyrocompasses must be fitted with an automatic alarm to indicate a major fault in the compass system.^{Footnote 25} In December 2000, the IMO's Marine Safety Committee adopted guidelines on ergonomic criteria for bridge equipment and layout.^{Footnote 26} These guidelines came into effect on 01 July 2002 as part of revisions to Chapter V/15, Principles relating to bridge design, design and arrangement of navigational systems and equipment and bridge procedures, of the Safety of Life at Sea (SOLAS) Convention. Among other things, these guidelines stipulate that alarms should be maintained until they are acknowledged.

1.12 Power distribution system

1.12.1 Main and emergency switchboards

The distribution of power from the generators to the various systems on the Atlantic Erie is controlled by the main switchboard, which is located in the ECR. The main switchboard divides the vessel's power into smaller circuits for distribution to transformers, panel boards, control equipment, and, ultimately, to individual system loads. The main switchboard also provides switching, overcurrent, and short circuit protection such as fuses and breakers.

Under normal operating conditions, the Atlantic Erie's main switchboard can be powered by 1 or more of the vessel's 3 main generators. The main switchboard normally also powers the emergency switchboard via 2 transfer breakers.^{Footnote 27} The emergency switchboard powers 1 steering gear motor and various navigational instruments, including the gyrocompasses (Appendix D). In the event of a blackout (a situation where all 3 main generators fail), the 2 transfer breakers will open and, after a pre-set time delay, the emergency generator will start, its circuit breaker will close automatically, and it will begin supplying the emergency switchboard.^{Footnote 28}

The vessel also has an auto-standby system, which means that 1 of the main generators can be put on standby so that if the generator in operation fails, the standby generator will start automatically and replace the one that failed.

1.12.2 Engine room blackout procedure

Procedures in case of a blackout are defined in the Atlantic Erie's SMS, which is referred to by the company as the V.Ships Management System (VMS).^{Footnote 29} The engine room blackout procedure provides instructions for restarting the main engines and for resupplying power to the emergency switchboard using the main switchboard, rather than the emergency generator. Among other things, the procedure involves opening and closing the transfer breaker situated in the ECR. The CE had revised the procedure following testing of the generators conducted on 12 May 2014; the revisions included changes to the wording and formatting of the procedure, but did not alter the content.

In this occurrence, the 2 drops in voltage caused by restarting the bow thruster motor were significant enough to activate power failure alarms on the bridge navigation equipment. However, both times, a main generator continued to power the main switchboard and so the vessel did not, in fact, sustain a loss of electrical power. The blackout procedure was performed after each voltage drop. Because the vessel had not lost power, the blackout procedure had the effect of de-energizing the emergency switchboard each time it was performed, which interrupted power to the bridge equipment and activated the associated alarms.

1.12.3 Load sharing between generators

Load sharing involves the division of a vessel's total electrical load between 2 or more generators operating in parallel; it is carried out to avoid overloading and stability problems on the generator sets and the electrical systems. Depending on the vessel's power requirements, the EOW will determine the number of generators needed to supply power to the main switchboard. Before a generator's maximum rated capacity is attained, the EOW will start a second generator and synchronize it with the first, allowing the load to be shared by the 2 generators. The distribution of the load is automatically achieved by the engine speed governor^{Footnote 30} and the automatic voltage regulator.^{Footnote 31}

Prior to the occurrence, the CE had experienced a problem with the automatic voltage regulator that had impacted the load distribution between the generators.

1.13 Bridge resource management

BRM is the effective management and use of all resources, human and technical, available to the bridge team to ensure the safe completion of the voyage. BRM includes skills, knowledge, and strategies on workload management, problem solving, decision making, teamwork, and situational awareness, especially during critical operations. Specifically, bridge team members have a responsibility to maintain overall situational awareness as well as be responsible for their individual duties. They also have a duty to work as a team to help prevent single point failure, which may occur when only 1 person is responsible for a safety-critical task and that person has no back-up to help identify possible errors. The exchange of information is necessary for the team to work together towards a common goal. Ineffective communication can result in crew members having different understandings of the unfolding situation.

The company had recently implemented a Human Element Leadership Management (HELM) training program. This is a 1-week scenario-based course where masters and chief engineers are provided training on the limitations of human performance. The course is intended to help participants develop an understanding of cognitive errors, and how various stressors (fatigue, emergencies, work overload) can contribute to the occurrence of errors. The course involves 18 hours of classroom-based facilitated instruction on the following topics:

• leadership and management
• communication
• human capabilities and limitations
• decision making
• human error and human reliability
• fatigue and stress

The course also comprises 14 hours of simulator-based facilitated activities that involve both the bridge and the engine room crew. As the week progresses, the situations grow increasingly complex. The training goal is to develop the capability of trainees to manage simple and complex emergency situations.

1.14 Safety management system

Vessels that operate under the International Management Code for the Safe Operation of Ships and for Pollution Prevention (ISM Code) are required to implement an SMS, which provides a framework for managing safety risks within routine and emergency situations. The Atlantic Erie's SMS includes guidance on a number of issues relevant to this occurrence.

1.14.1 Bridge organization

With respect to bridge organization, the SMS states that bridge team members must realize they have a vital part to play in the safe navigation of the vessel and that safety depends on all personnel exercising their duties to the utmost of their ability. It also specifies that, among other things, an efficient bridge organization will “minimize the risk that an error by one person will have; emphasize the need to maintain a visual lookout; and (…) require the use of all means of establishing the ship's position so that in the case of one method becoming unreliable, others are immediately available.”^{Footnote 32}

1.14.2 Use of the 3D Navigator / Electronic Chart Precise Integrated Navigation System

The SMS contains information on using ECDIS^{Footnote 33} as the primary means for navigation and specifies that in this case, “radar and visual bearing should be cross-checked using the bearing line facility of the ECDIS unit.”^{Footnote 34} The SMS also cautions against the risk of losing situational awareness as the navigator's role becomes increasingly passive with the use of electronic chart systems and notes that a quick glance at the system on board is not sufficient to “ensure the safety of the vessel, to confirm the integrity of the automated position fixing or to maintain awareness of hazards ahead.”^{Footnote 35} The section concludes by emphasizing that navigators must maintain an active role and continue to manually plot positions at regular intervals to confirm the position displayed on the electronic chart system is correct.

1.14.3 Bridge equipment failures

The section of the SMS dealing with equipment failure provides suggested procedures to follow in the event of a failure of any piece of bridge equipment. These include increasing bridge manning and using hand steering. Specifically for a main gyrocompass failure, the suggested procedure is the use of a magnetic compass and the taking of additional compass errors.^{Footnote 36} The SMS originally contained checklists for the failure of key items of equipment, including the gyrocompasses; however, during a modification of the SMS to reduce obsolete and infrequently used procedures, the company had removed the checklist for gyrocompass failure with the plan of adding it to the shipboard contingency plan, but had not done so at the time of the occurrence. However, a power failure checklist, which requires a cross-check of the gyro and magnetic compasses, was available on board.

1.14.4 Emergency procedures

The SMS also provides guidance on emergency procedures, among which the following is specified:

• All emergency signals are to be backed up with information on the vessel's PA system.
• When the general alarm sounds, all personnel are to muster at their muster locations promptly and with due regard to personal safety.
• If the CE and electrician are not in the engine room when the alarm sounds, they are to make contact with the bridge before entering the engine room.
• The master is to inform the engine room of the location and type of emergency, if it is outside the machinery spaces.

The emergency procedures contained in the SMS are organized by single failure (what to do in case of a fire, a grounding, etc.), and emergency drills are conducted in the same way. In April and May 2014, the Atlantic Erie drill record indicates that single failure drills were carried out as required.

1.15 TSB laboratory reports

The TSB completed the following laboratory report in support of this investigation:

• LP129/2014 – Power System Analysis

2.1 Events leading to the grounding

In this occurrence, a voltage drop on the bridge escalated into an emergency after subsequent actions in the engine control room (ECR) caused multiple brief power interruptions to the bridge navigational equipment, and the gyrocompass became misaligned. The gyrocompass was not verified following the power interruptions. The helmsman was steering the ordered course of 180°G using a gyrocompass repeater that was becoming increasingly misaligned.^{Footnote 37} The master, who was not using all available bridge resources to monitor the vessel's position and course, did not identify the vessel's deviation until it was too late for corrective action and the Atlantic Erie ran aground.

2.1.1 Emergency response in the engine control room

After the initial voltage drop on the bridge, the chief engineer (CE) was informed that there were 2 problems requiring attention: a blackout on the bridge and a bow thruster failure. Given that the CE had recently experienced load-sharing problems with the generators, he interpreted the bow thruster failure as being connected to these problems, and not a problem with the bow thruster itself. This preliminary interpretation of the situation, combined with a desire to get the bow thruster back online quickly to assist the master in manoeuvring the vessel away from the canal, led the CE to attempt restarting the bow thruster without assessing its condition and the potential risks involved.

The CE had also received a report of a blackout on the bridge, but when he proceeded to the ECR, he observed an emerging set of cues that contradicted this report (lights on, generators running). The CE's interpretation of the problem did not change as a result of these cues, and he subsequently applied the blackout procedure twice in circumstances that did not call for it. The application of the blackout procedure while the vessel was still powered caused the situation to escalate. The CE did not realize or understand the consequences of applying the blackout procedure while the vessel was still powered, possibly due to an incomplete knowledge of the vessel's power generation system, and his actions inadvertently interrupted power to the bridge.

The CE's application of the blackout procedure and focus on the bow thruster failure as a load-sharing problem may have been a consequence of cognitive fixation. When problems arise, especially during critical operations where time pressure is present and the margins of error are limited, people tend to develop a particular interpretation of a problem/solution based on the context of the problem itself and to interpret cues that match the situation. Even if some cues are ambiguous or contradictory, people's tendency is to interpret cues in a way that complements their current understanding, because it allows them to settle on a plausible explanation and take action. Although this is efficient, the risk is that this can prevent a person from considering other explanations and actions. The tendency to become focused on one interpretation to the exclusion of others is known as cognitive fixation. Cognitive fixation is not related to problems with a person's motivation, but instead is related to the limited capacity of people in general to process new information and update their understanding or actions, which causes their original belief to persist.^{Footnote 38}

2.1.2 Emergency response on the bridge

Following the initial voltage drop, the master was faced with a novel and unfolding series of emergencies as he attempted to steer the vessel away from confined waters. These included repeated activations of power failure alarms on the bridge for which the cause was unknown, power loss to some navigational instruments and others that defaulted to standby mode, as well as a smoke alarm in the bow thruster compartment.

After receiving a report of smoke in the bow thruster compartment, the master sounded the general alarm and attempted twice to make an emergency announcement to all crew using the PA system, but both times he made mistakes, so he stopped trying to use the PA system and instead made the announcement using the vessel's internal very high frequency (VHF) system. The master likely switched to the VHF system out of concern for the time he was losing in repeated unsuccessful attempts to transmit the announcement on the PA system. However, as a consequence of the announcement being transmitted by VHF, the CE did not receive the message and was therefore not aware of the location of the fire and the danger associated with restarting the bow thruster.

Given the high workload involved in managing multiple unfolding emergencies while also navigating the vessel away from the canal, some critical aspects of the master's performance were shed unintentionally (e.g., managing bridge team resources to guard against single point failure, verifying the gyrocompass, monitoring visually, leaving the bridge without transferring the con).

In high-workload situations, individuals tend to reduce their use of peripherally relevant information, and centralize or limit their focus of attention to cues that they perceive to be most important or most relevant to a primary task.^{Footnote 39} If peripheral cues are ignored when they might be relevant to an important task, performance on that task may suffer. Individuals may also react by shedding or simplifying task demands and may have decreased situational awareness.

In this occurrence, both the master and CE faced an emerging complex emergency. Although they had completed Human Element Leadership Management (HELM) training just over a year previously, some important aspects of their training were not incorporated in their responses to the complex emergency. For example, the bridge-engine room communication was insufficient to update the master and CE's respective understandings of the developing situation and to allow them to work together to address the emergency. In addition, the CE did not use all available engine room resources (e.g., seeking information from other ECR team members) to update his situational awareness and assist him in taking appropriate action, nor did the master use all available bridge resources to reduce his high workload as the emergency unfolded.

2.2 Monitoring the vessel's progress

To ensure the safe passage of a vessel, navigators use visual cues and information from multiple types of navigational equipment. It is also important that navigators work as a team when monitoring the vessel's progress to minimize the chances that a single error will go undetected.

In this occurrence, the accuracy of the gyrocompass was compromised by the 2 power interruptions that took place while the vessel was turning. The gyrocompass was not cross-checked with the magnetic compass following the power interruptions. The master was monitoring the vessel's progress using only the Electronic Chart Precise Integrated Navigation System (ECPINS), which was showing the vessel's heading inaccurately due to the gyrocompass misalignment, but he did not detect this error.

Although the master called the second officer to the bridge on 2 occasions, both times the second officer was tasked only with silencing the alarms and was not engaged in monitoring the vessel's progress. As a result, the master was navigating alone without another officer to help him detect errors such as the inaccurate data being provided by the ECPINS. Furthermore, at one point the master left the bridge briefly to retrieve his cellular phone without handing over the con to the second officer.

Without using all available resources and information to verify the vessel's position, the bridge team did not detect the vessel's deviation from its intended course for a period of approximately 15 minutes.

If a bridge team does not make use of all available resources, both human and technical, to monitor the vessel's progress, there is a risk that errors may go undetected, which may result in an accident.

2.3 Gyrocompass alarm design

Effective alarm design involves consideration of a number of factors, including the method by which the alarm alerts the operator of a problem, the duration of the alarm, and the way the alarm is acknowledged, among other things.

In this occurrence, the bridge team was dealing with multiple activations of numerous different power failure alarms. Most of the alarms would continue to activate until the bridge team acknowledged them. However, in the case of the gyrocompass, the alarm would silence automatically whenever the voltage returned to normal. This meant that the bridge team was left without any reminder to verify the gyrocompass. Given that the bridge team was busy handling repeated activations of numerous different alarms, the design of the gyrocompass alarm was likely a factor in why verification of the gyrocompass was overlooked.

While the International Maritime Organization (IMO) brought guidelines into effect in 2002 stipulating that alarms should continue until they are acknowledged, the Atlantic Erie was constructed prior to this date and therefore the design of the gyrocompass alarm did not comply with the guidelines. This may also be the case on other vessels that were constructed prior to the date that the IMO guidelines came into force.

If an alarm does not continue to activate until acknowledged by an operator, there is a risk that the underlying problem may be overlooked and secondary effects on equipment may go unnoticed.

3.1 Findings as to causes and contributing factors

1. The bow thruster circuit breaker tripped and caused a voltage drop throughout the vessel that activated a number of power failure alarms on the bridge; the alarms created a situation that resembled a blackout and was interpreted as such.
2. The chief engineer responded to the developing situation by applying the vessel's blackout procedure twice, which caused additional power interruptions to the bridge; however, the chief engineer was unaware that his actions were having this effect.
3. These power interruptions, combined with the vessel's turn to starboard, caused the gyrocompass to become misaligned.
4. The gyrocompass was not verified for accuracy following the power interruptions, and the master was now navigating using inaccurate data from the Electronic Chart Precise Integrated Navigation System (ECPINS).
5. The helmsman, who was steering using a gyrocompass repeater that had been misaligned, unknowingly placed the vessel off course.
6. The master was not using all available bridge resources to monitor the vessel's progress, and the vessel proceeded off its intended course for approximately 15 minutes.
7. When the master identified that the vessel was not following the intended course, he attempted to take corrective action, but it was too late to be effective, and the vessel ran aground.

3.2 Findings as to risk

1. If a bridge team does not make use of all available resources, both human and technical, to monitor the vessel's progress, there is a risk that errors may go undetected, which may result in an accident.
2. If an alarm does not continue to activate until acknowledged by an operator, there is a risk that the underlying problem may be overlooked and secondary effects on equipment may go unnoticed.

3.3 Other findings

1. The checklist to follow in the event of a gyrocompass failure (Checklist 3.5.11) had been removed from the vessel's safety management system with the intent to add it to the shipboard contingency plan; however, this had not been done at the time of the occurrence.
2. The public address and the very high frequency handsets on the bridge central console are similar in appearance, are located close together, and had been mistaken for one another in the past.

4.1 Safety action taken

4.2 Canada Steamship Lines

Following the occurrence, the master wrote a letter that was circulated to the fleet masters. In the letter, the master provided an explanation of what had happened during the occurrence and why. The master also solicited feedback from the fleet masters as to how they might have handled the situation for the purpose of creating a forum for open discussion that might help to avoid similar occurrences in future. The master's letter was also used to develop a case study exercise based on the occurrence that has been incorporated into Human Element Leadership Management (HELM) training.

HELM mentors have been hired for the 2015 season to sail in the fleet, observe and further coach the vessel's crew on HELM principles. This is a refresher for the training previously provided on the simulator.

This report concludes the Transportation Safety Board's investigation into this occurrence. The Board authorized the release of this report on 10 June 2015 . It was officially released on 12 August 2015.

Appendix A – Atlantic Erie general arrangement

Image

Source: CSL Group inc., with TSB annotations

Legend

1. Emergency generator room (on port side of vessel)
2. Engine control room
3. Bridge
4. Bow thruster compartment

Appendix B – Bridge layout

Image

Note: Bridge layout is not to scale.

Legend

1. Radars
2. Electronic Chart Precise Integrated Navigation System (ECPINS)
3. 3D Navigator draft information system
4. Very high frequency (VHF) radiotelephone handset
5. Public address (PA) handset
6. Engine telegraph table
7. Bow thruster control
8. Gyrocompass
9. Gyrocompass repeater
10. Steering console
11. Helm
12. Fire control panel
13. Chart table
14. Stairway

Appendix C – Atlantic Erie's track

Image

Legend

1. The officer of the watch gives the engineer of the watch 1 hour's notice for manoeuvring.
2. The officer of the watch calls the master to the bridge, as per the night orders.
3. The master arrives on the bridge.
4. The master takes over the con and calls a Seaway Welland vessel traffic controller to report the vessel's position at calling-in-point (CIP) 16.

Appendix D – Electrical schematic

Image

Note: The main busses are part of the main switchboard and the emergency busses are part of the emergency switchboard.

1. Circuit breaker for generator No. 1
2. Circuit breaker for generator No. 2
3. Circuit breaker for generator No. 3
4. Circuit breaker for emergency generator
5. Transfer breaker (in engine room)
6. Transfer breaker (in emergency generator room)
7. Circuit breaker for bow thruster
8. Circuit breaker for rudder indicator
9. Circuit breaker for bridge instruments
10. Circuit breaker for forward steering pump
11. Circuit breaker for rear steering pump

Appendix E – Course made good versus gyrocompass heading

The following image has been compiled by the TSB to show the difference between the vessel's course made good (CMG) and the gyrocompass heading as it was being displayed on the Electronic Chart Precise Integrated Navigation System (ECPINS) at the time of the occurrence. The grey (dark) vessel-shaped markers show what the master would have been seeing on the ECPINS, whereas the yellow (light) markers show the actual CMG.

Image

Appendix F – Electronic Chart Precise Integrated Navigation System screenshots

Screenshot 1: As the vessel begins turning to starboard and away from the entrance to the canal, the difference between the vessel's heading and the course made good (CMG) starts to increase, as per usual.

Image

Screenshot 2: As the vessel is turning, the difference between the vessel's heading and the CMG continues to increase, which is also normal.

Image

Screenshot 3: The vessel has completed the turn and has been proceeding on 180°G for approximately half a minute. At this point, the difference between the CMG and the heading is increasing, when it would normally decrease. In addition, the vessel-shaped marker is pointing southerly, even though the vessel is proceeding easterly.

Image

Note: It could not be determined why the vessel-shaped marker is not overlaid on the vessel's track, which is normally the case.

Appendix G – Gyroscope response to tilting

Image