Marine transportation safety investigation report M17A0039

On 14 March 2017, the fishing vessel Atlantic Destiny, with 31 people on board, sustained a breakdown in its main engine, as well as damage to its shaft alternators and machinery spaces, 200 nautical miles southwest of Halifax, Nova Scotia. The fishing vessel Atlantic Preserver towed the Atlantic Destiny to Shelburne, Nova Scotia. No injuries or pollution were reported.

Particulars of the vessel

Description of the vessel

The Atlantic Destiny is a single-screw stern trawler of all-welded steel construction (Figure 1). The navigating bridge and crew accommodations are located forward, and the engine room is located aft.

Image

The vessel is engaged in scallop fishery off the east coast of Canada and is equipped for processing, freezing, and storing scallop catches. The vessel's scallop-processing factory is located one deck above the refrigerated fish hold.

The propulsion plant of the Atlantic Destiny consists of one 9-cylinder turbocharged, intercooled, 4-stroke diesel engine with a displacement of 114 L and a power rating of approximately 2500 shaft horsepower. The engine was built in 2001 and, at the time of the occurrence, had accumulated 106 200 running hours. The engine operates at a constant 900 rpm and is equipped with a feedback-controlled governor and an air-starting system.

The main engine is connected to a combination gearbox by a flex coupling (Appendix A). There are three output shafts from the combination gearbox: the lower output shaft at a 5.52:1 reduction for the propeller shaft, and 2 upper output shafts with a fluid coupling, at a 1:2 increase, to drive the generator. The rpm limit for the fluid couplings is 1800. At a normal engine operating speed of 900 rpm, the propeller shaft turns at 163 rpm and the generator turns at 1800 rpm.

The main engine is protected against damage in case of failure by a safety system that shuts down the engine when its pre-set parameters, including engine speed, are exceeded.

There are 3 emergency stop buttons to shut down the main engine: 2 are located on the bridge, and 1 is in the engine control room.

When the Atlantic Destiny is at sea, the main engine provides the propulsion and the ship's electric power.

Although not required by regulation, the vessel is equipped with a closed-circuit television (CCTV) system that allows monitoring of the engine room, the scallop-processing factory, and the main deck, from the bridge. This system is used for operational and safety purposes. In this occurrence, it provided recorded data showing actions taken by the chief engineer and the deckhand.

History of the voyage

On 13 March 2017 at 2215 Atlantic Daylight Time,^{Note de bas de page 1} after a day in port for engine repairs, unloading catch, resupplying, refuelling, and a complete crew change, the Atlantic Destiny left Riverport, Nova Scotia, for a 21-day scallop-fishing trip, with 31 people on board. The vessel reached the fishing grounds near Georges Bank, Nova Scotia (Appendix B), on 14 March at 1450 and began fishing.

At about 2100, the main engine began to slow down and the chief engineer observed that the fuel pressure was slightly lower than normal. After the chief engineer started another fuel booster pump and changed over the engine-mounted fuel filters, the pressure returned to normal and the engine appeared to operate normally.

At 2115, the engine shut down, causing a blackout. The auxiliary generator automatically started and provided electrical power to the vessel. The chief engineer tried to determine the cause of the shutdown, then tried to restart the engine. After a few attempts, the chief engineer requested the help of another crew member by waving in front of the engine room CCTV camera.^{Note de bas de page 2} The factory boss came into the engine room to assist the chief engineer; they attempted to restart the engine, but because the factory boss had to return to his station, a deckhand was sent at 2208 to assist the chief engineer.

The chief engineer bypassed the engine governor to restart the engine by installing a wrench on the governor output shaft to control the engine's speed. The chief engineer explained to the deckhand that, once the engine started, the deckhand would have to use the wrench to maintain the engine at about 600 rpm, until the chief engineer had reset the engine's electronic governor panel in the control room, which would allow the engine to run on its own.

The chief engineer started the engine from the local control panel. However, from his position beside the governor (Appendix C), the deckhand could not see the rpm indicator on the local control panel; without this guide, the deckhand was unable to maintain the rpm at the appropriate level. The chief engineer signalled to the deckhand to let the wrench go and the engine stopped. The chief engineer attached a rope to the handle of the wrench mounted on the engine governor and attached it to the mounting bracket on the local control panel. This rope allowed the deckhand to shift position so that he could control the engine by lightly pressing on the rope while monitoring the rpm indicator.

The chief engineer started the engine again and the deckhand was able to control the rpm. The chief engineer then went into the control room and reset the electronic governor, and the engine then began to run on its own at 600 rpm. The deckhand removed the rope and the wrench, preparing to leave the engine room. The chief engineer clutched in the propeller shaft, then increased the engine's rpm to 900 to prepare to put the 2 generators on line. Before the chief engineer completed the process, the main engine shut down again.

While the chief engineer reset the engine alarms in the control room, the deckhand reinstalled the wrench and rope. When the chief engineer joined the deckhand at the local control panel, he pushed the start button; the engine started and immediately oversped, reaching 1500 rpm. The chief engineer tried to slow the engine down, first by using the local speed control, and then by pressing the stop button on the local control panel, with no effect.

As the chief engineer was on his way to the control room, the two fluid couplings shattered, projecting fluid and multiple metal fragments at high speed throughout the engine room, especially on and around the gearbox. The chief engineer and the deckhand were unharmed. At 2245, the engine shut down.

The master contacted Marine Communication and Traffic Services (MCTS) Halifax by high-frequency radio to report the incident. Because the communication with MCTS was difficult, the master called the Atlantic Preserver, which was 15 nautical miles away, for assistance. The master of the Atlantic Preserver had to relay the Atlantic Destiny's communications to MCTS Halifax. For the remainder of the occurrence, the master of the Atlantic Destiny used the vessel's satellite phone for all external communications.

Following the occurrence, the vessel's propulsion could not be restored. On 15 March, at 1140, the Atlantic Preserver began towing the Atlantic Destiny to Shelburne, Nova Scotia. Both vessels arrived in Shelburne on 16 March at 1050.

Damage to the vessel

Due to the overspeed, the vessel's main engine, the 2 generators, and their fluid couplings sustained major damage.

The main engine and the 2 generators had to be overhauled, and the fluid couplings had to be replaced. Piping and electrical junction boxes near the gearbox also had to be repaired or replaced.

Environmental conditions

At the time of the occurrence, the wind was 35 to 45 knots from the southwest, with a swell of 4 to 5 m and good visibility.

Vessel certification

The Atlantic Destiny was certified and equipped in accordance with existing applicable regulations. The vessel was built under Det Norske Veritas Germanischer Lloyd classification society rules, and was maintained in class until 2012.^{Note de bas de page 3} At the time of the occurrence, the vessel was not in class.

As a fishing vessel over 24.4 m and with a gross tonnage of over 150, the Atlantic Destiny is subject to Canada's Large Fishing Vessel Inspection Regulations. The vessel underwent its annual Transport Canada (TC) inspection on 28 April 2016, and was issued an Inspection Certificate valid for 1 year with a maximum complement of 32 people.

The vessel held a Minimum Safe Manning Document as required by the Marine Personnel Regulations, which specified a minimum complement of 11 and indicated that a 2-person watch system was implemented on the bridge and in the engine room. This document was issued to the vessel on 15 May 2013 and was valid until 14 May 2018.

The Atlantic Destiny did not operate under a safety management system, nor was it required to by regulation.

Personnel certification

Master

The master held a TC-issued Fishing Master, Third Class certificate and was limited to serving as a master on fishing vessels. The master began his employment on the Atlantic Destiny in 2000. The master had also served as a relief mate / relief master on other company vessels.

Chief engineer

The chief engineer held a Third-Class Engineer, Motor Ship certificate. The chief engineer had been employed as an engineer with the company since 1998, and had been a chief engineer on the Atlantic Destiny since 2010.

Deckhand

The deckhand did not hold certifications of any kind, nor was he required to by regulation. The deckhand had worked on various fishing vessels since 1985 and on the Atlantic Destiny since 2004.

Crew familiarization

In 1989, the deckhand had worked briefly as an engineer on a small fishing vessel, but had not worked as an engineer since. The deckhand had not received any familiarization training in the Atlantic Destiny's engine room prior to the day of the occurrence.

Engine safety system

The main engine is protected against damage in case of failure by a safety system that monitors the engine's rpm, as well as the oil pressure of the main engine and gearbox; this protects the engine from overspeeding and from low oil pressure. The safety system shuts down the engine via the emergency stop mechanism when pre-set engine parameters are exceeded, including engine speed.

The safety system monitors 2 parameters, or levels, of overspeed: approximately 15% and 22% over the nominal operating rpm (in this case, 900 rpm). Each circuit is equipped with its own speed sensor that monitors the engine rpm.

The emergency stop mechanism, mounted on the engine, disconnects the fuel rack from the actuator, despite the set point of the governor. This allows a spring to push the fuel rack to zero, thereby stopping the engine. The emergency stop mechanism is activated by a solenoid that responds to an electric signal from the safety system.

The manufacturer's recommended interval for testing overspeed protection is every 1500 hours.^{Note de bas de page 4} To test the 2 overspeed parameters without overspeeding the engine, each parameter has a test button.

Vessel maintenance

The vessel is scheduled to operate 21 days at sea and approximately 12 hours in port between each fishing trip. Once a year, usually in December, the vessel remains in port for 3 consecutive weeks for major maintenance.

Shore management relies on the engine crews' adherence to the manufacturer's recommended maintenance schedule; it does not include oversight or detailed records. One week prior to returning to port, the chief engineer sends a work list to shore management, which then assigns resources to attend to the vessel and perform the necessary repairs.

During the vessel's last port stay, in March 2017, repairs were performed on the main engine fuel booster pump. During the vessel's previous fishing trip, this pump had been found to be worn out and was suspected to have caused a main engine shutdown.

In December 2015 and January 2016, the maintenance work consisted mainly of overhauling the main engine's principal mechanical elements and associated pumps, and testing the overspeed protection devices. The testing was done by slowly increasing the engine speed until the safety system shut the engine down.

Transport Canada vessel inspection

In January 2016, TC conducted an intermediate inspection of the vessel's main engine and associated pumps. These items are required to be inspected every 5 years. The governor was not part of this inspection.

The main engine safety devices were tested by slowly increasing the speed of the engine, until the safety system shut the engine down. The overspeed test buttons were not used during this test. This method tested only one level of the overspeed protection system. Based on the results of this test, the overspeed protections system was deemed functional.

In April 2016, TC conducted its periodic (annual) inspection of the vessel; this inspection did not include testing of the main engine safety devices.

Engine controls

The Atlantic Destiny's engine is equipped with multiple controls that maintain the engine speed at the required level.

The engine starts at 600 rpm and, after the propeller shaft is clutched, is maintained at a constant 900 rpm by an electronic governor. The electronic governor has 3 main parts: the electronic card, which is in the engine control room, maintains the engine's rpm as set by the operator; a speed sensor that is mounted on the engine and monitors the rpm; and an actuator^{Note de bas de page 5} that is mounted on the engine itself and acts on the engine injection pump rack. If the engine's rpm drops below or rises above the set speed—for example, because of a change in the engine load—the governor signals the actuator to push or pull on the fuel rack, which varies the quantity of fuel injected into each engine cylinder accordingly, thereby maintaining a constant rpm.

For the governor's electronic card to properly monitor the engine's rpm and act accordingly, it must receive a continuous signal from the speed sensor. If the electronic card stops receiving this signal, it orders the actuator to act on the fuel rack and stop the engine.

The electronic governor is also used to stop the engine. When the stop button on the local control panel is pressed, the actuator acts on the fuel rack, thereby stopping the engine.

When the crew member installed the wrench and rope for the second time, the fuel injection was inadvertently set to approximately 80% instead of 0%, which disabled all engine speed controls and the electronic governor's ability to stop the engine.

Unexpected engine shutdowns

Multiple unexpected engine shutdowns had occurred on previous trips over the last few years. It was generally believed throughout the company that the fuel supply system was responsible for the shutdowns; however, the exact cause was not known.

Over time, the engine room crew had developed a workaround to restart the engine by bypassing the governor. By installing a wrench on the output shaft of the governor actuator, and a rope between the wrench and the local control panel, the engineer could start the engine and manually control the engine speed while monitoring the rpm indicator to maintain the engine at 600 rpm. Once the engine was running at 600 rpm, the engineer was able to attach the rope to the local control panel and go to the engine control room to reset the electronic governor. When available, a second person could assist by maintaining the engine speed with the wrench while the engineer reset the governor in the control room. Once this process was complete, the rope and wrench could be removed, and the engine would maintain its speed.

Machinery failure

A post-occurrence examination of the vessel determined that the main engine's electronic governor and overspeed protection were compromised by speed sensors that were either installed incorrectly or functioning intermittently due to electrical shorting. The governor speed sensor was intermittently electrically shorted at the connector and installed with excess clearance. The 15% overspeed sensor was installed with excessive clearance and was 90° off of its proper orientation. The 22% overspeed sensor was electrically shorted, installed with excessive clearance, and was 30° off of its proper orientation (Appendix D); it likely shorted due to cracked wire insulation and broken strands of wiring.

The emergency stop mechanism was inoperable due to mechanical wear and resistance, and the solenoid was electrically shorted.

The fluid couplings failed in an instantaneous overstress rupture due to excessive rotational speed. As the main engine's exhaust valves floated,^{Note de bas de page 6} they were struck by the pistons and bent, and the engine lost compression. Without sufficient compression, fuel combustion ceased, and the engine slowed down and stopped.

Previous occurrences

From 2011 to 2014, the TSB investigated 5 occurrences identifying issues about adhering to regular and recommended inspection, testing, and maintenance intervals (Appendix E).

TSB laboratory reports

The TSB completed the following laboratory reports in support of this investigation:

• LP076/2017 – CCTV Analysis
• LP077/2017 – Propulsion Engine Analysis

The TSB's investigation into the Atlantic Destiny'scatastrophic machinery failure determined that the engine's speed control and safety system were not maintained in good working order, causing unexpected engine shutdowns. The crew used a workaround to restart the engine, which eventually caused an engine overspeed. The overspeed protection system did not operate, resulting in major damages.

This analysis will discuss the events leading to the engine overspeed and machinery failure, the engine controls, the additional safety provided by the engine overspeed protection system, and periodic testing of the engine safety systems.

Factors leading to the machinery failure

While the vessel was 200 nautical miles offshore, its engine unexpectedly shut down. The chief engineer was unable to restart the engine despite having changed the fuel filters and using another feed fuel pump. The engine likely failed to start because the electronic governor's speed sensor did not send a signal to the governor to inject fuel into the engine.

The chief engineer, having installed a workaround solution that had proven successful in the past, started the main engine with the assistance of the deckhand. Once the engine was running, the chief engineer went into the control room and the deckhand removed the wrench and rope. Shortly thereafter, the engine unexpectedly shut down by itself again.

The deckhand had no experience or training in the engine room. While the chief engineer was in the control room resetting various systems, the deckhand installed the wrench and rope in preparation for starting the engine, and inadvertently set the fuel injection to 80%, instead of 0%, disabling all engine speed controls.

Once the chief engineer had re-started the main engine using the local control panel start button, the engine immediately went into overspeed. The chief engineer was alerted to the overspeed by the engine sound, and observed a high reading on the engine rpm indicator. Because the engine controls had been disabled by the workaround, the chief engineer was unable to reduce the engine speed at the local control panel or activate the manual local shutdown.

Within approximately 8 seconds, the maximum engine speed reached was in excess of 1200 rpm, and possibly as high as 1500 rpm. This caused the gearbox fluid couplings to turn at approximately 2400 to 3000 rpm.

The investigation determined that the gearbox fluid couplings failed in an instantaneous overstress rupture due to excessive rotational speed. The engine overspeed damaged the intake valves, which reduced cylinder compression, causing the engine to shut down. The extent and nature of the damage prevented repairs at sea and the vessel had to be towed back to port.

Engine controls

The engine room crew was unable to determine the cause of multiple unexpected engine shutdowns on previous trips, and had developed a workaround of bypassing the engine controls to restart the engine. Bypassing the governor and manually controlling the fuel injection with a rope and wrench made it possible to restart the engine and then reset the electronic governor.

Determining the cause of an unexpected engine shutdown can be challenging; a process of elimination must be used to determine the actual cause of the shutdown. In this occurrence, given the persistent belief that the cause was related to fuel supply, and the use of the workaround to keep the engine running while at sea, the actual cause of the shutdowns was not established, and further examination of the issue while the vessel was in port was unsuccessful in determining cause.

The investigation determined that the governor speed sensor had deteriorated over time and would intermittently electrically short; it could not transmit a continuous signal to the governor, causing unexpected engine shutdowns. Because the crew was not aware of this electrical short, the unexpected engine shutdowns persisted.

If workarounds are consistently used and the actual cause of unexpected engine shutdowns is not correctly identified, there is a risk that a latent condition will remain and worsen over time.

Engine overspeed protection

The 15% overspeed sensor was installed with excessive clearance, and was 90° off of its proper orientation. The 22% overspeed sensor was electrically shorted and oriented 30° from its proper position; this orientation prevented the sensor's correct operation. The main engine overspeed protection was compromised by the 2 speed sensors that were either installed incorrectly or functioning intermittently due to electrical shorting.

The engine emergency stop mechanism was inoperable due to wear and resistance, and the solenoid was electrically shorted. Consequently, the engine emergency stop mechanism could not shut down the engine when the engine overspeed protection was activated.

Periodic testing of engine safety systems

In accordance with Transport Canada's intermediate inspection schedule for the Atlantic Destiny, the overspeed protection system was tested in January 2016 and was deemed functional. However, only 1 level of the protection system was tested. From the date of that test until the occurrence, the engine had been in service for over 5000 hours. Given the manufacturer's recommendation to test the overspeed protection system every 1500 hours, 3 tests should have been conducted during that period.

The condition of the overspeed protection system at the time of the TSB's investigation indicates that the engine crew was not periodically testing the system's readiness and function. This, together with vessel maintenance practices, suggests that the company did not ensure that engine crews were performing these tests.

Periodic tests of engine safety systems are consistent with a proactive approach to safety, where issues with components are identified and addressed before the overall system is compromised. If engine safety systems are not periodically tested in accordance with manufacturers' recommended schedules and repaired accordingly to ensure their readiness, there is a risk that engine safety systems will not operate as intended when a malfunction occurs.

Crew familiarization with an unfamiliar work environment

On board the Atlantic Destiny, the crew had developed a workaround method to restart the main engine after unexpected shutdowns. This method involved bypassing the engine control systems and had been used for many years.

Personnel from other vessel departments, such as deckhands, were often directed to assist in the engine room. These personnel had no formal training in engine room operations, and had not been familiarized with engine room equipment and procedures.

As demonstrated in this occurrence, if untrained personnel are placed in an unfamiliar work environment, there is a risk that they will perform tasks incorrectly, which could lead to an accident or an injury.

Findings as to causes and contributing factors

1. The engine room crew was unable to determine the cause of multiple unexpected engine shutdowns on previous trips, and developed a workaround method of bypassing the engine controls to restart the engine.
2. The main engine was started by using a rope and wrench to bypass the governor, thereby disabling all engine speed controls.
3. While installing the wrench and rope in preparation for using the workaround method of starting the engine, the untrained deckhand inadvertently set the fuel injection to 80% instead of 0%.
4. The chief engineer's attempts to reduce the engine speed at the local control panel, and then to push the stop button, were unsuccessful because the engine controls were disabled.
5. The main engine overspeed protection was compromised by the 2 speed sensors that were either installed incorrectly or functioning intermittently due to electrical shorting.
6. The engine emergency stop mechanism was inoperable due to wear and resistance, and the solenoid was electrically shorted. Consequently, the engine emergency stop mechanism could not shut down the engine when the engine overspeed protection was activated.
7. The gearbox fluid couplings failed in an instantaneous overstress rupture due to excessive rotational speed.
8. The extent and nature of the damages prevented repairs at sea and the vessel had to be towed back to port from some 200 nautical miles offshore.

Findings as to risk

1. If workarounds are consistently used and the actual cause of unexpected engine shutdowns is not correctly identified, there is a risk that a latent condition will remain and worsen over time.
2. If engine safety systems are not periodically tested in accordance with manufacturers' recommended schedules and repaired accordingly to ensure their readiness, there is a risk that engine safety systems will not operate as intended when a malfunction occurs.
3. If untrained personnel are placed in an unfamiliar work environment, there is a risk that they will perform tasks incorrectly, which could lead to an accident or an injury.

Other findings

1. Following the catastrophic failure of the machinery, multiple metal fragments from the fluid couplings were projected at high speed in various directions. The chief engineer and the deckhand were not struck by the projected fragments.
2. Although not required by regulation, a closed circuit television camera system on the bridge provided a remote view of the engine room and other locations on the vessel, for operational and safety purposes. In this occurrence, it provided recorded data showing actions taken by the chief engineer and the deckhand. 

Safety action taken

Vessel owner

Following this occurrence, the vessel owner installed shielding around the fluid couplings and replaced the aluminum floor plates above the fluid couplings with stronger ones.

This report concludes the Transportation Safety Board of Canada's investigation into this occurrence. The Board authorized the release of this report on 06 February 2018. It was officially released on 26 February 2018.

Appendix A – Gearbox block diagram

Image

Appendix B – Area of occurrence

Image

Appendix C – Engine room layout

Image

Appendix D – Speed sensor arrangement

Image

Image

Appendix E – Previous occurrences

Marine Transportation Safety Investigation Report M14C0193: On 12 September 2014, the tug Vachon struck the breakwater in Port-Cartier, Quebec, while assisting the bulk carrier Orient Crusader with entering the harbour. The tug master activated the tow-abort mechanism in an attempt to release the tow line and avoid striking the breakwater, but the tow-abort mechanism failed. The investigation found that if vessel operators do not test towing equipment, and regulators do not consistently inspect it, there is a risk that problems will go unnoticed and equipment will not function in an emergency.

Marine Transportation Safety Investigation Report M14P0023: On 11 February 2014, the tug Jose Narvaez, while towing the empty barge TCT 8000 down the South Arm Fraser River, British Columbia, sustained a loss of propulsion due to a main engine seizure. The tug and barge were towed back to the Lafarge marine dock and secured, and the main engine was deemed a constructive loss. The investigation determined that if companies do not ensure that engine maintenance is conducted according to the manufacturer's recommendations, a vessel's engine may not function as intended, thereby increasing the risk of an accident.

Marine Transportation Safety Investigation Report M13W0057: On 23 April 2013, the fishing vessel American Dynasty experienced a blackout while approaching the graving dock in Esquimalt, British Columbia. Following the blackout, the vessel gained speed to an estimated 5 knots, veered to starboard, and struck the HMCS Winnipeg, which was berthed nearby at the Canadian Forces Base Esquimalt. The investigation found that the crew had not been familiarized with the vessel and its equipment, and that the maintenance of some safety-critical equipment did not follow a schedule to ensure regular testing and servicing, which posed an increased risk to the safety of the vessel, its crew, and the environment.

Marine Transportation Safety Investigation Report M12N0017: On 30 May 2012, the passenger ferry Beaumont Hamel experienced an electrical failure (blackout), the cause of which could not be determined. The blackout caused the vessel to lose propulsion and steering, while approaching Portugal Cove, Newfoundland and Labrador, and the vessel struck the wharf. Despite mechanical repairs intended to address recurring blackouts on the vessel, this maintenance did not identify or address the cause of the blackouts, and they continued.

Marine Transportation Safety Investigation Report M11L0160: On 15 December 2011, the bulk carrier Orsula departed Contrecœur, Quebec, for Baie-Comeau, Quebec. While proceeding downbound on the St. Lawrence River under the conduct of a pilot, the vessel lost steering control and ran aground. The investigation found that the potentiometer connected to the port steering system failed due to an unknown source of contamination; this failure disrupted the electrical link between the steering stand and the port telemotor in the steering gear compartment, resulting in the loss of control of rudder movement. The investigation determined that without the regular replacement of potentiometers, as recommended by manufacturers, there is an increased risk that they will fail in service.