Marine transportation safety investigation report M17C0108

History of the voyage

On 15 June 2017, at 1835,^{Footnote 1} the Damia Desgagnés departed from the Eisenhower Lock Wall, upbound, with 20 persons on board (Figure 1). As the vessel departed, the Iroquois traffic control centre informed the crew that traffic at the Iroquois Lock was delayed, as a downbound vessel was in the lock.

The Damia Desgagnés proceeded toward the lock at a reduced speed. From 1950 to 2250, the crew received regular updates from the Iroquois traffic control centre that there would be further delays, and that the lock wall waiting area was occupied by another upbound vessel. The master conferred with the bridge team and the decision was made to anchor the vessel just above the Iroquois Lock in order to wait for the downbound vessel to pass and the other upbound vessel to enter the lock.

At 2251, en route to the Iroquois Lock, numerous alarms began to sound on the bridge. After approximately 1 minute, and without any active input from bridge personnel, the Damia Desgagnés lost propulsion.

At 2252, the master contacted the engine room crew, who confirmed that the engine had stopped; the engine room crew requested that the master transfer propulsion control to the engine room, so that the crew could attempt to restart the engine. The master transferred the propulsion control as requested. The next planned course for the vessel was to port, so an attempt was made to steer the vessel with the bow thruster and the rudder hard to port, but the current pushed the vessel toward the shore.

At 2253, while the engine room crew was working to restart the main engine, the port bow anchor was remotely let go from the bridge and the third mate went forward to standby at the anchor. The stern thruster was set to full power to starboard in order to counteract the transverse force produced by the port anchor. However, the vessel grounded shortly afterward.

At 2257, the main engine was restarted and propulsion control was transferred back to the bridge. The master ordered the third mate to heave up the port anchor.

At 2300, the port anchor was secured and the telegraph was set to dead slow astern. At 2303, the propulsion was stopped and the master informed the Iroquois traffic control centre that the vessel had lost propulsion and was aground near Robertson Point. The master ordered the crew to switch on the deck lights and take tank soundings. It was determined that there was no pollution or any water ingress.

On 17 June, the vessel was refloated with the assistance of 2 tugs, and was towed to Johnstown, Ontario. Subsequent underwater inspection showed there was no apparent damage to the vessel.

The investigation found that the main engine had been inadvertently shut down by the accidental activation of the main engine shutdown button on the integrated alarm monitoring and control system touch screen on the bridge. The touch screen was mounted horizontally in the centre bridge console near the steering and propulsion controls (Figure 2). At the time of the loss of propulsion, 4 crew members were within 2 m of the screen. Post-occurrence testing showed that the touch screen was reactive to a variety of mediums including the telephone cord situated next to it. In Figure 2, the telephone cord is visible near the face of the screen.

When the main engine shutdown button was activated on the touch screen, a generic system status message appeared on the touch screen, stating "SLOWDOWN alarm. CANCELLABLE UNIC^{Footnote 2} SLOWDOWN REQUEST[.] Engine speed will be reduced in 60 sec"^{Footnote 3} (Figure 3). The message did not specify that the engine was about to shut down, nor did it indicate how the shutdown was activated or from where (bridge, engine room, emergency stop, etc.).^{Footnote 4}

Although the bridge team noticed this message, none of the bridge team crew members were aware of its meaning or that propulsion could be shut down in this manner. A similar message appeared on the alarm screen in the engine control room (Figure 4). Approximately 60 seconds after the message appeared on both screens, the engine shut down.

The vessel was built in a foreign shipyard, and during its construction phase the master attended one of the vessel's sea trials. There was limited opportunity for the master to become familiar with the vessel's systems, and he received approximately 4 hours of familiarization with the integrated alarm monitoring and control system. Once the vessel arrived in Sorel, Quebec, the master rejoined the vessel for its maiden voyage.

On 17 June, TSB investigators observed post-occurrence testing of the system and determined that the slowdown alarm could not be cancelled, despite the on-screen message.

Also on 17 June, the managing company installed a plastic cover over the vessel's touch screen to prevent the recurrence of an inadvertent shutdown. On 21 December, after a thorough review, the equipment manufacturer disabled the main engine shutdown function of the touch screen and the plastic cover was removed under the supervision of the managing company. Because the touch screen was highly sensitive, certain functions were removed from the wheelhouse without reducing the ability to properly control the ship. As of February 2018, these adjustments have been made to both company ships that are similarly equipped. In case of an emergency, the main engine can still be shut down from the bridge via the traditional shutdown button.

Additional factual information obtained during the investigation

On 14 June 2017, the Damia Desgagnés struck the wall between locks 3 and 4 near Beauharnois, Quebec. The master had not matched the bow thruster controls on the bridge wing console with that of the centre console, resulting in the inability to take over the control of the bow thruster. The design of the control transfer function between control stations was contrary to the bridge crew's expectation. To guide the operator in the normal process for a control transfer, a blinking pilot light indicates that the controls are not synchronized and the control can only be completed when the commands on both controls are identical.^{Footnote 5}

Human–machine interface

In recent years, there has been significant human-factors research in the maritime domain, which has led to a number of ergonomic and human–machine interface guidelines, as well as standards for the design of equipment and layout of vessel bridges and engine rooms.^{Footnote 6} The International Maritime Organization and some classification societies recognize the importance of incorporating human factors and ergonomic design principles in the development of modern vessels.

The design of this vessel's consoles, including the touch screen controls and system feedback messages, did not follow existing ergonomic and human-machine interface (HMI) guidelines.^{Footnote 7} Under the directives regarding ergonomics and the man-machine interface (MMI) ISO 8468:2007 5 - Bridge functions and tasks and their relations to workstations, alerts and messages should enable the operator to

• devote full attention to the safe navigation of the ship,
• readily identify any abnormal situation requiring action to maintain the safe navigation of the ship, and
• avoid distraction by announcements that require attention but do not constitute alarms.

Since the message displayed on the touchscreen was ambiguous and did not clearly identify the abnormal situation or the source of the alarm, it caused distraction.

The tanker Damia Desgagnés was inspected and classed by Bureau Veritas which includes the automation systems installed on board. This was despite the applicable Rules for the Classification of Steel Ships^{Footnote 8} from Bureau Veritas (Part C, Chapter 3) which indicate that:

• Sufficient information is to be provided for proper handling of alarms.
• The design of the operator interface is to follow ergonomic principles.
• The operation of input devices, when installed, is to be logical and correspond to the direction of action of the controlled equipment. The user is to be provided with positive confirmation of action.
• If use of a push button may have unwanted consequences, provision is to be made to prevent an instruction from being executed by a single action (e.g. simultaneous use of 2 push buttons, repeated use of push buttons). Alternatively, this push button is to be protected against accidental activation by a suitable cover, or use of a pull button, if applicable.

In this occurrence, the touchscreen on the centre bridge console was mounted horizontally near the steering and propulsion controls, increasing the probability of the operator accidentally activating ship controls. The message on the touchscreen did not provide sufficient information to the bridge operator to respond to or manage the alarm. The alarm could not be acknowledged by the operator, because the message on the touchscreen did not provide the possibility to positively confirm the accidental activation of the main engine shutdown button. The shutdown was activated by a single movement (action) on the touchscreen.

The number of other vessels constructed with similar integrated bridge systems was not determined.

Safety messages

In the past decade, 13 marine occurrences have been reported to the TSB^{Footnote 9} that were related, at least in part, to a system control design issue on board a vessel that resulted in controls not being operated as the designers intended. As integrated bridge and automated control systems become more common, it becomes even more important to design interfaces that allow for effective operation and control by humans, while providing concise feedback to aid the operator in the decision-making process.

In order to effectively use shipboard equipment, crews must know how to operate that equipment during routine and emergency situations. This knowledge may come from technical manuals, familiarization, and/or training.

In this occurrence, given the sensitivity of the touch screen on the vessel's integrated alarm monitoring and control system, it was especially important that crew members be familiarized with the sensitivity level of the screen and the lack of a positive confirmation message after any action was taken using the screen. The bridge team was not familiar with all of the various integrated system arrangements; team members were therefore unable to respond effectively.

It is important for crew members to be familiarized with all aspects of the operation of safety critical equipment on board a vessel, such as a vessel's integrated alarm monitoring and control system, so that they have the knowledge required to operate the system proficiently or regain control in an emergency.

This concludes the TSB's limited-scope investigation into this occurrence. The Board authorized the release of this investigation report on 25 April 2018. It was first released on 09 May 2018.