Marine Engineering Survey and Consultancy

Consideration of serious cruise ship incidents as exampled by the QM2 and Viking Sky

Large vessel's main control room

A large vessels control room

by Ieuan Dolby

The recent episode of the 'Viking Sky' should be extremely concerning as it adds to a growing catalogue of preventable cruise ship occurrences. Exampled and discussed below are two of many cruise ship incidents, both of which highlight the urgent need for microscopic investigations into the installation of overly-complicated, high-tech systems and equipment and a ship engineer's ability to manage.

Incident One – Fire and Explosion onboard the QM2 on 23 September 2010

In 2010, the MAIB published an investigation titled, "Report on the investigation of the catastrophic failure of a capacitor in the aft harmonic filter room on board RMS Queen Mary 2 while approaching Barcelona 23 September 2010". The report concluded that various safety improvements were required but was relatively weak on one critical finding. This finding, detailed in Section 2.6, titled "Alarm Management" discusses the frequency of alarms sounding in the engine room and the practical ability of the duty engineer to cope with them. In section 2.6 the MAIB Inspector writes, "During the watch before the incident the duty engineer accepted approximately one alarm every minute …. If the alarms appear as frequently as one every minute, it would be almost impossible for the watchkeeper to deal with them effectively". The report continues, "Half an hour before the accident, the duty engineer had accepted two fire alarms without taking any further action and without actually knowing at the time that these were false alarms".

Item 4 of the conclusion reads, "The frequency of alarms on the IAS at around one every minute, in addition to alarms from the P1200 system is most likely to have overwhelmed the watchkeeper, and it is not surprising that the propulsion motor alarms were not acted upon".

The report further highlighted the lack of training of the crew and of insufficient instruction for the use of installed equipment, e.g. essential fire-fighting systems. One sentence, item 5 of the conclusion, adequately states, "Losing control of a large cruise liner due to an electrical blackout, with 3823 people on board, is a serious concern."

Nine-years after the fire and explosion on the QM2, major and potentially tragic incidents are still occurring as highlighted by the very recent serial engine failures onboard the Viking Sky.

Incident Two – Failure of the Four Main Engines on Viking Sky, 23 March 2019

Mr Lars Alvestad, Head of Norway's Maritime Authority, issued his verdict on the 'direct cause' of the engine failure(s) that stranded the cruise ship, 'Viking Sky'. He said, "The heavy seas in Hustadvika probably caused movements in the tanks so large that the supply to the lubricating oil pumps stopped …… This triggered an alarm indicating a low level of lubrication oil, which in turn shortly thereafter caused an automatic shutdown of the engines."

Every engine requires lubrication to maintain separation of the rotating metal components. If this lubrication supply is severely disrupted, and usually as a last resort measure, an installed sensor(s) can be setup to automatically stop the engine. This response is protective in design – a 'fail safe'; on the one hand propulsion is required but without lubrication catastrophic failure will occur. In other words, the best option is to shut the engine down despite losing propulsion as if left to run the engine will fail within seconds anyway.

Typically, a low-level sensor is installed in the engine's sump tank. The sump tank is the main lubricating oil holding tank which can be situated under or near the engine (wet or dry sump) and from which lubricating oil is drawn, circulated around the engine, and then returned. If the level in the tank becomes too low, the oil cannot be drawn out. Therefore, if low level is detected the engine's protection system is activated – often as an alarm only (warning) and / or as an automatic shutdown.

During periods of movement of the vessel due to rolling and / or pitching the oil in the tank is liable to shift round. In such a scenario, the level of oil on one side of the tank will drop whilst the other side rises. This shift can often result in the level of oil being momentarily below the alarm sensor(s), and which is more likely to occur if the oil is at a low level to start with. As the ship regains its upright position (rolls back), the sensor would once again become covered in oil, i.e. whilst the oil is momentarily below the sensor the supply of oil has not in fact been disrupted and the shutdown is an unnecessary precaution.

The practicality of coping with low oil levels combined with the movement of the oil varies. Initially, the manufacturers of marine engines, as being responsible for design, should ensure that their engines can cope with expected sea conditions and resulting vessel movements, e.g. is a time delay required on the sensor to cope with rolling or should two sensors be installed? Typically, if two low level sensors are installed and if the oil level is below one sensor only, a warning alarm will sound. Only when both sensors detect low oil level would the engine shutdown activate.

From the point of view of the operation of such equipment by onboard engineers, one of the first lessons that any engineering cadet learns is, ‘if bad weather is to be encountered the oil in the sump tanks must be topped up'. This is a very basic routine, one that has been conducted for decades on the basis of, 'if the oil is topped up to the higher end or highest level allowable then the activation of a low-level sensor will be far less likely to occur – if at all'. Indeed, rightly or wrongly many engineers put in 'an inch more', just to make sure!

Current Industry

The above two examples highlight the broadening gap between requirement and expectation, between an actual engineer's knowledge and his ability to cope daily and potentially a lack of specific training in the high-tech equipment and software being installed. This high-tech approach results in numerous warning alarms and reactive automation, little of which appears to adequately match the ability of a duty engineer to both understand, accept and react accordingly.

Potentially, in one single engine room, fifty or more alarm panels can exist, each with their own alarms, warnings and reactive parameters. Ship designers, in accordance with common sense and regulation, ultimately must choose which of these warnings and alarms should be directed towards the control room and to the immediate attention of the duty engineer. Therefore, for the duty engineer to be aware of these 'other' alarms and warnings (as being external to the control room) direct contact and visual sighting is required. However, hours can pass between routine checks and therefore these lower priority sub-alarms or 'not so important' alarms can remain unknown for lengthy periods. The only warning of a developing situation maybe a major alarm: warning that what began as a small issue has developed to full-blown status.

When considering the example of the QM2, alarms were available on the local panel, but these went unnoticed as the duty engineer was otherwise occupied answering 'major’ alarms in the control room. Some of these control-room prioritised alarms were fire alarms and it can only be assumed that the reason for the duty engineer's lack of reaction to these was because false alarms frequently sounded. In other words, he had been forced into complacency, or that due to the total number of alarms sounding he had prioritised his response incorrectly. Such behaviour is unacceptable on any vessel, never mind a large and populated cruise ship, noting that due to the recognised importance of fire alarms they are not only relayed to the engine room but to the navigation bridge also. This last fact ultimately compounds the failure of the crew (and the shipboard management system) as a whole.

When considering the example of the Viking Sky, regardless of the complexity (accuracy) of low oil level detection, it does not appear as if the crew were able to cope. In explanation, with four separate engines and a very modern alarm and control software system for each, it would be expected that various pre-warning alarms sounded, e.g. low level, low pressure, etc. and before the final auto-shutdown(s) activated. In other words, it is doubtful that the first warning of an issue were the end-of-the-line 'shutdowns'. What must therefore be queried is how the engineer(s) responded, noting that topping-up the level of lubricating oil is neither an arduous nor complicated task. Concerningly, all four engines were similarly affected, yet it would have been very unlikely for all four engines to have shut down in unison.

Whilst full investigations will undoubtedly be conducted and the exact cause elaborated upon in subsequent reports, Mr Lars Alvestad appears to lead us directly to why the engines shutdown. The assumption drawn from his precise words is of crew ignorance of basic engineering principles and / or the potential over complication of automation, not on one engine, but on all four, each of which typically has its own lubricating oil system. This was certainly not an isolated issue, e.g. sensor failure, but an across the board failure, i.e. there are common factors. Reading between the lines of his initial verdict, had the crew ensured a higher level of oil, this incident would never have occurred.

similarly, and in continuation of the obvious, questions arise over why it took so long to restart the engines (at least one) after they had automatically stopped. Was this again due to unreasonably high-tech systems that baffled the crew and / or a lack of basic engineering knowledge? Or if they had topped up the oil upon recognition of the cause, was it simply poor or faulty engine or system design that prevented immediate restart?

In Conclusion

Individual manufacturers must design equipment and systems with emphasis on the end-environment, to co-exist with numerous similar systems, each vying for the attention of the duty engineer. In other words, to prevent costly incidents arising, any number of which could result in tragedy, requires industry-wide understanding of the complexity of all equipment and systems combined and not only of the individual units.

If the equipment and systems are fully integrated, the next step is to ensure that the duty engineers are sufficiently skilled and able to cope (practically, mentally and physically) with routine maintenance and reactively to warnings. This would require identification of training requirement, potentially conducted by individual manufacturers (with simulation on their actual equipment) rather than purely college-based, generic type education. Additionally, a refined college training system could be considered, one which recognises the increased need for operators rather than 'engineers'; a teaching system that is progressive in nature to account for rapidly developing (less 'steam') technology.

Potentially, short courses, conducted at more frequent intervals could better prepare engineers for the tasks they are being asked to face; backed up by national and international re-consideration of manning levels. In this regard, employers of seafarers might benefit immensely from training their crew appropriately and then retaining them for longer periods. Conversely, the current setup whereby crew members often complete one trip before moving on can mean that they are constantly working with different (new) types of machinery and systems - continual novices in their daily routines rather than the experts they should be.

A back to basics approach is urgently required so that crews can be provided with the necessary tools to cope with the increasingly complex and expensive systems that have been placed in their care.

Go Back

Comments for this post have been disabled.

Article Search