BRM New Case Studies Booklet 2019 Student Version PDF

Maritime Crew Resource Management
Case Studies
Originally developed by CAE Training and Services UK Ltd
Revision 2, March 2019

CAE Training and Services UK Ltd Fleming Way, Crawley, West Sussex, RH10 9UH
T +44 (0) 1293 543541 F +44 (0) 1293 547063
For Training Purposes Only ©2018
©2018 CAE Training & Services UK Ltd 1 All Rights Reserved

Contents
Case study introduction 3

Case Study Maersk Kithira 4
Case Study Torrey Canyon 8
Case Study DASH 8 12
Case Study Dover Seaways 16
Case Study Finnreel 20
Case Study Gimli Glider Case 24
Study HMS Endurance Case 28
Study Three Mile Island 33
Case Study Vallermosa 37

CASE STUDY INTRODUCTION
We have now reached the stage when we are going to look at a number of case studies. In the
case studies we inevitably focus on things that went wrong. We don’t look at the 99% of cases in
which mariners did a good job, day out and day in. These success stories are sadly not news.
The case studies chosen have been selected for their suitability in that respect and because
the documentation concerning them has been easily available.
We believe that there are many advantages to be gained by examining specific cases and viewing
them from the MCRM point of view only.
Before you start we would like you to read a few preliminary comments:
• We are attempting to view the accident purely from the point of MCRM.
• We shall use the material presented in the MCRM course as the base line of proper resource
management methods. We do this with full realisation that the mariners involved in the cases
had probably never heard of the methods we suggest. Accordingly, we are not attempting to
second guess or criticise their performance in any way, as this would be totally unfair. Rather,
we are attempting to learn from their experience and to see if our methods would protect us
from similar situations in the future. We seek ONLY a learning experience.
• Because we are only engaging in a learning experience, we feel that it is not unreasonable to
engage in some speculation. When we do this, we may at times be unfairly treating the
mariners involved, as our information may be either inaccurate or incomplete, but if we, as
professional mariners, can learn from this we feel it is justified.
With these thoughts in mind, please continue with the case studies.

MCRM CASE STUDY: MAERSK KITHIRA
BACKGROUND
Maersk Kithira was originally built as P&O Nedlloyd Cook, but was renamed on her transfer to the A.P.
Møller – Maersk Group in 2007. She was built with a totally enclosed bridge, situated in the after third
of the ship’s length, and approximately 200m from the forecastle.
At the time of the accident, Maersk Kithira was manned with a crew of 24, consisting of UK officers,
with the exception of a Ukrainian Second Engineer and Filipino ratings. The ship had just started a
new voyage loop, and was on the first rotation. The loop started at Yokohama, visited Chinese ports
southbound, Singapore, Jebel Ali, the Chinese ports northbound, Taiwan, Los Angeles, and returned to
Yokohama.
Operating a traditional three watch system, it was the routine for the Master to stand a watch between
16:00 and 17:00, and between 07:00 and 08:00 to allow the Chief Officer to leave the bridge to complete
paperwork, or carry out upper deck rounds as required.
Maersk Kithira sailed from Yantian (Mirs Bay, Hong Kong) at 14:30 on September 23rd, for Xiamen,
where she was due to berth at 10:00 the following morning. Weather reports about the approaching
typhoon Hagupit had been received on board, and the “heavy weather checklist” from the company
SMS had been completed by 15:30. This included a requirement to check the anchor securing
arrangements, ventilator closures on the forecastle and hatch cover locking devices. The Chief Officer
was relieved by the Second Officer as officer of the watch (OOW) when full away on passage was rung
at 15:18. At 15:30, the Chief Officer commenced rounds of the upper deck to visually confirm that the
ship was secured for heavy weather, and at the same time the crew checked the cargo lashings.
At 17:00 the Chief Officer relieved the Master as OOW, and a weather report was sent, indicating
force 9 winds and 6m swell. At 17:25 and for a few minutes after that, a series of alarms sounded
on the ship’s voyage management and monitoring system. This indicated that both the main and
emergency starboard navigation lights had failed and that there was an earth on the circuit. This was
correctly diagnosed as indicating that the sidelight unit had been hit by a wave, a fact substantiated
during discharge the following day when a number of containers were noted to have been damaged in
the vicinity of the starboard sidelights. However, no impact had been felt on the bridge, and speed was
maintained. The Master was informed, and he decided that no further action would be taken to
remedy the situation due to the exposed position of the lights and the poor weather. It was agreed that
approaching ships would be alerted to Maersk Kithira’s presence by illuminating the deck if necessary.
By 19:00 it was fully dark, and it was no longer possible to see the sea ahead of the ship. The wind
direction remained steady at about 30 degrees on the port bow, causing a 2-3m sea. A large swell of
about 6m was also evident coming from 20-30 degrees on the starboard bow. Under these influences,
the ship was rolling to about 10º, but not pitching heavily. Engine speed was set for 20 knots, and the
ship was making a good speed of 12 knots. This speed was considered to be sufficient for Maersk Kithira
to make her scheduled arrival time at Xiamen the next morning as the Master expected the overall
voyage speed to increase as the vessel passed to the north of the typhoon’s centre and proceeded
further east into calmer waters.
At 19:45, the bosun’s store bilge alarm sounded indicating to the Chief Officer the possibility that a
forecastle watertight closure had failed. Once he was relieved by the Third Officer at 19:50, he went to
discuss the problem with the Master. Finding the Master with the Chief Engineer, he informed the
Master of the alarm, and it was agreed that the Chief Officer would go forward to investigate the cause
of it. The Chief Engineer volunteered to accompany the Chief Officer, so both men changed into

working gear and prepared to make their way forward via the under-deck passageway on the starboard
side. The Master went to the bridge to oversee the operation, and took the con from the Third Officer.
The Master reduced the speed of Maersk Kithira to 10 knots and altered her course to starboard to
reduce the rolling by placing the swell directly ahead of the vessel.
On arrival at the bosun’s store the Chief Officer and Chief Engineer found that the deck was wet, and
that water was entering through the forecastle deck stores hatch cover seal. Shortly afterwards, at
20:07, they reported to the bridge by telephone what had been found.
The Master, Chief Engineer and Chief Officer jointly agreed that it would be necessary to tighten the
dogs securing the forecastle stores hatch cover to prevent further water from entering the space. The
Third Officer switched on the foredeck floodlights, and the Chief Officer and Chief Engineer waited
briefly at the top of the access to the upper deck for the Master to give permission for them to
proceed. At 20:10, permission was given, and the two men went onto the upper deck. Ship movement
was such that neither found it difficult to stand. They made their way initially to the access port in
the breakwater, and stood in the shelter of the breakwater to assess the motion of the ship, and gauge
the amount of water being shipped on the deck. Noting that the only water coming onto the deck
was spray coming up through the hawse pipe, they decided that it was safe to go onto the forecastle,
and at 20:11, informed the Master by UHF radio of what they were doing.
Communication between the forecastle and the bridge continued by UHF radio, with the Chief Officer
commenting that both men were getting wet due to the spray coming on board. At 20:18, having
received no response from the forecastle team to repeated calls by UHF radio, the Master ordered the
Third Officer to go forward and investigate. The Master reduced the speed of Maersk Kithira further to
5 knots.
At 20:23, as the Third Officer was getting changed to go on deck, the Master received a telephone call
from the Chief Engineer, in the bosun’s store, telling him that a large amount of spray had come on
board and soaked the radios, rendering them inoperable. The Chief Engineer also confirmed that the
stores hatch cover securing dogs had been tightened. However, the starboard anchor cable securing
chain was noted to be slack, and he reported that he and the Chief Officer would take a couple of
minutes to tighten it. The Master then called the Third Officer back to the bridge, explaining that
contact had been re-established.
The Chief Officer and Chief Engineer returned to the forecastle and set about tightening the anchor
cable securing chain. This required one man to mount the windlass platform to release the securing
chain locking screw, while the other remained at deck level to adjust the securing chain through a
link of the anchor cable. The Chief Engineer mounted the platform, and released the locking screw,
allowing the Chief Officer to adjust the chain. As the Chief Engineer then re-tightened the locking
screw, a wave broke over the forecastle and washed him off the platform. The wave also knocked the
Chief Officer off his feet and propelled him into the windlass, rendering him unconscious. No wave
impact was seen or felt by either the Master or Third Officer on the bridge.
The Chief Officer woke up seconds later in about 30cm of water. Looking around, he saw the Chief
Engineer forward of the windlass, lying stationary on the deck. The Chief Officer dragged the Chief
Engineer behind the breakwater and put him into the recovery position. He then went to the bosun’s
store and telephoned the bridge.

At 20:37 the general alarm was sounded, and the Master made an announcement on the ship’s
public address system stating that there had been an accident and for personnel to muster in the
ship’s office. The ship’s emergency organisation was such that the Chief Officer was the medical
officer, with the Third Officer acting as his deputy. On mustering in the ship’s office the Third Officer
and the fourth engineer were sent by the Master to find the casualties and make an initial
assessment of their condition. Taking a first-aid kit, they made their way forward and found the
Chief Officer holding the Chief Engineer in the recovery position aft of the breakwater. The Third
Officer’s initial assessment was that the Chief Engineer required a stretcher, while the Chief Officer
could walk if assisted. The Third Officer then used the telephone in the bosun’s store to discuss his
findings with the Master on the bridge and request that a stretcher party be sent forward. The
stretcher party arrived shortly afterwards, and the Chief Engineer was carried aft to the ship’s
hospital. The fourth engineer escorted the Chief Officer aft to the ship’s accommodation.
The Third Officer took charge of the attempt to provide the Chief Engineer with first-aid. It was
readily apparent that the Chief Engineer’s injuries were very serious, so the Master sought advice by
telephone from the company’s medical officer.
Following reassurance from the company medical officer that the actions being taken were
appropriate,the Master began to assess options for evacuating the Chief Engineer to hospital ashore.
At 08:30, he stopped breathing, and Cardiopulmonary Resuscitation (CPR) was started by the Third
Officer, assisted by the electrician and other crew members. The ship arrived alongside her berth at
Xiamen at 10:00, when paramedics boarded, and assessed the situation. CPR was stopped at 10:42,
and Mr Ross was pronounced dead.

Maersk Kithira Case

MCRM CASE STUDY: TORREY CANYON
TORREY CANYON GROUNDING
Shortly before 02:30 on March 18th, Captain Rugiati wrote his night instructions for First Officer
Bonfiglio who would relieve Second Officer Fontana at 04:00. Bonfiglio was to call him as soon as the
Scilly Isles appeared on radar. In any event Bonfiglio was to call with a report at 06:00 whether he had
radar contact with the Scillies or not. Captain Rugiati went to bed at 02:40. The Torrey Canyon was at
16 knots on a course of 018 degrees on autopilot.
Technical note.
The steering system had 3 modes manual, autopilot and control. Autopilot was the most commonly used
mode, with manual being used for port entries and to make alterations of course at sea. Control mode as a
backup mode in case of failure of the main systems. This disconnected the main wheel and switch control of
the rudder to a small tiller to the left of the wheel.
At 04:00 Bonfiglio relieved Fontana. Visibility was good - 10 miles. He expected to see the Scillies on
the starboard side after dawn. At 05:00 there was no sign of them on the radar. At 06:00 still no sign.
Bonfiglio called the Captain.
Bonfiglio: “It is 6 o clock, Captain. I have not yet seen the Scillies on radar.”
Captain: “Uh, thanks. When do you estimate them to come within radar range?”
Bonfiglio: “About 7”
Captain: “Call me when you make contact. Bye.”
At 06:30 Bonfiglio observed the Scillies on radar at a distance of 40 miles. But the position came as a
shock. Instead of lying to starboard they were off to port. The set of the current had forced the vessel
off course by about 8 miles. Bonfiglio changed course without notifying the Captain. First he called
the Helmsman to the wheel. Then he moved the steering control lever from automatic to manual
before giving the order “Come left to zero zero six degrees.” The vessel was then heading directly for
the Bishop Rock Lighthouse but was 24 miles away. He expected Captain Rugiati to confirm the course
change and order another change to port to bypass the lighthouse and return to the original track.
Once the Torrey Canyon had settled on zero zero six degrees he called the Captain.
Bonfiglio : “Captain, I have tracked the Scilly Isles on radar. We have moved over to the right of the
course. I have headed the bow for the Scilly Isles. I am heading for the Scilly Isles.”
Rugiati was angry, which surprised Bonfiglio.
Captain: “What? You changed course without consulting me?”

Bonfiglio: “But we were off track.”
Captain: “That’s not your decision. With our original heading of 18 degrees, would we be free
of the Scillies?”
Bonfiglio: “Yes.”
Captain: “Then continue on course zero one eight degrees. I intend to pass to the starboard of
the Scilly Isles.”
Bonfiglio: “If you really think so Captain.”
Captain: “Pay attention. In a few minutes I will be on the bridge.”
Captain Rugiati’s first action on the bridge was to confirm that First Officer Bonfiglio had carried out
his instructions and placed the vessel on the original 18 degrees heading. He then checked that the
vessel was free of the Scilly Isles. She was headed for the narrow channel between the Scillies and the
Seven Stones.

Rugati and Bonfiglio then concerned themselves with the transfer of cargo problem that had to
be solved before the Torrey Canyon could enter Milford Haven on the high tide at 23:00 that night.
Rugati had been warned that his maximum draft must be 52 feet and two inches. His draft at the
bow and stern was 51 feet seven inches. But there was a sagging amidships, by careful distribution
they had now reduced to nine inches. This meant that the draft amidships was only 52 feet and four
inches. So this would have to be reduced even more to get into Milford Haven.
Making the problem worse was the fact that the cargo transfer could only be done in calm seas since
the tanks were nearly full and this would take five hours. ETA at Milford Haven was 16:30. So
if transfer could not be done at sea then there was just enough time (an hour and a half) to delay
the transfer until the Torrey Canyon entered the Milford Haven Roads, but there was no time for a
delay.
But he felt no concern for the ship’s safety. Fixes were taken at 07:09, 07:45 and 08:00. Relations
were back to normal with First Officer Bonfiglio who left the bridge shortly after 08:00.
When Officer Bonfiglio left the bridge it was not clear whether a transfer at sea was possible and
whether they did in fact have a time problem.
Between 08:00 and 09:00 on the bridge with Captain Rugiati were Scotto, an experienced Helmsman
and Alfonso Coccio, an inexperienced Third Officer. Both were on their maiden voyage with the
Torrey Canyon. When Scotto first joined the bridge at 08:00 Captain Rugiati sent him down to
get two ashtrays, then a second time to get some sandpaper. He was not informed of the vessel’s
course. Coccio had spent hours the previous day checking the charts and course in the expectation
that they would be going west of the Scillies. Now he was informed that were going east. After
the briefing Coccio Bonfiglio left the bridge.
Fixes were taken at 08:10 and at 08:18. The speed was 15.75 knots. They were now abeam of the
Peninnis Head Lighthouse on the Scillies and 30 minutes from the shoals of the Seven Stones reef.
Coccio checked the radar.
Coccio: “Captain, there are two fishing vessels ahead.” “Yes,”

Captain: “I have seen them already.”
It had always been his intention to come to port once clear of the Scillies. Captain Rugiati changed
the ship’s heading to 015 degrees. With the automatic steering system being used this could still be
done in auto (the system allowed small alterations of course in automatic mode) without moving to
the manual position.
However the set of the current, drift and wind were counteracting the three degree turn to port and
the vessel was still heading on 018 degrees.
At 08:30 the Torrey Canyon was still in a slow sweeping turn to port. The heading was then 010
degrees and Captain Rugiati was intending to turn further to port. But the presence of more fishing
vessels to port meant that he ordered “put the ship back on a course of 013 degrees for about
10 minutes.”
Alfonso Coccio was uncertain of the ship’s exact position at that time and made three attempts to plot
the position. At 08:38 Captain Rugiati looking over Coccio’s shoulders could see that the fix was grossly
inaccurate. He could see that the last position was in error by at least a mile. Captain Rugiati could
now see that he was in trouble. He would have to take over himself.
“Stop using the Scillies for bearings.” he told Coccio, “Use the lightship.”

Coccio ran out to the starboard wing to take a bearing on the lightship. It was 033 degrees. The
Captain took the radar distance - 4.8 miles. When the position was plotted Rugiati saw that the ship
was only 2.8 miles from Seven Stone. The time was 08:40.
The ship was still on automatic Pilot. Rugiati decided to change to manual and change course to 000
degrees. He put her on course then changed back to automatic steering. In the meantime Coccio
took another bearing - the Torrey Canyon was 2.78 miles from the lightship, within less than a mile
of the nearest rock.
At that point Captain Rugiati fully realised the danger. He sprinted from the chart room yelling to
Helmsman Scotto: “Come to the wheel. Come to the wheel. Take it hard to port!”
Rugiati was already at the wheel, repeating his orders. “Hard to port. Go to 350. Take her to 340.
Take her to 320.” Then he returned to the chart room.
Scotto put the wheel hard over. For a few seconds he watched in growing amazement as the rudder
indicator didn’t move. He shouted to the Captain: “Captain, the ship is not turning.” But Rugiati was
too engrossed in the chart and didn’t hear in all the excitement.
It took Captain Rugiati close to a minute to sense that something was seriously wrong and it took
him a few seconds longer to realise what it was. The gyro compass was not clicking. He went cold
and turned towards Scotto. “She’s not turning, Captain” the Helmsman repeated.
Even then there was time, if only Rugiati could find out what was wrong quickly. His first fear was
that it was a fuse. This had happened before. Rugiati tested each in turn. They were all OK. Still the
rudder did not respond. His second thoughts were that the oil pumps controlling the rudder had
broken down. That too had broken down before.
In desperation Rugiati leaped for the telegraph and dialled the engine room. In his haste however he
dialled 14 instead of 6, and got the Officer’s dining room instead.
“Julio, here. Captain, are you ready for breakfast?”
Rugiati slammed the phone down. He was redialling when his fingers stopped. He had a clear view of
the steering control panel, “Porco Dio” he swore. The steering lever was not in “manual” but in
the “control” position. The Torrey Canyon could not turn. In effect the wheel was disengaged.
He then rushed to the control panel, switched it to manual and helped the Helmsman turn the
wheel hard to port.
The bow started to move to port. The ship reached a heading of 350 degrees, but it was too late.
She was slamming into Pollard Rock at a speed of 15.75 knots. Coccio felt the rocks touch at 08:50.

(Extracts taken from “The Black Tide in the wake of the Torrey Canyon” by Richard Petrow,
published by Hoddard and Stoughton SBN 340 02990 0).

MCRM CASE STUDY: Wheel Detachment Incident DHC-8-402 Dash 8 G-JEDR
After take-off from Exeter Airport, as the landing gear was retracted, the inboard wheel of
the right main landing gear separated from its axle and fell to the ground within the
airport boundary. The crew then entered a holding pattern to the east of the airport and
carried out the ‘Alternate Landing Gear Extension’ procedure prior to returning to Exeter
where it landed safely. The investigation found that the wheel’s outer bearing had seized.
This was most likely as a result of the bearing cage and cup having come into contact due
to excessive movement of the cage, probably due to wear. This caused the bearing to fail
catastrophically. Consequential damage had allowed the wheel to detach.

Glossary
AAIB Air Accident Investigation Branch
ABP Able Bodied Person
AFRS Air Field Rescue Service
ATC Air Traffic Control
FL030 Flight Level 030 (3000 feet)
FMS Flight Management System
Kt Knots
NDB Non Directional Beacon: An airfield marker beacon
NITS Nature, Intentions, Timings and Special instructions briefing
SCCM Senior Cabin Crew Member
V1 Engine Failure Recognition Speed
VR Rotation Speed: The speed at which the nose-wheel leaves the ground
VREF Landing Reference Speed
History of the flight
The Dash 8 aircraft was on the final sector of a four sector rotation which had commenced
at Newcastle Airport at 0705 hrs that morning. The commander had performed the pre‑
flight inspection, which included a visual examination of the right landing gear. Nothing
unusual was noted.
During the take-off from Runway 08 at Exeter a single “ding” audio signal activated
between 80 kt and V1/VR. The co-pilot checked for any indications on the relevant
instruments but there were none and he reported “spurious, continue”. The take-off was
continued and the landing gear was selected up once a positive rate of climb was
established. A number of passengers seated on the right side of the aircraft noticed
sparks emanating from the right inboard wheel area during the take-off roll and saw the
right inboard wheel fall from the aircraft as the landing gear retracted. They did not
inform the cabin crew at this point. The flight crew were advised by ATC shortly after take-
off that the aircraft may have lost a wheel. The climb was continued to FL030 and a right
turn was made to join the hold at the Exeter NDB. The FMS was programmed to fly the
hold and the autopilot was engaged.

The commander contacted the SCCM on the interphone to inform her of the situation and
asked her to inspect the right landing gear area. The passengers informed the SCCM of the
loss of the wheel and she could see that the gear was retracted and the landing gear doors
were closed, but parts of the landing gear mechanism were protruding. She reported her
observations to the commander. The co-pilot then spoke with a company engineer who
was a passenger on the flight and confirmed for himself the SCCM’s observations.
The flight crew reviewed the ‘Landing Gear Malfunction’ and ‘Emergency Landing’ sections
of the Abnormal and Emergency Checklist and agreed that the landing gear should be
extended using the ‘Alternate Landing Gear Extension’ procedure. On actioning this, the
left main and nose landing gear indicated down and locked but the right landing gear did
not indicate any movement. The company engineer advised the flight crew that the right
landing gear had not lowered. Following a discussion with the engineer, the pilots
prepared to use the landing gear manual lowering procedure but the right landing gear
then lowered and indicated it was down and locked. This was visually confirmed from the
cabin by the engineer and the co‑pilot.
The commander transmitted a MAYDAY which was acknowledged by ATC and the
transponder code of ‘7700’ (the normal aircraft emergency transponder code) was set.
The pilots reviewed the ‘Emergency Landing’ procedure and discussed their options. They
agreed that although the landing gear had lowered and indicated locked down, there was
a possibility that the right outboard wheel may detach in the air or on landing and they
should also be prepared for the right landing gear to collapse on touchdown. They
considered shutting down the right engine for the approach and landing but agreed to
keep it operating in order to reduce the asymmetric effects of selecting the propeller to
disc or reverse.
The commander gave a NITS briefing to the SCCM, who then briefed the other cabin crew
member. The passengers were then individually briefed. Following the commander’s
instructions, they also moved passengers on the right side away from the propeller area,
distributing them evenly forward and aft.
The co-pilot contacted the operator’s Chief Pilot by radio to discuss the most appropriate
landing procedure. It was decided that they would use a left-wing-down technique
ensuring that the left main-wheels touched down on the runway first, then lowering the
remaining right main-wheel onto the runway as gently as possible. The flaps would be set
at 35° and the touchdown would be at or just below the VREF of 112 kt calculated for their
landing weight of 24,000 kg. No wheel braking would be used during the landing roll.
The approach was flown manually with the co-pilot calling out check altitudes, airspeed
and rate of descent. At 1,000 feet on the radio altimeter the passengers were instructed
to adopt the brace position.

The aircraft touched down on the left main-wheels at or about VREF and the right main-
wheel was lowered onto the runway. The aircraft then veered to the left and the
commander had to apply significant amounts of right rudder in order to regain the
centreline. The pilots had briefed not to use the toe brakes during the landing roll and as
the aircraft slowed to a walking pace the commander made a gentle application of the
emergency brake, bringing the aircraft to a stop and the parking brake was set. Once the
AFRS was in position, the commander instructed the SCCM to disembark the passengers;
this was carried out through the front left door. The co-pilot and the SCCM used the public
address system to make announcements before the aircraft electrical systems were
isolated. The SCCM had briefed a number of ABPs to ensure the safe containment of the
passengers following the disembarkation. The passengers were taken to the terminal in
buses.
The detached main wheel and bearing debris found on the runway were recovered for
AAIB inspection. Initial examination of the aircraft revealed that the wheel nut was still in
position on the axle with its locking devices correctly installed. The brake unit was loose
on the axle. Both inboard and outboard bearings had suffered significant damage. The
outboard bearing (closest to the wheel nut) showed that it had failed first and its cone
thrust rib had been pushed flat by the forces of the failure, allowing the wheel to detach.

MCRM CASE STUDY: MV Dover Seaways Contact with Breakwater
MV Dover Seaways was a 2006 built cross-channel ro-ro ferry, operating up to 8 crossings a day
between Dover and Dunkerque at a service speed of 25 knots. She was certified to carry a
maximum of 1000 people. On 9th November 2014, she made heavy contact with the south
breakwater at Dover, requiring hospitalisation of three people and necessitating a spell in drydock
for the repair of the vessel’s bulbous bow and “cowcatcher”. The contact with the breakwater
resulted from a loss of directional control as Dover Seaways turned towards the harbour’s eastern
entrance. The ferry’s engines were set to “full astern” and the starboard anchor was let go, but
these actions did not prevent the ferry from colliding with the breakwater at 3.5 knots. No
announcement was made to warn the passengers or crew of the impending collision.
At 0745 on 9th November 2014, the ferry was being made ready for her regular crossing to
Dunkerque. On the bridge were the on duty Master, the Chief Officer and the on watch
Quartermaster (the term given by DFDS A/S to the navigational watch ratings). The stern ramp
was housed, and at 0754 the engines were placed on stand-by. Dover Seaways sailed at 0756.
The Master manoeuvred the vessel from the port Bridge wing control console where he controlled
the propulsion, steering and thrusters. The Chief Officer accompanied the Master while the
Quartermaster was by the starboard Bridge wing console, checking that the starboard side was
clear.

As Dover Seaways’ stern cleared the piers, the Master increased speed by setting the engine
control to between “slow ahead” and “half ahead”. He also applied 10° of port helm to turn the
vessel toward the port’s eastern entrance between the Eastern Arm and the South Breakwater
(see AIS plot on previous page). Meanwhile, the Quartermaster moved to the radar display that
was to port of the centre control console and started to track radar targets that the vessel was
likely to encounter outside the port.
At 0758, the Quartermaster heard a “double beep” from the centre control console. This was an
indication that the mode of steering control had been changed. He asked the Master if he still had
control of the steering. In response, the Master increased port helm.
Almost immediately, Dover Seaways started to turn to starboard. The Master ordered the
Quartermaster to put the steering in “main wheel” control (the steering wheel situated on the
centre control console) and apply full port helm. Within seconds the Master realised that the
vessel would not be able to pass through the entrance as planned.
Dover Seaways was about 250 metres from the northern end of the South Breakwater, making a
speed of 10.4 knots, when the Master set the engine controls to “full astern”. He also set the
thrusters to “full” thrust to port, and ordered the anchors to be let go. Accordingly, the Chief
Officer warned the crew on the forecastle and then the Quartermaster activated the anchor
release switches on the bridge. Dover Seaways’ speed reduced as she continued towards the end
of the South Breakwater. At 0759:19, the ferry hit the end of the breakwater at a speed of about
3.5 knots. The passengers and crew were not warned of the impact, and many fell to the deck or
were thrown from their seats; three passengers and ten crew sustained minor injuries. Several
vehicles were also damaged.
Dover Seaways remained underway; only the starboard anchor had released but insufficient cable
had run out and the anchor had not reached the seabed. The anchor was recovered, and the ferry
returned alongside without assistance. Meanwhile, the ferry’s first aid team treated the injured in
the vessel’s cafeteria. Details of the injured were passed to the Port of Dover, which informed the
emergency services. The emergency services met the ship on arrival, and three of the injured
persons were taken to hospital for further checks. The ferry’s bulbous bow and “cow catcher”
were damaged, requiring the ferry to be drydocked for repair. There was no pollution, and Dover
Seaways returned to service on November 21st 2014.
Steering System
Dover Seaways was fitted with two high-lift rudders. Each rudder was driven by a rotary vane
steering gear system with two electro-hydraulic motors. The steering gear was operated by an
electronic control system from the bridge (“follow up”) or directly by solenoids in the steering gear
room (“non follow-up”). With two hydraulic motors running, the rudder moved from 35° on one
side to 35° on the other side in approximately 16 seconds. Rudder angle indication was provided
on conning displays on the bridge control consoles and also on overhead repeaters.
In “follow up”, the steering gear could be controlled in one of four modes – “Autopilot”, “Main
Wheel”, “Call Up” or “Trackpilot”. The mode selector switch was located on the main steering
stand. Selection of the “Call Up” mode enabled the steering control to be selected at one of the
following positions:

• Port Bridge wing console
• Starboard Bridge wing console
• Port trackpilot
• Starboard trackpilot
• Autopilot
Steering control was transferred between these positions by use of “take over” buttons requiring
a positive pressure push to engage. There was, however, no indication on the bridge wing
consoles to show the station in control of the steering. This information was only provided on the
centre console.
When Dover Seaways sailed on 9th November 2014, all hydraulic pumps were operating. The
steering mode selected was “Call Up” and the steering was controlled from the Port Bridge wing
console.
Automatic Steering
Automatic steering was via either the autopilot or one of two trackpilots. The autopilot was
located on the centre console and controlled the rudders to follow a pre-set course. The
trackpilots were located next to the port and starboard radars, either side of the centre control
console. The trackpilots’ operation was similar to that of the autopilot but they also used an input
from the Global Positioning System information to follow a course over the ground rather than
steer a pre-set heading. The trackpilots were interfaced with the electronic chart display and
information system (ECDIS).
When the autopilot or the trackpilots were selected by using either the mode selector switch or
the call up buttons, the systems adjusted the rudders to follow the ship’s heading at the time of
selection. Therefore, it was usual practice to select autopilot or trackpilot control after the ferry
was steady on its intended heading or track. If the systems were switched on whilst the ship was
turning they applied sufficient rudder, limited by user preference, to counteract the turn and
resume the vessel’s heading at the time the take-over button was pressed or the mode selector
switch was moved. Dover Seaways’ rudder limits were set at 30°.
Examinations, Tests and Analysis

Following the accident, the following was identified:
• The trackpilot steering mode was engaged at 0758:14 and disengaged at 0758:42
• During the loss of directional control, the “clog filter” and “control power failure” alarms
activated on all four steering motors
The following was also observed during subsequent steering system trials:
• The steering system functioned correctly
• The “clog filter” alarms activated. It was determined that the alarms tended to activate
when the hydraulic oil in the steering system was cold. The frequency of alarms also
increased when replacement filters were required
• The “control system failure” alarms also activated, but the performance of the steering
system was unaffected
• The bridge team was aware that control of the steering could be transferred to the bridge
wing consoles when “call up” mode was selected. They were unaware that control could

also be transferred to the autopilot or trackpilots if their respective “take control” buttons
were pressed, despite having completed bridge familiarisations and undertaking regular
steering failure drills
• The shaft on the mode selector switch on the bridge main steering stand was loose
The defect to the mode selector switch had been recorded 5 days before the accident in the
vessel’s defect log. The mode selector switch was removed for examination. The switch shaft
retaining nut on the underside of the casing was found to be loose; no other defects were found.
Evidence from the ECDIS alarm log, the “double beep” heard by the Quartermaster and the
unexpected turn to starboard all indicate that directional control was lost due to control of the
steering transferring from the port Bridge wing to one of the trackpilots. Post incident trials
indicated that the “clog filter” and “control power failure” alarms did not contribute to the loss of
control, neither did the defective mode selector switch. The Bridge team were used to hearing
“clog filter” alarms and “control power failure” alarms, and treated steering gear alarms as
“spurious”. Whilst the “double beep” heard by the Quartermaster alerted the Bridge team to the
steering problem, the “call up” indicator panel was not checked to ascertain exactly where
steering control was located, neither were the rudder angle indicators monitored. If they had
been, the movement of the rudders from port to starboard when control passed to the trackpilot
would have been appreciated sooner.
The cause of the transfer of the steering control from the port Bridge wing to a trackpilot is not
known. The transfer was not intended and the steering system functioned correctly in all modes
during subsequent tests. As the Quartermaster was close to the port trackpilot, the possibility of
the “take control” button on the port trackpilot being accidentally pressed cannot be discounted.
However, it is not known to which trackpilot steering control was transferred. Furthermore, the
possibility of the transfer of steering control being due to an intermittent fault cannot be
discounted.
Dover Seaways was 400 metres from the eastern entrance when steering control passed to the
trackpilot. Directional control was lost for 28 seconds, by which time the ferry had closed to 250
metres from the breakwater. Had the vessel’s engines been set to “full astern” – in accordance
with the company’s “steering failure checklist” – at the time of the loss of directional control, it is
likely contact with the breakwater would have been avoided.
As Dover Seaways approached the South Breakwater, the Bridge team were undoubtedly focussed
on the imminent contact. However, the lack of broadcasting a warning to the passengers and
crew was a significant omission. The lack of warning of impact meant no-one braced, sat or lay
down, or moved to a safe position. Consequently, when she struck the breakwater at 3.5 knots,
the sudden stop was sufficient for a number of passengers and crew to lose their balance and fall
to the deck, causing minor injuries.

MCRM CASE STUDY: MV Finnreel Grounding Incident
Finnreel was a ro-ro cargo vessel engaged on a regular triangular service between Helsinki, Rauma
and Hull, with a mixed general cargo, most of which was usually paper products. She was purpose
built for the trade with specifically designed ventilation, drainage and an anti-roll system. She was
fitted with one V12 MAN/B&W main engine (operated at a nominal speed of 500rpm with a
maximum output of 12600kW) which drove a single Controllable Pitch Propeller (CPP) through a
single reduction gearbox. The vessel was fitted with two tunnel thrusters, one of 900kW fitted
forward, and one of 600kW fitted aft. The gearbox also consisted of a single direct drive power
take off which drove a 1500kW 400v shaft alternator for the thrusters, with two 500kW diesel
alternators being provided for auxiliary electrical power at 400v 50Hz.
Prior to departure from Rauma, bound for Hull, the Pilot boarded at around 1830. The Chief
Officer was completing the loading, and was finalising the ballast in the cargo control room. In the
Engine Room, the second diesel alternator was started and paralleled to the main switchboard.
The hydraulic pumps for the CPP were started, and both steering motors switched on. At about
1920, the Master tested the steering gear. The stern door was closed at 1940 by the Chief Officer,
who then made his way to the Bridge after a final check of the cargo lashings. The main engine
was kicked over on air, and after closing the indicator cocks the main engine was started locally at
1940, gradually being brought up to the operating speed of 500rpm. Engine control was passed up
to the bridge, and with the shaft alternator supplying power, both bow and stern thrusters were
started. The Master rang stand-by. As was normal practice, the Master was on the bridge for
departure, along with the Chief Officer and the Pilot. The Engine Control Room (ECR) was manned
by the Chief Engineer, Second and Relief Second Engineers, Third Engineer and the Electrician. For
departure, the Second Officer went to the mooring deck aft whilst the Third Officer went forward.
The vessel singled up, and then the last mooring line came inboard at 1946. With the Master
taking the con, the vessel left the berth, with the Master handling the engine movements and
helm himself and the Chief Officer recording movement times. Once clear of the berth and lined
up for the channel, the Master handed over the conduct of the navigation to the Pilot, and the
Chief Officer took the helm. The Pilot was using the port side radar to confirm the vessel’s

position in the channel, as well as using the leading lights astern as a further check. No other
traffic was either inbound or outbound. The Pilot requested an increase in speed to about 12
knots. Some 10 minutes after leaving the berth, the bosun arrived on the bridge and took over the
helm from the Chief Officer. The thrusters had been left running ready for use if required. The
Third Officer arrived on the Bridge at about 2000. He took over the watch from the Chief Officer
at 2002, after the Chief Officer had plotted a position on the chart. The Chief Officer then left the
Bridge. The vessel was proceeding normally in the buoyed channel. The Master was on the
starboard Bridge wing and the Pilot was by the helmsman, who was applying helm on a virtually
continuous basis to maintain the vessel’s position in the channel. The Third Officer was in the
Chart Room. In the ECR, all four of the Engineers along with the Electrician were still present,
waiting for the Pilot to disembark and FAOP to be rung.
At 2004, the main engine crankcase oil mist alarm sounded in the ECR, and was acknowledged by
the Second Engineer. Almost immediately, the alarm changed to main engine shutdown, and was
followed by various other alarms as the main engine slowed down and stopped. Both Second
Engineers went to the bottom plates to check the condition of the crankcase doors and the
temperatures of the bearing lub oil returns. Nothing unusual was subsequently found. On the
Bridge, the helmsman was steering 249° and the vessel’s speed was around 12.5 knots as the
vessel approached the Levi and Hylkikarta buoys. The Pilot observed that the vessel was heading
about 2° to starboard of the intended track. The helmsman called out “no steering” and the Pilot
ordered hard to port. As the main engine slowed down, the shaft alternator main breaker tripped
off the switchboard, resulting in both thruster breakers also tripping.
The Master saw and heard the alarm indicating both thrusters had lost electrical power. He tried
to restart them, from the starboard Bridge wing console, but got no response. He then moved to
the centre console to try from there, where the helmsman told him the vessel was not steering.
Despite the rudder being hard to port, the vessel continued to swing to starboard. The Master
telephoned the ECR and told the Chief Engineer that they had a problem with the steering. The
conversation between the Master and the Chief Engineer was short, and at no point was the main
engine shutdown mentioned. The Chief Engineer sent the Third Engineer and the Electrician aft to
check the steering gear. Nothing abnormal was subsequently found. The Master could hear an
alarm sounding, but could see no lights lit on the main engine alarm panel on the Bridge (the
alarm light lamp had failed, a fault not picked up in the pre-departure checks). The Master also
assumed the audible alarm he could hear was for the thrusters; this alarm had a similar tone to
that for the Main Engine auto-shutdown. The Master moved the propeller pitch control to slow
astern and confirmed the pitch was responding.
On hearing the alarm, the Third Officer had gone to the central console, next to the Pilot, where
he saw that the vessel was moving to starboard, out of the channel, despite the rudder being hard
to port. The Pilot asked for hard to port from the bow thruster, but was told by the Master that
he could not start the thruster unit. The Master placed the propeller pitch control to full astern,
and although the CPP responded and moved to the full astern position the vessel was sufficiently
far out of the buoyed channel that she ran aground at 2008, North of the channel and to the East
of the Hylkikarta buoy. The time from the start of the swing to starboard until the grounding was
about 90 seconds. The Master, Pilot and Third Officer were caught by surprise by the engine

shutdown and didn’t realise that the engine had, in fact, stopped until after the vessel was
aground.
The speed at impact was about 8.5 knots with the ship’s heading 276°. The grounding was
accompanied by a loud bang, vibration, and a sensation of “sliding upwards” and then rolling,
before the vessel came to a halt. The Pilot informed VTS of the grounding by VHF and called the
Pilot boat. The Third Officer wrote down the ship’s position from the GPS and then continued to
note times of various actions undertaken by the vessel’s crew. The Master telephoned the ECR
and asked the Engineers to check the Engine Room for leaks. The Chief Officer arrived on the
Bridge and was instructed by the Master to check for leaks in the holds, whilst the Second Officer,
also just arrived on the Bridge, was instructed to muster the ship’s company. The Third Officer
and two ABs were sent around the vessel with a lead line to take soundings.
The Master saw from the ballast console that there was water being lost from the forepeak tank,
and that number 1 centre and number 2 port and starboard ballast tanks were flooding. An AB
sent to inspect the bow thruster room reported back that it was flooding. At 2020, the Chief
Engineer was instructed to start pumping the bow thruster space to try to maintain the water level
below that of the electric motors. The Pilot boat was on scene at 2038, and noted the Finnreel’s
draughts, passing them on to the Master. The Master made no attempt to take the vessel off the
rocks because, he considered, with the extent of the damage not precisely known, it was safer to
remain in position.
The response of the Engineering staff with regard to the high crankcase oil mist alarm and
subsequent shutdown of the main engine was immediate and followed standard industry practice.
As the shutdown was an autonomous reaction, nothing could have prevented the engine trip.
Even operating the “reset” button on the detector would have then required the main engine to
be started again, and given the time frame between the engine shutdown and the grounding, it is
unlikely that there would have been sufficient time to prevent the grounding. After the
grounding, the Chief Engineer arranged for the main engine turning gear to be engaged and the
crankcase doors to be removed. A thorough internal inspection of the bearings and detector
heads was carried out, using the turning gear as required. No evidence of bearing failure or
misalignment was found. This action, in addition to checks on the steering gear and CPP
confirmed there was no apparent damage to either steering gear, propeller assembly or main
engine.
First contact was made with the vessel’s owners at about 2020, with regular contact (at
approximately 30 minute intervals) then being maintained. At 2311, the owners were told that
the vessel’s current draughts were 4.15 metres forward, 7.35 metres aft, with the forepeak,
number 1 centre, number 2 port and starboard and the bow thruster spaces breached, and that
the main engine was available for use as required.

MCRM CASE STUDY: The “Gimli Glider” – Boeing 767 C-GAUN
The “Gimli Glider” is the nickname of an Air Canada aircraft that was involved in an
unusual aviation incident. On July 23, 1983, Air Canada Flight 143, a Boeing 767–233 jet,
ran out of fuel at an altitude of 41,000 feet, about halfway through a flight originating in
Montreal and bound for Edmonton. The crew were able to glide the aircraft safely to an
emergency landing at Gimli Industrial Park Airport, a former Royal Canadian Air Force
base in Gimli, Manitoba.
Running out of fuel

On July 23, 1983, flight 143 was cruising at 41,000 feet. The aircraft's cockpit warning
system sounded, indicating a fuel pressure problem on the aircraft's left side. Assuming a
fuel pump had failed the pilots turned it off, since gravity should feed fuel to the aircraft's
two engines. The aircraft's fuel gauges were inoperative because of an electronic fault
which was indicated on the instrument panel and airplane logs (the pilots mistakenly
believed the flight was legal with this malfunction). The flight management computer
falsely indicated that there was still sufficient fuel for the flight; however, this was not
correct as due to a conversion error during loading, the fuel had been loaded in pounds
instead of kilograms (Note: 1kg = 2.2lb). A few moments later, a second fuel pressure
alarm sounded for the right engine, prompting the pilots to divert to Winnipeg. Within
seconds, the left engine failed and they began preparing for a single-engine landing.
As they communicated their intentions to controllers in Winnipeg and tried to restart the
left engine, the cockpit warning system sounded again with the "all engines out" sound, a
long "bong" that no one in the cockpit could recall having heard before and that was not
covered in flight simulator training. Flying with all engines out was something that was
never expected to occur and had therefore never been covered in training. Seconds later,
with the right-side engine also stopped, the 767 lost all power, and most of the
instrument panels in the cockpit went blank.
The 767 was one of the first airliners to include an Electronic Flight Instrument System
(EFIS), which operated on the electricity generated by the aircraft's jet engines. With both
engines stopped, power was lost and the system went dead, leaving only a few basic
battery-powered emergency flight instruments. While these provided sufficient

information with which to land the aircraft, a vertical speed indicator – that would
indicate the rate at which the aircraft was descending and therefore how long it could
glide unpowered – was not among them.
In the event of a double engine failure, a ram air turbine deploys a propeller driven
hydraulic pump and alternator. Its output is dependent on aircraft speed, so on landing
the reduction in speed reduces the power available to control the aircraft.
Landing at Gimli
In line with their planned diversion to Winnipeg, the pilots were already descending
through 35,000 feet when the second engine shut down. They immediately searched their
emergency checklist for the section on flying the aircraft with both engines out, only to
find that no such section existed. The Captain was an experienced glider pilot, so he was
familiar with flying techniques almost never used by commercial pilots. To have the
maximum range and therefore the largest choice of possible landing sites, he needed to
fly the 767 at the optimal glide speed. Making his best guess as to this speed for the 767,
he flew the aircraft at 220 knots. The First Officer began to calculate whether they could
reach Winnipeg. He used the altitude from one of the mechanical backup instruments,
while the distance travelled was supplied by the air traffic controllers in Winnipeg. His
calculations indicated that they would not reach Winnepeg.
At this point, the First Officer proposed landing at the former RCAF Station Gimli, a closed
air force base where he had once served as a Royal Canadian Air Force pilot. Unknown to
him, part of the runway had been converted to a drag race track complex. On the day of
the incident, races were being run.
Without power, the pilots attempted lowering the aircraft's main landing gear via a
gravity drop. The main gear locked into position, but the nose wheel did not, which later
turned out to be advantageous. As the aircraft slowed on approach to landing, the ram air
turbine generated less power, rendering the aircraft increasingly difficult to control.
As the runway drew near, it became apparent that the aircraft was coming in too high and
fast, raising the danger of running off the runway before it could be stopped. The lack of
hydraulic pressure prevented flap/slat extension which would have, under normal landing
conditions, reduced the stall speed of the aircraft and increased the lift coefficient of the
wings to allow the aircraft to be slowed for a safe landing. The pilots briefly considered a
360-degree turn to reduce speed and altitude, but decided that they did not have enough
altitude for the manoeuvre. The Captain decided to execute a forward slip to increase
drag and lose altitude. This manoeuvre is commonly used with gliders and light aircraft to
descend more quickly without increasing forward speed.
As soon as the wheels touched down on the runway, the Captain braked hard, blowing
out two of the aircraft's tyres. The unlocked nose wheel collapsed and was forced back

into its well, causing the aircraft's nose to slam into, bounce off, and then scrape along the
ground. This helped to slow the airplane and avoid injuring the people on the ground. The
nose also grazed the guardrail now dividing the strip, which further slowed it down.
Seventeen minutes after running out of fuel, Air Canada flight 143 came to a final stop on
the ground.
None of the 61 passengers were seriously hurt. A minor fire in the nose area was
extinguished by racers and course workers armed with fire extinguishers. As the aircraft's
nose had collapsed onto the ground, its tail was elevated and there were some minor
injuries when passengers exited the aircraft via the rear slides, which were not long
enough to accommodate the increased height.
Fuel quantity indicator system

The amount of fuel in the tanks of a Boeing 767 is computed by a dual channel Fuel
Quantity Indicator System (FQIS) and displayed in the cockpit. In the event of both
channels failing there would be no fuel display in the cockpit, and the aircraft would be
considered unserviceable and not authorised to fly.
Because inconsistencies were found with the FQIS in other 767s, Boeing had issued a
service bulletin for the routine checking of this system. An engineer in Edmonton duly did
so when the aircraft arrived from Toronto following a trouble-free flight the day before
the incident. While conducting this check, the FQIS failed and the cockpit fuel gauges went
blank. The engineer had encountered the same problem earlier in the month when this
same aircraft had arrived from Toronto with an FQIS fault. He found then that disabling
the second channel by pulling the circuit breaker in the cockpit restored the fuel gauges to
working order albeit with only the single FQIS channel operative. In the absence of any
spares he simply repeated this temporary fix by pulling and tagging the circuit breaker.
A record of all actions and findings was made in the maintenance log, including the entry;
"SERVICE CHK – FOUND FUEL QTY IND BLANK – FUEL QTY #2 C/B PULLED & TAGGED...".
This reports that the fuel gauges were blank and that the second FQIS channel was
disabled, but does not make clear that the latter fixed the former.
On the day of the incident, the aircraft flew from Edmonton to Montreal. Before
departure the engineer informed the pilot of the problem and confirmed that the tanks
would have to be verified with a floatstick. In a misunderstanding, the pilot believed that
the aircraft had been flown with the fault from Toronto the previous afternoon. That
flight proceeded uneventfully with fuel gauges operating correctly on the single channel.
On arrival at Montreal, there was a crew change for the return flight back to Edmonton.
The outgoing pilot informed the new Captain and First Officer of the problem with the
FQIS and passed along his mistaken belief that the aircraft had flown the previous day
with this problem. In a further misunderstanding, the Captain believed that he was also
being told that the FQIS had been completely unserviceable since then.

While the aircraft was being prepared for its return to Edmonton, a maintenance worker
decided to investigate the problem with the faulty FQIS. To test the system he re-enabled
the second channel, at which point the fuel gauges in the cockpit went blank. He was
called away to perform a floatstick measurement of fuel remaining in the tanks.
Distracted, he failed to disable the second channel, leaving the circuit breaker tagged
(which masked the fact that it was no longer pulled). The FQIS was now completely
unserviceable and the fuel gauges were blank.
On entering the cockpit, the Captain saw what he was expecting to see: blank fuel gauges
and a tagged circuit breaker. He consulted the aircraft's Minimum Equipment List (MEL),
which told him that the aircraft could not be flown in this condition. The 767 was still a
very new aircraft, having flown its maiden flight in September 1981. C-GAUN was the 47th
Boeing 767 off the production line, delivered to Air Canada less than four months
previously. In that time there had been 55 changes to the MEL, and some pages were still
blank pending development of procedures.
Due to this unreliability, it had become procedure for flights to be authorised by

maintenance personnel. To add to his own misconceptions about the condition the
aircraft had been flying in since the previous day, reinforced by what he saw in the
cockpit, he now had a signed-off maintenance log that it had become custom to prefer
above the Minimum Equipment List.
Refueling
At the time of the incident, Canada was converting to the metric system. As part of this
process, the new 767s being acquired by Air Canada were the first to be calibrated for
metric units instead of customary units. All the other aircraft were still operating with
Imperial units. For the trip to Edmonton, the pilot calculated a fuel requirement of 22,300
kilograms (49,200 lb). A floatstick check indicated that there were 7,682 litres already in
the tanks. To calculate how much more fuel had to be added, the crew needed to convert
the quantity in the tanks to a mass, subtract that figure from 22,300 kg and convert the
result back into a volume. In previous times, this task would have been completed by a
flight engineer, but the 767 was the first of a new generation of airliners that flew only
with a pilot and co-pilot, and without a flight engineer.
In planning the quantity of fuel to load, the wrong conversion factor was used, due to
confusion over the change from Imperial measurements to Metric. This resulted in only
about half the total amount of fuel required for the flight being loaded. Knowing the
problems with the FQIS, the Captain double-checked the calculations but as he used the
same incorrect conversion factor he inevitably came up with the same incorrect figures.

MCRM CASE STUDY: HMS Endurance
HMS Endurance was an icebreaker that served as the Royal Navy ice patrol ship between
1991 and 2008. Built in Norway as MV Polar Circle, she was chartered by the Royal Navy
in 1991 as HMS Polar Circle, before being purchased outright and renamed HMS
Endurance in 1992. She was taken out of service in December 2008, when she was
seriously damaged by flooding on December 16th following an error during routine
maintenance on a sea water strainer. In October 2013, it was reported HMS Endurance
would be sold for scrap, as it was not “economically viable” to repair the damage
sustained in 2008, which along with the subsequent deterioration of the vessel after the
flooding incident was estimated to cost £30,000,000 to repair.
Background
In 2007, the Fleet Command carried out a study of the feasibility of deploying HMS
Endurance for an extended period of 18 months. The ensuing report recommended that
HMS Endurance deploy for 18 months and a team was formed to plan for the deployment.
A key issue identified by the team was the challenge of meeting the mandated manning
requirements for a ship deployed for such a length of time. The Engineer Officer posts
were recognised as having particular challenges, and so the ship’s company was increased
by an additional Engineer Officer prior to her deployment. To satisfy the manning
requirements the ship established a manning regime somewhere between “managed
gapping” and a formal three watch system, dependent upon the person’s role on board.
Managed gapping is a system whereby it is acceptable for key personnel to leave the
vessel, with their duties either shared to others or cascaded down to lower ranks. The
lower ranks in turn then either share out their own duties or again cascade them further
down. Key personnel returned to the UK when the program permitted. For those whose
roles were less program dependent, a standard leave rotation of 1 in 3 was instituted.
In October 2007, just prior to commencing her deployment, HMS Endurance completed a
4-week period of Operational Sea Training. Overall, according to Flag Officer Sea
Training’s final report, she performed well, although she had not adopted the manning
system that was to be used for the 18 month deployment. The total deployment was to

comprise of three distinct phases, two periods in Antarctica with a period off West Africa
separating them. Prior to the West African phase, the vessel visited Simons Town, South
Africa, during which a maintenance period was undertaken along with a period of training
for helicopter operations that were expected in West Africa.
In October 2008, the vessel completed a further Operational Training Period, which
focussed on Damage Control and Fire Fighting, and prepared the Chief Officer to assume
temporary command when the Captain went on leave. During this period, there was a
flood in the engine room caused by the inadvertent dumping of hot, fresh water into the
engine room bilges. This incident was effectively managed by the ship’s company.
However, as a result of damage caused by this flood, much of the Operational Training
Period was spent alongside whilst repairs were carried out.
Towards the end of November 2008, the Captain went on leave and the Chief Officer
assumed temporary command. The Chief Engineer returned from leave, and a new 1st
Engineer joined the vessel. The 2nd Engineer went on leave with his duties being
temporarily covered by the remaining ship’s staff under managed gapping.
On December 14th 2008, there was another flood within the engine room. An
investigation was initiated, but was never concluded owing to subsequent events. The
likely cause of this flooding incident was thought to be an incorrectly fitted ballast tank lid
on number 5 ballast tank allowing water to flood out when the tank was pressed up.
HMS Endurance was fitted with two fresh water (FW) generators, each with a design
production of 12.5 tonnes of fresh water a day. The sea water supply to the FW
generators was provided through pumps using an independent sea chest. The incoming
sea water was heated using waste heat from the main engine cooling water system
and/or steam, being boiled under a vacuum in the FW generators. Prior to the 16th
December (the date of the incident), fresh water production had been lower than normal.
With 38 passengers on board in addition to the ship’s crew, fresh water consumption was
also considerably higher than usual. The 2nd Engineer, who was on leave, was the person
who normally maintained the FW generators and their associated equipment. In his
absence, these duties were being covered under managed gapping by other team
members in addition to their own duties. Two days were spent working on the systems
associated with the fresh water generators in an attempt to improve their performance,
and this resulted in the FW Generators being off for around 5 hours each day.
By the 16th December, the Chief Engineer was sufficiently concerned about the level of
fresh water on board that he put some restrictions in usage in place. He called a
departmental management meeting during which he emphasised the importance of
improving the fresh water production rate. Without improvements, he commented that a
return to the Falkland Islands, where support was more readily available, may have to be
made. Following this meeting, the two Engineers who had been working on the FW

generators, after consulting with the 1st Engineer, continued to investigate ways in which
their performance could be improved. An e-mail was sent to the on-leave 2nd Engineer,
requesting advice and detailing what had already been carried out. However, before any
reply was received, it was decided that one possible cause of the poor performance was a
reduced sea water flow due to blocked inlet strainers. It was already suspected that the
main high sea suction strainer had been blocked for the previous 10 days.
The main sea water system provided cooling for the closed circuit fresh water system
which cooled the main engines, generators and other auxiliary machinery. The sea water
pumps could take suction from any one of three inlets – low, high or emergency. The sea
water supply to the fresh water generators was designed to be independent of the main
sea water supply, but it could be cross-connected if required to maintain a sea water
supply should its own sea water inlet become blocked. All sea water inlets had a strainer
fitted, designed to collect any foreign objects before they could block, damage or
contaminate the systems. Each strainer had an inlet and outlet valve allowing for strainer
isolation so that they could be removed and cleaned as necessary. See diagram, page 5.
The Incident
Before commencing the cleaning of the sea water strainers, the two Engineers discussed
their analysis of the fresh water generator problems with the Chief Engineer. The Chief
Engineer assumed they were intending to clean the sea water strainers that were solely
for the fresh water generators; the two Engineers assumed their discussion with the Chief
Engineer provided them with authorisation to clean all of the sea water strainers.
The high level sea water inlet strainer had an isolation valve between the strainer and the
sea chest (v/v 1113) and a valve between the strainer and the system (v/v 1114). Similar
to many valves on HMS Endurance, the hull valve (v/v 1113) could be operated remotely
from the Engine Control Room (ECR) using an electronically controlled pneumatic
actuator. These valves were known to take around 30 seconds to operate pneumatically.
In the control system for these valves, it was possibly to “block” the remote operation of
each valve by entering a “no operation” command in the ECR. The Engineers working on
the strainers informed the Engineering Officer of the Watch (EOOW) in the ECR that they
were about to clean the sea water strainer, and the EOOW disabled the remote operation
of v/v 1113. In the engine room, the Engineers isolated the sea water system from the
strainer by closing v/v 1114, and visually sighted that v/v 1113 was shut. The nuts
securing the strainer lid were slackened, and once it was clear that the strainer was
completely isolated, and there was no water ingress, the strainer lid was removed.
Each pneumatically controlled valve had two control air lines connected to it; one to open
the valve, and one to close it. Unique to v/v 1113 on HMS Endurance, the control air lines
interfered with the removal of the strainer basket, and it was necessary to remove them
in order to be able to withdraw the basket for cleaning. The spindle of v/v 1113 to which
the actuator connected to was 50mm shorter than that of all the other remotely operated

valves, and this resulted in the interference between the strainer basket and the control
air lines. There was no obvious reason for this discrepancy.
In order to be able to remove the control air lines, it was first necessary to isolate the air
off the Local Control Panel (LCP). This also disabled the remote operation of all of the
ballast valves, as well as the sea water ship’s side valves. The vessel was engaged in
helicopter operations at the time, and in the past the ballast system had been required
during these operations. However, at no time was contact made with the bridge to check
their requirements. The valve to isolate the LCP was identified as v/v 6. The Engineers
informed the EOOW that they were closing v/v 6, and then disconnected the two control
air lines. The line from the left hand side of the actuator was placed to the left, the line
from the right hand side was placed to the right. The basket strainer was then withdrawn,
and then the air lines were reconnected. To allow for the use of the ballast system, v/v 6
was reopened and the EOOW was informed. The “no operation” command was removed
in the ECR.
The two Engineers then left the engine room for a break, and two others commenced
cleaning the strainer basket and housing. After approximately 30 minutes, the two
Engineers returned to the Engine Room, and this coincided with the change of EOOW.
One of the Engineers commenced checking the line-up of the sea water system in
preparation for cleaning the next strainer, whilst the other resumed his supervision of the
cleaning of the open strainer. Once the strainer and housing were clean, and the strainer
lid seal was greased, the supervising Engineer informed the EOOW that he was about to
close v/v 6 again, and isolate the control air off the remote operated valves. Once v/v 6
was shut, the control air lines were again removed from v/v 1113, being pushed aside to
allow the strainer basket to be reinstalled. The air lines were then reconnected, with the
intention of restoring the control air supply as quickly as possible. Before the filter lid had
the retaining nuts fitted, v/v 1113 suddenly opened without warning. This caused the
filter lid to be blown off by the force of water and led to major Engine Room flooding.
As water cascaded into the engine room, a verbal flooding alarm was raised. The new 1st
Engineer rushed to the LCP and opened v/v 6. He operated the normal “close” side of the
solenoid for v/v 1113, anticipating that the regular “close” command would be successful.
Finding this had no effect, the 1st Engineer alternated between the close and open
commands at the solenoids for at best a period of 10 seconds, but there was no reduction
in the rate of inflow of sea water. His last action before proceeding to the ECR was to
push the “close” side of the solenoid. Unable to control the inrush of water, the Engine
Room was abandoned and allowed to flood. The vessel was towed to port and
subsequently declared a total constructive loss.

MCRM CASE STUDY: Three Mile Island Accident
The Three Mile Island accident was a partial nuclear meltdown that occurred on March 28, 1979,
in one of the two Three Mile Island nuclear reactors in Dauphin County, Pennsylvania, United
States. It was the worst accident in U.S. commercial nuclear power plant history.
The accident began with failures in the non-nuclear secondary system, followed by a stuck-open
pilot-operated relief valve in the primary system, which allowed large amounts of nuclear reactor
coolant to escape. The mechanical failures were compounded by the initial failure of plant
operators to recognize the situation as a loss-of-coolant accident due to inadequate training and
human factors, such as human-computer interaction design oversights relating to ambiguous
control room indicators in the power plant's user interface. In particular, a hidden indicator light
led to an operator manually overriding the automatic emergency cooling system of the reactor
because the operator mistakenly believed that there was too much coolant water present in the
reactor and causing the relief valve to open.
The partial meltdown resulted in the release of unknown amounts of radioactive gases and
radioactive iodine into the environment. The clean up of the reactor started in August 1979, and
officially ended in December 1993, with a total clean up cost of about $1 billion.
TMI Reactor 1
TMI Reactor 2

The Accident
1) Machinery
In the night time hours preceding the incident, the TMI-2 reactor was running at 97% of full power,
while the companion TMI-1 reactor was shut down for refuelling. The main chain of events leading
to the partial core meltdown occurred in TMI-2's secondary (non-nuclear) circuit.
The initial cause of the accident happened eleven hours earlier, during an attempt by operators to
fix a blockage in one of the eight condensate polishers, the sophisticated filters softening the
secondary loop water. These filters are designed to stop minerals and impurities in the water from
accumulating in the steam generators and increasing corrosion rates in the secondary side.
Blockages are common with these resin bead filters and are usually fixed easily, but in this case
the usual method of separating out the resin plug with compressed air did not succeed. The
operators continued to try to clear this blockage for 11 hours, and the compressed air blown into
the feed system in trying to resolve the blockage caused a large water hammer in the system. This
water hammer caused the feedwater pumps and condensate pumps to shut down, which then
immediately resulted in a turbine trip.
With the steam generators no longer receiving feedwater, heat and pressure increased in the
reactor coolant system (primary circuit), causing the reactor to perform an emergency shutdown.
Within eight seconds, control rods were inserted into the core to halt the nuclear chain reaction.
The reactor continued to generate decay heat and, because steam was no longer being used by
the turbine, heat was no longer being removed from the reactor's primary water loop.
Once the secondary circuit feedwater pumps stopped, the three auxiliary feed pumps activated
automatically. However, because their valves had been closed for routine maintenance, they were
unable to pump any water in to the system. The closure of these valves was a violation of a key
Nuclear Regulatory Commission rule, according to which the reactor must be shut down if all
auxiliary feed pumps were isolated for maintenance.
The loss of heat removal from the primary loop and the failure of the auxiliary system to activate
caused the primary loop pressure to increase, triggering the pilot-operated relief valve (PORV)
between the pressuriser and the pressurised relief tank to open automatically. The relief valve
should have closed when the excess pressure had been released, and the electric power to the
solenoid of the pilot line was automatically cut. However, the relief valve stuck open because of a
mechanical fault. The open valve permitted coolant water to escape from the primary system, and
this was the principal mechanical cause of the partial meltdown that followed.
2) Human Factors
Despite the relief valve being stuck open, a light on the control panel showed that the valve was
closed. In fact, the light did not indicate the physical position of the valve, only the status of the
electrical signal being delivered to the opening solenoid, thus giving false evidence of a closed
valve. The bulb was simply connected in parallel with the valve solenoid, implying that the PORV
was shut when it went dark, without actually verifying the real position of the valve. When
everything was operating correctly, the indication was true and the operators became used to
relying on it. However, when things went wrong and the main relief valve stuck open, the unlit
lamp was actually misleading the operators by implying that the valve was shut. This caused the
operators considerable confusion, because the pressure, temperature and coolant levels in the

primary circuit, so far as they could observe them via their instruments, were not behaving as they
would have if the PORV were shut. As a result of the PORV valve position indication, the
operators did not correctly diagnose the real problem for several hours. It was not until a fresh
shift came in that the problem was correctly identified. By this time major damage had occurred.
The operators had not been trained to understand the ambiguous nature of the PORV indicator
and to look for alternative confirmation that the main relief valve was closed. There was a
temperature indicator downstream of the PORV in the tail pipe (between the PORV and the
pressurised relief tank) that could have told them the valve was stuck open, by showing that the
temperature in the tail pipe remained higher than it should have been had the PORV been shut.
This temperature indicator, however, was not part of the "safety grade" suite of indicators
designed to be used after an incident, and the operators had not been trained to use it. Its
location on the back of the desk also meant that it was effectively out of sight of the operators.
3) Consequences of the stuck valve

As the pressure in the primary system continued to decrease, reactor coolant continued to flow,
but it was boiling inside the core. First, small bubbles of steam formed and immediately collapsed,
known as nucleate boiling. As the system pressure decreased further, steam pockets began to
form in the reactor coolant. This departure from nucleate boiling into the regime of "film boiling"
caused steam voids in coolant channels, blocking the flow of liquid coolant and greatly increasing
the fuel cladding temperature. The overall water level inside the pressurizer was rising despite the
loss of coolant through the open PORV, as the volume of these steam voids increased much more
quickly than coolant was lost. Because of the lack of a dedicated instrument to measure the level
of water in the core, operators judged the level of water in the core solely by the level in the
pressuriser. Since it was high, they assumed that the core was properly covered with coolant,
unaware that because of steam forming in the reactor vessel, the indicator provided misleading
readings. Indications of high water levels contributed to the confusion, as operators were
concerned about the primary loop "going solid," (i.e. no steam pocket buffer existing in the
pressuriser) which in training they had been instructed to never allow. This confusion was a key
contributor to the initial failure to recognize the accident as a loss-of-coolant accident, and led
operators to turn off the emergency core cooling pumps (which add coolant to the primary
system, and had automatically started after the PORV stuck and core coolant loss began) due to
fears the system was being overfilled.
With the PORV still open, the pressurised relief tank that collected the discharge from the PORV
overfilled, causing the containment building sump to fill and sound an alarm. This alarm, along
with higher than normal temperatures on the PORV discharge line and unusually high
containment building temperatures and pressures, were clear indications that there was an
ongoing loss-of-coolant accident, but these indications were initially ignored by operators. The
relief diaphragm of the pressurised relief tank ruptured, and radioactive coolant began to leak out
into the general containment building. This radioactive coolant was pumped from the
containment building sump to an auxiliary building, outside the main containment building.
After almost 80 minutes of slow temperature rise, the primary loop's four main reactor coolant
pumps began to cavitate and vibrate as a steam bubble/water mixture, rather than water, passed
through them. The pumps were shut down, and it was believed that natural circulation would

continue the water movement. However, steam in the system prevented water flow through the
core, and as the water stopped circulating it was converted to steam in increasing amounts.
About 130 minutes after the first malfunction, the top of the reactor core was exposed and the
intense heat caused a reaction to occur between the steam forming in the reactor core and the
Zircaloy nuclear fuel rod cladding, yielding zirconium dioxide, hydrogen, and additional heat. This
reaction melted the nuclear fuel rod cladding and damaged the fuel pellets, which released
radioactive isotopes to the reactor coolant, and produced hydrogen gas that is believed to have
caused a small explosion in the containment building later that afternoon.
There was then a shift change in the control room. A new arrival noticed that the temperature in
the PORV tail pipe and the holding tanks was excessive and used a backup valve – called a "block
valve" – to shut off the coolant venting via the PORV, but around 120 tonnes of coolant had
already leaked from the primary loop. It was not until 165 minutes after the start of the problem
that radiation alarms activated as contaminated water reached detectors; by that time, the
radiation levels in the primary coolant water were around 300 times expected levels, and the
plant was seriously contaminated.
A plant Supervisor now declared a site area emergency, and less than 30 minutes later the station
manager announced a general emergency, defined as having the "potential for serious radiological
consequences" to the general public.
It was still not clear to the control room staff that the primary loop water levels were low and that
over half of the core was exposed. A group of workers took manual readings from the
thermocouples and obtained a sample of primary loop water. Seven hours into the emergency,
new water was pumped into the primary loop and the backup relief valve was opened to reduce
pressure so that the loop could be filled with water. After 16 hours, the primary loop pumps were
turned on once again, and the core temperature began to fall. A large part of the core had melted,
and the system was dangerously contaminated.

Report on the investigation into the contact
made by the tanker
Vallermosa,
with the tankers
Navion Fennia and BW Orinoco at the

Fawley Marine Terminal
on 25 February 2009
Marine Accident Investigation Branch

Mountbatten House
Grosvenor Square
Southampton
United Kingdom
SO15 2JU
Report No 23/2009
November 2009
©2018 CAE Training & Services UK Ltd 37 AllReserved

All Rights Rights Reserved
arrative
1.2.1 Background
The oil product and chemical tanker Vallermosa was chartered to BP Oil UK Limited
(BP) to carry a cargo of 35,000t of Jet Fuel A1 from Rotterdam to BP Hamble
Terminal’s jetty (BPJ) in Southampton Water.
Vallermosa completed loading in Rotterdam at 0106 CET on 24 February, and the ship
cleared harbour at 0648 that morning. Following an uneventful voyage, the vessel
anchored at 2212 the same day at the Nab Anchorage No.10, south-east of the Isle of
Wight (Figure 1)1, to await her berth at the next high water.
1.2.2 Weather and tidal data

Vallermosa was scheduled to berth alongside BPJ at high water, predicted for 1101
on 25 February 2009, 4.4m above Chart Datum, 2 days before spring tides. The wind
was west-south-west at around 8 to 10 kts, with good visibility.
Vallermosa experienced a following tidal flow of around 1.0 kt as she entered the Thorn
Channel, which reduced during the remaining passage to approximately 0.5 kt.
1.2.3 Events leading to the accident

The BP Hamble Terminal marine supervisor, who normally ensured that customs
documentation was correct, was on leave at the time and this task had been delegated
to the terminal’s loading master. He arrived at BPJ at around 0700 on 25 February. He
opened an email from the customs agent, received at 1612 the previous evening, which
requested confirmation of the cargo’s country of origin, and replied stating that the
cargo originated in Rotterdam.
At 0736 Vallermosa departed the anchorage for the 21nm passage to the berth. The
master conned the ship east of Nab Tower to embark the pilot, and at 0800 the third
officer (3/O) took over from the chief officer as the officer of the watch (OOW).
At 0820, the pilot embarked Vallermosa, arriving on the bridge at 0824. The pilot
explained to the master that the vessel would berth at high water, port
side alongside, and that two tugs had been booked to provide assistance during the
berthing operation. The pilot handed the master a copy of the ABP Southampton Port
Passage Plan and Pilotage Document (Figure 2) showing the expected passage times,
under keel clearances and expected tidal streams; the master then signed the Pilotage
Document. The master informed the pilot that Vallermosa had a draught of 10.8m, was
fitted with a Becker rudder, an 800kW bow thruster and that, when the engine was
operated astern, the vessel would be affected by transverse thrust. The master passed
a copy of the Pilot Card
(Figure 3) to the pilot, which he then signed.

AIS data courtesy of MCA
Reproduced from Admiralty Chart BA 2450 by permission of
the Controller of HMSO and the UK Hydrographic Office
©2018 CAE Training & Services UK Ltd

39
1 Figures 1 and 5 indicate the vessel’s position at the times stated within the narrative.
Figure 1
All Rights Reserved

Route taken by Vallermosa
40
All Rights Reserved
Figure 2
ABP Southampton Port Passage Plan (left) and Pilotage Document (right)
41
All Rights Reserved
Figure 2
ABP Southampton Port Passage Plan (left) and Pilotage Document (right)
Figure 3
Pilot Card from Vallermosa

As Vallermosa proceeded inbound, the bridge was manned by the master, the 3/O, a
cadet and a helmsman. The cadet was plotting the vessel’s position on the paper
chart, the 3/O was responding to the pilot’s engine instructions, and the helmsman
steered the vessel to the pilot’s orders. The pilot was standing
by the starboard radar display (Figure 4). The master remained on the bridge
throughout and allowed the pilot to con the ship.
Figure 4
Pilot’s position next to the starboard radar display
Although Vallermosa was fitted with an Electronic Chart System (ECS), the paper
chart remained the primary means of navigation. The vessel’s position was
monitored by visual and radar navigation and plotted on the paper chart. The ECS
was not monitored during the passage, and the display did not show Vallermosa’s
position from the time the vessel turned into the Thorn Channel.
At 0828 the pilot ordered full manoeuvring speed of 13.5 kts for the initial
passage in the Solent.
At 0845 the pilot conducted the first turn in the Solent; the ship turned as expected,
and neither pilot nor master commented on the manoeuvre. At 0908, with the
speed through the water (STW) of 13 kts2, the pilot ordered the
2 Vallermosa’s speed through the water is used throughout the narrative . Ground speed, shown in the figures and
taken from AIS, is greater than water speed by around 1 knot, reducing to 0.5 knot as the flood tidal stream
diminished during the passage.
main engine to half ahead. As the vessel passed the entrance to Portsmouth
Harbour, the pilot and master discussed in more detail the berthing plan and the
mooring lines required to secure the vessel. The pilot also observed that he
expected to hear from the BPJ personnel shortly to confirm the berthing plan.
At 0926 a customs agent queried the origin of Vallermosa’s cargo and the customs
paperwork provided. The origin of the cargo had been declared as “Rotterdam” on
a customs form that was designed to be used for cargoes originating from outside
the European Union.
At around 0940, as Vallermosa passed the Mother Bank buoy, the BP Hamble Terminal
marine superintendent telephoned the Southampton Vessel Traffic Services (VTS)
watch manager, and informed him that Vallermosa’s berthing might be aborted as the
correct paperwork for the cargo had not been received. The watch manager informed
the marine superintendent that any decision to abort would need to be taken within
the next 15 minutes to enable Vallermosa to be diverted to an anchorage north of the
Ryde Middle Buoy before she entered the Thorn Channel.
At around 0950, the Svitzer tugs booked to assist Vallermosa’s arrival, Svitzer Sarah
and Lyndhurst, departed Dock Head in order to meet the vessel west of the Hook
buoy.
At 0954 an email was sent from BP’s London office to the BP Hamble Terminal marine
superintendent, which stated that the required certificate of origin for Vallermosa’s
cargo would be sent “in the next 10 minutes”.
At 1010, as Vallermosa approached the West Bramble Buoy, her speed was 9.4 kts,
and the pilot ordered the main engine to full ahead to increase the water flow over
the rudder and execute a broad turn to starboard into the Thorn Channel. During the
turn no discussions were held between master and pilot regarding either the turn or
the handling characteristics of the vessel.
At 1016, the marine superintendent sent an email to the BP Jet desk3 in London
stating that Vallermosa’s berthing had been aborted due to improper
documentation, and then told the loading master to advise Vallermosa by VHF radio
of the decision to abort and that the vessel should return to anchor.
Vallermosa continued to turn into the Thorn Channel and, at 1018, the pilot ordered
the main engine to half ahead. As the ship entered the Thorn Channel the BP Hamble
Terminal loading master called Vallermosa and advised the pilot that, due to incorrect
paperwork, Vallermosa’s berthing was aborted and that he should return the ship to
the Nab anchorage. The pilot requested that the transmission be repeated as he had
expected to hear the routine berthing information, and to allow the master, who had
not heard the original message,
3 The BP Jet desk coordinates the transportation and delivery of jet fuel bought and sold by BP jet fuel
brokers.

to listen. The information was then repeated. The pilot requested that the ship’s agent
be contacted so that the decision to abort could be formally passed to the master.
At 1021, once Vallermosa had completed the turn and was steady on a course of 040º
(Figure 5), the pilot called Southampton VTS to confirm that the vessel was required to
return to anchor. The Vessel Traffic Services Officer (VTSO) confirmed the information
and explained that the vessel should return to the Nab anchorage, rather than the
closer Ryde Middle anchorages, as the time required to rectify the paperwork problem
was unknown.
The pilot then asked the VTS watch manager whether the tugs had been advised
that they were no longer required, and was informed that they had
not. The pilot checked with the master whether, as Vallermosa was fitted with a
Becker rudder and bow thruster, he thought that tugs would be necessary to assist
when turning the vessel to head seaward. The master replied that tugs
were not necessary, and the pilot agreed with him. The pilot then confirmed to the
VTSO that the tugs were not required, and that he would inform them of this.
The pilot, frustrated by the instruction to abort the berthing, remarked to the master
that they should have been advised of the decision much earlier, or even before the
pilot had embarked.
At 1023, with the vessel making 9.5 kts, the pilot ordered the main engine to slow
ahead, for a speed of 6 kts. The pilot then called the harbour tug Svitzer Sarah on VHF
radio and advised the skipper that the berthing had been aborted and that the tug was
not required. Svitzer Sarah’s skipper offered to stand by until Vallermosa had been
turned to face seaward. The pilot declined his offer, and then replied to a radio call
from Lyndhurst’s skipper and confirmed that his tug was also not required.
Although the master had heard the various VHF exchanges concerning
the change to the plan, the pilot again briefed him that he planned to turn
Vallermosa off the Fawley Marine Terminal jetty and return to the Nab anchorage.
The master then discussed the tug cancellation and the changed plan with the ship’s
agent by mobile phone.
At 1026, the vessel was approaching Calshot Spit at 8.8 kts. The pilot ordered the
main engine to half ahead to assist the turn, and then ordered the rudder to port 5º.
At 1028, the pilot ordered the main engine speed to full ahead as Vallermosa started
to turn into Calshot Reach.
At 1029, the BP Hamble Terminal marine superintendent received another certificate of

origin for Vallermosa’s cargo, which was forwarded to BP’s customs agent. The customs
agent subsequently replied that this certificate was acceptable.
As Vallermosa turned around Calshot Spit, her speed increased to 9.5 kts.

AIS data courtesy of MCA
Reproduced from Admiralty Chart BA 2036 by permission of
the Controller of HMSO and the UK Hydrographic Office

46
Figure 5
All Rights Reserved

Route taken by Vallermosa
At 1033, as the pilot ordered the helmsman to steady on a course of 318º into
Southampton Water, he realised that the ship’s speed was 10.5 kts, contrary to his
plan, which called for the vessel to be proceeding at 4-5 kts at this point.
At 1034 the pilot reduced the main engine speed to half ahead as Vallermosa
approached the VTS reporting point at the Hook buoy, 1nm from the southern end of
the Fawley Marine Terminal. At 1035, the pilot reported to VTS as the vessel passed
the Hook buoy, and the VTSO acknowledged his call. The pilot ordered the main
engine to slow ahead at 1036, followed 30 seconds later by dead slow ahead. At
1037, the engine was ordered to stop, with the vessel travelling at 10.0 kts, and
steady on a course of 320º.
Neither the master nor the bridge officers voiced any concern over Vallermosa’s speed,
and the pilot did not bring the vessel’s unexpectedly high speed to their attention.
At 1038, the VTSO called Vallermosa and advised the pilot that Bravo anchorage,
which was closer than the previously agreed Nab anchorage, was available. Initially
the pilot asked the master to wait to be shown the new anchorage until after the turn
off Fawley Marine Terminal had been completed. The pilot then changed his mind,
and requested the master’s chart so that he could show him the position of the new
anchorage. During this conversation Vallermosa started to swing to starboard, and
the helmsman increased the port helm in an attempt to return the vessel to the
required heading. When the rudder was at 35º to port the helmsman advised the
pilot that the wheel was hard over and the ship was not responding to the helm. The
pilot ordered the main engine to dead slow ahead, and the wheel held hard to port.
At 1039, 3 cables from Fawley Marine Terminal, and at a speed of 8.0 kts, Vallermosa
started to swing to port. The pilot ordered the main engine to stop and the wheel to
amidships, and 30 seconds later the main engine to dead slow astern. The pilot then
asked the master to confirm that the bow would swing to starboard if the engine was
operated astern. The master confirmed this, and the pilot ordered the main engine to
slow astern as the rate of turn to port increased to 18º per minute.
At 1040, as the rate of turn did not decrease as expected, the pilot realised that the
expected transverse thrust was not developing. The pilot then ordered the main
engine to stop, the wheel hard to starboard, and then the main engine to dead slow
ahead. At 1041, with Vallermosa 1 cable from the southern end of Fawley Marine
Terminal, at a speed of 7 kts, the pilot ordered the bow thrust full to starboard. As the
ship continued to swing to port, now at 20º per minute, the pilot ordered the main
engine to dead slow ahead, and instructed that the Becker rudder should be used at
50º to starboard and then full over to 65º, which was repeated by the master. The
pilot then ordered the main engine to slow ahead.

The Fawley Marine Terminal jetty supervisor saw Vallermosa approaching and called
Navion Fennia’s OOW by VHF radio to advise him to stop pumping cargo immediately.
He then repeated this message to the OOW of BW Orinoco.
The VTSO, aware that Vallermosa was close to Fawley Marine Terminal,
contacted the Fawley Marine Terminal marine controller by telephone and
alerted him to the vessel’s presence.
At 1042, the pilot asked the master whether the anchors were ready to let go, and the
master instructed the anchor party to stand by. The pilot ordered both anchors let go,
the main engine to stop and, immediately after, the main engine to full astern. The
rudder was held at 65º to starboard as both anchors were let go. The pilot then
confirmed the full astern engine order and instructed the master to ensure that the
anchors were held. He then ordered the rudder to amidships.
At 1043, Vallermosa’s speed had reduced to 5.5 kts as the vessel made contact with
Navion Fennia, berthed at Fawley Marine Terminal berth 5, causing a large flash as the
two ships touched. Navion Fennia’s OOW stopped discharging cargo by activating the
cargo pump emergency stops following the contact. BW Orinoco’s OOW predicted that
contact was imminent, and stopped discharging cargo before Vallermosa struck the
vessel’s stern. BW Orinoco, berthed at Fawley Marine Terminal berth 4, was pushed
forward by the force of the contact, which parted two forward spring mooring lines and
caused the shore gangway to collapse on to the vessel’s deck.
As Vallermosa’s speed reduced, the pilot ordered the main engine to slow astern
and the bow thrust stopped. The Solent Towage operated tugs Tenax, Phenix, Apex
and Thrax, stationed at Fawley Marine Terminal, left their berth to assist. As
Vallermosa’s stern lifted from the jetty, two of BW Orinoco’s four cargo hoses split
and an estimated 600L of jet fuel leaked onto the jetty and then down and into the
Solent. BW Orinoco’s master sounded the vessel’s general alarm and contacted VTS
for assistance.
1.2.4 Post accident

The tug Tenax assisted and then stood by as Vallermosa moved astern from Fawley
Marine Terminal and clear of the berthed vessels. The tugs Phenix, Apex and Thrax
pushed BW Orinoco alongside the jetty and held her in position while the cargo
hoses and mooring lines were re-secured. During this movement, Svitzer tug
Lyndhurst advised Vallermosa that VTS had given permission for the vessel to berth
alongside BPJ.
The spilt jet fuel was quickly dispersed by the propeller wash from the tugs. The VTS
watch manager contacted Solent Coastguard and the Environment Agency to advise
them of the situation.

BRM New Case Studies Booklet 2019 Student Version PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

BRM New Case Studies Booklet 2019 Student Version PDF

Uploaded by

Copyright:

Available Formats

Maritime Crew Resource Management

Revision 2, March 2019

For Training Purposes Only ©2018

©2018 CAE Training & Services UK Ltd 1 All Rights Reserved

Case study introduction 3

©2018 CAE Training & Services UK Ltd 2 All Rights Reserved

©2018 CAE Training & Services UK Ltd 3 All Rights Reserved

©2018 CAE Training & Services UK Ltd 4 All Rights Reserved

©2018 CAE Training & Services UK Ltd 5 All Rights Reserved

©2018 CAE Training & Services UK Ltd 6 All Rights Reserved

©2018 CAE Training & Services UK Ltd 7 All Rights Reserved

Rugiati was angry, which surprised Bonﬁglio.

Captain: “What? You changed course without consulting me?”

©2018 CAE Training & Services UK Ltd 8 All Rights Reserved

Coccio checked the radar.

Coccio: “Captain, there are two ﬁshing vessels ahead.” “Yes,”

©2018 CAE Training & Services UK Ltd 9 All Rights Reserved

“Julio, here. Captain, are you ready for breakfast?”

©2018 CAE Training & Services UK Ltd 10 All Rights Reserved

©2018 CAE Training & Services UK Ltd 11 All Rights Reserved

©2018 CAE Training & Services UK Ltd 12 All Rights Reserved

AAIB Air Accident Investigation Branch

ABP Able Bodied Person

AFRS Air Field Rescue Service

ATC Air Traffic Control

FL030 Flight Level 030 (3000 feet)

FMS Flight Management System

NDB Non Directional Beacon: An airfield marker beacon

NITS Nature, Intentions, Timings and Special instructions briefing

SCCM Senior Cabin Crew Member

V1 Engine Failure Recognition Speed

VREF Landing Reference Speed

History of the flight

©2018 CAE Training & Services UK Ltd 13 All Rights Reserved

©2018 CAE Training & Services UK Ltd 14 All Rights Reserved

©2018 CAE Training & Services UK Ltd 15 All Rights Reserved

©2018 CAE Training & Services UK Ltd 16 All Rights Reserved

©2018 CAE Training & Services UK Ltd 17 All Rights Reserved

Examinations, Tests and Analysis

©2018 CAE Training & Services UK Ltd 18 All Rights Reserved

©2018 CAE Training & Services UK Ltd 19 All Rights Reserved

©2018 CAE Training & Services UK Ltd 20 All Rights Reserved

©2018 CAE Training & Services UK Ltd 21 All Rights Reserved

©2018 CAE Training & Services UK Ltd 22 All Rights Reserved

Running out of fuel

©2018 CAE Training & Services UK Ltd 24 All Rights Reserved

©2018 CAE Training & Services UK Ltd 25 All Rights Reserved

Fuel quantity indicator system

©2018 CAE Training & Services UK Ltd 26 All Rights Reserved

Due to this unreliability, it had become procedure for flights to be authorised by

©2018 CAE Training & Services UK Ltd 27 All Rights Reserved

©2018 CAE Training & Services UK Ltd 28 All Rights Reserved

©2018 CAE Training & Services UK Ltd 29 All Rights Reserved

©2018 CAE Training & Services UK Ltd 30 All Rights Reserved

©2018 CAE Training & Services UK Ltd 31 All Rights Reserved

©2018 CAE Training & Services UK Ltd 33 All Rights Reserved

©2018 CAE Training & Services UK Ltd 34 All Rights Reserved

3) Consequences of the stuck valve

©2018 CAE Training & Services UK Ltd 35 All Rights Reserved

©2018 CAE Training & Services UK Ltd 36 All Rights Reserved

made by the tanker

Navion Fennia and BW Orinoco at the

Marine Accident Investigation Branch