Boiler Rupture on Bahamian Cruise Ship S/S Norway
|Vessel:||Bahamas-registered passenger vessel S/S Norway|
|Piers 1 and 2, Miami, Florida|
|May 25, 2003|
|0637 eastern daylight time 1|
|Norwegian Cruise Line|
|Passengers: none Crew: 8 fatalities; 10 serious injuries; 7 minor injuries|
At 0637 on May 25, 2003, the Bahamas-registered passenger vessel S/S Norway (figure 1), with 911 crewmembers and 2,135 passengers on board, 2 suffered a boiler rupture in the aft boiler room. The accident occurred about an hour after the vessel had moored in Miami, Florida, at the end of a 7-day Caribbean cruise. As a result of the accident, 8 crewmembers sustained fatal injuries, 10 suffered serious injuries, and 7 received minor injuries. 3 No passengers were injured.
Figure 1. In 2003, the 43-year-old Norway (originally the S/S France) was one of the last of the steam-driven cruise ships operating out of U.S. ports. After the accident, the ship was removed from service and later sold for scrap.
The Norway, owned and operated by Norwegian Cruise Line (NCL), was a conventional welded, steel-hulled liner, certificated for unrestricted international voyages. The ship met the regulations of the International Convention for the Safety of Life at Sea, 1960 (SOLAS 60), and the International Convention on Load Lines, 1966. After various upgrades in 1980, the vessel met the standards of the 1974 SOLAS Convention (SOLAS 74).
The Norway was built by Chantiers de l’Atlantique (Penhoët-Loire) in Saint-Nazaire, France, and originally sailed under the French flag as the S/S France. When launched in 1960, the France was the longest oceangoing liner in the world. The France operated primarily in the trans-Atlantic trade from the time of its construction until 1974. In 1979, the liner was sold to Klosters Rederi A/S, 4 one of Norway’s oldest shipping companies. Klosters had the vessel overhauled for its Caribbean cruising operations, which was run by its subsidiary, Norwegian Caribbean Lines. 5 Klosters renamed the vessel the S/S Norway in 1979 and registered it in Norway. Beginning in 1980, the Norway operated on Caribbean cruises that originated at Miami, and in 1987, the vessel was reflagged to the Bahamas flag. In October 2000, Star Cruises, 6 NCL’s parent company, announced that the Norway would be relocated to the Asian market, a decision that was later reversed.
The National Transportation Safety Board investigated the Norway accident under the authority of the Independent Safety Board Act of 1974 and according to Safety Board rules. The designated parties to the investigation were the U.S. Coast Guard; NCL; Bureau Veritas (BV), the classification society that inspected the Norway; 7 Bahamas Maritime Authority, the vessel’s flag state; Siemens, the manufacturer of the vessel’s boiler control and monitoring system; and Lloyd Werft Shipyard, which performed or contracted out boiler repairs in Bremerhaven, Germany, in 1987 and 1990.
In investigating the cause of the boiler rupture, the Safety Board reviewed the boiler repair history recorded in various company and classification society documents over the last 40 years (see “Boiler History” section). The Board also examined the operating practices and inspection procedures that affected boiler safety (see “Factors Affecting Boiler Life”). Representatives of the parties cooperated with the Board in its postaccident investigation (see “Postaccident Investigation and Findings”).
About 0400 on May 25, 2003, while the Norway was inbound through the channels leading to the Port of Miami (figure 2), the engineering watch changed. The second engineer, who was going off duty, said that he told his relief that there was nothing out of the ordinary to report about the boilers and that “all conditions were normal.”
At 0529, the Norway moored at its berth at piers 1 and 2 on Dodge Island, the bridge watch ordered “finished with main turbines,” and the engineroom watch began to shut down the propulsion system in preparation for the ship’s port stay. The vessel’s four main propulsion boilers were located on the engine deck (deck No. 2; see figures 3 and 4), in the next-to-aftermost main vertical zone. 8
By 0600, the Norway was secured alongside the pier and crewmembers were starting the in-port routine, which included rigging gangways, discharging garbage, fueling, provisioning, offloading passenger baggage, and disembarking passengers. In the aft engine/boiler room, the watch was reduced from seven to six crewmembers when one of the second engineers received permission to leave before the end of the watch. 9 On the Biscayne deck (deck No. 5), the second engineer was monitoring the boiler gauges and instruments in the engine control room aft of the boiler room (figure 5). He later stated, “All was normal.” No alarms were indicated, and he heard only “normal engine/boiler room sounds.” At the time, boiler No. 21 was not operating and boiler Nos. 22, 23, and 24 were operating and providing steam to vessel systems. The remaining five boiler room watchstanders were in the aft boiler room or in spaces next to it.
Figure 2. Overall schematic of Port of Miami.
Figure 4. Plan view of decks 2 through 5 on Norway.
Figure 5. Layout of Norway’s aft boiler room, where boiler No. 23 ruptured (from copy of original drawing of S/S France boiler arrangement provided by NCL). Boilers were numbered to indicate whether they were in the forward (1) or aft (2) boiler room. Thus, No. 23 indicated the third boiler in the aft boiler room. The forward boilers were removed when the France was overhauled and renamed the Norway.
About 0637, a boiler ruptured in the aft boiler room. The second engineer in the engine control room and other crewmembers said that they heard a “bang” and felt the vessel shake. Some crewmembers said they thought that something had struck the side of the vessel; others said they thought that a bomb had detonated. The second engineer who had gone off watch said that he was outside on the Olympic deck (deck No. 11) when he heard the bang, looked up to see “lots of black smoke from the aft smoke stack,” and knew that “something had gone very wrong in the boiler room.”
Boiler No. 23, located on the starboard side of the boiler room, had ruptured. The boiler contained about 20 tons of water operating at a temperature of about 528º F under a pressure of about 60 bar (870 pounds per square inch [psi]) 10). In the normal atmospheric pressure of the aft boiler room (14.7 psi), the pressurized hot water rapidly expanded in volume about 1,260 times into steam. 11 The expanding steam, mixed with smoke, soot, and debris, swept through the engineering spaces, fatally injuring four engineering crewmembers who were on watch or on duty in or near the boiler room, as well as four other crewmembers who were in the crew living spaces on the starboard side of the Caribbean deck, next to the boiler room.
Because of the height of the boilers (about 30 feet), the aft boiler room space extended from deck No. 2 to deck No. 4 (Caribbean deck). The Caribbean deck was the first level having living quarters—in this case, crew rooms forward, immediately outboard, and aft of the boiler room (figure 4). The boiler casing continued upward through the remaining decks, allowing the exhaust from the boilers to vent to the outside air through the aft smokestack.
As the steam rose through the aft boiler room, it broke through the bulkheads on the starboard side of the Caribbean deck (No. 4) and the Biscayne deck (No. 5), breaching the crew accommodation areas and scalding six crewmembers in their rooms or in the corridors of the accommodation spaces. Seven crewmembers were preparing to rig a garbage gangway out the side port of 12 the Biscayne deck when the steam entered the corridor near them. They sustained thermal burns on 6 to 20 percent of their bodies before escaping the scalding vapor by jumping overboard toward the pier, which was about 8 feet below the Biscayne deck. Three crewmembers who jumped from the side port landed in the water and four landed on the pier; one suffered a broken leg when he landed on the dock. A crewmember on vessel security detail at an aft gangway on the Biscayne deck suffered minor burns from the smoke and steam before he escaped down the gangway to the pier. In the 15 minutes immediately after the boiler rupture, about 125 crewmembers exited the ship using the Biscayne deck gangway.
At the time of the boiler rupture, a Miami-Dade police officer on routine patrol of the pier was within 100 feet of the Norway’s side port. He said that the blast momentarily stunned him, but that he recovered and immediately reported the accident and the injured crewmembers on the pier and in the water to his command, which alerted area response agencies. The police subsequently secured the pier area and did not allow anyone other than city response personnel to board the Norway, including crewmembers who had fled the ship and later attempted to reboard.
In the meantime, on board the Norway, some of the injured crewmembers made their way to safety, including two men who took shelter in the main galley on the Atlantic deck (deck No. 6). The galley staff on duty immediately called the bridge to request medical help, thus alerting the bridge watch about the crew injuries. Within 5 minutes of the rupture, the bridge watch ordered the fire watch and emergency teams to muster. 13 Ten minutes later, the master made a public address directing the passengers to their lifeboat muster stations. Table 1 chronicles the documented emergency response actions by shoreside agencies and shipboard personnel.
Table 1. Chronology of emergency activities.
After the accident, the shoreside response agencies and NCL critiqued the emergency response activities of their personnel and made procedural changes based on the findings of their reviews. A discussion of their actions is found in the “Postaccident Actions by Parties” section of this brief.
The damaged Norway was towed to Germany, arriving in Bremerhaven on September 23, 2003. The ship remained moored at Bremerhaven awaiting a decision on whether it would be repaired and returned to service or taken out of service. In March 2004, NCL announced that the Norway would not be returned to service and transferred ownership of the vessel to its parent company, Star Cruises, for eventual scrapping. The Norway was the only steam vessel operated by NCL.
The Norway’s boilers were water-tube, modified D-type 14 units (figure 6). The boilers produced steam at about 60 bar (870 psi) pressure from water that was heated by oil-fired furnaces. The water was carried in tubes surrounding the furnace area (combustion chamber). Combustion air was routed from forced-draft fans to the five burners (fed with heavy fuel oil) fitted on the front of each burner.
The Norway’s boilers had an upper steam drum, a lower water drum, and a waterwall header. The waterwall header (where the failure occurred in the accident) was about 29 inches in diameter and had manholes at each end. The drums and header connected the various banks of tubes surrounding the furnace area. The outer surfaces of the boiler were kept cool by waterwall tubes and refractory materials suitable for high temperatures, 15 all of which were enclosed in an air-cooled steel casing.
The steam drum served as the upper interface between the steam and the water. Steam traveled from the steam drum through an outlet pipe at the top to another set of tubes called the superheater. The superheater further raised the steam’s temperature and thus its energy level. 16 Superheated steam went to the ship’s main propulsion turbines and auxiliary turbines. The turbines converted the thermal energy of the steam into mechanical energy and drove the Norway’s propellers and electrical generators. Steam at lower pressures and temperatures also heated the boiler’s fuel oil, produced distilled water, and warmed the ship’s living and work spaces, among other uses.
Figure 6. Boiler cross section. The Norway’s boilers had three separate drums that were interconnected with steel tubes to exchange heat with the furnace to produce steam—the steam drum, the water (or mud) drum, and the waterwall header. The waterwall was a series of vertical tubes that lined the furnace wall. At the base of the waterwall was its header (drum). Each boiler measured about 30 feet high, 25 feet wide, and 20 feet deep.
Most of the steam was produced in the generating tubes, which surrounded the furnace and absorbed heat from the burning fuel. The generating tubes were arranged in rows at high angles of inclination to accelerate the natural circulation of water in the boiler between the steam drum and the water drum. The system also contained other tubes, including screen tubes (which protected the superheater tubes and generating tubes from direct exposure to the radiant heat of the burners), waterwall tubes and floor tubes (which cooled the boundaries of the furnace), and downcomer tubes (which ran outside the furnace area to ensure downward circulation of lower-temperature water between the drums). Most of the tubes were 1 to 3 inches in diameter. The largest tubes were the downcomer tubes, about 4 inches in diameter.
The steam output flow rate was regulated by controlling the fuel oil pressure to the burners and by varying the number of burners in operation. Combustion gases leaving the furnace were routed across screen tubes, superheater tubes, generating tubes, and economizer tubes before passing upward through the exhaust duct and away from the ship at the top of the smokestack.
The boilers were fitted with an electronic automatic control system and an electronic boiler management system. Besides automatically lighting and shutting down the boilers and burners (the burners could also be started and stopped manually), the boiler management system would automatically shut down the boiler or burners when critical parameters (such as steam pressure or steam drum water level) exceeded safe limits or when a burner failed. The boilers were also equipped with a remote monitoring and alarm system, and each boiler had three safety valves—two at the top of the steam drum and one at the superheater outlet—to protect against overpressurization. 17
The Norway’s boilers operated as part of the steam cycle—a closed cycle in which used steam is condensed and returned to the boilers as feedwater to generate more steam. The steam cycle has four phases: generation, expansion, condensation, and feed (figure 7).
In the generation phase of the steam cycle, the chemical energy of fuel oil is converted into thermal energy (steam). In the expansion phase, the steam enters the turbines, which convert its thermal energy to mechanical energy. Having lost most of its energy, the steam leaves the turbines at a very low pressure and a much lower temperature than when it entered.
The low-pressure steam then enters the condensation phase, in which a seawater-cooled condenser converts it from a vapor to a liquid at nearly vacuum pressure. The liquid goes to a condensate pump, which increases the pressure of the fluid and delivers it to a deaerating feedwater heater. Direct contact with steam heats the water and removes oxygen.
The heated and deaerated water (feedwater) goes to a feedwater pump, then through economizer tubes in the boiler’s exhaust duct. The economizer tubes heat the feedwater before it passes into the steam drum, and the steam cycle begins again.Figure 7. Schematic of the steam cycle, showing the main steps in which steam flowed from the Norway’s boilers to the turbines, after which it was condensed and returned as feedwater to the boilers, where it was reused to generate more steam.
Modification. As constructed, the vessel had eight main steam boilers (four in the forward boiler room and four in the aft boiler room) that powered four main propulsion turbines and steam auxiliaries and four propeller shafts. Between 1974 and 1979, the France was in lay-up status, during which the eight boilers in the forward and aft boiler rooms were preserved as stipulated by BV, its classification society. During the vessel’s 1979 overhaul for use on Caribbean cruises, the four boilers in the forward engineroom and two of the propellers were removed, in anticipation of voyages not requiring high transoceanic operating speeds.
Some boiler features were also upgraded and other features installed to enhance the safety of operations, including a remote monitoring and alarm system to alert engineers of abnormal conditions, an electronic automatic control system, and an electronic boiler management system. The management system had chart recorders that continuously captured several monitored parameters, including steam drum water level, steam drum pressure, burner fuel oil pressure, fuel oil flow rate, superheater steam pressure, and superheater steam flow rate. In addition, various automatic safety shutdowns, in case of low water level in the boiler steam drum or high steam pressure, for example, were fitted to protect personnel and equipment from damage.
About September 1997, NCL contracted for a propulsion study to determine methods of achieving a 27-knot ship speed and the steam demanded by 80,000 shaft horsepower. The propulsion study report recommended that new, higher-capacity boilers and new booster propulsion units be installed to achieve the desired horsepower. About the same time, NCL also contracted with Harris Pye Marine, Ltd., a leading specialist in repairing marine boilers and associated steam systems, to assess the Norway’s boiler equipment. The contractor reported:
Although these boilers are around 40 years old and are currently suffering from on-going tube failures, there is no report of the main components—i.e., headers or drums–having any Conditions of Class 18 put on them. It is known that various defects have been noted in and attended to in the past, but we would not suggest that this precludes these components from many more useful years work, once the deteriorating tubes have been addressed. . . .
In November 1997, the port engineer at the time wrote to the NCL executive vice president, cruise operations: “The boilers on the S/S Norway have reached a state where a decision must be made.” He recommended a number of options for addressing the problems, including, but not limited to, replacing the old boilers, completely retubing the old boilers with new economizers, and installing new automation.
On November 19, 1997, NCL’s executive vice president, cruise operations, wrote in an interoffice memo that the company would begin a retubing program on the Norway “next year.” Major overhauls of the boilers began in November 1998 with the retubing of both the upper and the lower economizers. In May 1999, the tube bank in the furnace area was retubed, and in 2002, the secondary superheater was retubed.
Defects and Repairs. To determine the nature and scope of past problems with the boilers, Safety Board staff obtained copies of various company and classification society documents over the previous 40 years to review the repair history of the boilers. Company reports and classification society surveys documented instances of cracking, corrosion, pitting, and tube failures throughout the history of the ship’s boilers (tables 2 and 3). 19 The documents indicate that as early as December 1970, cracks were observed in the longitudinal welds of the waterwall headers, water drums, and steam drums of all four boilers. The documents also indicate that the longitudinal welds on the header of boiler No. 23 (the boiler that ruptured) were last weld-repaired in 1990.
The boiler drums were periodically monitored by visual and nondestructive testing 20 methods, and detected cracks were removed by grinding. When cracks extended below the minimum allowable wall thickness, they were ground off, and weld repairs built the walls back up. The engineering company Deutsche Babcock specified the welding procedure, which BV approved. Lloyd Werft or its subcontractor performed the weld repairs while the ship was in drydock in Bremerhaven in 1987 and 1990.
Table 2. Documented boiler cracks and corrosion during vessel history.
No documents were found indicating that cracks were found or repaired after 1996. A former port engineer told investigators that his practice had been to have the boilers periodically inspected for cracks, but that such inspections did not take place during the 1999 shipyard period, his last year of employment with NCL. NCL’s Miami port engineer at the time of the accident declined on the advice of legal counsel to be interviewed by the Safety Board.
Table 3. Documented tube defects and corrective action during vessel history.
Marine boilers have an estimated design life, 21 and the degree of material fatigue they sustain is affected by how they are operated, how well they are maintained, and how often and how well they are inspected and repaired. The Safety Board reviewed the written operating practices of NCL and BV and interviewed past and present company representatives to determine the effectiveness of stated and actual operations. Investigators addressed a number of practices; the discussion below summarizes findings in the areas of written guidance, startup and shutdown protocols, cycling, water testing and treatment, maintenance and cleaning, and inspections.
Written Guidance. The original boiler manuals issued by the vessel manufacturer 22 included detailed instructions for operation and maintenance designed to minimize thermal stresses and the potential for material degradation, such as cracking and corrosive pitting, and component breakdown, such as water tube failures and leaks.
NCL’s procedures for managing the Norway’s engineering equipment were formalized in 1998, as required by the International Management Code for the Safe Operation of Ships and for Pollution Prevention (International Safety Management Code, or ISM code). 23 The stated objective of the NCL safety and environmental management system (SEMS) was “to ensure that conditions, activities, and tasks both ashore and onboard essential for the safety and protection of the passengers, crew, ship and the environment, are carried out under controlled conditions.” NCL SEMS procedure J100 stated:
This ship is to be maintained in compliance with applicable Flag State, Classification, International and Local Rules and Regulations at all times. A Planned Maintenance System, AMOS-D, forms the basis for the onboard maintenance program for equipment and systems, additionally, there shall be an ongoing maintenance program kept up to date both for corrosion control purposes and to present the vessel in a first class condition at all times.
NCL used AMOS, a computer-based preventive maintenance program, to plan and document maintenance actions for all equipment, including the boilers. The computer-based program did not contain a procedure for boiler inspection and cleaning. The original boiler manual states that the “frequency of cleaning cannot be laid down in any precise manner” but recommends that cleanings should not be carried out more often than every 3,000 hours. 24 At the shipboard level, the chief engineer and his staff managed the Norway’s engineering equipment. The senior first engineer was responsible for maintaining AMOS. 25
Startup and Shutdown Protocols. During the startup, also called “light-off,” and shutdown of a steam boiler, pressure and temperature changes cause bending and alternating stresses in the various boiler components, such as drums and headers. All marine boilers are designed to accommodate thermal and mechanical stresses. In the case of the Norway boilers, the waterwall header, the water drum, and the inboard side of each boiler had structural supports at the front and the rear. In addition, the structural foundation of each boiler was supported by a “sliding foot,” a design arrangement that allowed the boiler to expand as it heated up during light-off and to contract when it was cooling off during shutdown. 26
Maintenance records indicate that the boilers had experienced problems with the condition of the sliding feet on at least two occasions before the accident. In January 2003, the Harris Pye inspector reported that “the sliding feet [of boiler No. 24] showed no indication of movement” and “no signs of lubrication.” A sliding foot that cannot move is termed a “frozen foot” and can cause high stresses on the boiler and the ship’s structure because it restricts boiler expansion. NCL records show that maintenance was performed on “not working” feet of unidentified boilers 2 weeks before the rupture.
Major marine industry entities involved with steam boilers, including the U.S. Navy, classification societies, and boiler manufacturers, have published instructions indicating that care must be taken during light-off and shutdown to mitigate thermal stresses on a boiler. The machinery operation and maintenance guide issued by the vessel manufacturer specified proper procedures for starting up and shutting down its boilers. 27 During light-off, the manufacturer’s manual indicated that one or more of the unit’s burners should be fired at intervals until the pressure reached 8 bar (116 psi), after which continuous firing was allowed until the boiler reached a pressure of 60 bar (870 psi). 28 The manual states that reaching the recommended operating pressure requires “about 3 hours,” and that it is “advisable not to accelerate the procedure, and to allow the temperature to rise gradually.” The manual’s specified procedures for shutting down a boiler indicate that the superheater should not be filled with water until “the boiler has cooled down, about 48 hours after extinction [of fires].”
The Norway’s chief engineer had posted the company’s light-off and shutdown procedures in the boiler room for the engineering crew’s reference. The posted procedures did not specify a period for raising the steam pressure or for cooling down a boiler.
Safety Board investigators talked with several second engineers on the Norway. Their comments indicated that, in general, they followed the light-off procedures recommended by the manufacturer. A second engineer who had worked on board the Norway for about 4 years stated that he allowed a boiler to heat up “very slowly” by switching a burner on for 5 minutes and then off for 5 or 10 minutes during “the first hours,” and that this light-off process took about 10 hours. He stated, in part:
We used to start heating the boiler when we are in St. Thomas . . . about 8:00 in the morning . . . We start the process for . . . eight to nine hours, till we have full pressure. We do it very slowly. So, I may . . . switch on the burner for five . . . minutes and switch off 10 minutes the first hours. Normally, we . . . have 60 bar on the boilers about 6:00 in the evening. . . . .
Statements from several second engineers revealed, however, that none of them followed the manufacturer’s procedures for shutting down the boilers. They each employed one or more measures, such as opening vents and drains and running one or more of the boiler’s forced-air fans, in an attempt to speed the cooling of the boiler so that it could be shut down in less time, in some cases, in as little as 1 to 2 hours. One second engineer said that by using the forced-draft fans and opening the drain on the bottom of the water drum (the boiler bottom blow valve) for about 20 minutes “so [that] it loses a lot of pressure,” he estimated that the boiler pressure could be reduced from 60 bar (870 psi) to 0 bar in 1 to 2 hours.
The boiler monitoring system had several strip chart recorders 29 that recorded various boiler operating parameters, including steam pressure (for boiler data, see appendix A). The pressure chart data could be used to estimate the time it took for a boiler to warm up and cool down during light-off and shutdown, respectively. Investigators noted that the charted light-off profiles were consistent with intermittent firing of the burners. The data indicate that the boilers went from zero pressure to a full pressure of 60 to 62 bar (870 to 900 psi) in 1.5 to 5.5 hours; the average was 3.4 hours. According to the charts, the boilers were fired at 10-minute intervals and shut down for 10 minutes until the boilers reached pressure.
The charted shutdown profiles showed a steadily decreasing curve, representative of a falling pressure rate over time—in most cases, a reduction from full pressure to zero pressure in about 3 hours. The rate of pressure drop from full to zero pressure ranged between 45 minutes and 4 hours, with an average of 2.8 hours. 30
Between the late 1990s and 2002, several port engineers and chief engineers expressed concern about the effects on the boilers caused by the frequent light-offs and shutdowns required by the vessel’s operational schedule and route. In a 1998 e-mail to the NCL’s vice president of ship operations, an NCL port engineer stated:
Since the S/S Norway started the itinerary to St. Maarten, St. John, St. Thomas, Great Stirrup Cay, the ship has been sailing on 2-3 boilers. This operation is causing a lot of stress to the boilers, because we are forced to shut them down frequently. After a few years of operating in this condition, and being the boiler shut down for more than 100 times, and light off every year, we can see that the steel is getting brittle and the reoccurrence of tube failures. If we want to continue the safe operations of the vessel with no mechanical interruptions, the retubing of all 4 boilers should be done soonest.
During the last few years, we experienced numerous boiler tube failures, which caused shutting down the boilers for repairs. We must realize that we have reached a point where the operation of the vessel is not safe. Also we should take in consideration that the interior of the boilers [is] worn out due to sulfur-dioxide corrosion.
In January 2002, a different port engineer (the port engineer at the time of the accident) sent an e-mail to NCL management, advising:
Leaks on the boiler will happen again, and is–once in awhile, not particular[ly] abnormal. But with the frequency of leaks we have had lately, particular on boiler 24, it is all reasons for concern, and it has to be addressed. The reason for boiler-tube leaks on the Norway is well known; in and out with the third boiler every single week gives heavy thermal stresses of the boiler-tubes, economizers and brickwork. With the present itinerary, delays and/or cancellation of ports must be expected.
Later that year, in July 2002, the port engineer e-mailed NCL management:
The planned re-tubing of the superheaters [has] had some impact on the consumption; with only 3 boilers in operation, the chief engineer has been uncomfortable in shutting down the boiler on Saturdays, knowing he must light it up again before S. Martens. So three boilers have been in line until safe rest-speed to St. Martens has been obtained. Knowing how much stress this lighting up and shutting down has on the boiler, I support this when one boiler is out of service.
Cycling. One boiler cycle is defined as the unit going from zero pressure to full pressure and back down to zero pressure. At the time of the accident, the Norway’s itinerary was a 7-day voyage that departed the Port of Miami, sailed to stops in St. Maarten (Netherlands Antilles), St. Thomas (U.S. Virgin Islands), and the Great Stirrup Cay (Bahamas), and then returned to Miami. After the Norway began that itinerary, the ship’s boilers were subject to more frequent cycling than when the vessel made trans-Atlantic voyages while under French flag. The Norway normally sailed using two or three boilers, depending on the speed needed to reach a port on the cruise schedule. Typically, one or more boilers were idle for periods lasting from a day to several weeks (see appendix A).
Investigators examined the stoker (boiler operator) logbooks to determine the number and the duration of the cycles and the shutdown periods for the four boilers. For a 1-year period (July 1997 to July 1998) taken at random, the boilers had between 11 and 29 cycles, or an average of 23 cycles per year. For the 17-month period before the accident (January 2002 through May 2003), the boilers had between 18 and 26 cycles, or an average of 15.2 cycles per year. The logbooks show that a boiler’s cycle frequently lasted 1.5 days or less, and in many cases, less than half a day.
The logbooks showed that between July 1997 and July 1998, the boilers were shut down for 10 or more days between two and seven times (appendix A, table 2). Pressure chart data confirmed that the Norway’s engineering crew typically brought a boiler’s pressure down to zero shortly after they shut it down. Three of the four boilers each were idle for periods lasting 20 or more days. 31 Boiler No. 22 was shut down once for more than 20 days, boiler No. 23 was shut down twice for more than 20 days, and boiler No. 24 was shut down six times for more than 20 days. In the 17-month period before the accident, a boiler was shut down for 10 days or more between three and seven times. Boiler No. 23 was shut down once for more than 20 days, boiler No. 21 was shut down twice for more than 20 days, and boiler No. 24 was shut down for more than 20 days three times. The boiler records did not indicate whether the boilers were in a wet or dry condition 32 during periods of idleness or what techniques, if any, were used to prevent oxygen corrosion during lay-up (see below).
Water Testing and Treatment. An essential maintenance task associated with steam boilers is ensuring that the water in the system is free of contaminants and has the appropriate chemical and oxygen levels to prevent scale formation and corrosion. As discussed in the “Boiler History” section, the Norway’s boilers were found to have pitting and oxygen corrosion on multiple occasions during their lifetime. As noted in the “Postaccident Investigation and Findings” section, the fatigue cracks found on the water wall header fracture surface appeared to have originated at the base of corrosion pits.
NCL had a chemical treatment program that included required procedures for water testing by onboard engineering personnel and a contract with Drew Marine Division of Ashland Chemical to supply test and treatment chemicals for the boiler water and to provide technical services. The water treatment manual used by Drew Marine recommends that the level of hydrazine 33 in a boiler’s water be 0.03 to 0.01 parts per million (ppm) for normal operations and that it be increased to 150 to 200 ppm during periods of wet lay-up. The Drew Marine guidance also states that a wet lay-up (as opposed to dry lay-up) be used for “all but very extended lay-up periods.” However, the manual does not define “very extended lay-up periods.” The original operating manual from the French manufacturer recommended that if a boiler was to be “shut down for a prolonged period (5 days or more), completely fill the upper drums [with water] up to the air releases [drum vents], injecting hydrazine.” 34
The NCL water treatment procedures required a second engineer to draw and test the water from the boilers each day and, if needed, to either add the appropriate chemical to control phosphate levels, alkalinity, pH levels, chloride levels, dissolved solids, and oxygen levels (as indicated by the amount of oxygen scavenger present in the water) or to skim the water to remove contaminants. An NCL second engineer documented the test findings. Although the water test and treatment logs indicated whether a boiler was in a steaming condition or shut down, they did not record whether it was in a dry or a wet lay-up status when idle. Consequently, the logs do not indicate whether the level of hydrazine was increased as part of the lay-up procedures for a boiler being idled (appendix A).
The contract services with Drew Marine included a visit about once a month from one of its engineers, who would review the records of tests done by the vessel’s second engineer, independently test the boiler water, and, if necessary, train the crew in boiler-water-testing procedures. The service engineers also submitted reports of findings to the Norway’s chief engineer and to the port engineer. Available historical service reports indicate that a Drew Marine engineer repeatedly commented about deviations from the standard levels of chemicals and the need to maintain the levels within prescribed limits. However, the service technician did not state that NCL’s administration of the chemical program was deficient.
According to a Drew Marine representative in Miami, the service engineers relied primarily on their reviews of tests done by the crew and on their own monthly tests to evaluate the effectiveness of the water treatment program. The service engineers did not examine the interiors of the boilers to determine whether or how well the chemical treatments controlled scaling, sludge, and corrosion inside the drums and tubes.
Safety Board investigators examined the water chemistry logbook for the boilers and noted that the second engineers had recorded daily readings of parameters such as phosphate, hydrazine, conductivity, chloride, pH, and alkalinity. The logbook also showed the amounts of other chemicals, including the oxygen-scavenger hydrazine, that reportedly had been added to adjust the water chemistry. 35 Investigators noted that no entries were logged for some boilers for several days at a time and subsequently determined that water chemistry readings were not taken when a boiler was not steaming. Closer examination of the data for a randomly selected year (January through December 2000) revealed the following about the levels of hydrazine:
Among the documents that Safety Board investigators reviewed were shipyard memoranda warning that action needed to be taken to address the suspected cause of the active corrosion found in the boilers, including the maintenance of idle boilers. A memorandum dated January 25, 1991, from a shipyard that had performed an inspection of the boilers stated:
Regarding the increased occurrence of corrosion pittings inside the boiler drums and Babcock’s report on this matter, we hereby point out to you again that the preservation of the boilers in shutoff condition should be given the utmost attention. It would be recommended to make a provision for transfer pumping of the boiler water from the smaller side drums to the upper drum. Maybe, there should also be discussions with Drew Chemical about the dosage of hydrazine in boiler water and condensate.
In July 1991, the same shipyard stated in a memo:
Please find enclosed the report of the boiler water analysis for the S/S Norway . . . No major trace elements have been found in the analysis results. So there is every indication to suppose that the increase in corrosions is nothing else but the effect of shutdown corrosion. We would suggest the following measures to solve this problem: Installation should be done of a connecting steamline from the atomizer steam groups on each boiler to the respective two lower drums in each case . . . The steam as nozzled this way will keep the boiler under pressure and maintain temperature . . . The overall situation about the problems with combustion air and corrosion should be discussed in detail between Siemens, Babcock, the Owner, and Lloyd Werft.
Investigators found no evidence that the shipyard’s recommendations were followed. In late 2002 (table 2), a contractor inspected boiler No. 21 at the request of NCL and found “oxygen tubercles present in the [generating] tubes.” 37 The report further stated, “[W]hat gives us cause for concern is the fact that we do not know what active corrosion is underneath the tubercles.”
Maintenance and Cleaning. On the basis of statements from the vessel’s engineering crew and other maintenance records for the 3 years preceding the accident, all four boilers had been cleaned and inspected about every 3,000 hours. The 3,000-hour maintenance tasks included cleaning the water economizer and water-washing the superheater and generating tubes. The original boiler manual noted that “if the treatment of the boiler water is correct, then as a rule no significant deposit should occur within the boiler tubes.” If necessary, a scaling device driven by compressed air could be used, but the manual advised against using it “frequently or regularly, unless large deposits are detected, as the mechanical scaling of the tubes destroys the protective coating formed by the phosphates.” The manual states that the drums should be cleaned at every inspection by washing with fresh water to remove mud deposits that “may have a rapid corrosive effect.” 38
For boiler No. 23, the 3,000-hour cleanings and inspections had occurred in February 2000, November 2000, March 2001, September 2001, May 2002, July 2002, January 2003, and April 2003. Boiler No. 23 was off-line from April 19, 2003, until May 15 (10 days before the accident) while engineers repaired the furnace’s refractory material (blue-ram 39).
Inspections. As noted in the “Written Guidance” section, NCL had formalized the process for managing the Norway’s engineering equipment, listing the required procedures in the company’s SEMS and establishing a computerized preventive maintenance system (AMOS). Investigators reviewed the SEMS manuals and other materials and found no references to requirements or procedures addressing periodic inspection of the boiler interior areas for corrosion and cracks.
Because of the limited access to the interiors of the waterwall headers (a manhole at each end of the 13-foot-long cylinders), inspection was best accomplished by the inspector actually entering the headers. However, access was difficult because the access manholes measured only about 12 by 16 inches (30 by 40 centimeters) and the drum was only 29 inches in diameter. In interviews, the second engineer in charge of boiler maintenance said that he could and did enter the waterwall headers to check the inside of the drums. 40 The relief chief engineer, who was 6 feet 7 inches tall and weighed 340 pounds, said that it was impossible for him to enter the drums and headers. 41
BV rules required a complete (internal) survey of boilers twice in 5 years, or about every 2 1/2 years. BV had internal procedures that provided guidance to its surveyors in the inspection of boilers. When questioned about his inspection of the internal areas of the drums and headers, the BV surveyor at the time of the accident stated that BV did not require its surveyors to enter the drums and that he could not get into the steam drum, the water drum, or the waterwall header because the access manholes were too small. He said, “You can look in . . . for corrosion or whatever, but it’s limited.”
The previous BV surveyor stated that he had entered the steam and water drums of the boilers, but that he had not entered the waterwall header and had only viewed the interior of the header from the outside. He also stated that the BV guidelines required the surveyors to enter only the steam drum; the requirements did not stipulate that they should enter the water drum or the waterwall header.
According to NCL’s previous Norway port (Miami) engineer, the BV surveyor who performed boiler surveys during the 1980s and until 1991 went inside the drums and headers during inspections. He indicated that a surveyor could not examine the drum by simply putting his head through the access opening and shining a flashlight inside the drum. He stated, “You have to go in . . . And it’s a very, very cramped space. Not everybody can get in there.” He said that he was aware that other BV surveyors had entered the drums to inspect them.
According to BV survey rules and internal guidance provided to its surveyors before the accident and still in effect, if a boiler has not been fully surveyed internally, hydraulic tests are required. 42 No specific test pressure is specified for the hydraulic tests, but 115 to 140 percent of working pressure is the typical pressure specified for such tests. Because the Norway boilers were certified to operate at 70 bar (1,015 psi), a 115 percent test pressure would have been about 80 bar (1,160 psi). According to BV survey documents, boiler No. 23 was last internally inspected in July 2002, at which time it was subjected to a 70 bar (1,015 psi), or working pressure, hydraulic test. During its previous internal examination in November 2001, the boiler was not subjected to a hydraulic test, and at its May 1999 internal examination, it was subjected to a hydraulic test of 80 bar (1,160 psi). Thus, BV did not appear to follow its own rules regarding hydraulic testing.
Postaccident Investigation and Findings
NCL assigned a metallurgist to assist a Safety Board metallurgist during the on-scene examination of the boiler room. The NCL metallurgist also participated in the follow-up examination and analysis of boiler sections that were removed and sent to the Board’s materials laboratory in Washington, D.C.
On June 6, 2003, Safety Board investigators conducted an on-site examination of boiler No. 23 and observed that a large outboard section of the waterwall header was liberated where fracture had occurred (figure 8). The waterwall header had been manufactured by longitudinally welding together two half-cylinder components—the tube sheet, so called because it contains openings for the waterwall tubes, and a thinner sheet called the wrapper sheet. Investigators noted that weld repairs had been made at the longitudinal welds between the two sheets and that large portions of the header fracture occurred at or next to the repair regions. Later laboratory tests found that the repairs appeared to have been made using the temper bead welding technique. 43
The entire waterwall header, including the caps (“dished heads”), was about 16.5 feet long. The cylindrical portion of the header was about 13 feet long. The fracture along the upper longitudinal weld extended about 11 feet, and the fracture along the lower longitudinal weld extended about 8 feet. The weld repairs were approximately 1.5 inches wide along almost the entire length of the original longitudinal weld seams. The fractures along the weld seams were connected by overstress fractures through the wrapper sheet. The header’s upper longitudinal fracture had dark areas, indicating preexisting cracks that extended from the inner surface through about 40 percent of the wall thickness toward the outer surface of the header.
Figure 8. Schematic (left) showing location of fracturing along the longitudinal welds, and partial view (right) of damaged waterwall header, looking aft. The waterwall header was constructed by longitudinally welding together two half-cylinders and then welding caps (dished heads) on either end. The two half-cylinders were of different thicknesses. During the manufacture of the header, the tube sheet was tapered down to the wrapper sheet and the two were welded together at the bottom of the tapered region. The header fractured where weld repairs had been made along the original longitudinal welds joining the tube sheet and the wrapper sheet.
The header’s lower longitudinal fracture surface also had dark areas, again indicating the presence of preexisting cracks from the inner surface through about 60 percent of the wall thickness. The preexisting crack region extended along the length of the fracture. Investigators observed isolated thumbnail-shaped regions, indicative of metal fatigue, at both ends of this fracture. The weld repair region contained both longitudinal and transverse cracks not observed in other areas of the boiler. The transverse cracks varied from 0.5 to 2 inches long.
The liberated section of the header (a single piece of the wrapper sheet) showed the presence of the preexisting cracks and copper nuggets covering portions of the fracture surface near the inner surface. The significance of the copper nuggets is discussed below.
To determine the nature of the fracture, Safety Board investigators had eight sections from the header and the liberated piece sent to the Safety Board’s materials laboratory for examination. Safety Board investigators examined the fracture surfaces along the longitudinal welds of the boiler No. 23 header under high magnification in the laboratory. The fractures were found to have begun along the side of the weld repair region, with the upper fracture on the tube sheet side of the weld repair region and the lower fracture on the wrapper sheet side of the weld repair region. Fatigue cracks on multiple longitudinal planes joined to form a larger crack front.
The fracture features indicated that fatigue cracking began at the base of large corrosion pits and then propagated alongside the weld repair. The header material next to welded areas is known as the heat-affected zone. Heat from welding operations and subsequent recooling causes changes in the microstructure and mechanical properties of the base metal in the heat-affected zone. The welding process can also create residual stresses in and next to the weld areas. Residual stresses can lead to accelerated corrosion and cracking. Controlled welding procedures approved by the classification society are used for welds in stress-critical structures such as boilers to minimize the effects of welding. Industry codes for boilers also use substantial safety factors in design to account for uncertainties such as residual stresses.
Visual examination of the fracture surface along the lower longitudinal weld repair showed fatigue cracks that reached a maximum depth of 0.55 inch in a section 0.933 inch thick. The remainder of the wall thickness fractured in overstress and was necked down (narrowed), reducing the overall wall thickness at the fracture to between 0.7 and 0.8 inch. 44 Investigators prepared a transverse metallographic section through the forward end of the fracture at the wrapper sheet and lower longitudinal weld for examination in detail. This section showed cracking or pitting up to 0.1 inch deep in the wrapper sheet and up to 0.15 inch deep in the center of the weld repair, both on the header interior surface. Laboratory examination of part of the original weld (an area without weld repair) showed that portions of the original weld had been ground and the thickness of the wrapper sheet reduced. Where grinding had removed the most material, the wall was approximately 0.788 inch thick, slightly below the minimum thickness (0.791 inch) allowed before weld repair was required. 45
Investigators found copper fragments on the surface of the fatigue crack portion of the fracture, next to the inner surface of the header. Fragments were not found elsewhere in the header material. The fragments were about 0.070 to 0.190 inch long, flat, and flush with the inner surface of the header, up to about 0.1 inch wide and 0.09 inch deep in the crack. The side of the copper fragments deepest into the cracks was rounded and contained longitudinal cracks. The fracture halves were put together to determine how well they matched. The shape of the fragments of copper closely matched the fracture contours (figure 9).
Figure 9. View of matching fracture halves (above) and enlarged image of copper nuggets (below) at the edge of the fracture. Arrow points to area of enlarged image.
Investigators determined the elemental composition of the copper fragments to be almost pure copper, with a wrought (hammered) structure similar to the composition of hammered copper refrigeration tubing. The inside surface of the nuggets had transverse marks associated with grinding, consistent with the copper material having been ground flush with the inner diameter of the header after being introduced into the open crack. Investigators considered the possibility that the copper had entered the boiler as the result of chemical reactions such as deposition induced by excess hydrazine. 46 They discounted this mechanism as the source because of the mechanical features and shape of the copper nuggets.
Safety Board investigators consulted with several experts in boiler operation and maintenance, none of whom could propose any theories that could adequately explain the origin of the copper nuggets. Investigators therefore concluded that the copper had most likely been deliberately introduced into the boiler waterwall header during a misguided maintenance action. A likely result of the introduction of the copper into the cracked areas of the water wall header would have been to mask the cracks, making their detection more difficult during inspections.
Tests of Associated Equipment
The Safety Board tested or arranged for the testing of various safety and control devices associated with the boiler system to determine whether their operation or failure might have caused or contributed to the rupture. Tests of the four safety valves on boiler No. 23 revealed no significant defects, indicating that they probably functioned properly at the time of the accident.
The fuel burner management system was designed to detect abnormal operating parameters in the boiler and automatically shut it down if necessary. The control console for the system was located in the engine control room. The boiler rupture and release of steam therefore did not affect the system’s control components. However, the local actuators, sensors, and cabling were damaged to such a degree that a full system check was not possible. The Safety Board arranged for Siemens, the manufacturer of the system, and an independent systems specialist acting on behalf of the Board to do a functional check of the burner management system using simulated inputs. The check determined that the system worked as intended.
NCL engineers conducted tests, witnessed by a Coast Guard representative, of the burners, retractable igniters, and fuel valves at the front of boiler No. 23. The tests indicated that the front hardware of boiler No. 23 operated properly.
Investigators sent fuel oil samples taken from the storage tanks to a fuel-testing laboratory for analysis to determine whether the oil was contaminated. Depending on the type and amount of contamination in fuel oil, its flashpoint can be lowered to the point that it can prematurely ignite and cause an explosion. The test results for the fuel samples (380 centistokes [cSt] viscosity grade) showed that the flashpoint of the oil was above 200° F, well above the specification for this grade of fuel and for the boiler.
After the accident, NCL contracted with Det Norske Veritas (DNV), another classification society, to evaluate the condition of the drums and headers of the three boilers not involved in the accident. The tests were visual inspection, plastic replica testing, hardness testing, and magnetic particle inspection. The tests were used to determine the presence and severity of cracks and the metallurgical condition of the drum and header material.
The visual inspections found moderate to significant pitting and corrosion in the drums and headers. The nondestructive testing found cracks that required extensive repair before the boilers could be returned to service. The plastic replica examination of the material microstructure of the steam and water drums of boiler No. 24 found “significant material degeneration due to carbide coarsening and the formation of creep pores,” and concluded that the “drums [were] not suitable for further safe operation.”
The Safety Board also contracted with Engineering and Inspections Unlimited, Inc., for nondestructive testing of the same three boilers. The contractor’s report states:
Fluorescent Magnetic Particle examination located cracks in the welds of headers 21, 22, and 24, and in the welds of water drums 22 and 24. No cracking was observed in water drum 21 or steam drum 22.
The contractor conducted ultrasonic testing to measure the depth of the cracks. The depth ranged from 0.010 to 0.250 inch.
Norwegian Cruise Line Changes
NCL’s standing Risk Management Committee met in October 2003 to address safety issues that the cruise line itself had identified in the Norway accident. As prescribed by the ISM code, the objectives of the committee were as follows:
NCL adopted most of the committee’s recommended improvements or preventive measures fleetwide by the end of 2004 and included them as review items to be verified annually during internal audits. Most of the changes, several of which are described below, have been incorporated in the company’s SEMS.
In the Norway accident, about 125 crewmembers exited the ship within minutes of the boiler rupture, and area police did not allow them to return to the vessel. As a result, some members of the vessel response teams and some crew monitors for the passenger muster were not on board the ship, which affected the timely accomplishment of some emergency tasks. NCL therefore added training and quarterly drill requirements for shoreside evacuations to all ship emergency plans. In some cases, the quarterly drills are conducted in cooperation with local response authorities, including those serving the Port of Miami.
According to company officials, having multiple gangways rigged when the boiler ruptured facilitated evacuation from the Norway. NCL therefore reviewed other ships and ports to determine the feasibility of rigging multiple gangways so that emergency evacuation could be accomplished away from potentially hazardous ship areas. Ship emergency plans now include ongoing reviews of shoreside muster procedures following a ship evacuation.
An NCL spokesperson indicated that the Norway accident highlighted the need for better hazardous material (hazmat) awareness, handling, and containment. In this instance, the Miami responders may not have been aware of the asbestos on the vessel. 47 NCL has since removed vessels with asbestos from service. The company also reviewed and mapped onboard areas such as chemical lockers that pose potential explosion or release dangers and upgraded its training and response procedures for hazmat incidents. Emergency drills now include control of damaged areas after an accident, identification of hazmat contamination and personnel exposure, and other site safety measures. In addition, the company has arranged service agreements with hazmat incident response contractors at all U.S. ports where its ships call.
Emergency preparedness measures now include ensuring that for emergency follow-up and investigation, responders and others can obtain extra copies of fire plans, either from a ship that has onboard plotting capability or from a port agent. For the safety of personnel, company officials researched what clothing and personal protective equipment (PPE) could safeguard crew (regular and response personnel) against hazards such as those that prevailed in the Norway accident and protect them from injury. In addition, ships are now required to carry additional PPE and portable communications for postaccident follow-up.
NCL evaluated the various areas of its ships to identify structural and technical considerations for different types of emergencies. In the Norway accident, the steam lifted and propelled several deck plates (although the plates struck no one). The company’s technical superintendent now must evaluate as part of his semiannual inspection whether deck plates pose “missile hazards.” Officials reviewed the location and adequacy of shut-off valves for piping that might be blown away or damaged and included bulkhead valve inspection and testing in internal audits. The evaluations determined that the risk associated with machinery-space doors that opened onto crew or passenger accommodation or work areas was limited to older ships; however, as an ongoing measure, the company will evaluate all new-build designs for such risks. Company officials considered whether watertight doors in machinery areas should be kept closed in case of an explosion, but decided against any procedural change after realizing that in the Norway accident, closed doors would have funneled the steam and debris to upper accommodation areas.
In the Norway accident, not all the ship’s hospital spaces had emergency lighting. NCL officials have now identified secondary medical stations on all their ships. In addition, evaluating postaccident crew care facilities has been added to the action log for NCL’s shoreside officials.
NCL officials reviewed all records of vessel modifications and vessel drawings for completeness and accuracy. All new vessel drawings, technical reports, and manuals have been translated into English. A spokesperson said that digitizing the files has improved record-keeping fleetwide, and a project is under way to convert all files to electronic format. In addition, each ship’s technical superintendent has been tasked with taking digital photographs of machinery spaces when doing semiannual inspections of ships so that company and investigative officials will have a preincident record of conditions, if necessary.
Other than the Norway, the NCL fleet had diesel engine-based propulsion systems. However, steam continues to be used for purposes other than propulsion on NCL motor ships as well as in virtually all other motor vessels, with the steam being generated by either oil-fired or waste heat boilers. Often termed auxiliary boilers, they provide low-pressure steam (7 to 10 bar or 100 to 145 psi) for a variety of uses, including fuel oil heating, hot water heating, laundry and galley services, and heating in HVAC (heating, ventilation, and air conditioning) systems. The steam generators used for auxiliary steam services pose a much lower threat to safety than those used for propulsion, principally because of their smaller size and the much lower pressure, temperature, and energy levels at which the boilers supply steam. Consequently, the hazards posed by low-pressure steam, while not trivial, are much lower than those of high-pressure propulsion steam boilers.
The company’s review of operating procedures resulted in several changes. NCL standardized its routine maintenance program and associated documentation and included areas that were not controlled in the past. The company’s SMS now includes maintenance, document control, and audits of formerly unofficial logs such as stoker and incinerator logs. After a review of welding procedures for normal and emergency repairs, NCL’s SMS was changed to put greater emphasis on qualifications, credentials, and third-party inspections. The review of boiler inspection procedures resulted in standing orders for staff to submit reports if any pitting is identified and if class surveyors do not enter a boiler’s internal spaces when carrying out their examinations. Also, the condition of each boiler must be mentioned in periodic reports.
After it enacted its procedural and systemic changes, NCL asked the Coast Guard to audit its SMS. Coast Guard inspectors and auditors reviewed NCL headquarters, as well as two cruise ships (Norwegian Majesty and Norwegian Sun) that were selected at random. According to NCL, the Coast Guard now routinely audits its SMS as part of the certification process for U.S-flag vessels.
Shortly after the Norway accident, the classification society DNV, which had evaluated the condition of three of the Norway’s boilers for NCL after the rupture, issued a notice to its surveyors to pay special attention to the survey of all boilers over 9 years old. The notice advised surveyors to
perform a general internal examination of both water- and fire/gas side, with a special focus on the drums and headers, welding seams for possible cracks, corrosion, pitting and wastage. If conditions described above are found, thickness measurements and/or other non-destructive testing methods will be performed.
DNV intended to use the experience surveyors gained through this increased focus to help in its continuous efforts to improve rules and survey procedures.
In 2006, BV revised its rules for boiler surveys to include requirements for the surveyor to review the operation, maintenance, repair history, and feedwater chemistry records since the last boiler survey. The revision was in response to changes to the IACS unified requirements concerning classification and survey (section Z18), which became effective in January 2007.
City of Miami Changes
As part of their standard operating policies, the fire departments and police departments involved in the Norway accident critiqued the response effort to identify whether and when problems occurred. One report stated:
There appeared to be much confusion by the Miami fire units as to which department had responsibility for the incident and who was in command. There were [two] different operations going on at the same time in two different locations with no real formal command structure in place. . . .
Representatives of the departments subsequently met to address the deficiencies identified in the Norway accident and to develop procedures for improving interaction and communication. The Miami response agencies also agreed to participate in shoreside drills that NCL added to its emergency preparedness procedures after the accident.
Analysis of Boiler Rupture
During the course of the investigation, it became clear that the header in boiler No. 23 ruptured because of extensive fatigue cracking and that a number of factors contributed to the initiation and propagation of the cracking. Cracks were detected at original welds beginning in the 1970s, and additional cracks were observed on later occasions. The cracks were monitored and ground away until the minimum allowable wall thickness was reached, at which time weld repairs were made to build up the material thickness. The cracks initiated at the base of corrosion pits at the original longitudinal welds when the boiler was exposed to excessive cycling (thermal and mechanical loading), with severe transients (rates of temperature change) from startup to cooldown and constraint from frozen support feet. The pitting most likely resulted from improper water chemistry (oxygen pitting) during lay-up periods.
In 1987 and 1990, weld repairs were performed when the cracks extended below the minimum allowable grinding thickness. Cracking began again a few years later. The width and length of the weld repairs probably accelerated the pitting and cracking because of residual stresses in the weld repairs.
The cracks then grew to critical size, causing the header in boiler No. 23 to rupture. Documents analyzed by the Safety Board showed no nondestructive testing or appropriate internal visual inspections after 1996 for the headers of boiler Nos. 22 and 24 and after 1990 for the headers of boiler Nos. 21 and 23.
The metallurgical analysis found that the material properties of the header steel were normal. In addition, the pressure readings at the time of the accident were within normal operating range. Therefore, the boiler was subjected to typical loads at the time of the rupture. Nevertheless, the boiler ruptured because preexisting cracks extended 40 to 60 percent through the wall thickness, which was already reduced by grinding. At the time of the rupture, there was insufficient cross-sectional area in the header to withstand the pressure, and the header failed catastrophically. It is thus clear that fatigue cracking ultimately led to the rupture of the header.
Postaccident examination detected fatigue cracking in both the original welds and the weld repairs. The cracking initiated at the base of corrosion pits on the inner surface of the drums. The presence of pits localized stresses at the surface and favored the initiation of fatigue. The reduced wall thickness also contributed to fatigue initiation by concentrating local stresses. After the fatigue cracks initiated, they produced local stress concentrations at the crack tips, which most likely propagated with every firing cycle of the boiler.
In a pressure vessel, cracking is expected to occur along the longitudinal weld seams because the hoop stress 48 is twice the longitudinal stress, based on the internal pressure load (for a cylindrical vessel). Both longitudinal and transverse cracking was discovered in boiler No. 23, suggesting either that stress was elevated enough to initiate cracking in both directions or that additional stresses in the longitudinal direction, such as in reaction to the frozen boiler supports, were superimposed on the pressure loads to cause transverse cracking.
Improper Water Chemistry
Poor control of water chemistry is known to contribute to corrosion fatigue damage. According to the American Society of Mechanical Engineers (ASME) boiler code, corrosion in a boiler can occur either while the boiler is in service or while it is idle. 49 When a boiler is idle, proper precautions need to be taken. Boilers are typically passivated, that is, protected from corrosion by an internal film of magnetite (Fe3O4). The film can be broken by oxygen pitting, acid dissolving the coating (acid attack), or concentrated alkali (caustic) conditions, all of which cause localized loss of boiler metal (corrosion). Localized corrosion has been noted to be the primary cause of boiler failure and can result from high chemical concentrations or uncontrolled oxygen in the system. Water chemistry records, the metallurgical characteristics of the damage, and historical documents indicate that oxygen corrosion was the most likely mechanism for the corrosion pitting observed in boiler No. 23.
Oxygen corrosion, by definition, results from excess oxygen in the water system and is controlled by the use of deaerating equipment 50 and chemicals such as hydrazine. According to the Drew Marine water chemistry dosing chart, the hydrazine levels for the Norway were to be maintained between 0.03 and 0.01 ppm during operation. If the levels of hydrazine were not sufficiently high, excess oxygen would be present in the water to facilitate or enable corrosion. Records show that oxygen pitting had plagued the Norway’s boilers for several decades and that the boilers had an ongoing problem with maintaining the proper hydrazine levels to prevent corrosion. The Safety Board therefore closely examined the historical levels of hydrazine in the boilers, as discussed earlier in the “Water Testing and Treatment” section (see also appendix A). Investigators found low levels of hydrazine for long periods during both operation and lay-up.
Several warnings were given that oxygen corrosion was a problem and was likely the result of incorrect water chemistry during both operational and lay-up periods. It is apparent that efforts to address this issue were ineffective, since active oxygen corrosion was present, as documented in the Harris Pye reports on boiler Nos. 21 and 24 from November 2002 and January 2003. Active oxygen corrosion, as evidenced by tubercles, was also discovered during the postaccident examination of the boilers. The accident investigation determined that the Norway’s boilers were often shut down for longer than 10 days and sometimes for more than 40 days without proper water treatment. 51 According to the Drew Marine documents, hydrazine levels were to be increased during idle or lay-up periods, but the documents did not specify how many idle days had to pass before the boiler was considered in lay-up condition.
The documents point to numerous boiler tube failures over the years. Boiler tube failure can occur because of direct pitting of the internal surfaces or because of sludge buildup on the interior surfaces. When deposits build up inside the tubes, heat transfer reduces and the tubes operate at higher temperatures because less energy is transferred to the water or steam in the tubes. Operation at higher temperatures can eventually lead to loss of material properties (creep damage), fracturing, and burn-through, requiring that the tubes be plugged at the ends and put out of commission. Deposits typically form because of improper water chemistry that leads to precipitation of minerals from the boiler feedwater or from internal corrosion of the boiler and steam system, leading to rust deposits. It is likely that the oxygen corrosion that was observed in the headers and elsewhere contributed to the observed boiler tube failures.
Cycling. The greatest contributors to the initiation and propagation of the fatigue cracking in boiler No. 23 were the thermal and pressure stresses associated with starting up and shutting down the boilers. As described earlier (see also appendix A), the number of boiler cycles (pressure going from zero to full then back to zero) and the rate of pressure buildup in the Norway’s boilers were as follows:
According to NCL’s former port engineer, the ship often had to shut down a boiler for some reason (such as leaking tubes), and when the engineers would restart the boiler, they would often raise the pressure too fast. The rate of drop from full to zero pressure ranged between 45 minutes and 4 hours, with an average of 2.8 hours. The time necessary to reduce boiler pressure was not specified in the operating manual or other records. 52 Depending on how quickly they were started and cooled, the boilers could have suffered significant additional stresses from thermal transients. Multiple documents show that the boilers had frequent and significant damage to the boiler refractory materials, an indication that the boilers were heated and cooled too quickly.
As noted earlier, when the ship was converted to Caribbean sailing, the four boilers in the forward engineroom were removed. The evidence indicates that two to three boilers operated at a time, with one usually being idle for maintenance. The original design documents were not available to show how the boilers were intended to be cycled. However, the actions taken by the classification society in 1987 when cracks were found, the statements from several of the engineers, and the numerous tube failures indicate that boiler cycling was damaging to the boilers and was known to be a problem on the Norway.
Frozen Sliding Feet. Additional stresses on the boilers could have come from frozen sliding feet, which would have impeded the movement of the water drums and headers. Thermal stresses would have resulted when the pressure vessels sought to expand or contract during heating and cooling but were held in place by the frozen sliding feet. A January 2003 inspection by Harris Pye found that the feet of boiler No. 24 did not appear to be lubricated. According to NCL maintenance records, repairs were made to the frozen feet of unidentified boilers 2 weeks before the rupture.
The Norway’s original boiler manual contains the following guidance regarding the sliding feet: “The free movement of the boiler feet should be checked periodically. If necessary, introduce grease through the oval holes.” 53 The Navy’s inspection manual 54 states that maintenance personnel should inspect the sliding feet movement indicators before each light-off, during warmup, and after a boiler comes on line. The manual further states that a boiler whose sliding feet cannot be verified as functional should be shut down for repair. The Navy document suggests that the presence of frozen feet is a serious condition that can stress the boiler and that should be corrected immediately.
The evidence (weld appearance, examination of metallurgical sections through various welds, and NCL documents) indicates that a temper bead welding technique was used to repair cracking and corrosion in the longitudinal welds of the header of boiler No. 23. Temper bead welding is used to reduce the detrimental effects of exposure to the very high temperatures associated with the welding process. Temper bead welding creates a weld that has a reduced hardness and lower residual stresses compared with welds created using conventional welding processes. Appendix B describes the temper bead welding technique, the weld procedure used by Lloyd Werft on the Norway’s boilers, and the procedure used by the Navy on its boilers.
BV had approved the welding process used by Lloyd Werft. However, Lloyd Werft’s procedure was not specific and did not indicate that a qualification plan was used to show that the welders were capable of the job. Nevertheless, because boiler operations were sufficient to create cracking in the header of boiler No. 23 before the weld repairs were made, even if the weld repair had properties similar to the original weld, additional cracking would have still occurred because NCL did not take the steps necessary to eliminate the conditions that had originally caused the cracking. In addition, the weld location showed changes in geometry, grain size, and structure. Those factors, in particular the residual stress, created conditions that allowed subsequent cracks to initiate sooner and propagate faster than the original cracks.
The fracture along the upper longitudinal weld in boiler No. 23 extended about 11 feet, and the fracture along the lower longitudinal weld extended about 8 feet. No evidence or substantiation of a welding procedure was found to show that weld repairs 11 feet long were acceptable and would not affect the life of the boiler. According to the Navy’s procedure (appendix B), weld repairs exceeding 6 inches in length require special approval.
Inspection and Maintenance
Boilers are typically inspected by a combination of internal visual inspection and nondestructive testing such as fluorescent magnetic particle inspection or ultrasonic inspection. The evidence suggests that lack of proper internal inspections, lack of appropriate nondestructive inspections, poor guidelines, and poor training of its surveyors by BV may have caused the cracks in the Norway’s boilers to remain undetected.
Documents show that cracks were first detected in 1970 on the original welds and were monitored through a combination of internal visual inspections and nondestructive testing by boiler repair specialists and BV. From interviews, investigators found that from 1996 on, the surveyors changed their method of internal visual inspections of the headers. They began opening the manholes and looking inside with a flashlight rather than crawling inside and doing a thorough inspection (the condition of the boiler was assessed primarily by entering only the steam drum).
According to the classification society rules, internal inspections were not required as long as pressure tests were performed. If visual internal inspections were performed, according to the guidelines to surveyors, inspectors did not need to enter the headers, only the steam drums. The visual inspection guide was vague and did not point out any specific areas to be inspected. The entire contents of the BV guidelines for inspecting the lower boiler drums consisted of the following: 55
An internal inspection will not usually show much but any signs of pitting in the upper drum or tubes should be followed up by a further examination of the tubes via the lower drum.
Manhole doors, their landings, joints and dogs should be carefully checked.
After weld repair of the drums in 1987 and 1990, it appears that no further nondestructive testing was performed, except for the work done on boiler Nos. 22 and 24 in 1996, which indicated that cracking continued. From 1990 through 2003, it appears that no nondestructive testing was done on the weld seams of boiler Nos. 21 and 23, even though the history of cracking was well-documented and cracking was rediscovered on the weld seams of boiler Nos. 22 and 24 in 1996.
The Safety Board’s metallurgical examination found large, isolated copper nuggets on the fracture surfaces near the surface of the header. The nuggets closely matched the contours of both fracture halves. Analysis of the nuggets revealed that the material was highly worked, with elevated hardness, and that its composition was pure copper. Similar characteristics were produced in the materials laboratory using highly worked copper tubing.
The copper nuggets were found in only two areas of the fracture surface next to the weld repairs and not in other areas of the fracture surfaces or in the other boiler drums. The boiler contained no sources of pure, highly worked copper. Pure copper could have been produced by corrosion of the copper materials elsewhere in the steam system, such as in the condenser, but it would not have had the same size, microstructural features, ground-flat areas, and elevated hardness as exhibited by the nuggets. The Safety Board’s metallurgist concluded that the nuggets were not produced by corrosion. The metallurgist also discounted the possibility that the copper had been deposited in the boiler as a result of chemical reactions between excess hydrazine and copper alloys in the condenser and feedwater system.
The width, overall shape, structure, and ground surface of the copper nuggets clearly indicate that the copper was worked into the cracks after they were largely formed. This means that when the copper was introduced into the fatigue crack portion of the fracture in boiler No. 23, the crack was approximately 0.1 inch wide. None of the several boiler experts interviewed had ever heard of a temporary fix using copper. From a metallurgical point of view, copper would offer no structural benefits and would not be considered a repair. 56 The only explanation for the presence of the copper is that it was introduced to mask the crack, impede inspection, and avoid necessary repairs.
In recent years, no formal inspection program appears to have been carried out for the boilers, even though it was known that they were susceptible to cracking and were in fact cracked in 1996. For the Norway’s last 6 to 7 years of operation, there is no record that either classification society surveyors or NCL personnel entered the headers to inspect them. Although NCL personnel apparently opened the drums and headers and looked into the boilers to assess their cleanliness during the required 3,000-hour inspections, it does not appear that they actively inspected the drum and header interiors for cracks. The presence of copper on the fracture surfaces indicates that NCL shipboard engineers were aware of the cracking condition but did not take appropriate action to fix the problem.
The Safety Board determined that the following factors contributed to the rupture of boiler No. 23 on the Norway:
The National Transportation Safety Board determines that the probable cause of the boiler rupture on the Norway was the deficient boiler operation, maintenance, and inspection practices of Norwegian Cruise Line, which allowed material deterioration and fatigue cracking to weaken the boiler. Inadequate boiler surveys by Bureau Veritas contributed to the cause of the accident.
BY THE NATIONAL TRANSPORTATION SAFETY BOARDMARK V. ROSENKER ROBERT L. SUMWALT
Chairman Vice Chairman
DEBORAH A. P. HERSMAN STEVEN R. CHEALANDER
Adopted: October 29, 2007
Member KathRYN O’LEARY Higgins voted to disapprove this brief.
2 The crew was composed of Norwegian officers in the deck and engine departments. As is the case on most foreign-flag cruise ships operating in U.S. waters, members of the other shipboard departments comprised a variety of nationalities.
3 Title 49 Code of Federal Regulations section 830.2 defines a fatal injury as any injury that results in death within 30 days of an accident. It defines a serious injury as one that (1) requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, muscle, or tendon damage; (4) involves any internal organ; or (5) involves second- or third-degree burns, or any burn affecting more than 5 percent of the body surface. In the Norway accident, all the deceased sustained second- and third-degree burns on 50 to 100 percent of their body area and died from thermal injuries or from complications from thermal injuries. Four crewmembers died the day of the accident; three died within 4 days; and the eighth man died 26 days later.
7 Classification societies such as BV are private, independent organizations that establish and apply technical standards for the design, construction, and survey (inspection) of ships. Classification societies are one of the elements of the maritime safety network. Other elements include ship owners, ship builders, national and international regulatory bodies, and insurance underwriters. The standards developed by classification societies are published in documents referred to as the classification society’s “Rules.” Currently there are over 50 classification societies in the world, and the 10 major classification societies, collectively representing about 94 percent of the world commercial tonnage, are members of an association known as the International Association of Classification Societies (IACS). International standards and regulations promulgated by the International Maritime Organization, the United Nations agency concerned with maritime safety and the prevention of marine pollution from ships, require ships to be designed, constructed and maintained in compliance with structural, mechanical, and electrical requirements of a recognized classification society or with applicable requirements of the flag administration, giving classification societies a prominent role in the international regulatory regime of vessel safety (SOLAS regulations at chapter II-1, part A-1, regulation 3-1). In addition, many countries (including the Bahamas and the United States) delegate responsibility for some regulatory functions to classification societies, such as inspection for compliance with certain national and international regulations and issuance of some safety certificates, and may also adopt class society rules as their own national standards. Ship classification is usually a requirement for a ship owner to obtain and maintain insurance coverage.
8 A vessel meeting the standards of SOLAS 74 is divided along its length into main vertical zones by “A-60 class divisions,” that is, bulkheads that are insulated steel barriers designed to prevent the passage of smoke and flame from a fire for 60 minutes.
9 The 0400-to-0800 watch included three licensed crewmembers (one third engineer and two second engineers) and four unlicensed crewmembers. The third engineer was in charge of the boiler room and was there at the time of the accident.
11 Water at that pressure and temperature will expand about 1,260 times into hot vapor/steam when the pressure is released to atmospheric pressure (Michael R Lindeburg, Mechanical Engineering Reference Manual for the PE [professional engineer] Exam, 11th ed. [Belmont, California: Professional Publications, Inc., 2001], appendix 24B, p. A-46).
12 An opening in the hull through which a gangway can be rigged for the passage of cargo, luggage, provisions, garbage, or fuel hoses. When not in use, such ports are secured by hinged, watertight doors.
14 D-type boilers are so called because the position of the drums and the header appears to form the letter D. The Norway’s boilers were modified in that the waterwall headers were larger than in a normal D-type boiler and the floor tubes were inclined rather than horizontal.
17 The safety valves at the top of the steam drum were set to release at 71.5 and 71.3 kilograms per square centimeter (kg/cm2), or 1,017 and 1,014 psi. The valve at the superheater outlet was set to release at 66 kg/cm2 (939 psi). The superheater safety valve could either release spontaneously at its set pressure or be initiated by a pilot valve mounted on the steam drum that was set at 71 kg/cm2 (1,010 psi).
18 “Conditions of class” or “recommendations” are synonymous terms used by class societies for requirements that specific measures, repairs, or requests for surveys are to be carried out by the owner within a specified time to retain the ship’s class certificate. A vessel is said to be “in class” when the rules and regulations, in the opinion of the classification society, have been complied with.
19 Boiler repairs were described in the following documents: BV survey for April 14 through July 5, 1982; BV survey for September 2 through 24, 1984; Deutsche Babcock inspection report 18-8702-999, dated September 18, 1985; Lloyd Werft Bremerhaven instructions written by Deutsche Babcock dated October 26, 1987; BV survey report covering period September 7 through 23, 1987; Kloster Cruise interoffice memorandum dated October 8, 1987; BV survey report for period November 7 through 21, 1987; Deutsche Babcock repair document 18-9790-999, dated February 18, 1988; Deutsche Babcock repair document 94-8351-998, September 1990; BV survey report covering period September 3 through October 2, 1990.
21 The estimated design life of a marine boiler the size of those on the Norway was 150,000 hours under normal cycling conditions, based on an estimate provided by a representative of Siemens AG, a global corporation that provides a variety of technical services, including electrical engineering, for companies. The Safety Board could not determine the number of hours the Norway’s boilers had operated.
23 After a number of serious marine accidents in the late 1980s that were due to human error and poor management oversight, the International Maritime Organization adopted resolutions that led to the implementation the ISM code. Since July 1998, compliance with the ISM code is mandatory under SOLAS chapter IX, “Management for the Safe Operation of Ships.”
24 Liner France, Propulsion Machinery, Operation and Maintenance Guide, vol. 3, “Boilers”: “frequency of cleaning cannot be laid down in any precise manner; it depends on the percentage of impurities in the fuel, the quality of combustion, on the effectiveness of fuel additives, etc. It is recommended that washes be spaced out as much as possible, being carried out at the earliest after 3000 hours of operation, but perhaps occurring only after 6000 hours, provided that intermediate inspections of the elements prove satisfactory” (p. 40).
28 Each boiler was designed by the manufacturer and rated by the classification society to operate at 70 bar (1,015 psi) drum pressure, but both the original owner/operator and NCL elected to operate the boilers at 60 to 62 bar (870 to 900 psi).
29 A strip chart recorder consists of a roll of paper that is passed beneath one or more ink pens. If the signal representing the monitored parameter remains constant, a straight horizontal line is drawn on the chart. If the parameter changes, the pens deflect, producing a charted display resembling sawtoothed or sloping curved lines.
30 In some cases, the recordings were interrupted, meaning that a full reading could not be obtained. Either the recorders were stopped before pressure dropped to zero or the boilers were started back up in the middle of a cycle.
33 Hydrazine (chemically N2H4), a highly toxic carcinogenic chemical, is used in the treatment of boiler water. When injected into the boiler feedwater system, it acts an “oxygen scavenger” to remove excess oxygen from the feedwater and thereby prevent corrosion.
35 Besides hydrazine, the chemicals were GC (a concentrated alkaline liquid that neutralizes acid and controls corrosion); Adjunct B (a phosphate boiler water treatment chemical that works in conjunction with GC to control scale formation due to hardness); and SLLC-A (condensate corrosion inhibitor made from a volatile liquid organic amine designed to minimize corrosion in steam and condensate systems by providing a pH environment that neutralizes the effects of carbon dioxide).
37 Tubercles (also spelled tubercules) are local mounds of corrosion products (or oxide crust) that promote accelerated corrosion underneath. Tubercles appear to grow above the surface of the metal and are indicative of oxygen corrosion or other forms pitting mechanisms, such as chloride pitting and galvanic corrosion.
41 The relief chief engineer was not part of the Norway crew at the time of the accident but was in Miami and available for interviewing during the on-scene investigation; he was scheduled to begin his 4‑month duty 2 weeks after the accident.
42 A hydraulic test is commonly called a hydrostatic or hydro test. The test involves completely filling the boiler with water, sealing it of from other connected systems, and applying the specified test pressure using the ship’s feedwater pump or a small special-purpose hydrostatic pump.
45 BV specified in its September 1984 boiler survey that the design thickness of the header at the longitudinal seams was 24 mm (0.995 inch) and the minimum allowable thickness was 20.1 mm (0.791 inch). The permissible reduction in header thickness was an allowance for wastage as a result of corrosion.
46 As noted earlier, hydrazine is used to prevent corrosion by removing excess oxygen from boiler feedwater. Any hydrazine that does not react with oxygen decomposes at higher temperatures into ammonia. Ammonia, which leaves the boiler with the steam output, causes corrosion of components in the condenser and feedwater system containing copper alloys, removing copper from the metal and suspending it in the feedwater. The suspended copper then enters the boiler and can be deposited on the inside of the boiler or carried over with the steam output and deposited on other components, such as turbine blades.
55 By comparison, the Navy’s technical manual for inspection of boiler drums and headers devotes an entire chapter to the inspection of boiler drums and headers (chapter 5 in Navy Technical Manual S9221-D2-MMA-010).