EXECUTIVE SUMMARY

About 2225 on June 10, 1995, the Panamanian passenger ship Royal Majesty grounded on Rose and Crown Shoal about 10 miles east of Nantucket Island, Massachusetts. The vessel, with 1,509 persons on board, was en route from St. Georges, Bermuda, to Boston, Massachusetts. Initial attempts to free the vessel were unsuccessful. Deteriorating weather and sea conditions prevented the evacuation of passengers and crewmembers from the vessel.

On June 11, the Royal Majesty, with the aid of five tugboats, was freed from its strand. Initial damage surveys revealed deformation of the vessel's double bottom hull. However, no penetration or cracking of the hull was detected, and no fuel oil had been spilled. The U.S. Coast Guard gave the vessel permission to proceed to Boston. On June 12, the vessel arrived in Boston and disembarked its passengers.

There were no deaths or injuries as a result of this accident. Damage to the vessel and lost revenue, however, were estimated at about $7 million.

The National Transportation Safety Board determined that the probable cause of the grounding of the Royal Majesty was the watch officers' over-reliance on the automated features of the integrated bridge system; the company's failure to ensure that its officers were adequately trained in the automated features of the integrated bridge; the deficiencies in the design and implementation of the integrated bridge system and the procedures for its operation and the implications of this automation on bridge resource management; and the second officer's failure to take corrective action after several clues indicating that the vessel was off course.

Contributing factors were; inadequate international training standards for watch standards aboard vessels equipped with electronic navigation systems and integrated bridge systems; and inadequate international standards for the design, installation, and testing of integrated bridge systems aboard vessels.

This report examines the following major safety issues:

• Performance of the Royal Majesty's integrated bridge system and GPS.
• Performance of the Royal Majesty's watch officers.
• Effects of automation on watch officers' performance.
• Training standards for watch officers aboard vessels equipped with electronic navigation systems and integrated bridge systems.
• Design, installation, and testing standards for integrated bridge systems.

As a result of its investigation of this accident, the Safety Board issued safety recommendations to the Majesty Cruise Line, STN Atlas Electronik GmbH, Raytheon Marine, the U.S. Coast Guard, the International Council of Cruise Lines, the International Electrotechnical Commission, the National Marine Electronics Association, the International Chamber of Shipping, and the International Association of Independent Tanker Owners.

FINDINGS

1. The weather, the mechanical condition of the Royal Majesty, except for the global positioning system receiver, the officers' certifications, drugs, and fatigue were not factors in the accident.

2. Although Coast Guard personnel observed no indications that the officers had been under the influence of alcohol, alcohol could not be conclusively ruled out as a factor in the accident because of the delay in collecting the blood and urine specimens.

3. About 52 minutes after the Royal Majesty left St. Georges, Bermuda, the global positioning system (GPS) receiver antenna cable connection had separated enough that the GPS switched to dead-reckoning mode, and the autopilot, not programmed to detect the mode change and invalid status bits, no longer corrected for the effects of wind, current, or sea conditions.

4. Openly routing the global positioning system antenna cable in an area where someone occasionally walked increased the risk of damage to the cable and related connectors.

5. Had the fathometer alarm been set to 3 meters, as was the stated practice, or had the second officer chosen to display the fathometer data on the control console, he would have been alerted that the Royal Majesty was in far shallower water than expected and, thus, was off course. He would have been alerted perhaps as long as 40 minutes before the grounding, and the situation could have been corrected.

6. The watch officers' monitoring of the status of the vessel's global positioning system was deficient throughout the voyage from St. Georges.

7. Deliberate cross checking between the global positioning system and the Loran-C to verify the Royal Majesty's position was not being performed and should have been on the voyage from St. Georges.

8. Even though it is likely that the watch officers were not aware of the limitation of using the position-fix alarm to monitor course accuracy, it was not appropriate for them to rely solely on this feature to warn them of deviations from the ship's intended course.

9. The sighting of lights not normally observed in the traffic lanes, the second officer's inability to confirm the presence of the "BB" buoy, and the sighting of blue and white water should have taken precedence over the automation display on the central console and compelled the second officer to promptly use all available means to verify his position.

10. The chief officer and the second officer did not observe good watchkeeping practices or act with heightened awareness of the precautions that are needed when a vessel approaches the Boston traffic lanes and landfall.

11. The master's methods for monitoring the progress of the voyage did not account for the technical capabilities and limitations of the automated equipment.

12. The watch officers on the Royal Majesty may have believed that because the global positioning system had demonstrated sufficient reliability over 3 1/2 years, the traditional practice of using at least two independent sources of position information was not necessary.

13. All of the watchstanding officers were overly-reliant on the automated position display of the NACOS 25 and were, for all intents and purposes, sailing the map display instead of using navigation aids or lookout information.

14. Because the industry standard National Marine Electronics Association (NMEA) 0183 data protocol did not provide a documented or standardized means of communicating or recognizing that a DR positioning mode was in use by a hybrid, DR-capable position receiver, Raytheon and STN Atlas adopted different design philosophies about the communication of position receiver mode changes for the 920 GPS and the NACOS 25.

15. STN Atlas should have, in order to help ensure safety and compatibility with different NMEA 0183 position receivers, programmed the Royal Majesty's NACOS 25 to recognize the "VALID/INVALID" status bits in the (NMEA) 0183 data, including those specified in the (NMEA) 0183 v1.5 "RMC" recommended minimum global positioning system data sentence.

16. Had the NACOS 25 autopilot been configured to compare position data from multiple independent position receivers and had a corresponding alarm been installed that activated when discrepancies were detected, the grounding of the Royal Majesty may have been avoided.

17. Because watch officers must verify proper equipment operation frequently, alternative sources of critical equipment status should have been displayed directly on the console or on repeaters located where they could be seen from the central console.

18. The brief aural alarm of the Raytheon 920 global positioning system (GPS) receiver, the remoteness of the receiver's location, and the failure of the installer to connect the GPS external alarm resulted in the inadequacy of the aural warning sent to the crew when the GPS defaulted to the dead-reckoning mode.

19. Performing failure modes and effects analyses of the Royal Majesty's integrated bridge system would probably have disclosed the shortcomings of the system's components.

1. The on-the-job training program employed by Majesty Cruise Line to train the Royal Majesty's watch officers in the operation of the integrated bridge system did not adequately prepare these officers to identify and respond to system malfunctions.
   
2. The Royal Majesty's integrated bridge system did not adequately incorporate human-factors engineering.
   
3. Currently, there are no performance or training standards for integrated bridge systems, nor are they required to be inspected or certified.
   

SAFETY RECOMMENDATIONS

As a result of its investigation of this accident, the National Transportation Safety Board makes the following safety recommendations:

--to the Majesty Cruise Line:

Provide initial and recurrent formal training on essential technical information, equipment functions, and system operating procedures to all bridge watchstanding personnel on your ships that are equipped with integrated bridge systems. (M-97-00)

Review the bridge watchstanding practices on all your vessels, and revise as necessary, to ensure that all watch officers adhere to sound watchstanding practices and procedures, including using landmarks, soundings, and navigational aids to verify a vessel's position, relying on more than one source for position information, and reporting to the master any failure to see navigational aids. (M-97-00)

Periodically review the performance of all officers onboard your vessels. (M-97-00)

Eliminate the practice of openly routing navigation equipment cable to decrease the risk of damage. (M-97-00)

--to the International Council of Cruise Lines:

Provide initial and recurrent formal training on essential technical information, equipment functions, and system operating procedures to all bridge watchstanding personnel on your ships that are equipped with integrated bridge systems. (M-97-00)

Review the bridge watchstanding practices on all your vessels, and revise as necessary, to ensure that all watch officers adhere to sound watchstanding practices and procedures, including using landmarks, soundings, and navigational aids to verify a vessel's position, relying on more than one source for position information, and reporting to the master any failure to see navigational aids. (M-97-00)

Periodically review the performance of all officers onboard your vessels. (M-97-00)

Eliminate the practice of openly routing navigation equipment cable to decrease the risk of damage. (M-97-00)

-to the U.S. Coast Guard:

As part of the foreign flag passenger ship control verification examination program, assess the adequacy of installed integrated bridge systems and verify that the ships' officers are properly trained in their operation and possible failure modes.

Verify that ships' officers watchstanding procedures include the use of multiple independent means of position verification.

Propose to the International Maritime Organization that it develop appropriate performance standards for the training of watch officers assigned to vessels equipped with integrated bridge systems and require this training. (M-97-00)

Propose to the International Maritime Organization that it develop standards for integrated bridge system design that will require

• multiple independent position receiver inputs;
• monitoring position receiver data for failures/invalid data and subsequent positive annunciation to the crew;
• comparing position receiver data for significant discrepancies between position receivers, and subsequent positive annunciation to the crew; and
• performing failure modes and effects analyses (FMEAs) during the design process and once again when all peripheral devices and equipment details have been "frozen" if the FMEA done during the design process does not account for all peripheral device/equipment variations. (M-97-00)

Propose to the International Maritime Organization that it apply existing human-factors engineering standards in the design of integrated bridge systems on vessels. (M-97-00)

Propose to the International Maritime Organization that a provision be included in the performance standard for integrated bridge systems that would require that a competent independent authority inspect and certify the navigation bridge of each commercial vessel equipped with an integrated bridge system when the system is installed and throughout its life. (M-97-00)

Continue its research on shipboard automation, focusing on watch officers' monitoring and decisionmaking aboard ships with automated integrated bridge systems. (M-97-00)

-to STN Atlas Electronik:

Design integrated bridge systems to incorporate multiple, independent position receivers, comparison of position data from those receivers, and related crew alerts regarding changes in position receiver accuracy, selection, and mode. (M-97-00)

Recommend that all your customers have final failure modes and effects analyses performed for their integrated bridge system installations. (M-97-00)

-to Raytheon:

Design your hybrid positioning systems to identify themselves as integrated instruments (II) with an appropriate system mode identifier (SYS). (M-97-00)

Design your position receivers to provide continuous aural alarms that require positive user action to silence them. (M-97-00)

-to the National Marine Electronics Association:

Revise the 0183 electronic interface standard to provide an explicit means of indicating when hybrid position receivers are transmitting dead reckoning-derived position data. (M-97-00)

Advise your members to (1) immediately inform the National Marine Electronics Association and the International Electrotechnical Commission of perceived inadequacies in electronic interface standards, and (2) if applicable, design their hybrid positioning systems to identify themselves ("talk") as integrated instruments (II) with an appropriate system mode identifier (SYS). (M-97-00)

Recommend to your members that they design and install critical aural alarms that are continuous and require positive user action to silence them. (M-97-00)

-to the International Electrotechnical Commission:

Advise your members to (1) immediately inform the National Marine Electronics Association and the International Electrotechnical Commission of perceived inadequacies in electronic interface standards, and (2) if applicable, design their hybrid positioning systems to identify themselves ("talk") as integrated instruments (II) with an appropriate system mode identifier (SYS). (M-97-00)

-to the International Council of Cruise Lines, the International Chamber of Shipping, and the International Association of Independent Tanker Owners:

Recommend to your members that they ensure that integrated bridge systems installed on their vessels provide critical aural alarms that are continuous and require positive user action to silence them. (M-97-00)

Recommend that your members ensure that their existing and new integrated bridge systems incorporate the following:

• multiple independent position receiver inputs;
• monitoring position receiver data for failures/invalid data and subsequent positive annunciation to the crew;
• comparing position receiver data for significant discrepancies between position receivers, and subsequent positive annunciation to the crew; and

performing failure modes and effects analyses on existing systems, during the design process for new systems, and whenever peripheral devices or equipment details change. (M-97-00)