75
PB97-916401 NTSB/MAR-97/0l NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, DC 20594 MARINE ACCIDENT REPORT GROUNDING OF THE PANAMANIAN PASSENGER SHIP ROYAL MAJESTY ON ROSE AND CROWN SHOAL NEAR NANTUCKET, MASSACHUSETTS JUNE 10, 1995 6598A

Royal Majesty

Embed Size (px)

Citation preview

Page 1: Royal Majesty

PB97-916401NTSB/MAR-97/0l

NATIONALTRANSPORTATIONSAFETYBOARD

WASHINGTON, DC 20594

MARINE ACCIDENT REPORT

GROUNDING OF THE PANAMANIAN PASSENGER SHIPROYAL MAJESTY ON ROSE AND CROWN SHOALNEAR NANTUCKET, MASSACHUSETTSJUNE 10, 1995

6598A

Page 2: Royal Majesty

Abstract: On June 10, 1995, the Panamanian passenger ship Royal Majesty grounded on Rose andCrown Shoal about 10 miles east of Nantucket Island, Massachusetts, and about 17 miles from where thewatch officers thought the vessel was. The vessel, with 1,509 persons on board, was en route from St.George’s, Bermuda, to Boston, Massachusetts. There were no deaths or injuries as a result of thisaccident. Damage to the vessel and lost revenue, however, were estimated at about $7 million.

This report examines the following major safety issues: performance of the Royal Majesty’s integratedbridge system and the global positioning system, performance of the Royal Majesty’s watch officers,effects of automation on watch officers’ performance, training standards for watch officers aboardvessels equipped with electronic navigation systems and integrated bridge systems, and design,installation, and testing standards for integrated bridge systems.

As a result of its investigation, the National Transportation Safety Board issued safety recommendationsto Majesty Cruise Line, the U.S. Coast Guard, STN Atlas Elektronik GmbH, Raytheon Marine, theNational Marine Electronics Association, the International Electrotechnical Commission, theInternational Council of Cruise Lines, the International Chamber of Shipping, and the InternationalAssociation of Independent Tanker Owners.

The National Transportation Safety Board is an independent Federal agency dedicated to promotingaviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, theagency is mandated by Congress through the Independent Safety Board Act of 1974 to investigatetransportation accidents, determine the probable causes of the accidents, issue safety recommendations,study transportation safety issues, and evaluate the safety effectiveness of government agencies involved intransportation. The Safety Board makes public its actions and decisions through accident reports, safetystudies, special investigation reports, safety recommendations, and statistical reviews.

Information about available publications may be obtained by contacting:

National Transportation Safety BoardPublic Inquiries Section, RE-51490 L'Enfant Plaza, SWWashington, DC 20594(202) 314-6551

Safety Board publications may be purchased, by individual copy or by subscription, from:

National Technical Information Service5285 Port Royal RoadSpringfield, Virginia 22161(703) 487-4600

Page 3: Royal Majesty

GROUNDING OF THE PANAMANIAN

PASSENGER SHIP ROYAL MAJESTY

ON ROSE AND CROWN SHOAL

NEAR NANTUCKET, MASSACHUSETTS

JUNE 10, 1995

MARINE ACCIDENT REPORT

Adopted: April 2, 1997Notation 6598A

NATIONALTRANSPORTATION

SAFETY BOARD

��������� � �����

Page 4: Royal Majesty
Page 5: Royal Majesty

���

CONTENTS

������������� � ����������������������������������������������������������������������������������������� �

���������������������������������������������������������������������������������������������������������������� �

�������� ������������������������������������������������������������������������������������������ �

��� ����� ����� � ���������������������������������������������������������������������������������� �

�������� ��������������������������������������������������������������������������������������������������

������������� ����������������������������������������������������������������������������������������

������������ ��� ������������������������������������������������������������������������������������

!�� �� �����������������������������������������������������������������������������������������

������"����� ���������������������������������������������������������������������������������

#����� �� �������������������������������������������������������������������������������������

$�����"����� �������������������������������������������������������������������������������

�������������� ��� �����������������������������������������������������������������������������������%

&����������������������������������������������������������������������������������������������%

�� ���� ���'������$(� �� ������������������������������������������������������������������%

������������������� ���� ���'������$(� �� ������������������������������������������ �

)�� ���&����������*������#�"$� +�����������������������������������������������

)� ����(�������� ���������������������������������������������������������������������������������

!� ������������������ ��� ����������������������������������������������������������������������� %

��,���������������� ��� ������������������������������������������������������������������������� %

)� �� ���������������������� ��������������������������������������������������������������� %

��� ����� ���� �������&�$ ���������������������������������������������������������������������� -

$��� (�'����.��*���� �$��� (�/�������� ���� ���������������������������������������������� -

$��� (�'����.����0���1�������������������������������������������������������������������������� 2

!����� ������������������������������������������������������������������������������������ 2

$ ��������"�����3� ���� ������������������������������������������������������������������ 2

��������� ����$��� ��� �������������������������������������������������������������������� 4

���������������������������������������������������������������������������������������������������������������� �

&������������������������������������������������������������������������������������������������������ �

�������� ����������������������������������������������������������������������������������������� �

)� ��"������.����������� ���������������������������������������������������������������������%5

�6��7��� ����7� �������������������������������������������������������������������������%�

1� ���� ���������������������������������������������������������������������������������%�

&�$�$ � �������������������������������������������������������������������������������������%�

�����8��9����������� ������ ����������������������������������������������������������%�

*���������� ���8��,����� ����������������������������������������������������������������%

���� ���� �������#����� ���������������������������������������������������������������%

!�� ��.��!��� ���������������.�������������������������������������������������������%%

���� ������ ��� �������)� ��"������.����������� �������������������������������������%-

�� ���� ���'������$(� ��������������:�� ���������������������������������������������������%2

Page 6: Royal Majesty

��

;�����$(� ������ ���� ��� �����������������������������������������������������������������������%�

)� ��"������.�������������*������� ���� ���'������$(� ��� ��������������������-5

;����8�� ��������������� ��������������������������������������������������������������-

��� ���� ��������� ���� ���'������$(� ��� �����������������������������������������������������-%

����������� ���������������������������������������������������������������������������������������������������-+

� ����������� ����������������������������������������������������������������������������������������������-4

����������������������������������������������������������������������������������������������������������-<

77����,�=������ ��� ��������;������������������������������������������������������������������������+%

77����,�'=�!���� (��������:���.�������������.��>'����������������&����?���������������++

77����,��=�!���� (��������:���.����������#���� ���������������������������������������������������+�

77����,��=���� ����� ���� �������&�$�/������������ ���� ����������������������������������2�

77����,��=�$��� (�'����.��*���� �$��� (�/�������� �������������������������������������������2%

77����,�1=�/������������������������#�� �9� �$������������@�����5A����+ ���������������2+

77����,�&=�00����� ������������(����������������������������������������������������������������24

Page 7: Royal Majesty

v

EXECUTIVE SUMMARY

About 2225 on June 10, 1995, the Panama-nian passenger ship Royal Majesty grounded onRose and Crown Shoal about 10 miles east ofNantucket Island, Massachusetts. The vessel,with 1,509 persons on board, was en route fromSt. George’s, Bermuda, to Boston, Massachu-setts. Initial attempts to free the vessel were un-successful. Deteriorating weather and sea con-ditions prevented the evacuation of passengersand crewmembers from the vessel.

On June 11, the Royal Majesty, with the aidof five tugboats, was freed from its strand. Ini-tial damage surveys revealed deformation of thevessel’s double bottom hull. However, no pene-tration or cracking of the hull was detected, andno fuel oil had been spilled. The U.S. CoastGuard gave the vessel permission to proceed toBoston. On June 12, the vessel arrived in Bostonand disembarked its passengers.

There were no deaths or injuries as a resultof this accident. Damage to the vessel and lostrevenue, however, were estimated at about $7million.

The National Transportation Safety Boarddetermines that the probable cause of thegrounding of the Royal Majesty was the watchofficers’ overreliance on the automated featuresof the integrated bridge system, Majesty CruiseLine’s failure to ensure that its officers wereadequately trained in the automated features ofthe integrated bridge system and in the implica-tions of this automation for bridge resourcemanagement, the deficiencies in the design andimplementation of the integrated bridge systemand in the procedures for its operation, and thesecond officer’s failure to take corrective actionafter several cues indicated the vessel was offcourse.

Contributing factors were the inadequacy ofinternational training standards for watch-standers aboard vessels equipped with electronicnavigation systems and integrated bridge sys-tems and the inadequacy of international stan-dards for the design, installation, and testing ofintegrated bridge systems aboard vessels.

This report examines the following majorsafety issues:

• Performance of the Royal Majesty’sintegrated bridge system and theglobal positioning system.

• Performance of the Royal Majesty’swatch officers.

• Effects of automation on watch of-ficers’ performance.

• Training standards for watch offi-cers aboard vessels equipped withelectronic navigation systems andintegrated bridge systems.

• Design, installation, and testingstandards for integrated bridge sys-tems.

As a result of its investigation of this acci-dent, the Safety Board issued safety recommen-dations to Majesty Cruise Line, the U.S. CoastGuard, STN Atlas Elektronik GmbH, RaytheonMarine, the National Marine Electronics Asso-ciation, the International Electrotechnical Com-mission, the International Council of CruiseLines, the International Chamber of Shipping,and the International Association of IndependentTanker Owners.

Page 8: Royal Majesty
Page 9: Royal Majesty

1

The AccidentAbout 22251 on June 10, 1995, the Panama-

nian passenger ship Royal Majesty (see figure 1)grounded on Rose and Crown Shoal near Nan-tucket Island, Massachusetts. The Royal Maj-esty, carrying 1,509 passengers and crewmem-bers, was en route from St. George’s, Bermuda,to Boston, Massachusetts. No injuries or deathsresulted from the grounding.

On the night of the accident, the Royal Maj-esty was on the last day of a 7-day voyage. Theship had left Boston for Bermuda on June 5. Thevessel had arrived in St. George’s on June 7,where it was berthed until it departed Bermudaon June 9 for the return trip to Boston. The ves-sel was scheduled to arrive in Boston about0530 on June 11.

The return trip to Boston was divided intotwo legs. The first leg normally extended fromSt. George’s to the entrance of the approach tothe Port of Boston Traffic Separation Scheme(Boston traffic lanes)—a distance of more than500 miles over open ocean. The second legnormally took the vessel in a northerly directionthrough the traffic lanes along the eastern edgeof Nantucket Shoals and around the easternshores of Cape Cod. The entire voyage to Bos-ton (a distance of about 677 miles—see figure2) normally took about 41 hours.

The navigator testified that on June 9, hewent on duty about an hour before the scheduleddeparture time of 1200. He said that he custom-arily tested the vessel’s navigational equipmentbefore getting underway. He stated that when hetested the navigation equipment, including“compasses, repeaters, radars, NACOS 25, GPS,Loran-C, and the communications systems”during the half hour before the vessel departedSt. George’s, he found the equipment to be in

1This report uses eastern standard times based on the 24-

hour clock.

“perfect” operating condition. He said thatshortly after departure, he set the navigation andcommand system (NACOS) 25 autopilot on thenavigation (NAV) mode.2 He further stated thatlater when the vessel dropped off the harbor pi-lot (about 1230), he compared the position datadisplayed by the global positioning system(GPS)3 and by the Loran-C4 and found that thetwo sets of position data indicated positionswithin about a mile5 of each other.

According to the watch officers on duty, thenorthbound trip was uneventful during the first24 hours. The watch officers stated that theRoyal Majesty followed its programmed track,as indicated on the display of the automatic ra-dar plotting aid (ARPA) maintaining a course ofabout 336°.6

2A description of the vessel’s radar and navigational

equipment is contained in a section on vessel informationlater in the report. When set on the NAV mode, theNACOS 25 autopilot automatically corrected for the effectof set and drift caused by the wind, sea, and current to keepthe vessel within a preset distance of its programmed track.

3The GPS is a satellite-based radio navigation system de-

signed to provide continuous and accurate position dataunder all weather and sea conditions. The accuracy of thesystem is based on the GPS unit’s ability to receive, iden-tify, and measure radio signals from orbiting satellites. TheGPS receiver on the Royal Majesty, when fully operational,was capable of providing position data accurate to within100 meters to the NACOS 25 autopilot (see discussion laterin this section).

4The Loran-C is a radio-based navigation system de-

signed to provide position data along the coasts of theUnited States. The system is based on the Loran-C unit’sability to receive, identify, and measure time-differenceradio signals from a series of land-based Loran stations.The accuracy of the system is largely dependent on theuser’s location in relation to the transmitting stations. Forexample, the Loran lines of position in the Bermuda areacross at oblique angles, whereas along the U. S. coast, nu-merous lines of position cross at much sharper angles toprovide greater accuracy.

5In this report, the term mile means nautical mile.

6Unless otherwise specified, only true courses and bear-

ings are noted in this report.

INVESTIGATION

Page 10: Royal Majesty
Page 11: Royal Majesty

3

Figure 2—Map of route between Bermuda and Boston.

Page 12: Royal Majesty

4

At 1200 on June 10, the navigator was againon watch, assisted by a quartermaster. Accord-ing to the navigator, the Royal Majesty main-tained its course of 336°, and its speed was 14.1knots (over ground). Entries in the vessel’sbridge log indicated cloudy skies, winds out ofthe east-northeast at 8 knots, and seas between 1and 3 feet. Meteorological visibility was report-edly at least 10 miles.

The navigator stated that during his watch,he was using the port ARPA on the 12-mile-range scale. (See figure 3.) He also stated thathe was plotting hourly fixes on the chart of thearea using position data from the GPS. He statedthat although he frequently checked the positiondata displayed by the Loran-C, all of the fixesthat he plotted during the voyage from Bermudawere derived from position data taken from theGPS and not the Loran-C. (See figure 4. In thelower photograph, the lower receiver was in-stalled after the accident.) The navigator furtherstated that in the open sea near Bermuda, thepositions indicated by the GPS and Loran-Cwould have been expected to be within ½ to 1mile of each other. As the vessel approachedcloser to the United States, the positions wouldhave been expected to be within about 500 me-ters of each other.

At 1600, the watch changed, and the ves-sel’s chief officer relieved the navigator. Thechief officer was assisted by a quartermaster,who acted as either a helmsman or a lookout onan as-needed basis. The chief officer stated thathe used the port radar set on the 12-mile range.He further stated that no procedure specified thenumber of radars to use, but that usually twowere used in bad weather. He stated that be-cause the weather was good and visibility wasclear, he used one radar. The chief officer alsoindicated that he relied on the position data fromthe GPS to plot hourly fixes during his watchesand that the Loran-C was used as a backup sys-tem in case the GPS malfunctioned. He stated,however, that for the 1700 and 1800 hourlyfixes he compared the data from the GPS withthe data from the Loran-C and that in both in-stances the Loran-C indicated a position about 1mile to the southeast of the GPS position.

The chief officer testified that before the1700 hourly fix, at about 1645, the master tele-phoned the bridge and asked him when he ex-pected to see the BA buoy, the buoy that markedthe southern entrance to the Boston traffic lanes(see figure 5). The chief officer responded thatthe vessel was about 2½ hours away (35.25miles at 14.1 knots) from the buoy. The mastertestified that he asked the chief officer to callhim when he saw the buoy. According to thechief officer, about 45 minutes later (1730), themaster visited the bridge, checked the vessel’sprogress by looking at the positions plotted onthe chart and at the map overlay exhibited on theARPA display, and asked a second time whetherthe chief officer had seen the BA buoy.7 Thechief officer responded that he had not. Shortlythereafter, the master left the bridge.

According to the chief officer, about 1845,he detected on radar a target off his port bow ata range of about 7 miles and concluded that thetarget was the BA buoy. He stated that his con-clusion had been based on the GPS positiondata, which indicated that the Royal Majestywas following its intended track, and on the factthat the target had been detected about the time,bearing, and distance that he had anticipateddetecting the BA buoy. He further testified thaton radar the location of the target coincided withthe plotted position of the buoy on the ARPAdisplay. He said that about 1920, the radar targetthat he believed to be the BA buoy passed downthe Royal Majesty’s port side at a distance of 1.5miles. He stated that he could not visually con-firm the target’s identity because of the glare onthe ocean surface caused by the rays of the set-ting sun.

He testified that about 1930, the mastertelephoned the bridge and asked him for thethird time whether he had seen the BA buoy.According to the chief officer, he responded that

7The master testified that it was his practice to visit the

bridge about 10 to 15 minutes after the change of the watchand that he typically called or visited the bridge betweentwo and four times during each watch. Each visit to thebridge lasted between 10 and 15 minutes. He also testifiedthat when he visited the bridge he typically checked thevessel’s position by looking around and by examining thechart and the NACOS 25 map overlay on the ARPA.

Page 13: Royal Majesty

5

3

u

Page 14: Royal Majesty
Page 15: Royal Majesty

7

7 n WA, *oO%n( w Aoti AR03no W., . . -, W.... -,. . .. --,.

Figure 5-Intended track and approximately actual track.

Page 16: Royal Majesty

8

the ship had passed the BA buoy about 10 min-utes earlier (about 1920). The master then askedwhether the chief officer had detected the buoyon radar; the chief officer replied that he had.According to the testimony of the chief officerand the master, the chief officer did not tell themaster that he had been unable to visually con-firm the identify of the BA buoy, and the masterdid not ask whether the buoy had been visuallyconfirmed.

The second safety officer (second officer)testified that he arrived on the bridge about 1955and prepared to assume the watch from the chiefofficer. According to the testimony of both offi-cers, during the subsequent change-of-the-watchbriefing (2000), they discussed the traffic con-ditions and the vessel’s course, speed, and posi-tion. According to the testimony, the chief offi-cer did not discuss with his relief the circum-stances surrounding his identification of the BAbuoy. The second officer testified that at 2000,he assumed the watch, assisted by two quarter-masters,8 and that the chief officer left thebridge. The second officer stated that shortlyafter assuming the watch, he reduced the rangesetting on the port radar from the 12-mile rangeto the 6-mile range. He testified that he relied onthe position data from the GPS in plottinghourly fixes during his watches and that he con-sidered the Loran-C to be a backup system. Healso stated that it was not his practice to use theLoran-C to verify the accuracy of the GPS.

The quartermaster standing lookout on theport bridge wing (port lookout) stated that about2030 he saw a yellow light off the vessel’s portside and reported the sighting to the second offi-cer. According to the quartermaster, the secondofficer acknowledged the report, but took nofurther action. At the time of the sighting, theNACOS 25 was showing the Royal Majesty’sposition to be about halfway between the BAand BB buoys. (The BB buoy is the second buoyencountered when traveling northbound in theBoston traffic lanes.) Shortly after the sightingof the yellow light, both the starboard and portlookouts reported the sighting of several high

8The two quartermasters served as port and starboard

lookouts.

red lights off the vessel’s port side.9 Accordingto the lookouts, the second officer acknowl-edged the report, but took no further action.

The port lookout stated that shortly after thesightings of the yellow and red lights, the mastercame to the bridge. The master testified that hespent several minutes talking with the secondofficer and checking the vessel’s progress bylooking at the plotted fixes on the chart and themap overlay on the ARPA display. According tothe master, the GPS and ARPA displays wereshowing that the vessel was within 200 metersof its intended track. The master then left thebridge. According to the testimony of both themaster and the second officer, no one told themaster about the yellow and red lights that thelookouts had sighted earlier.

The master testified that about 2145, hetelephoned the bridge and asked the second offi-cer whether he had seen the BB buoy. The mas-ter stated that the second officer told him that hehad seen it.

According to the master, about 2200 he ar-rived on the bridge for the second time duringthat watch. He testified that after talking withthe second officer for several minutes, hechecked the vessel’s progress by looking at thepositions plotted on the chart and at the mapoverlay on the ARPA display. He stated that heagain asked the second officer whether he hadseen the BB buoy and the second officer repliedthat he had. Satisfied that the positions plottedon the chart and that the map displayed on theradar continued to show the vessel to be fol-lowing its intended track, the master left thebridge about 2210. He stated that he did notverify the vessel’s position using either the GPSor the Loran-C for two reasons: (1) his officershad reported that the BA and BB buoys hadbeen sighted, and (2) he had observed that themap overlay on the ARPA display showed thatthe vessel was following its intended track.

9A series of radio towers with flashing red lights are on

the eastern end of Nantucket. Because the towers are about30 miles from the traffic lanes, the lights are not generallyvisible to vessels transiting the traffic lanes.

Page 17: Royal Majesty

9

The second officer testified that he had notseen the BB buoy but had informed the masterotherwise because he had “checked the GPS andwas on track” and because “perhaps the radardid not reflect the buoy.” He also testified thaton the previous transits of the traffic lanes, hehad sighted buoys both visually and by radar.

According to the testimony of the lookouts,a few minutes after the master left the bridge,the port lookout reported to the second officerthe sighting of blue and white water dead ahead.According to this lookout, the second officeracknowledged receiving the information, but didnot discuss it or take action. The port lookoutstated that the vessel later passed through thearea where the blue and white water had beensighted.

The second officer testified that about 2220,the Royal Majesty unexpectedly veered to portand then sharply to starboard and heeled to port.The second officer stated that because he wasalarmed and did not know why the vessel wassheering off course, he immediately switchedfrom autopilot to manual steering. The master,who was working at his desk in his office, feltthe vessel heel to port and ran to the bridge. Hestated that when he arrived on the bridge, hesaw the second officer steering the ship manu-ally and instructed one of the lookouts to takeover the helm. The master then turned on thestarboard radar, set it on the 12-mile range,10

and observed that Nantucket was less than 10miles away. According to the master, he imme-diately went into the chart room to verify hisposition. He stated that he then immediately or-dered the helmsman to apply hard right rudder.However, before the helmsman could respond,the vessel grounded, at 2225. The master statedthat he then had the vessel’s GPS and Loran-Cchecked and realized for the first time that theGPS position data was in error by at least 15miles. The Loran-C position data showed thevessel where it had grounded, about 1 mile

10

According to the master, the starboard radar was typi-cally turned off during good weather. When he used thestarboard radar, he normally set it on the 12-mile range. Hefurther stated that no procedures prescribed the radar scaleto use; it was the option of the watch officer on duty.

south of Rose and Crown Shoal.11 (See figure6.) Charts of the area indicate that the shoal,which is about 10 miles east of Nantucket’sSankaty Head Light, has a hard sandy bottom.

Postaccident EventsThe master testified that immediately after

the grounding, he called the engineroom andtold the engineering officer on duty that the ves-sel had grounded and that he should immedi-ately inspect the vessel’s double bottom hull andfuel tanks for signs of leakage. According to themaster, several minutes later, the engineroomcalled the bridge and reported that there was noevidence that the vessel was taking on any wa-ter. The master responded by asking the engin-eroom personnel to repeat the inspection, whichthey did. The master stated that about 2245 theengineroom again reported to him that no evi-dence of leakage had been found. Shortly there-after, the master instructed the vessel’s cruisedirector to inform the passengers and crewmem-bers that the vessel had run aground, that it wasnot in any danger, and that the crew was tryingto free the vessel by using its engines. At 2310,the U.S. Coast Guard, after receiving a messagefrom a passenger via cellular telephone, calledthe Royal Majesty, at which point the RoyalMajesty requested Coast Guard assistance. Ac-cording to the testimony of the master, he hadbeen about to notify the Coast Guard when theCoast Guard called him.12

Several unsuccessful attempts were madebetween 2245 and 0015 to free the vessel usingthe main engines. Shortly thereafter, MajestyCruise Line, the owner of the vessel, made

11

Rose and Crown Shoal is one of numerous shoals thatlie east and south of Nantucket Island, making the area oneof the most dangerous for ships. (See “Waterway Informa-tion” later in this report for a more detailed discussion.)

12According to 46 Code of Federal Regulations 4.05-

1(a), immediately after the addressing of resultant safetyconcerns, the owner, agent, master, operator, or person incharge shall notify the nearest Marine Safety Office, Ma-rine Inspection Office, or Coast Guard Group Office when-ever a vessel is involved in a marine casualty consisting ofan unintended grounding. According to the Coast Guard,the time interval was reasonable and the Coast Guard tookno enforcement action regarding the notification.

Page 18: Royal Majesty
Page 19: Royal Majesty

11

arrangements to hire tugboats to pull the vesseloff the shoal.

At 0024 on June 11, the passengers weretold that the efforts to free the vessel had beenunsuccessful and that the vessel was awaitingthe arrival of tugboats. Later that morning, thepassengers were told that they and their luggagewould be transferred to ferries for transport toHyannis, Massachusetts, and then to Boston.

At 1330 on June 11, the ferries M/V BrantPoint and Point Gammon arrived on scene.13

The Brant Point and Point Gammon togethercould hold about 1,200 persons.

At 1550, the tugboats Vincent Tibbets, Har-old Rheinhauer, Resolute, Reliance, and Venusarrived on scene. Meanwhile, sea conditionscontinued to deteriorate. About 1600, plans tooffload passengers to the ferries were canceledbecause sea conditions had become too hazard-ous. Shortly thereafter, the Brant Point and thePoint Gammon returned to Hyannis.

At 2154, the Royal Majesty, with the aid offive tugboats, was refloated and escorted to asafe anchorage near Chatham, Massachusetts,where the damage was surveyed. At 0742 on themorning of June 12, the Coast Guard gave thevessel permission to begin the 6-hour trip toBoston. At 1535, the vessel was safely mooredwith its port side to the Black Falcon PassengerTerminal in Boston. Passengers began disem-barking the vessel at 1710.

The Coast Guard/Safety Board hearing intothe grounding of the Royal Majesty was heldJune 14 through June 16 in Boston. After thehearing, the Safety Board learned that two fish-ing vessels were just east of Fishing Rip Shoalon the evening of June 10. They observed acruise ship pass about ¾ mile west of the fishingvessels’ position heading in a northerly direc-tion. About 2042, one of the fishing vessels ra-dioed a cruise ship at “41 02N, 69 24W” viaVHF-FM channel 16. They later stated it wastheir intent to inform the vessel that it was in an

13Hyline Cruises in Hyannis, Massachusetts, owned and

operated the two ferries. Hyline Cruises operates a ferryservice between Cape Cod and Nantucket and Martha’sVineyard.

area not frequented by large cruise ships. Thecalls to the cruise ship were in English; how-ever, all the transmissions between the fishingvessels, including the transmission regarding theship being in the wrong location, were in Portu-guese. An unknown person interrupted the Por-tuguese conversation and requested that thefishermen change channels. (See appendix F.)

According to international regulations(SOLAS-Regulation 8), when ships such as theRoyal Majesty are at sea they are required tomaintain a continuous listening watch on thenavigating bridge on 156.8 MHz (channel 16).During the Coast Guard Marine Board of In-quiry, the second officer was not asked whetherhe was monitoring channel 16 on the night ofthe accident.14 Since that time, a spokespersonfor Majesty Cruise Line has identified the per-son who interrupted as possibly the second offi-cer. The Safety Board could not confirm this.According to the Coast Guard, the call to thecruise ship from the fishing vessel did not con-vey any urgency and would not have alerted thesecond officer aboard the Royal Majesty or theradio operator at U.S. Coast Guard GroupWoods Hole, where the transmissions were re-corded, that the Royal Majesty or any othercruise ship was in danger.

InjuriesThe accident did not cause any deaths or

injuries.

Vessel DamageOn June 16, the Royal Majesty left Boston

for the Sparrows Point Shipyard in Baltimore,Maryland, where it was drydocked and repaired.The grounding of the Royal Majesty had dam-aged its outer hull extensively. According to thefield survey conducted by Lloyds Register onJune 19, a portion of the vessel’s outer shellplating, which was about 51 feet wide and 41feet long, needed to be cropped and renewed.The report also indicated that the bottom fuel oil

14

The second officer was released by Majesty CruiseLine after the accident and is not available in this country.

Page 20: Royal Majesty

12

tanks and the internal steel structure between thevessel’s internal tank tops and hull plating hadbeen substantially damaged. No oil spilled as aresult of the accident.

On June 22, the vessel was refloated andreturned to Boston. On June 24, the vessel re-sumed passenger service. Total structural dam-age was estimated at about $2 million. Lostrevenue for the period the vessel was out ofservice was estimated at about $5 million.

Crew InformationMaster.—The master, age 53, held a mas-

ter’s certificate for seagoing vessels that hadbeen issued by Panama on June 7, 1991. He alsoheld a master’s certificate from the Greek gov-ernment that was originally issued in 1974. Hehad been going to sea for 32 years. During hiscareer, he had served in a variety of licenseddeck officer positions on tankships and passen-ger ships. Between 1968 and 1992, he had sailedas chief officer and master on several passengervessels built in the 1950s. Majesty Cruise Lineassigned him as master of the Royal Majesty inNovember 1992. He stated that the Royal Maj-esty was the first vessel that he had served onthat had an integrated bridge system.15

The master testified that he had not con-sumed any alcohol before the grounding, that hehad not taken any prescription medicine, andthat he was not required to wear eyeglasses. Hestated that he typically slept about 7 hours eachnight, from 2400 to 0700, and then took a 1-houror 1½-hour nap in the afternoon, schedule per-mitting.

Chief Officer.—The chief officer, age 43,held a master’s certificate for seagoing vesselsthat had been issued by Panama on May 20,1994. He also held a chief officer’s certificateissued by the Greek government in 1982. He hadbeen going to sea since 1971. During his career,he had served in a variety of licensed deck offi-cer positions on cargo ships, tankships, and pas-senger ships. Between 1981 and 1992, he hadbeen chief officer on four passenger vessels

15

“Vessel Information,” the next section of the report,discusses integrated bridge systems.

built in the 1950s. Majesty Cruise Line hiredhim as chief officer on the Royal Majesty in1992. The Royal Majesty was the first vessel hehad served on that had an integrated bridge sys-tem. At the time of the grounding, he had spent30 of the previous 36 months as a bridge watchofficer aboard the Royal Majesty.

The chief officer stated that routinely afterfinishing his 1600-to-2000 watch, he would jogon deck (weather permitting) for about 45 min-utes, work out in the vessel’s gym for about 15minutes, and retire around 2200. He normallyslept until about 0330. He stated that typicallyhe also slept about 2½ hours before starting his1600 watch.

Navigator.—The navigator, age 30, held asecond officer’s certificate for seagoing vesselsthat had been issued by the Greek governmenton May 18, 1994. He also held a second offi-cer’s license from Panama. He had been goingto sea in a licensed capacity since March 20,1987. During his career, he had served 8 monthsas second officer on a tankship and 7 months assecond officer on two passenger ships that hadbeen built in the 1950s. Majesty Cruise Linehired him as a second officer on the S/S Se-abreeze on July 18, 1994. He was assigned asnavigator aboard the Royal Majesty on August1, 1994. The Royal Majesty was the first vesselthat he had served on that had an integratedbridge system.

The navigator testified that he had not con-sumed alcohol in the 24 hours before his lastwatch, that he was not taking any prescriptiondrugs, and that he was not required to wear eye-glasses.16

Second Officer.—The second officer, age33, held a chief officer’s certificate for seagoingvessels that had been issued by the Greek gov-ernment on January 4, 1991. He also held achief officer’s license from Panama. He hadbeen going to sea in a licensed capacity sinceMay 1984. During his career, he had served in avariety of licensed deck officer positions on

16

There was no information in the navigator’s testimonyabout the amount of sleep he received in the 24 hours be-fore his last watchstand or about his sleep pattern.

Page 21: Royal Majesty

13

bulk carriers and passenger ships. He had sailedas second officer and chief officer on five pas-senger vessels between 1987 and 1994. MajestyCruise Line hired him as a second officer onMay 1, 1995. After 3 weeks of on-the-job train-ing, the master allowed him to stand a naviga-tion watch alone. On May 21, 1995, he assumedhis duties as watch officer for the 0800-to-1200watch. The Royal Majesty was the first vesselthat he had served on that had an integratedbridge system.

The second officer testified that he had notconsumed alcohol or taken any prescriptionmedicine in the 24 hours before his last watch.He stated that he slept about 7 hours after fin-ishing his previous 2000-to-2400 watch and thathe had also taken a 2-hour nap before beginninghis 2000 watch on June 10.

Vessel InformationGeneral.—The Royal Majesty was a con-

ventional steel-hull, bulbous-bow, passengerliner designed for unrestricted internationalvoyages. The vessel was constructed in 1992 atKvaener Masa Yard in Turku, Finland. Panamahad certified the vessel to carry 1,256 passen-gers and 490 crewmembers, a total of 1,746 per-sons. The vessel held the highest vessel classifi-cation for construction issued by Det NorskeVeritas (DNV). The vessel’s principal charac-teristics follow:

Length overall: 568 feet (173.16 meters)Breadth: 91 feet (27.60 meters)Draft (departureBermuda): forward: 18 feet, 0.5 inches

(5.5 meters); aft: 19 feet, 6 inches (5.95 meters)

Gross registeredtonnage: 32,396Displacement: 17,214 tonsService speed: 19 knotsPropellers: two controllable pitch

The Royal Majesty was fitted with the fol-lowing navigation, communications, shiphan-dling, and collision-avoidance equipment:

Radar: Two Krupp Atlas17 Model 8600 A/CAS with ARPA

Radar: One Krupp Atlas slave radar with ARPA

Autopilot: STN Atlas ElektronikGPS: Raytheon RAYSTAR 920 with

dead-reckoning backup mode optioninstalled (NNE-205 DR interface)

Loran-C: Raytheon RAYNAV 780VHF radios: Two Sailor radios (with dual

monitoring capabilities)Speed log: Atlas Dolog 23Gyrocompass: AnschutzCourserecorder: Anschutz

Integrated Bridge System.—The RoyalMajesty had an integrated bridge system. Ac-cording to the definition of the InternationalElectrotechnical Commission (IEC),18 issuedafter the vessel was built, an integrated bridgesystem is a combination of systems that are in-tegrated in order to allow centralized access tosensor information and command/control fromworkstations. One of the main components ofthe vessel’s integrated bridge system was STNAtlas Elektronik (STN Atlas) NACOS 25.19 TheNACOS 25 was a special upgrade of the firstgeneration NACOS 20 integrated navigationsystem, of which approximately 130 have beensold and installed on vessels of various typesand service. The NACOS 25 was specificallydesigned for service on six Baltic Sea ferriesconstructed at Kvaener Masa Yard. Some weresold to Italian vessel owners. According to STNAtlas, 14 NACOS 25 units were sold to ownersof passenger ships. The last unit was sold inMay 1988 to the shipyard constructing the RoyalMajesty. However, because of construction de-lays, the Royal Majesty’s NACOS 25 equipment

17

Krupp Atlas was the previous name of STN AtlasElektronik.

18A later section of the report discusses the IEC and in-

tegrated bridge systems in general.19

According to STN Atlas, 260 such units have been soldworldwide; 200 are currently in service. (Safety At Sea.June 1995, page 36.)

Page 22: Royal Majesty

14

was held in stock until installation in the springof 1992.

The Royal Majesty’s NACOS 25 was capable ofcreating radar maps and exhibiting them on theARPA display (see figure 7). The radar mapscould be tailored to include reference pointsalong the vessel’s intended track (aids to navi-gation, navigation marks, waypoints, turningpoints, etc.). Navigation lines could also beadded to these maps for the purpose of outliningthe perimeter of traffic lanes, channels, and ar-eas containing hazards to safe navigation.

The navigator testified that a radar map hadbeen created for the voyage between St.George’s and Boston. He also testified that themap, showing the vessel’s preprogrammedtrack, waypoints, and the location of the buoysnear the intended track, was exhibited on theARPA display before the accident.

The autopilot portion of the NACOS 25,using programmed information (latitude andlongitude of waypoints and the vessel’s maneu-vering characteristics), gyro and speed data, andposition data from the GPS or the Loran-C, wascapable of automatically steering the vesselalong a preprogrammed track. When engagedand operating in the NAV mode, the autopilotsteered the ship in accordance with the pro-grammed track while automatically compensat-ing for the effect of gyro error, wind, current,and sea. According to the Royal Majesty’sbridge officers, the NACOS 25 autopilot wasengaged and operating in the NAV mode fromthe time the vessel departed St. George’s (1400on June 9) to before the grounding.

The Raytheon GPS unit installed on theRoyal Majesty had been designed as a stand-alone navigation device in the mid- to late1980s, when navigating by dead reckoning(DR)20 was common and before the GPS satel-lite system was fully operational. The GPS unitwas designed to default to either a DR mode or

20

DR is a means of navigating. After an initial position isestablished, the position is estimated over time using datainput from the vessel’s speed log and gyro. The accuracy ofDR calculations depends on the accuracy of the speed inputand the effects of wind and current.

a hybrid navigation mode (accepting positiondata from a Loran-C, Omega, or Transit satellitenavigation receiver). The Royal Majesty’s GPSwas configured by Majesty Cruise Line toautomatically default to the DR mode when sat-ellite data were not available.21 When theRAYSTAR 920 GPS unit switches to DR mode,it

• issues a series of aural chirps simi-lar to those of a wristwatch alarm(the total duration of the series is 1second);

• continuously displays SOL (solu-tion)22 and DR on a liquid crystaldisplay; the display measures 3inches high by 3.5 inches wide (seefigure 8);

• changes the state of National Ma-rine Electronics Association(NMEA)23 0183 status field bitsfrom valid to invalid, indicating thatvalid position data are no longerbeing transmitted; and

• closes an electronic switch that isprovided as a means of activating anexternal alarm or other device of theinstaller’s choice (such as an exter-nal flashing light, audio alarm,etc.).24

21

RAYSTAR 920 DR mode capability requires courseand speed input either by manual entry or via an optionalinterface box. The Royal Majesty’s RAYSTAR 920 wasconfigured to use the DR interface box. According to STNAtlas, during the construction of the Royal Majesty, STNAtlas was told that the GPS would be backed up by a Lo-ran-C system during periods of GPS data loss, but was nottold that the GPS receiver would default to the DR mode.

22Raytheon engineers informed the Safety Board that

SOL is meant to indicate that the GPS satellite positionsolution is invalid or not available. According to the Ray-star 920 operation manual, SOL means the unit cannotcalculate its lat/long position.

23The NMEA 0183 is an industry-standard electronic

signal specification that defines how data are to be trans-mitted from an electronic device.

24An external alarm was not connected to this switch on

the Royal Majesty.

Page 23: Royal Majesty

15

al

L.g

L

Page 24: Royal Majesty

“Y3Z,.a:

7?3. . .,.. .,.,. . . .,.,;.’

--:-

sg=QD6

#. . . . ....:-

t “7m

IFigure 8—GPS display showing SOL and DR.

Page 25: Royal Majesty

17

All the watch officers testified that they didnot see SOL and DR displayed on the GPS unitduring their watches before the grounding. Theirtestimony indicated that they understood themeaning of these symbols and had seen them onprevious occasions.

The Raytheon RAYSTAR 920 GPS and theRaytheon RAYNAV 780 Loran-C were de-signed to output position and other navigationdata in NMEA 0183 v1.5 format.25 The outputincluded the recommended minimum GPS datasentence, RMC, which contained, among otherdata, latitude/longitude position coordinates.26

A position receiver that transmits data is a“talker” device in NMEA nomenclature; theRaytheon 920 GPS identified itself as a GPtalker, which signified a GPS position receiversending GPS position data. A position receiversuch as the Raytheon 920 GPS, while operatingin different position modes, could identify itselfas an integrated instrument (II) talker. At thetime the system was designed, the NMEA speci-fied a SYS sentence to identify the operationalmode of a hybrid system. The SYS sentence de-fines the mode in which the receiver is operat-ing: GPS (G), Loran (L), Omega (O), Transit(T), or Decca (D). However, DR is not a speci-fied system mode in the NMEA 0183 SYS sen-tence. Thus, Raytheon designed the 920 GPS toidentify itself as a “GP” talker regardless ofGPS or DR mode and used the NMEA 0183valid/invalid data bits as the means of notifying“listeners” that its data were invalid when in DRmode. However, the sentence formatter GDPwas available in NMEA 0183 v1.5 to indicatedead reckoned geographic position fixes.

Although both the GPS and Loran-C simul-taneously sent position data to the NACOS 25,the NACOS 25 was designed to use positiondata from only one external position receiver at

25

NMEA 0183 v1.5 was released in December 1987.26

According to STN Atlas, the NACOS, at the time ofdelivery for Royal Majesty, was programmed to read theNMEA 0183 v1.1 sentence GLL (geographic longi-tude/latitude) for position input. The sentence RMC wasonly introduced with the NMEA 0183 v1.5 after the designof the Radar Atlas 8600 was finished. (The radar providesthe interfaces to the position receiver(s), in a NACOS sys-tem.)

a time, as selected by the crew. That is, theNACOS 25 was not designed to compare theGPS and the Loran-C position inputs, nor was itdesigned to display both sets of position data tothe bridge officers simultaneously so that theycould compare the data. On June 9 and through-out the voyage, the autopilot was set by the crewto accept and display position data from theGPS receiver, which was the position receivernormally selected by the crew during the 3 yearsthe vessel had been in service.

Once the position receiver is selected, theNACOS 25 recognizes the chosen position re-ceiver based on the talker identifier codes in theNMEA 0183 data stream; for example, GP inthe data stream from the Raytheon 920 GPS.According to STN Atlas, its designers did notexpect a device identifying itself as GP to sendposition data based on anything other than GPSsatellite data, particularly not DR-derived posi-tion data. Further, STN Atlas expected invalidGPS position data to be recognizable by nulledposition data fields, by halted data transmission,by a separate proprietary SLL sentence,27 or byno changes in the position latitude/longitude.The latter case would trigger the NACOS posi-tion-fix alarm; the other cases would cause theNACOS to switch its position input to estimated(its own DR mode) and to highlight this infor-mation at all NACOS and radar displays untilthe transmission is resumed and/or the SLL sen-tence contains the valid data bit.

According to the NMEA, NMEA 0183 pro-vides three methods to indicate whether thetransmitted data are inaccurate or unavailable:(1) null fields where the sentence is transmittedbut no data are inserted in the fields in question;(2) by using system-specific status sentences(available only for Loran-C; and (3) by the useof “status” or “quality indicator” characters inspecific sentences. There are no other provisionswithin NMEA 0183 to indicate invalid data intransmitted sentences. In version 1.5, the use of

27

NMEA 0183 provides proprietary data sentences forspecial use between devices produced by the same manu-facturer, but not between devices by two different manu-facturers unless the two different manufacturers have coor-dinated use of such data sentences.

Page 26: Royal Majesty

18

null fields is the most common method, as mostsentences do not have status fields. According toSTN Atlas’s interpretation of this specification,when a position receiver with a GPS talkeridentifier has no GPS position data available, itmust transmit null fields instead.

The NACOS 25 autopilot was programmedto continuously calculate its own independentDR position in order to provide a comparisonwith the position data provided by the externalposition receiver (GPS or the Loran-C in thecase of the Royal Majesty). If the autopilot’s DRposition and the external position-receiver’s po-sition (GPS or Loran-C positions in the case ofthe Royal Majesty) are within a specified dis-tance of each other,28 the autopilot considers theposition data from the external position receiverto be valid, makes any necessary course correc-tions, and uses the new external position re-ceiver’s position to continue its own independ-ent DR calculations. If, however, the two posi-tions are more than the specified distance apart,the autopilot sounds a loud alarm29 and presentsa visual indication (warning position fix) on allthe NACOS displays, including the radars,meaning that a position discrepancy has beendetected that requires the watch officers’ imme-diate attention. If the lateral distance betweenthe GPS position and the preprogrammed trackline exceeds the specified distance, the autopilotsounds a loud alarm and presents a visual indi-cation (warning track limit exceeded) on theNACOS display, meaning that the vessel is offthe intended track.

The navigator stated that during the 11months he had been aboard the vessel, he hadobserved a phenomenon he called “chopping.”Other deck officers stated that they too had wit-nessed this phenomenon. According to the navi-gator, chopping occurred when, for whatever

28

The NACOS 25 autopilot has off-track and position-fixalarms that allow the operator to set the off-track and posi-tion-comparison limits anywhere between 10 and 990 me-ters. On the day of the accident, the limit was set at 200meters. This value, which is displayed to the crew asTRACK LIMIT, is used for both the off-track and the posi-tion-fix alarm calculations.

29The alarm is designed to be audible within a range of

about 10 meters under normal ambient noise conditions.

reason, the position data displayed by the GPSwere unreliable. Majesty Cruise Line’s elec-tronics technician and the Raytheon staff indi-cated that chopping could have been the resultof atmospheric interference with GPS signals orthe obstruction of the GPS antenna’s view of thesatellites by the vessel’s superstructure and/ortall buildings or other structures while the vesselwas in port. These circumstances degraded theGPS signal, changing the calculated position,and consequently caused the radar map displayto jump erratically, which the crew referred toas chopping.

According to the navigator’s testimony,when chopping occurred, the 1-second series ofaural chirps sounded and SOL and DR appearedon the GPS display. The master testified thatchopping also usually set off the NACOS 25position-fix alarm, indicating that the differencebetween the NACOS 25 DR position and theGPS position was greater than 200 meters. Hestated that watchstanders had found, throughtrial and error, that if they acknowledged thealarm before switching to the COURSE mode,30

the autopilot automatically accepted the errone-ous position data and the radar map movedabout the ARPA display. To avoid this, watch-standers switched the autopilot from the NAVmode to the COURSE mode before acknowl-edging the alarm. Thus, they could use the mapuntil the GPS returned to normal. According tothe master, chopping generally lasted a fewminutes. Nothing in the testimony of the watchofficers suggested that chopping had occurredduring the trip from Bermuda to Boston.

According to Majesty Cruise Line, the GPSantenna, originally installed on the radar mast,had been moved in February 1995, severalmonths before the grounding, as part of an effortto eliminate the chopping. Majesty CruiseLine’s electronics technician indicated that as aresult of the move, the antenna’s view of thesatellites was less obstructed and the crew com-plained much less about chopping.

30

In COURSE mode, the NACOS 25 system steers a se-lected course while correcting for drift using the Dopplerlog traverse speed component.

Page 27: Royal Majesty

19

The Royal Majesty’s integrated bridge sys-tem was also fitted with an automatic bell logger(bell log), which was located against the afterbridge bulkhead. At regular intervals, the belllog recorded the propeller pitch settings, enginerevolutions per minute, true course, and speed.It also recorded the time of each entry inGreenwich mean time.31 The course and speeddata that were recorded by the bell log camefrom the vessel’s GPS.

The bell log showed that it was turned on at1131:54 on June 9. Between 1131:55 and1133:17, the bell log recorded a course of 197°,000°, and 197°, indicating that the GPS datawere invalid. This could be the result of the GPSreceiver being turned on and going through itssatellite acquisition process, chopping, antennaconnection problems, or other problems. Therecord also showed that between 1133:18 and1202, the Royal Majesty was steering variouscourses. Between 1130 and 1202, the vessel wasstill moored alongside the pier.32 Such coursevariation while the vessel is stationary is con-sistent with normal GPS position variation andthe resulting calculation of courses betweenthose slightly different positions. The bell logrecorded various courses between 1203, whenthe ship left the pier, and 1252, consistent withport departure. At 1252:02, the bell log onceagain began recording consecutive courses of197° and 000°, when, in fact, the vessel wassteering a course of 333°, as shown by the ship’scourse recorder. At 1309:06, the bell log re-corded a course of 336°. After that recording,the bell log recorded 197°/000° headings con-tinuously until after the vessel’s arrival in Bos-ton.33 (See table 1.) After the accident, MajestyCruise Line advised the Safety Board that the

31Mean solar time in which the day begins at midnight

on the meridian of Greenwich. For this report, the entrytimes have been converted to local time.

32During this time, the Royal Majesty was moored with

its port side to the Ordnance Island Passenger Terminal inSt. George’s.

33The Royal Majesty’s bridge logs indicated that the ves-

sel departed the Ordnance Island Passenger Terminal at1203, dropped off its pilot at 1230, and then altered courseto 059°. Shortly before 1300, the vessel altered course to336° and remained within 1° to 3° of this heading until thegrounding.

anomalous 197°/000° courses recorded by thebell log were the result of the GPS receiver be-ing in the SOL and DR modes.

The bell log also recorded speed calcula-tions based on information provided by the GPS.The bell log recorded 18 speed calculationsbetween 1200 on June 9 (departure time fromthe pier) and 2000 on June 10. These speed cal-culations and the time at which they were re-corded are listed in table 2. The Royal Majesty’swatch officers also maintained written recordsof the vessel’s speed during the voyage in thebridge log and in the speed record. According toentries made in the bridge log between 1400 onJune 9 and 1200 on June 10, the vessel’s aver-age speed was 19.06 knots. The bridge-logspeed data, however, were calculated using po-sition data from the GPS. If the GPS was in DRmode, the bridge-log speed data would not ac-count for wind, seas, and current. The speeddata recorded by watchstanders in the speed re-cord were based on distances between DR posi-tions shown on the GPS. The distances betweenDR positions depended on the speed supplied bythe Doppler speed log.34 The speed data, whichwere recorded at hourly intervals between 1500on June 9 and 2200 on June 10, indicated thatbetween 1400 on June 9 and 2200 on June 10the vessel’s average speed was 18.79 knots. Thespeed record also showed that between 1200 and2200 on the day of the accident, the vessel’saverage speed was 13.87 knots.

34

The Doppler speed log provided watchstanders with adigital readout of the vessel’s speed (over ground) at anygiven moment in time. The readout did account for wind,sea, and current.

Page 28: Royal Majesty

20

The Royal Majesty was also fitted with anAtlas 481 echo sounder (fathometer)35 withdigital readout. The fathometer data could bedisplayed on the NACOS screen by pressing abutton. The fathometer had a recorder, whichwas in the chart room. Postaccident examinationof the fathometer recorder indicated that it wasnot turned on at the time of the accident.36

35

An echo sounder, or electronic depth sounder, is an in-strument that indicates water depth below the bottom hullplating. Hereinafter, the term fathometer will be used in thereport.

36The chief officer, the navigator, and the second officer

testified that the echo sounder was turned on before theaccident. The recorder had a separate on/off button.

The fathometer was also fitted with alarmsthat were activated whenever the vessel tran-sited waters shallower than the water for whichthe alarms were set. In addition to an auralalarm, a flashing message appeared on theNACOS display. Both the aural alarm and theflashing message could be overridden by watch-standers.

Table 1—Bell-log record of courses, June 9, 1995 (based on data from the GPS unit)

TimeCourse

Made Good TimeCourse

Made Good TimeCourse

Made Good TimeCourse

Made Good

1131:54(GPS unitturned on)

(continued fromprevious column)

(continued fromprevious column)

(continued fromprevious column)

1132:46 197.0 1147:11 094.0 1201:35 210.0 1321:59 01133:01 0 1147:59 115.0 1201:52 203.0 1322:47 197.01133:17 197.0 1149:35 159.0 1202:07 212.0 1324:41 01137:17 291.0 1150:07 129.0 1202:40 206.0 1324:55 197.01138:05 275.0 1150:23 181.0 1203:11 213.0 1332:57 01138:21 258.0 1150:55 064.0 1204:15 169.0 1333:45 197.01138:37 306.0 1151:11 097.0 1205:51 091.0 1349:29 01139:09 215.0 1151:59 0 1206:23 097.0 1349:45 197.01139:25 250.0 1152:15 047.0 1206:55 088.0 1357:45 01139:41 232.0 1152:31 078.0 1211:11 082.0 1358:07 197.01139:57 250.0 1152:47 131.0 1219:12 090.0 1406:01 01140:13 261.0 1153:19 092.0 1219:27 082.0 1406:33 197.0a

1141:01 038.0 1153:35 151.0 1228:32 076.01141:17 242.0 1153:51 133.0 1229:19 070.01141:49 298.0 1154:55 174.0 1230:09 064.01142:07 326.0 1155:11 130.0 1242:41 055.01142:23 345.0 1155:43 213.0 1244:33 037.01142:39 289.0 1155:59 320.0 1245:37 025.01143:41 074.0 1156:15 271.0 1252:02 197.01144:31 025.0 1156:31 261.0 1255:45 01145:03 100.0 1156:47 217.0 1256:01 197.01145:19 079.0 1157:03 227.0 1304:01 01145:35 068.0 1157:19 208.0 1305:05 197.01146:07 080.0 1158:39 216.0 1309:06 336.01146:33 008.0 1200:04 221.0 1311:46 197.0

a The bell log continued to record the 197º/000º headings until after the vessel’s arrival in Boston.

Page 29: Royal Majesty

21

The chief officer andthe navigator testified thatthe fathometer alarm wasnormally set to go offwhen the water beneaththe keel was less than 3meters (9.75 feet) deep.On the night of thegrounding, the Royal Maj-esty’s deep draft was 19feet 6 inches. Based onstatements from the chiefofficer and the navigator,the alarm should have ac-tivated when the RoyalMajesty entered waterwith a depth of 29 feet 4inches or less. During thehour preceding thegrounding, the Royal Maj-esty passed over Great Rip and Davis Shoals,where in some areas the depth of the water wasless than 29 feet 4 inches. The master, chief of-ficer, and second officer did not recall seeing orhearing the fathometer alarm before thegrounding. Postaccident examination revealedthat the fathometer alarm was set at 0 meters.According to the navigator, the alarm was nor-mally set at 0 when the vessel was in port or in aharbor to prevent the alarm from being continu-ously activated.

Crew Training on Integrated Bridge Sys-tem.—The Royal Majesty entered service inJune 1992. The master, who joined the vessel inNovember of that year, stated that before joiningthe vessel, he had read all the manuals and tech-nical documents related to the integrated bridgesystem (see next section). He stayed aboard theship for 1 month with the master he was reliev-ing and received on-the-job training related tothe integrated bridge system from that masterand the navigator who was aboard the vesselwhen it entered service.

The chief officer of the Royal Majesty hadjoined the ship in 1992. He stated that he hadalso received on-the-job training (3 weeks) fromthe same navigator as the master had.

The navigator who was aboard the RoyalMajesty at the time of the accident had joinedthe ship in August 1994. According to him, hewas responsible for the orientation and trainingof new officers in the operation of the NACOS25, GPS, Loran-C, Decca, fathometer, gyro(s),speed log, ARPA radars, and engine controls.He stated that he was solely responsible for pro-gramming the radar maps onto the ARPA dis-play. He stated that it was his responsibility toensure that watch officers fully understood howthe different systems worked and interacted witheach other. He further stated that one of his re-sponsibilities was to tell the master when anewly assigned watch officer was fully preparedto stand a bridge watch alone. The navigatorstated that the master made the final decisionabout whether an individual was sufficientlyqualified to operate the bridge equipment andwas fully conversant in the ship’s watchstandingprocedures.

The second officer joined the Royal Majestyon May 1, 1995. He received 3 weeks of on-the-job training—2 weeks with the navigator and 1week with the chief officer. According to histestimony, the 3 weeks of on-the-job trainingincluded his being familiarized with the compo-nents of the integrated bridge system but alsowith other bridge watchstanding duties and re-

Table 2—Bell-log record of the speed calculations based on in-formation obtained from the GPS unit

June 9, 1995 June 10, 1995

Time Speed (Knots) Time Speed (Knots)

1200:03 13.3 0000:03 12.71206:39 14.7 0400:03 12.71210:23 16.0 0800:03 12.71223:43 17.3 1200:03 12.71225:03 18.8 1600:03 12.71228:31 21.1 2000:04 12.7a

1233:19 22.31252:01 12.71309:05 21.31311:45 12.71600:03 12.72000:04 12.7

a The bell-logger printout continued to record a speed made good of 12.7 knotsfrom 2000 (June 10) up to the time of the vessel’s arrival in Boston on June 12.

Page 30: Royal Majesty

22

sponsibilities, fire and boat drills, vessel main-tenance, and various other officer duties andresponsibilities.

According to the testimony of the watch of-ficers, there was no formal classroom or simu-lator-based training on the integrated bridgesystem, nor was any curriculum, checklist, orexam used during the 3 weeks of on-the-jobtraining to measure the extent of the trainee’sknowledge of the system or its components.

According to STN Atlas, the manufacturerof the NACOS 25, STN Atlas offers classroomand simulator training in the operation of itsequipment at an additional cost to the purchaser.STN Atlas also indicated that several companiesand organizations in Europe were qualified toprovide formal classroom and simulator-basedtraining in the operation of the STN AtlasNACOS 25. Majesty Cruise Line did not obtainsuch training from STN Atlas or any other or-ganization, nor was it required to by any inter-national regulations or standards.

Written Guidance on Use of the NACOS25.—STN Atlas supplied several supportingmanuals with the NACOS 25 on the Royal Maj-esty. Manuals for the Atlas NACOS 25 systemincluded Specifications, Navigation Instruc-tions, “Brief Navigation Instructions,” Operat-ing Instructions, and “Brief Operating Instruc-tions.”37 In addition, STN Atlas provided manu-als for the Atlas 8600 ARPA radar and the pro-gramming of maps using the ARPA radar. STNAtlas notes the following in its concluding re-marks in the Navigation Instructions:

The navigator’s role is that of overseerof the ship’s progress and proper func-tioning of the automatic equipment. Ifthe system performs faultlessly, it couldhappen that the navigator loses interestin overseeing a faultlessly functioningsystem. Before entering into this situa-tion one must set about planning thenext stage of development.

37

The briefs were laminated two-page summaries of thelarger manuals and were meant to be used as quick refer-ence material.

In the next stage of development, onemust consider changing the automationso that the supervising of the navigationwill be done automatically instead of bythe navigator.

Waterway InformationThe Royal Majesty grounded on Rose and

Crown Shoal about 10 miles east of SankatyHead Light, which is on the eastern shore ofNantucket Island and about 17.0 miles west ofthe vessel’s intended track (the northboundBoston traffic lane). The shoal extends ap-proximately 5 miles in a north-south directionand about 3 miles in an east-west direction. Theminimum depth of the water in this area rangesbetween 3 and 7 feet at mean low water. Thearea is also known to contain breakers. Theshoal is marked by a lighted whistle buoy(2RC). The buoy’s red light flashes at 2.5-second intervals and is visible at a distance of atleast 6 miles when visibility is clear.

Rose and Crown Shoal is one of severalbroken shoals that compose Nantucket Shoals—the general name of the shoals that extend 23miles east and 40 miles south of Nantucket Is-land. The currents in this area are strong anderratic, reaching a velocity of 3 to 5 knotsaround the edges of the shoals. According toVolume 2 of U.S. Coast Pilots (Atlantic Coast:Cape Cod to Sandy Hook), Nantucket Shoals is“one of the most dangerous parts of the coast ofthe United States.” It also states that “this areashould be entirely avoided by deep draft vesselswhen possible and by light draft vessels withoutlocal knowledge.”

The shoals, which are shifting in nature, arebordered to the south and east by several aids tonavigation. The southwest corner of NantucketShoals is marked by the Davis South Shoallighted whistle buoy. The buoy has a red lightthat flashes at 4-second intervals and is visibleat a distance of about 4 miles when visibility isclear. Marking the southeast corner of Nan-tucket Shoals is the Asia Rip (AR) lighted bellbuoy. This buoy, which is about 17 miles westof the Royal Majesty’s intended track and15 miles (on a bearing of 248°) away from theBA buoy, has a yellow light that flashes at 2.5-

Page 31: Royal Majesty

23

second intervals. Fifteen miles to the south-southwest of the AR buoy and 30 miles west ofthe Royal Majesty’s intended track is the Nan-tucket Shoals lighted horn buoy. This buoy,which replaced the original Nantucket Light-ship, is a large navigational buoy38 that has ayellow light that is 40 feet above the water andflashes at 6-second intervals.

Large deep-draft vessels operating betweenBermuda and Boston generally use the Bostontraffic lanes east of Nantucket and Cape Cod.The purpose of the traffic lanes is to separatenorthbound and southbound vessels and to pro-vide a deep-water route for vessels en route toand from Boston that keeps them clear of Nan-tucket Shoals. A traffic separation zone sepa-rates the northbound and southbound lanes.Marking the separation zone are a series oflighted buoys (BA, BB, BC, BD, BE, and BF).Each buoy has a flashing yellow light and a ra-dar reflector and has a distinctive flashing char-acteristic. For example, the yellow light on theBA buoy, which marks the southeast entrance tothe traffic lanes, flashes four times at 20-secondintervals. The BA buoy also sounds a whistle at10-second intervals when certain rough sea con-ditions exist.

Meteorological InformationThe weather and sea conditions recorded by

the Royal Majesty crew between 1800 and 2230on June 10 generally indicated cloudy skies,force 4 winds39 (between 11 and 16 knots) outof the east, and seas between 2 and 4 feet. Visi-bility at sea level was reported to be at least 10miles.

A review of the bridge log for the 24-hourperiod beginning at 2100 on June 9 indicatedthat the Royal Majesty encountered winds aver-aging 15.9 knots out of the east-northeast. Basedon the Beaufort scale, a 16-knot wind could

38

A 40-foot-diameter, automated disc-shaped buoy usedto replace lightships. Most large navigational buoys areused in conjunction with major traffic separation schemes.

39Based on the Beaufort scale, a numerical scale from 0

to 12 that rates wind according to ascending velocities (0corresponds to calm winds at 0 to 1 knots, and 12 corre-sponds to hurricane winds above 65 knots).

generate a wind-driven current capable of set-ting the Royal Majesty toward the west-southwest at a rate of 0.32 knots, or a distanceof about 8 miles over a 24-hour period. The ef-fect of the wind on the vessel’s vast superstruc-ture would have also contributed to the vessel’swesterly drift.

Toxicological InformationThe Coast Guard does not have the author-

ity to order postaccident toxicological testing inaccidents on foreign vessels that occur in inter-national waters.40 However, Majesty CruiseLine requested that all watchstanders on thebridge at the time of the grounding and themaster provide specimens for toxicologicaltesting. The company tried to obtain the servicesof a testing firm that could travel to the site ofthe grounding. On the following day, June 11,the company found a contractor in New Hamp-shire who agreed to collect the specimens. Hearrived on scene in a chartered fishing vesseland was transported to the Royal Majesty on aCoast Guard vessel about midnight. The CoastGuard requested that the contractor wait until itwas safe to board, as the Coast Guard was stillin the process of freeing the vessel. Afterboarding, he was directed to the office of theship’s doctor and began collecting the speci-mens soon thereafter.

Twenty-five to 28 hours after the grounding,the master, the second officer, and the two look-outs on duty at the time of the grounding gaveblood and urine specimens for alcohol and drugtesting specified in 46 Code of Federal Regula-tions (CFR) Part 4 and in 49 CFR Part 40. Thespecimens were shipped for testing to the Meth-odist Medical Center in Peoria, Illinois. The re-sults of the tests were negative.

Watchstanding Policies and PracticesThree licensed deck officers and six unli-

censed crewmen were assigned to the watch-standing duties aboard the Royal Majesty. Eachstood a 4-hour-on/8-hour-off watch rotation.The watches for the three licensed deck officerswere as follows:

4033 CFR Chapter 1, Subpart 2.05-5.

Page 32: Royal Majesty

24

0000-0400/1200-1600 Navigator0400-0800/1600-2000 Chief Officer0800-1200/2000-2400 Second Officer

The master of the Royal Majesty, who didnot stand a regular watch, oversaw the perform-ance of the watch officers. According to themaster, in good weather he typically visited thebridge two to three times during the course of awatch and frequently telephoned the officer ofthe watch for navigation and traffic updates. Hestated that he visited the bridge more frequentlywhen the weather or sea conditions were bad orwhen visibility was poor.

Company policy governing the activities ofthe bridge watchstanders aboard the Royal Maj-esty are contained in its “Bridge ProceduresGuide” and the Majesty Cruise Line’s Opera-tions Manual. The two-page “Bridge ProceduresGuide” (see appendix B) was posted on thebridge of the Royal Majesty before the accident.According to Majesty Cruise Line, the purposeof the “Bridge Procedures Guide” is to providewatchstanders “with a description of the day-to-day bridge procedures that are recognized asgood practice and to promote through them thesafety of the M/V Royal Majesty, her passen-gers, and crew.”

The Operations Manual contains a collec-tion of policies, letters, and circulars coveringsuch topics as checking the vessel’s position,fire and boat drills, and payroll and accountingprocedures. Duties of the officer on watch arelisted on page 3 of Majesty Cruise Line’s Cir-cular No. 9, dated July 9, 1992 (see appendixC). The circular states that deck watch officersare to “check the ship’s position as often asconditions and circumstances allow, but neverlonger than 30-minute intervals.” The circulardoes not state how the ship’s position is to bechecked, nor does it require that GPS and Lo-ran-C position data be compared. The circularalso does not require that a written record bemaintained of GPS or Loran-C observations orof radar ranges and bearings of nearby floatingaids to navigation and/or landmarks.

The master testified that he required hiswatch officers to plot the vessel’s position on anhourly basis. A postaccident examination of

National Oceanic and Atmospheric Administra-tion chart No. 13200 (Georges Bank and Nan-tucket Shoals) indicated that hourly fixes hadbeen plotted on the chart of the area startingabout 100 miles to the south of the accident siteand continuing up into the Boston traffic lanes.

Circular No. 9 and the “Bridge ProceduresGuide” discuss when the master should besummoned to the bridge. Among the circum-stances that should prompt a call to the master isthe failure of watch officers to sight land or anavigation mark or to obtain a sounding by theexpected time.

Postaccident Testing of GPSAfter the accident, representatives from

Majesty Cruise Line and the Coast Guard ex-amined the Royal Majesty’s GPS antenna andreceiver. They found that the GPS antenna cablehad separated from the factory connection at theantenna. The antenna cable, which was factory-assembled, showed no sign of physical damage,other than having been separated from the con-nection. The Safety Board examination also re-vealed that the cable was openly routed on theroof of the bridge and that it had been paintedwith a brush or roller at least twice when thebridge was being painted (see figure 9). Trafficon the roof of the bridge was limited to MajestyCruise Line employees. However, the GPS cablewas not secured to the roof or protected fromsomeone tripping over it, kicking it, or other-wise damaging it and the nearby antenna con-nector.

Postaccident testing at Raytheon41 indicatedthat because the GPS antenna cable was sepa-rated from the connection, the GPS receivertransmitted DR-derived position data instead ofsatellite-derived position data to the NACOS 25autopilot.

Safety Board’s Urgent Safety Recom-mendations

The Safety Board’s postaccident testing andinspection of the integrated bridge system on the

41Appendix D has more details about the postaccident

testing done by representatives of the Safety Board, Ray-theon Marine, and Majesty Cruise Lines.

Page 33: Royal Majesty

25

0

u 15/16”

n

ow

GPS antenna andon deck of Royal

cabling as installedMajesty fly bridge

\ Taped antenna connections

- ..——Receiver/ Antenna

processor

PVC (vinyl) tape layers “SUM IN” tape layers

Figure 9—GPS antenna assembly (photograph shows antenna and cabling as installedon deck of fly bridge). .

Page 34: Royal Majesty

26

Royal Majesty raised concerns about the safetyof the world’s maritime fleet and the safety ofpassengers and crews on vessels with similarintegrated bridge systems, as well as the poten-tial damage to the environment that could resultfrom a release of hazardous cargo. Conse-quently, on August 9, 1995, the Safety Boardissued five urgent safety recommendations tothe Coast Guard, the International Council ofCruise Lines (ICCL), the International Chamberof Shipping, the American Institute of MerchantShipping, the International Association of Inde-pendent Tanker Owners (INTERTANKO), STNAtlas, and the NMEA. The recommendationsurged the organizations to immediately advisemaritime vessel operators of the circumstancesof the Royal Majesty’s grounding and to en-courage the operators to review the design oftheir integrated bridge systems to identify po-tential system and operational failure modes. Allfive recommendations were acted upon and,consequently, have been classified either“Closed—Acceptable Action” or “Closed—Ac-ceptable Alternate Action.”42

Safety Board’s Public ForumThe grounding of the Royal Majesty sug-

gested to the Safety Board a need to assess thecurrent state of the art in integrated bridge sys-tems. As a first step, the Safety Board held apublic forum on integrated bridge systems onMarch 6-7, 1996, to examine data-transmissionstandards, design standards for integrated bridgesystems, human-factors considerations in thedesign of integrated bridge systems, training andcertification of mariners responsible for operat-ing integrated bridge systems, and the impact ofintegrated bridge systems on safety, workload,and watchkeeping. Participating in the publicforum were representatives of the vessel opera-tors, standards organizations, manufacturers ofintegrated bridge systems, and classificationsocieties. Government representatives and ma-rine educators from the major maritime schools,colleges, and universities also participated.

42

Appendix E has the full text and status of each urgentsafety recommendation.

The following sections highlight some ofthe comments from the various participants.

Manufacturers.—The public forum showedthat manufacturers of integrated bridge systemsare designing and building the components oftheir systems in accordance with internationallyrecognized standards, proprietary standards, andthe standards of the classification societies.Manufacturers stated that problems were occa-sionally encountered in matching subsystems,such as Loran-C and GPS, speed logs, and gyrocompasses, with the integrated bridge systemthat they manufacture. They expressed concernabout the maintenance of system integritythroughout the life of the integrated system assubcomponents are added or replaced. They ex-pressed the belief that an independent authorityis needed to ensure system integrity.

Standards Organizations.—The Interna-tional Maritime Organization (IMO), a UnitedNations organization, produces performancestandards for navigation equipment required oncommercial vessels. Such standards are nor-mally cast in general terms. Once adopted, eachof the IMO performance standards is reviewedby either Technical Committee 8 (TC8) of theInternational Standards Organization (ISO) or,more often, by Technical Committee 80 (TC80)of the IEC, depending upon whether the equip-ment is mechanical or electric/electronic. Nor-mally, one of the two organizations will developspecifications (called standards) that enablemanufacturers to design and build navigationequipment that will meet the appropriate IMOperformance standard. It is not unusual for theISO and the IEC to work jointly to producestandards.

The ISO and the IEC are parallel interna-tional organizations, working in close coopera-tion to form a world system of standardizedworking procedures, terminology, and docu-mentation presentation. The TC8 has 10 sub-committees working on various areas, including

Page 35: Royal Majesty

27

ship bridge layout43 for one-person watchkeep-ing.44

The work of the IEC is managed throughmore than 200 technical committees, and theTC80, formed in 1979, is the technical commit-tee concerned with marine navigation and radio-communication equipment and systems. TheTC80 has 10 working groups.

In 1990, the TC80 notified the IMO that itwas forming a working group (WG9) to developa draft IMO performance standard for integratedbridge systems. The proposed standard wascompleted and submitted to the IMO in July1996. The proposed standard is expected to be-come an IMO performance standard by about1999.

In the absence of an ISO or IEC standard,manufacturers use other internationally recog-nized standards, such as those of the NMEA.The NMEA, a U.S. organization of manufactur-ers, dealers, and installers of marine electronicequipment, actively encourages internationalmembership and participation. The NMEA In-terface Standards Committee, for example, hasrepresentatives from nearly all the companies inthe world that manufacture marine electronicequipment.

The NMEA and the IEC have members oneach other’s working groups and in 1995 col-laborated to produce a harmonized standard fordata transmission (NMEA 0183 and IEC 1162-1), which will facilitate matching subsystemslike GPS with integrated bridge systems and theGlobal Maritime Distress and Safety System.45

The NMEA and the IEC have agreed to work

43

ISO standard ISO 8468 currently covers ship bridge de-sign and layout.

44One-person watchkeeping, sometimes referred to as

one-man or solo watchkeeping, means that the officer ofthe watch is the sole person on the bridge. This conceptenvisages reducing cost by eliminating the lookout positionfrom the navigation watch.

45The Global Maritime Distress and Safety System is an

automated radio transmitting and receiving device on thebridge. It can automatically send distress messages that givethe vessel’s identification and position and receive telex in-formation on navigation, weather, and search and rescue.

together on future transmission standards and tokeep both standards in harmony.

The NMEA representative stated that manu-facturers have sometimes made different inter-pretations of the NMEA standards and thatelectronic equipment has been mismatched. TheNMEA representative further stated that the0183 standard by itself does not regulate the useof the data in NMEA-provided sentences. TheNMEA counts on the knowledgeable input to,and sensible implementation of, the NMEAstandard by equipment designers. This processhas improved vastly over the past few years andmany of the early problems with implementationno longer exist. Helping in this regard is thetrend in international performance standards formarine electronic equipment to specify the useof specific NMEA 0183/IEC 1162-1 sentences.The representative stated that he believes thatthe new improved standards have reduced thepossibility of mismatching.

Classification Societies.—The DNV hasbeen involved in bridge navigation issues sincethe early 1970s; the classification society wasmotivated to enter this nontraditional area by thehigh number of groundings and collisions at-tributable to human error. The DNV studied thebridge environment, including design of workstations, organizational matters, range and qual-ity of instrumentation, and man/machine inter-face. The DNV then developed some standardsfor bridge design and equipment that might re-duce situation-induced errors. These standardswere offered as an optional classification nota-tion,46 NAUT-C.

46

Classification societies have normally been concernedsolely with developing classification rules (notations) for avessel's hull, the machinery, and certain essential systems(ballast systems, piping, sanitation systems, ventilation, etc.).For a vessel to be classed by a society, the vessel must beconstructed and maintained in accordance with the rules ofthe classification society. Surveyors (inspectors) employed bythe selected classification society inspect the vessel duringconstruction and periodically afterward as long as the vesselis classed. Classification is essential for obtaining insurance.Navigation equipment is not required to be classed; thus, thenavigation bridge does not have to be constructed or outfittedin accordance with classification society rules. With growinginterest in reducing navigation errors and with the interest inusing technology to reduce bridge manning, most classifica-tion societies now offer optional classification rules (nota-

Page 36: Royal Majesty

28

Currently, the highest class notation offeredby the DNV is Watch 1 (W1), which addressesequipment requirements, qualifications of theintegrated bridge system operator, operatingprocedures, documentation on maneuvering per-formance, and a contingency plan. The DNVrequires that vessel officers attend classes pro-vided by the integrated bridge system manufac-turer. An officer who has been trained by themanufacturer and has operated an integratedbridge system at sea may instruct other officers.All operators of an integrated bridge systemmust be certified by the DNV.

Germanischer Lloyd was the coordinator forthe German Ship of the Future program, whichinvolved various elements of the German mari-time industry. The intention of this researchprogram was to employ automatic navigationsystems to do routine functions; as a result,watchkeeping at any time, day or night, could behandled by one person. The culmination of theShip of the Future program was marked in 1985by the commissioning of a prototype vessel withan integrated bridge system. In 1991, Germanis-cher Lloyd published its Rules for Bridge De-sign on Sea-Going Ships - One-man ControlConsole. The rules were based on 5 years ofoperational experience with advanced naviga-tion systems. A ship complying with the rulesreceives the optional class notation Nav O(ocean area) or Nav OC (ocean area/coastalwaters).

Lloyd’s Register of Shipping (LR) pub-lished rules for navigation bridge arrangementsin 1988 and in January 1996, after completingfurther research, replaced those rules with amore comprehensive notation (NAV-1).47 TheLR is planning to offer an integrated bridge tions) covering bridge design, layout, and equipment.

47The development of NAV-1 followed a 3-year research

project known in Europe as Advanced Technology to Opti-mize Manpower Onboard Ships. The object of the projectwas to improve the competitiveness of European CommonMarket commercial vessels by using advanced technology,including the integration of bridge equipment and functions,to reduce bridge manning and contribute to navigation safety.The participants in the research project included nine Euro-pean companies and, in addition to the LR, equipmentmanufacturers, ship owners, research organizations, and onenational authority.

system notation, IBS, which will be an en-hancement of NAV-1. The notation also willaddress software, and will require that the “de-velopment, modification, replication and instal-lation of the software be subject to quality planswhich meet the requirements of acceptable stan-dards, e.g. the ISO 9000 series.” The LR willaccept certification of the software quality pro-cedures by a recognized authority as evidence ofcompliance. Also, the LR can now providecomprehensive software assessment to manu-facturers. (The DNV tests software at the manu-facturer’s plant for each model of an integratedbridge system and whenever there are changesin software.)

Nippon Kaiji Kyoukai published rules fornavigation bridge systems in February 1995. Inpreparing the rules, the organization consideredcurrent Japanese technology, other technicaldevelopments, vessel-owner desires, and inter-national standards, including those of the IMO,the ISO, and the IEC.

The Nippon Kaiji Kyoukai notation BRS1covers “functionality of the bridge design lay-out, configuration, bridge environment, and es-sential navigational equipment to be installedand work stations for one officer bridge opera-tion on the open sea.”

The Korean Registry of Shipping has intro-duced requirements for one-man bridge operatedships. In developing its rules, the organizationgave a high priority to the safety and reliabilityof systems. The organization also focused on thehuman element, including ergonomic criteriaand bridge design and installation, as well as ontechnical performance standards, system redun-dancy, and reliability.

The American Bureau of Shipping pub-lished guidelines for one-man bridge operationin 1992.

Page 37: Royal Majesty

29

ANALYSIS

GeneralThe weather at the time of the accident was

clear, visibility was at least 10 miles, seas werecalm, and winds were light. Except for the GPSantenna cable connection, all other navigationequipment and the main propulsion, steering,and auxiliary systems were fully operationalbefore and after the accident. The investigationindicated that the certifications of the masterand the deck officers were in accordance withcurrent international requirements. Accordingly,the Safety Board concludes that the weather, themechanical condition of the Royal Majesty, ex-cept for the GPS antenna cable, and the officers’certifications were not factors in the accident.

Because the accident happened in interna-tional waters, the Coast Guard did not have theauthority to order toxicological testing. How-ever, the master, the second officer, and the twolookouts on duty at the time of the accident pro-vided blood and urine specimens for alcohol anddrug testing, as requested by Majesty CruiseLine. On the basis of test results, the SafetyBoard concludes that drugs were not a factor inthe accident. However, because the specimenswere obtained more than 24 hours after the ac-cident, the alcohol tests were of little value; hadthere been any alcohol, it probably would havebeen metabolized and eliminated. Although in-vestigating Coast Guard personnel observed noindications that the officers had been under theinfluence of alcohol, the Safety Board could notdetermine conclusively that alcohol was not afactor in the accident.

The master and two of the deck officers, in-cluding the second officer, who was on duty atthe time of the accident, testified that theirwork/rest routines during the days preceding theaccident were normal. In particular, the secondofficer slept about 7 hours after finishing his2000-to-2400 watch and had also taken a 2-hournap before beginning his 2000 watch onJune 10, the day of the accident. In short, the

Safety Board concludes that fatigue was not afactor in the grounding of the Royal Majesty.

The Safety Board assessed the fishing ves-sel’s attempts to call a cruise ship shortly beforethe grounding of the Royal Majesty. Althoughthe Safety Board could not conclusively deter-mine whether the second officer was in factmonitoring channel 16, international require-ments and company procedures required him todo so. Because the position transmitted by thefishing vessel was approximately 17 miles awayfrom where the second officer believed the ves-sel to be and because the English transmissionsmade by the fishing vessel to the cruise ship didnot convey any urgency or immediacy and wereinterspersed with Portuguese conversation, theSafety Board believes it was reasonable that thesecond officer did not respond to these trans-missions. The transmissions do, however, pro-vide evidence of the location of the Royal Maj-esty almost 2 hours before the grounding.

The grounding occurred near Nantucket Is-land in an area known as Rose and CrownShoal—a location more than 17 miles west ofthe vessel’s intended track. The investigation,therefore, focused on determining how a largepassenger vessel with a sophisticated integratedbridge system, manned by experienced watchofficers, and operated in clear weather throughcalm seas could travel, unknown to the crew,more than 17 miles off course.

The AccidentShortly after the vessel left St. George’s, the

navigator set the NACOS 25 autopilot on theNAV mode. When engaged and operating in theNAV mode, the autopilot could steer the vesselalong a predetermined route using programmedinformation (latitude and longitude of waypointsand the vessel’s maneuvering characteristics),gyro and speed data, and position data from ei-ther the GPS or the Loran-C while automaticallycompensating for the effect of gyro error, wind,current, and sea. On the day of the accident, the

Page 38: Royal Majesty

30

crew had selected, as it normally had done sincethe vessel entered service, the GPS as the sourceof position data for the NACOS 25.

To compensate for the possible lack of sat-ellite data, the GPS unit on the Royal Majestyhad been designed to receive speed and gyroheading data so that when GPS satellite datawere not available, the unit would automaticallydefault to a DR mode, in which the lati-tude/longitude data transmitted to the autopilotwere derived from DR calculations rather thansatellite-based position data. When the GPS unitdefaulted to the DR mode after the vessel leftBermuda, the autopilot was unable to recognizethe status change; and, thus, its subsequentnavigation did not correct for the effect of wind,current, or sea.

The bell-log record provided evidence thatcomplete interruption of valid satellite-basedposition data occurred about 1311:46, whichwas about an hour after the vessel left St.George’s. From that point on, the bell log con-tinued to record alternate courses of 197° and000° until after the vessel’s arrival in Boston,although, in fact, the vessel was maintaining acourse of about 336° during that time. It ap-peared that a temporary interruption of validsatellite-based data occurred at 1252:02, about52 minutes after the vessel left Bermuda, as thecourse and speed recorded were 197° and 12.7knots, respectively—the same readings thatwere later recorded. The course of 336° re-corded at 1309:06 was consistent with the ves-sel’s course at that time. Similarly, the bell-logrecord of speed calculations based on the dataprovided by the GPS unit indicated that the lastaccurate recording occurred at 1309:05 whenthe bell log recorded a speed of 21.3 knots.However, from that point on until the vessel’sarrival in Boston on June 12, the bell log con-tinued to record a speed of 12.7 knots, a speednot consistent with the speeds recorded in thebridge log and speed record. In summary, theSafety Board concludes that starting about 52minutes after the Royal Majesty left St.George’s, the GPS receiver antenna cable con-nection had separated enough that the GPSswitched to DR mode, and the autopilot, notprogrammed to detect the mode change and in-

valid status bits, no longer corrected for the ef-fects of wind, current, or sea. Over time, theeffects of the east-northeasterly wind and sea setthe Royal Majesty in a west-southwesterly di-rection and away from its intended track, re-sulting in the 17-mile error. Further evidencecame from a Coast Guard transcript of radiotransmissions from two fishing vessels that werein the vicinity of Fishing Rip Shoal on the eve-ning of June 10 and had seen a large passengercruise ship about 16 miles west of the Bostontraffic lanes.

The investigation determined that the GPSantenna, which was originally installed on theradar mast, had been moved in February 1995,several months before the grounding, as part ofan effort to eliminate chopping. An examinationof the GPS antenna cable indicated that it wasrouted in such a way that it could be kicked ortripped over, which could induce separatingstress at the antenna cable connection, and thatit had been painted on at least two occasions.However, precisely when the painting was donewas not known. In short, it could not be deter-mined whether the GPS antenna failed as a re-sult of crewmembers’ inadvertently damaging itwhile they were doing routine maintenance, as aresult of crewmembers’ tripping over the cable,or as a result of other unknown factors. Never-theless, the Safety Board concludes that openlyrouting the GPS antenna cable in an area wheresomeone occasionally walked increased the riskof damage to the cable and related connectors.The Safety Board believes, therefore, that todecrease the risk of damage, Majesty CruiseLine should eliminate the practice of openlyrouting navigation equipment cable to decreasethe risk of damage and that the ICCL shouldencourage its members to do the same.

Watch Officers’ PerformanceThe crew’s failure to detect the ship’s errant

navigation for more than 34 hours raises seriousconcerns about the performance of the watchofficers and the master. None of the three watchofficers or the master determined that the GPShad switched to DR mode or that the RoyalMajesty had been on an errant course through-out the trip from St. George’s. Further, the chief

Page 39: Royal Majesty

31

officer and the second officer, who stood thelast two watches before the grounding, failed torecognize that the Royal Majesty was on an er-rant course despite several indications that thevessel was not on its intended track. The inves-tigation, therefore, examined the events leadingup to the accident from the time the Royal Maj-esty departed St. George’s, including the in-specting of equipment and the setting of thefathometer alarm. The investigation also exam-ined the watchstanding practices of the watchofficers and their lack of response to severalindications that the vessel was not following itsintended track, including the sighting of redlights, the failure to sight the BB buoy, and thesighting of blue and white water.

Equipment Inspection.—The navigator saidthat he had tested the navigational equipmentbefore the vessel left St. George’s and found theequipment to be in “perfect” operating condi-tion. Because the evidence from the bell log in-dicated that interruption of GPS data did notoccur until about 1252, about an hour after thevessel had left port, the GPS receiver wouldprobably not have shown the SOL and DR mes-sages before that time. Consequently, the navi-gator may indeed have inspected the GPS re-ceiver before the departure when the other navi-gation equipment was inspected and found noanomalies.

Fathometer Alarm.—Although the testi-mony indicated that the fathometer alarm wasusually set at 3 meters, the postacccident inves-tigation determined that the fathometer alarmwas set at 0 meters—the setting used when thevessel was in port or in harbor so that the alarmwould not be continuously activated. During thevoyage, no one detected that the fathometer set-ting was improper, and the fathometer recorderwas not turned on. Because the fathometeralarm was set at 0 meters, the aural fathometeralarm would not have activated; thus, the settingeffectively rendered the alarm useless.

Before it grounded, the Royal Majestypassed over several areas in which the depth ofwater beneath the keel was significantly lessthan 3 meters. Had the alarm been set as usual to3 meters, it would have activated several times

before the vessel grounded. The Safety Boardconcludes that had the fathometer alarm been setto 3 meters, as was the stated practice, or hadthe second officer chosen to display thefathometer data on the control console, hewould have been alerted in time for him to takecorrective action that the Royal Majesty was infar shallower water than expected and, thus, wasoff course. Because of the proximity of DavisBank (a shoal about 8 miles southeast of thegrounding site; the water is between 15 and 40feet deep) it is possible that he would have beenalerted perhaps as long as 40 minutes before thegrounding.

GPS Status.—Once the ship had beenplaced under the control of the automated navi-gation system, the watch officers’ operatingtasks were to ensure that the automated naviga-tion system equipment was operating properlyand to verify that the Royal Majesty was fol-lowing the intended track. The testimony of thewatch officers and the charts used by these offi-cers indicated that hourly fixes were beingplotted during the voyage, as instructed by themaster. The navigator and the second officerboth testified that the hourly fixes they plottedwere based on position data from the vessel’sGPS. However, according to testimony, no offi-cer, including the master, recognized the SOLand DR messages, indicating that the GPS posi-tion data were not reliable, until after thegrounding. Because the crew noticed the SOLand DR messages immediately after thegrounding and because postaccident testing con-firmed that the SOL and DR messages werefunctioning properly and should have been dis-played, the watch officers apparently read theposition coordinates on the GPS unit to accom-plish their manual plotting task, without attend-ing to the SOL and DR messages. The SafetyBoard concludes that the watch officers’ moni-toring of the status of the vessel’s GPS was de-ficient throughout the voyage from St. George’s.

Cross-checking of Position Data.—Despitefailing to recognize the SOL and DR indicators,the officers could have discovered that the GPShad defaulted to DR mode by using an inde-pendent source of information, such as the Lo-ran-C. According to the chief officer and the

Page 40: Royal Majesty

32

navigator, they periodically compared the GPSdata with the Loran-C data during the voyage.The second officer, however, stated that he didnot check the Loran-C because it was used as abackup only if the GPS failed. At the site of thegrounding, the Loran-C indicated the correctposition of the Royal Majesty, and there was noevidence that the Loran-C was malfunctioningduring the voyage. Thus, had the officers regu-larly compared position information from theGPS and the Loran-C, they should not havemissed the discrepant coordinates, particularlyas the vessel progressed farther from its in-tended track. The Safety Board concludes thatdeliberate cross checking between the GPS andthe Loran-C to verify the vessel’s position wasnot being performed and should have been onthe voyage from St. George’s.

Use of Position-fix Alarm.—Evidence sug-gested that instead of monitoring the positioninstrumentation, the watch officers relied on theposition-fix alarm, a feature of the autopilot de-signed to alert watchstanders to any degradationof position data from the position sensor in use.According to the officers, the only times theGPS positions could not be depended on for ac-curacy were during chopping episodes, whichcould usually be recognized because they wereaccompanied by an erratic movement of the ra-dar map and the sounding of the position-fixalarm. Because chopping did not occur on theaccident voyage and because the position-fixalarm never activated, the crew probably be-lieved there was no need to suspect that the GPSwas not providing satellite-derived positiondata. On this voyage, the position-fix alarm wasset to activate only when the position data gen-erated by the GPS and the DR position datagenerated by the autopilot differed by more than200 meters. Because the GPS and autopilotshared common gyro and speed inputs, the DRposition data transmitted by the GPS when itdefaulted to the DR mode was essentially iden-tical to the DR position data calculated by theautopilot. Consequently, the position-fix alarmwould not have activated after the GPS de-faulted to the DR mode. The Safety Board con-cludes that even though it is likely that thewatch officers were not aware of the inherent

limitation in using the position-fix alarm tomonitor the accuracy of GPS position data, itwas inappropriate for them to rely solely on thealarm to warn them of any problems with theGPS data.

Identification of Navigation Aids.—Al-though the officers’ inadequate monitoring ledto the errant track and was a serious deviationfrom acceptable methods of operating auto-mated equipment, the grounding itself couldhave been avoided had the chief officer and thesecond officer followed longstanding goodwatchkeeping practices when approaching land.During the 1600-to-2000 watch preceding theaccident, the chief officer did not visually iden-tify the buoy he saw on the radar about 1900and apparently assumed that it was the BAbuoy, which marked the entrance to the trafficlanes. The target that he probably observed wasthe AR buoy, which marked a wreck about 17miles west of the traffic lanes, and it was proba-bly coincidental that he detected it when andwhere he anticipated seeing the BA buoy. Helater explained that he was not concerned aboutconfirming that the target was the BA buoy be-cause the information displayed at the time onthe GPS and ARPA displays indicated to himthat confirmation was not necessary.

When the second officer assumed the fol-lowing watch, he did not detect, either visuallyor by radar, the next buoy in the traffic lanes,the BB buoy, when it was expected. Contrary tostanding orders from the master, he failed toreport that he had not seen the BB buoy; andwhen the master called the bridge anticipatingpassing the buoy, the second officer stated thathe had observed it.

The second officer continued to miss op-portunities to avoid the grounding when thelookouts reported sighting several high redlights (later determined to be on Nantucket Is-land), sighting a flashing red light on the portbow, and sighting blue and white water ahead ofthe Royal Majesty. He acknowledged these ob-servations, but he failed to take any action.

The second officer’s response to thesesightings should have been deliberate andstraightforward. He should have been concerned

Page 41: Royal Majesty

33

as soon as the BB buoy was not sighted and thenagain when the lookouts sighted the red lights.Had he then increased the radar range from 6miles to 12 miles on the port radar, the one radarin use, or turned on the starboard radar and set itto the 12-mile range, he would have detectedNantucket Island. He would also have seen thatthe radar pictures did not conform to the radarmaps exhibited on the ARPA display. In addi-tion, had he checked a chart of the area for thesource of the flashing red light, he would havelearned that the nearest flashing red light wasthe Rose and Crown Shoal buoy and, thus,would have been warned that the ship was not inthe traffic lanes, as he believed it was.

Additionally, the second officer should havechecked the Loran-C to cross check his position,as he knew the Loran-C to be accurate in thisarea. Had he still been uncertain about the posi-tion of the Royal Majesty after checking the Lo-ran-C, he should have called the master and thenavigator to the bridge for assistance. TheSafety Board concludes that the sighting oflights not normally observed in this area and thesecond officer’s inability to confirm the pres-ence of the BB buoy should have taken prece-dence over the automation display on the centralconsole and compelled the second officer topromptly use all available means to verify hisposition.

Fundamental seamanship practices cautionagainst exclusive reliance on any one source ofposition information for navigation. When awatch officer finds visually sighted navigationaids that conflict with a position determined byautomated instrumentation, he should promptlyverify the vessel’s position by using proper pro-cedures. The Safety Board concludes that thechief officer and the second officer did not ob-serve good watchkeeping practices or act withheightened awareness of the precautions that areneeded when a vessel approaches the Bostontraffic lanes and landfall. Consequently, in viewof the actions of the watch officers on the RoyalMajesty, the Safety Board believes that MajestyCruise Line should review and revise as neces-sary the bridge watchstanding practices on all itsvessels to ensure that all watch officers adhereto sound watchstanding practices and proce-

dures, including using landmarks, soundings,and navigational aids to verify a vessel’s posi-tion, relying on more than one source for posi-tion information, and reporting to the master anyfailure to detect important navigational aids.The Safety Board believes that the ICCL shouldencourage its members to take the same steps.The Safety Board further believes that MajestyCruise Line and the members of the ICCLshould periodically review the performance ofall officers on board their vessels.

Master’s Monitoring of the Vessel’s Prog-ress.—The investigation determined that themaster of the Royal Majesty frequently visitedthe bridge to keep himself informed aboutbridge operations and to confirm that the pas-sage was progressing satisfactorily. By request-ing that the chief officer and the second officerreport their sightings of the BA and BB buoys,the master made a reasonable effort to assurehimself that the Royal Majesty was following itsintended track. It is likely that the chief officerwas not aware that he had misidentified the BAbuoy, which marked the entrance to the trafficlanes, and unknowingly passed on erroneousinformation about the buoy to the master and thesecond officer. The second officer, however,deliberately misinformed the master when askedwhether he had seen the BB buoy. Thus, themaster was grossly misled by the second officerand was denied the opportunity to investigateclues indicating that the ship was not followingthe intended track.

The evidence suggests, however, that themaster did not have any better understanding ofthe automated navigation system and the func-tioning of the GPS than the watch officers. Hisrequirement that the officers plot courses manu-ally did not result in anyone monitoring the ves-sel position by using an independent source ofposition information. Because the officers usedthe GPS data to get the coordinates for the man-ual plotting, the fixes on the chart correspondedwith the map and positions displayed on thecentral console; thus the manual plotting in noway verified the validity of the GPS data. Themaster appeared to share the deck officers’ reli-ance on the automated navigation system, sincehe did not ask for deliberate cross checks be-

Page 42: Royal Majesty

34

tween the GPS and the Loran-C or make anycomparisons himself. The Safety Board con-cludes that the master’s methods for monitoringthe progress of the voyage did not account forthe technical capabilities and limitations of theautomated equipment.

Effects of Automation on Watch Officers’Performance

Innovations in technology have led to theuse of advanced automated systems on modernmaritime vessels. However, bridge automationhas also changed the role of the watch officer onthe ship. The watch officer, who previously wasactive in obtaining information about the envi-ronment and used this information for control-ling the ship, is now “out of the control loop.”The watch officer is relegated to passivelymonitoring the status and performance of theautomated systems. As a result of passivemonitoring, the crewmembers of the Royal Maj-esty missed numerous opportunities to recognizethat the GPS was transmitting in DR mode andthat the ship had deviated from its intendedtrack. The Safety Board examined why thewatch officers missed the opportunities.

When the GPS unit defaulted to its DRmode, it displayed both SOL and DR, indicatingthat the GPS solution was no longer valid andthat the unit had switched to a DR mode. Al-though the watch officers testified they used theGPS data for plotting, each officer also testifiedthat he did not see SOL displayed on the GPSunit. Ineffective monitoring of sophisticatedautomated equipment is not new. The SafetyBoard has investigated several aviation acci-dents in which pilots failed to monitor flightinstruments during automated flight.48 Likewise,empirical research on the monitoring of auto-

48

(a) National Transportation Safety Board. 1986. ChinaAirlines Boeing 747-SP, N4522V, 300 nautical milesnorthwest of San Francisco, California, Feb. 19, 1985.Aviation Accident Report NTSB/AAR-86/03. (b) NationalTransportation Safety Board. 1984. Scandinavian AirlinesSystem Flight 901, McDonnell Douglas DC-10-30, John F.Kennedy Airport, Jamaica, New York, February 28, 1984.Aviation Accident Report NTSB/AAR-84/15. (c) NationalTransportation Safety Board. 1973. Eastern Air Lines, Inc.,L-1011, N310EA, Miami, Florida, December 29, 1972.Aviation Accident Report NTSB/AAR-73/14.

mation has shown that humans are poor moni-tors of automated systems.49 The problem ofpoor monitoring of automated systems was alsoknown to STN Atlas, the manufacturer of theNACOS 25 system. STN Atlas warns in its op-erating manual for the NACOS 25 that opera-tors, with little to do, may fail to monitor theautomated NACOS 25 system.

The watch officers’ failure to recognize theSOL or DR messages may also have been relatedto the absence of any loud alarm signifying poorGPS data. Before the separation of the antennacable connection, failures of the GPS systemtriggered the NACOS 25 position-fix alarm.This could have led to what Wiener and Curry(1980) referred to as a primary/backup inver-sion.50 The primary indicators of the status ofthe GPS unit are SOL and DR. As a backup tothese primary indicators, the watch officerscould use the position-fix alarm to signal inac-curate GPS data. As Wiener and Curry warned,the watch officers and the master of the RoyalMajesty relied exclusively on the position-fixalarm instead of monitoring for SOL or DR. In1988, the Safety Board investigated another caseof primary/backup inversion in the crash of aNorthwest Airlines Boeing 737 in Romulus,Michigan.51 The plane crashed while the crewwas attempting to take off in the wrong flightconfiguration. The crew apparently relied on anonboard configuration warning system insteadof manually checking the position of the flapsand slats.

The Board’s investigation also found thatthe watch officers failed to use independent al-ternative means to verify the Royal Majesty's

49(a) Parasuraman, R.; Molloy, R.; Singh, I. 1993. “The

performance consequences of automation-induced compla-cency.” The International Journal of Aviation Psychology,3(1): 1-23. (b) Kessel, C. J.; Wickens, C. D. 1982. “Thetransfer of failure-detection skills between monitoring andcontrolling dynamic systems.” Human Factors, 24(1), 49-60.

50Wiener, E. L.; Curry, R. E. 1980 “Flight deck automa-

tion: problems and promises.” Ergonomics, 23 995-1011.51

National Transportation Safety Board. 1988. NorthwestAirlines, Inc., McDonnell Douglas DC-9-382, N312RC,Detroit Metropolitan Wayne County Airport, Romulus,Michigan, August 16, 1987. Aviation Accident ReportNTSB/AAR-88/05.

Page 43: Royal Majesty

35

position. Research on operator monitoring per-formance suggests that the reliability or trust-worthiness of an automated system52 could haveaffected the officers’ verification of the GPSposition data. The complete automated naviga-tion system, including the GPS, on the RoyalMajesty had proven to be a highly reliable andaccurate system, and the watch officers’ testi-mony suggested that they believed the GPS wassuperior to other onboard position instrumenta-tion. Also, the watchkeeping procedures of themaster and the watch officers did not include aneffective mechanism for comparing the GPSwith other position instrumentation. Althoughthe master required the watch officers to plotfixes manually as an apparent check on the sys-tem, this procedure did not provide an inde-pendent verification of the GPS information.The Safety Board concludes that the watch offi-cers on the Royal Majesty may have believedthat because the GPS had demonstrated suffi-cient reliability over 3 ½ years, the traditionalpractice of using at least two independentsources of position information was not neces-sary.

After failing to recognize the mode changeon the GPS system, the watch officers had nu-merous opportunities to detect that the vesselhad drifted away from its intended track. Thefailure of the chief officer and the second officerto recognize that the Royal Majesty was offcourse may be explained by how convincing thedisplay of position information was. TheNACOS 25 presented the watch officers with adetailed map view (on the ARPA display) thatindicated the position of the ship. The map dis-play provided a very salient and seemingly accu-rate picture of the Royal Majesty's course. Re-search on decisionmaking indicates that cuesthat are most salient, such as the map display,tend to bias operators when they make diagnos-tic decisions.53 Further, research on decision-making in the presence of automation has indi-

52Mosier, K. L., Skitka, L. J., and Heers, S. T. Automa-

tion and Accountability for Performance. In: Proceedingsof the 8th International Symposium on Aviation Psychol-ogy. Columbus, OG: The Ohio State University, 1995.

53Wickens, C. D. 1984. Engineering Psychology and

Human Performance. Columbus, Ohio: Merrill.

cated that automation can bias an operator’s de-cisions.54

Both the chief officer and the second officerexhibited decisionmaking bias toward the auto-mated map display. Based on information fromthe map display, the chief officer felt no need tovisually verify his identification of the BA buoy.The second officer was overly reliant on themap display when he failed to cross check thevessel’s position despite repeated indications ofthe Royal Majesty's deviation from its intendedtrack. The Safety Board concludes that all thewatchstanding officers were overly reliant onthe automated position display of the NACOS25 and were, for all intents and purposes, sailingthe map display instead of using navigation aidsor lookout information.

Notwithstanding the merits of advancedsystems for high-technology navigation, theSafety Board does not consider the automationof a bridge navigation system as the exclusivemeans of navigating a ship, nor does the Boardbelieve that electronic displays should replacevisually verifiable navigation aids and land-marks. The human operator must have the pri-mary responsibility for the navigation; he mustoversee the automation and exercise his in-formed judgment about when to intervenemanually.

As the grounding of the Royal Majestyshows, shipboard automated systems, such asthe integrated bridge system and the GPS, canhave a profound influence on a watchstander’sperformance. However, the full impact of auto-mated systems on watchstanding performancehas yet to be examined in detail. The CoastGuard has begun this effort by examining howautomation affects watch officers’ tasks andworkload. The Safety Board believes furtherresearch is necessary. Therefore, the SafetyBoard recommends that the Coast Guard con-tinue its research on shipboard automation, fo-cusing on watch officers’ monitoring and deci-

54

Mosier, K. L.; Skitka, L. J. 1966. “Humans & automa-tion, Made for each other?” In Raja Parasuraman andMustapha Mouloua. Eds. Automation and Human Per-formance: Theory and Applications. Mahwah, NJ: Law-rence Erlbaum Associates.

Page 44: Royal Majesty

36

sionmaking aboard ships with automated inte-grated bridge systems.

Integrated Bridge System Design andLocation

The performance of the watch officers dur-ing the voyage and the circumstances leading tothe grounding were linked to several error-inducing deficiencies in the design of theequipment and to an inefficient layout of systemdisplays on the bridge.

Although the Raytheon 920 GPS receiver’sNMEA 0183 output data should have been pro-grammed to identify the receiver as an inte-grated instrument (II) talker with a system mode(SYS) sentence to indicate GPS or DR mode, theindustry standard NMEA 0183 data protocol didnot provide a SYS identifier for DR mode. Inshort, the NMEA did not consider that hybridmode receivers could use DR as one of theirmodes of determining position. Consequently,the Raytheon designers chose to use the GPSGP identifier in the NMEA 0183 output, re-gardless of whether the Raytheon 920 GPS de-vice was transmitting valid GPS data or DR-derived position data.

To account for this, however, Raytheon alsoprogrammed the Raytheon 920 GPS to auto-matically set the NMEA 0183 valid/invalid po-sition data bits to the invalid state when the GPSwas operating in the SOL and/or DR mode. Indoing so, Raytheon assumed that a listener de-vice, such as the NACOS 25, using position datafrom a GP talker would recognize when the datawere flagged invalid.

Once the desired position receiver is se-lected by the crew, the NACOS 25 takes posi-tion data from the chosen position receiverbased on the “talker” identifier code in theNMEA 0183 data stream; in this case, GP in thedata stream from the Royal Majesty’s Raytheon920 GPS. STN Atlas designers did not expect adevice identifying itself as GP to send positiondata based on anything other than GPS data,particularly not on DR-derived position data.Further, STN Atlas expected inaccurate or failedGPS position data to be recognizable by nulledposition data fields or by no change in the posi-

tion latitude/longitude, the latter of which wouldtrigger the NACOS 25 position-fix alarm. STNAtlas therefore chose not to program theNACOS 25 to check the valid/invalid bits in theNMEA 0183 data stream as a means of detect-ing invalid GPS data. Consequently, when theGPS defaulted to the DR mode, the NACOS 25autopilot was unable to recognize the statuschange; and thus its subsequent navigation didnot correct for the effect of wind, current, orsea. The Safety Board concludes that becausethe industry standard NMEA 0183 data protocoldid not provide a documented or standardizedmeans of communicating or recognizing that aDR positioning mode was in use by a hybrid,DR-capable position receiver, Raytheon andSTN Atlas adopted different design philoso-phies about the communication of position-receiver mode changes for the Raytheon 920GPS and the NACOS 25.

Nevertheless, STN Atlas was aware of andclaimed compatibility with the NMEA 0183protocol containing the valid/invalid status bitsused by Raytheon and was capable of makingthe NACOS 25 NMEA 0183 interface fullycompatible with those specifications if it wantedto do so (including the recommended minimumGPS data sentence RMC). Therefore, the SafetyBoard further concludes that STN Atlas shouldhave, in order to help ensure safety and com-patibility with different NMEA 0183 positionreceivers, programmed the Royal Majesty’sNACOS 25 to recognize the valid/invalid statusbits in the NMEA 0183 data, including thosespecified in the NMEA 0183 v1.5 RMC recom-mended minimum GPS data sentence. TheSafety Board is aware that since the accident,STN Atlas has taken steps to program its inte-grated navigation system NMEA 0183 inter-faces to meet a newer, more comprehensiveNMEA 0183 version and to ensure that no DR-capable position receivers are used with itsNACOS-integrated navigation system. TheSafety Board believes that Raytheon should de-sign its hybrid positioning systems to identifythemselves as integrated instruments (II) with anappropriate system mode identifier (SYS) in co-ordination with the NMEA. Further, the Boardbelieves that the NMEA and the IEC should re-

Page 45: Royal Majesty

37

vise their electronic interface standards to pro-vide an explicit means of indicating when hy-brid position receivers are transmitting DR-derived position data. Finally, the Board be-lieves that the NMEA and the IEC should advisetheir members to (1) immediately inform theNMEA and the IEC of perceived inadequaciesin electronic interface standards and (2), if ap-plicable, design their hybrid positioning systemsto identify themselves (“talk”) as integrated in-struments (II) with an appropriate system modeidentifier (SYS).

Although the Royal Majesty was equippedwith multiple position receivers, the NACOS 25autopilot was not configured to compare posi-tion data from multiple independent positionreceivers, such as the Raytheon 920 GPS andthe 780 Loran-C receivers. Given the RoyalMajesty’s frequent proximity to land and theexpected reasonable accuracy of the Loran-C inthat area, the NACOS 25 could have recognizedthe large discrepancy between the GPS and theLoran-C positions as the vessel approachedNantucket Shoals had it been able to comparethem. The Safety Board concludes that had theautopilot been configured to compare positiondata from multiple independent position receiv-ers and had a corresponding alarm been installedthat activated when discrepancies were detected,the accident may have been avoided. The safetybenefits associated with the redundancy of suchcritical systems as position receivers would helpprevent such single-point catastrophic failuresas occurred on the Royal Majesty. The SafetyBoard believes, therefore, that STN Atlas shoulddesign its integrated bridge systems to incorpo-rate multiple independent position receivers,comparison of position data from those receiv-ers, and related crew alerts regarding changes inposition-receiver accuracy, selection, and mode.

The NACOS 25 central console provided ef-ficient access to and display of most informationneeded to conduct a passage when the GPS wasfully operational. However, where varioussources of position information were possible(i.e., GPS, Loran-C, or DR), as with the NACOS25 autopilot, it was important to delineateclearly which mode was in use. On the RoyalMajesty, because the NACOS 25 could not de-

tect the GPS’s change to DR mode, the centralconsole display switched from GPS to DR-derived positions without changing its display inany perceivable way or notifying the crew. Theintegrated bridge system, as configured, did notindicate to the officers at the central console thatthe navigation system had defaulted to the DRmode.

The design of the integrated bridge systemconsolidated most of the officers’ watchstandingnavigation activities at the central console whenthe Royal Majesty was underway. The officer onwatch could remain in the console seat for mostof his watch and execute maneuvers along withmost of the essential navigation tasks. However,key components of the system were installedelsewhere so that the officers needed to leavethe console area to do monitoring tasks. In orderto cross check the position instrumentation andto verify that the navigation system was not inthe DR mode, officers needed to see equipmentdisplays in the chart room behind the consolearea on the bridge. The GPS and the Loran-Creceivers were convenient only when manualchart work was being performed. The SafetyBoard concludes that because watch officersmust verify proper equipment operation fre-quently, alternative sources of critical equip-ment status should have been displayed directlyon the console or on repeaters located wherethey could be seen from the central console.

Of particular concern was the alarm systemfor the GPS. The internal aural alarm for theGPS lasted 1 second, despite its critical func-tion. Neither the brief aural alarm nor the visualalarm, in the form of very small DR and SOLcharacters on the GPS receiver’s screen, couldbe easily seen or heard at the command console.Rather, the GPS receiver was in the chart room.The remoteness of the location probably pre-cluded the watch officers’ hearing the alarm orinitially noticing the DR and SOL indicationswhen the GPS defaulted to the DR mode. Fur-ther, the installer of the integrated bridge systemdid not connect the GPS receiver’s externalalarm switch to a loud and continuous externalalarm, even though one was available. Had theGPS external alarm been installed or had its in-ternal aural alarm required the user to take ac-

Page 46: Royal Majesty

38

tion to silence it, the officers would have beenalerted to the GPS antenna problem shortly afterleaving St. George’s. Consequently, the SafetyBoard concludes that the Raytheon 920 GPSreceiver’s brief aural alarm, the remoteness ofthe receiver’s location, and the failure of theinstaller to connect the GPS external alarm re-sulted in the inadequacy of the aural warningsent to the crew when the GPS defaulted to theDR mode. In view of the foregoing, the SafetyBoard believes that Raytheon should design itsposition receivers to provide continuous auralalarms that require the user to take action to si-lence them. The Board further believes that theNMEA should recommend that its members de-sign and install critical aural alarms that arecontinuous and require the user to take action tosilence them. Finally, the Safety Board believesthat the ICCL, the International Chamber ofShipping, and INTERTANKO should recom-mend to their members that they ensure that in-tegrated bridge systems installed on their vesselsprovide critical aural alarms that are continuousand require the user to take action to silencethem.

The failure of the GPS antenna connectionand the subsequent failure of the NACOS 25autopilot to recognize the GPS data as invalidand to sound an alarm resulted in a single-point,“silent” failure mode on the Royal Majesty.Aeronautical and aerospace design safety prac-tices typically require the analysis of potentialfailure modes via failure modes and effectsanalyses (FMEAs). FMEAs of the Royal Maj-esty’s integrated bridge system could have high-lighted the need for multiple independent com-parisons of positioning systems to detect dis-crepancies between systems, the need for re-moval of the DR input to the Raytheon 920 GPSreceiver, and the need for the NACOS 25 to in-terrogate the NMEA 0183 valid/invalid positiondata bits. The Safety Board concludes thatFMEAs of the Royal Majesty’s integrated bridgesystem would probably have disclosed theshortcomings of the system’s components.Therefore, the Safety Board believes that theCoast Guard should propose to the IMO that itdevelop standards for integrated bridge systemdesign that will require:

• multiple independent position-receiver inputs;

• monitoring position-receiver datafor failures/invalid data and subse-quent positive annunciation to thecrew;

• comparing position-receiver data forsignificant discrepancies betweenposition receivers, and subsequentpositive annunciation to the crew;and

• FMEAs during the design processand once again when all peripheraldevices and equip-ment details havebeen “frozen” if the FMEA duringthe design process does not accountfor all peripheral device/equipmentvariations.

The Safety Board also believes that STNAtlas should recommend that all of its custom-ers have final FMEAs for their installations,because overall integrated bridge system andperipheral device installation details frequentlyvary from installation to installation.

Further, the Safety Board believes that, inthe interim, the ICCL, the International Cham-ber of Shipping, and INTERTANKO shouldrecommend that each of their members ensurethat their existing and new integrated bridgesystems incorporate the following:

• multiple independent position-receiver inputs;

• monitoring position-receiver datafor failures/invalid data and subse-quent positive annunciation to thecrew;

• comparing position-receiver data forsignificant discrepancies betweenposition receivers, and subsequentpositive annunciation to the crew;and

• FMEAs on existing systems, duringthe design process for new systems,

Page 47: Royal Majesty

39

and whenever peripheral devices orequipment details change.

Human Systems IntegrationIt is apparent that the marine industry is un-

dergoing the same evolution in automation thatthe aviation and other transportation industriesare. Accidents involving automated systems,like the grounding of the Royal Majesty, high-light the importance of considering the abilitiesof the human operator in automated systems.Rothblum et al. concluded:

Automation is becoming more prevalenton commercial ships, affecting such ar-eas as engineering, bridge, and cargooperations. When designed properly andused by trained personnel, such auto-mation can be helpful in improving op-erational efficiency and safety. How-ever, when designed poorly or misusedby undertrained or untrained personnel,automated equipment can be a contrib-uting cause to accidents. In one study of100 marine casualties, inadequateknowledge about equipment was foundto be a contributing cause in 35 percentof the casualties. The most frequentlycited problem was the misuse or nonuseof radar. Lack of training is not the onlyproblem. Poor equipment design can in-duce the mariner to make mistakes. Inthe same study, one-third of the acci-dents were found to be caused partly bypoor human-factors design of theequipment.55

Inadequate training and poor human-factorsdesign are often the result of applying a tech-nology-centered philosophy to automated sys-tems.56 This approach seeks to replace marinerfunctions with machine functions without con-sidering the mariners’ capabilities and limita-

55

Rothblum, Sanquist, Lee, and McCallum. “Identifyingthe Effects of Shipboard Automation on Mariner Qualifi-cations and Training and Equipment Design.” Paper pre-pared for ISHFOB ’95: Informational Symposium—Hu-man Factors on Board. Bremen, Germany. November 15-17, 1995.

56Norman, S; Billings, C.E.; and others. 1988. Aircraft

automation philosophy: A source document. Moffett Field,CA: NASA Ames Research Center.

tions. As a result, the approach has the effect ofleaving the mariner out of meaningful control oractive participation in the operation of the ship.A human-centered philosophy towards automa-tion recognizes that the mariner is the centralelement in the operation of the ship. Conse-quently, the philosophy emphasizes designs thatfully utilize human capabilities and protectagainst human limitations, such as unreliablemonitoring and bias in decisionmaking.

Human systems integration (HSI), part ofthe systems engineering57 process addressingthe psycho-social aspects of system design, rep-resents a method by which automation can bedesigned with a human-centered philosophy.HSI addresses such areas as human-factors en-gineering,58 training, manpower, and personnel.The types of human engineering analyses asso-ciated with HSI (i.e., task analysis, and erroranalysis) help us to understand the impact ofautomation on human tasks and on the entiresystem’s performance.

Several standards and guidelines have beenproduced to ensure that human factors are ad-dressed in system designs, thus reducing thepotential for human error. These standards ad-dress behaviors related to automation and spec-ify design parameters that keep the systems’operating characteristics within the physical andcognitive capabilities of humans. The U.S. De-partment of Defense and the National Aeronau-tics and Space Administration have long recog-nized the importance of addressing human fac-tors early in the system design, development,and overall acquisition processes and have pub-lished relevant human engineering standards andguidelines.59

57

Systems engineering is the management function thatcontrols the total system development effort for the purposeof achieving an optimum balance of all system elements.Generally, those elements are equipment, software, person-nel, facilities, and data. HSI specifically addresses the per-sonnel, or human interactive, aspects of the system.

58Human-factors engineering is the application of the prin-

ciples of human behavior to the design of equipment andsystems to enhance performance, safety, and quality.

59Department of Defense: DOD 5000.2 “Defense Acquisi-

tion Management Policies and Procedures;” MIL-H-46855,“Human Engineering Requirements for Military Systems,

Page 48: Royal Majesty

40

Other sectors of the maritime industry haveincorporated human-factors engineering rou-tinely. For example, the American Society ofTesting and Materials has adopted much of theDepartment of Defense human engineeringstandards in designing off-shore oil platforms.60

Thus, while human engineering is a known con-cept in the marine industry, there have not beenany unifying efforts to integrate this conceptinto the marine engineering and manufacturingsector. Additionally, human engineering in thebroader context of HSI has been given little orno consideration. Consequently, the potentialfor error causing behavior related to these sys-tems has not been adequately addressed by themarine industry.

To assess the HSI involved in the automatedsystems on the Royal Majesty, the Safety Boardexamined the training the officers received andthe design of the automated systems in the con-text of human-factors engineering.

Watch Officers’ Training in Using the In-tegrated Bridge System.—The investigationdetermined that although the manufacturer ofthe NACOS autopilot, STN Atlas, had class-room and simulator training available to pur-chasers of the system, the owner of the RoyalMajesty had not purchased any training. Whenthe vessel was placed in service, the manufac-turer provided an orientation during sea trials tothe first complement of officers assigned to theship; however, of the officers on the Royal Maj-esty at the time of the grounding, only the chiefofficer had been a part of that complement.

The investigation determined that the watchofficers on the Royal Majesty during thegrounding were familiar with the basic opera-tion of the automated navigation equipment, butthat no one, with the possible exception of thenavigator, appeared to be fully proficient withthe system, as evidenced by the lack of knowl-

Equipment, and Facilities;” MIL-STD-1472, “Human Engi-neering Design Criteria for Military Systems, Equipment, andFacilities;” MIL-STD 1800, “Human Factors Engineering;”MIL-STD 1801, “User-System Interface.”

60ASTM Standard F1166-88, Standard practice for hu-

man engineering design for marine systems, equipment andfacilities. ASTM Philadelphia, Pennsylvania.

edge about the GPS receiver’s DR mode capa-bility. The crew’s automated navigation equip-ment training consisted primarily of on-the-jobtraining, the type of training on which the ma-rine industry has historically relied. For exam-ple, the second officer’s preparation to operatethe automated navigation system was describedas him reading the equipment manuals acquiredwith the system installation, observing bridgeoperations by the other officers, and using theequipment under their supervision. Because thesecond officer’s introduction to the system con-sisted of watching others or operating the sys-tem himself during routine conditions, heprobably had very little experience in recogniz-ing and coping with system malfunctions.

The Safety Board has long supported on-the-job training as an important aspect of an op-erator’s training. However, with the implemen-tation of sophisticated, automated navigationalequipment, the Safety Board believes that on-the-job training alone may not be sufficient. TheSafety Board is particularly concerned that therewere no procedures to determine the proficiencyof the officers in operating the automated navi-gation system, including the navigator who, ac-cording to his testimony, was responsible for allinstruments on the bridge and the orientationand training of new officers. The Safety Boardconcludes that the on-the-job training programemployed by Majesty Cruise Line to train theRoyal Majesty’s watch officers in the operationof the integrated bridge system did not ade-quately prepare the officers to identify and re-spond to system malfunctions. Therefore, theSafety Board believes that Majesty Cruise Lineshould provide initial and recurrent formaltraining on essential technical information,equipment functions, and system operating pro-cedures to all bridge watchstanding personnelon all of its ships that are equipped with inte-grated bridge systems. The Safety Board alsobelieves that the ICCL should encourage itsmembers to take the same steps.

As discussed earlier, the watch officers, inparticular the second officer and the chief offi-cer, abandoned the good watchstanding prac-tices of properly monitoring and cross checkingthe progress of their vessel and instead relied

Page 49: Royal Majesty

41

almost solely on the GPS and the ARPA displayto provide them with information about the ves-sel’s movements. The circumstances of thegrounding of the Royal Majesty and the discus-sions at the Safety Board’s public forum suggestthat there is a need for the international mari-time community to address the issue of improv-ing training for deck officers assigned to vesselsequipped with electronic navigation equipmentand integrated bridge systems. The Safety Boardis concerned that the inadequacy of traininggiven to the crew of the Royal Majesty in theuse of sophisticated electronic navigationequipment and integrated bridge systems may betypical of the industry. Therefore, the SafetyBoard believes that the Coast Guard should pro-pose to the IMO that it develop appropriate per-formance standards for the training of watchofficers assigned to vessels equipped with so-phisticated electronic navigation equipment andintegrated bridge systems and then require thistraining.

The deficient monitoring of the integratednavigation system by the deck officers and thesecond officer’s failure to recognize the dangerto the Royal Majesty before the grounding pointto the usefulness of training in bridge resourcemanagement. As shown by its issuance of SafetyRecommendations M-93-18, and -19, the SafetyBoard has advocated such training for deck offi-cers who operate conventional navigationbridges. The grounding of the Royal Majesty,however, shows the need to address proceduresfor and training in effective monitoring of auto-mated navigation equipment.

Bridge resource management trainingadapted for watch officers working with fullyautomated navigation systems or integratedbridge systems could improve the officers’ per-formance. The training would help them makedecisions that are not biased by their use ofautomated equipment. It would improve theirsituational awareness,61 which, research

61

Situational awareness is a concept referring to percep-tion of an operating environment, comprehension of eventsand circumstances pertaining to that environment, and aprojection of their status. Endsley, M., Situational Aware-ness. Presentation to National Transportation Safety Board,June 6, 1996.

shows,62 declines when operations are auto-mated.

On June 25, 1993, as a result of its investi-gation of the grounding of the United Kingdompassenger vessel RMS Queen Elizabeth 2 (nearCuttyhunk Island, Vineyard Sound, Massachu-setts, on August 7, 1992, the Safety Board is-sued Safety Recommendations M-93-18 and -19to the Coast Guard. The Safety Board requestedthat the Coast Guard:

Propose to the IMO that standards andcurricula be developed for bridge re-source management training for themasters, deck officers, and pilots ofocean-going ships. (M-93-18)

Propose to the IMO that the masters,deck officers, and pilots of ocean-goingships be required to successfully com-plete initial and recurrent training inbridge resource management. (M-93-19)

On September 27, 1993, responding toSafety Recommendation M-93-18, the CoastGuard Commandant wrote:

I partially concur with this recommen-dation. The U.S. will propose at the25th Session of the IMO Subcommitteeon STW that standards and curricula bedeveloped for bridge resource manage-ment training for masters and deck offi-cers of seagoing ships. However, theCoast Guard views pilot qualificationsas a matter for port State regulation. Iwill keep the Board informed of ourprogress regarding this recommenda-tion.

On January 7, 1994, the Safety Board re-sponded:

62Pew, R.W. Situational Awareness and its Analysis in

Accident Situations. Presentation by Bold, Beranek andNewman, Inc., to the National Transportation Safety Board,June 7, 1995. Also, Endsley, M.L. and Kiris, E.O., TheOut-of-the-Loop Performance Problem: Impact of Level ofAutomation and Situational Awareness., ref. In Mouloua,M. and Parasuraman, R., Eds., Human Performance inAutomated Systems: Current Research and Trends,Hillsdale, New Jersey, Lawrence Erlbaum Associates,1994. Pp. 51,55.

Page 50: Royal Majesty

42

The Safety Board agrees that, in theend, pilot qualifications are a matter forthe port State to enforce. The intent ofthe recommendation is for the IMO todevelop a specified standard that wouldserve as a model that the port Statescould adopt. The United States has re-cently been more receptive to the ideaof developing a unilateral standard if itis included in the Standards of Trainingand Watchkeeping. Consequently, theBoard encourages the Coast Guard topursue this issue at the IMO. Becausethe Coast Guard states it will proposethe recommendation to the IMO, SafetyRecommendation M-93-18 has beenclassified “Open--Acceptable Re-sponse,” pending implementation by theIMO.

On September 27, 1993, responding toSafety Recommendation M-93-19, the CoastGuard Commandant wrote:

I partially concur with this recommen-dation. The United States will proposethat IMO agree in principle to requiringmasters and deck officers on seagoingships to complete initial and recurrenttraining in bridge resource management.However, the Coast Guard views pilotqualifications as a matter for port Stateregulation. I will keep the Board in-formed of our progress regarding thisrecommendation.

On January 7, 1994, the Safety Board re-sponded that for the reasons stated in the discus-sion of Safety Recommendation M-93-18, theSafety Board encouraged the Coast Guard toactively promote the IMO’s acceptance ofSafety Recommendation M-93-19. Because theCoast Guard had agreed to “proposing in princi-ple” the recommendation, the Board classifiedSafety Recommendation M-93-19 “Open--Acceptable Alternate Response,” pending theoutcome of the Coast Guard’s efforts.

Therefore, the Safety Board reiteratesSafety Recommendations M-93-18 and -19 andurges the Coast Guard to work closely with the

IMO in order to expedite the intended outcomeof these recommendations.

The Safety Board also believes that theCoast Guard, as part of the foreign flag passen-ger ship control verification examination pro-gram, should assess the adequacy of installedintegrated bridge systems and verify that theships’ officers are properly trained in their op-eration and possible failure modes. Furthermore,as part of the same program, the Coast Guardshould verify that the watchstanding proceduresof ships’ officers include the use of multipleindependent means of position verification.

Human-factors Engineering.—Where mul-tiple modes of operation are possible on a sys-tem, an important human-factors engineeringprinciple is the clear delineation to the operatorof what mode is in use and of when a change inmode occurs. Because different operating pro-cedures may be required for the different modesin use, the operator must be aware of the modeto remain in the decisionmaking process. Thus,the display of which modes and functions are inuse should be clearly evident to the operator.

A good example of automation mode confu-sion occurred on January 20, 1992, when an AirInter Airbus A320 crashed on a mountainsidewhile on approach to the Strasbourg-EntzheimAirport. The French Transport Ministry’s in-vestigation determined that the pilots had be-come confused with the vertical speed/flightpath angle display mode on the A320’s flightcontrol unit and had entered a 3,300 foot/minuteautomatic rate of descent instead of an intended3.3 angle of descent to the airport. The displaysof the vertical speed and the flight path anglewere almost identical and thus easily confused.

Not only did the GPS receiver on the RoyalMajesty display the DR coordinates in the samecharacter size and format as the coordinates de-rived from satellite data, it switched to the DRmode automatically, without requiring a humanto acknowledge that the mode was acceptable.However, as previously discussed, deficienciesin the alarm, the distance of the receiver fromthe operator, and the inadequacy of the crew’sprocedures also contributed to the crew’s failureto recognize the change to DR mode.

Page 51: Royal Majesty

43

The size of characters, the viewing distance,and the use of contrasting colors are a few of thefactors that should be considered in designingcharacter displays for alerts and warnings. Alertmessages and status indicators about criticalinformation, such as the GPS defaulting to theDR mode, should be distinctively displayed. Inthis case, the SOL and DR alert messages weremuch smaller than the normal status informa-tion.

An operator may also become desensitizedwhen an alert appears frequently with normalstatus information. In this case, whenever chop-ping occurred, SOL and DR were displayed. Thewatch officers had noticed these messages manytimes before and perhaps had learned to pay lit-tle attention to them.

The Safety Board concludes that the RoyalMajesty’s integrated bridge system had severalshortcomings with respect to human-factors en-gineering. First, mode information was notavailable to the crew at the central console (thenormal position). Second, the GPS/DR alarmand status indicators, which could have alertedthe crew to the mode change, were either notinstalled (external alarm) or not salient enough(internal alarm) to attract the watchstanders’attention. Finally, the integrated bridge systemas implemented on the Royal Majesty failed toadequately define the watch officers’ tasks andprocedures. If the automation on board theRoyal Majesty had been appropriately imple-mented and integrated with the human operator,the vessel probably would not have grounded.Because of the Safety Board’s concern thatautomation on other vessels has not been appro-priately implemented and integrated with thehuman operator, the Board believes that theCoast Guard should propose to the IMO that itapply existing human-factors engineering stan-dards in the design of integrated bridge systemson vessels.

Certification of Integrated Bridge Sys-tems

A draft IMO performance standard for inte-grated bridge systems is currently under reviewand is expected to be adopted and implemented

by 1999. At the Safety Board’s public forum onintegrated bridge systems, manufacturers of in-tegrated bridge systems pointed out that inte-grating the various components like ARPA,autopilot, electronic chart system (or radarmap), and monitoring systems involves carefulmatching and FMEAs to eliminate any potentialinterface problems. The recently developed in-terface standards from the IEC and the NMEA(IEC 1162-2 and NMEA 0183) should facilitatethe matching of subsystems manufactured byone manufacturer to an integrated bridge systemmanufactured by another. These standards andan IMO performance standard should eliminatemany of the potential interface problems. TheSafety Board concludes that there is a need tohave performance standards for integratedbridge systems, and to require that the systemsbe inspected and certified.

The proposed IMO performance standardfor integrated bridge systems includes a re-quirement that the manufacturers of integratedbridge systems be certified by the ISO. Thus, itwould appear that the safeguards for guarantee-ing the quality of software during manufacturinglikely will become an IMO requirement. Such arequirement could ensure that the people re-sponsible for developing the software are wellqualified and that the manufacturer has proce-dures for verifying the quality of the software.

Developments in electronic equipment,however, are very rapid, and it is sometimespossible for developments to occur more quicklythan standards can be produced. Further, thepossibility exists that software may be changed,possibly inappropriately, during the life of anintegrated bridge system. Therefore, the selec-tion and matching of electronic equipment willstill require highly qualified personnel who arefamiliar with the equipment, the data to betransmitted, the format of the data, and the ap-plicable standards. The Safety Board believesthat there is a need for some competent author-ity to conduct continuing oversight to ensurethat future changes in subsystems or software onintegrated bridge systems are compatible andthat system integrity is maintained. Also, theSafety Board believes that certifying navigationbridges equipped with integrated bridge systems

Page 52: Royal Majesty

44

should be done by a qualified, independentauthority. In summary, the Safety Board be-lieves that the Coast Guard should propose tothe IMO that a provision be included in the per-formance standard for integrated bridge systems

that would require that a competent independentauthority inspect and certify the navigationbridge of each commercial vessel equipped withan integrated bridge system when the system isinstalled and periodically throughout its life.

Page 53: Royal Majesty

45

CONCLUSIONS

1. The weather, the mechanical condition ofthe Royal Majesty, except for the global po-sitioning system receiver, the officers’ certi-fications, drugs, and fatigue were not factorsin the accident.

2. Although Coast Guard personnel observedno indications that the officers had been un-der the influence of alcohol, alcohol couldnot be conclusively ruled out as a factor inthe accident because of the delay in col-lecting the blood and urine specimens.

3. About 52 minutes after the Royal Majestyleft St. George’s, Bermuda, the global posi-tioning system receiver antenna cable con-nection had separated enough that the globalpositioning system switched to dead-reckoning mode, and the autopilot, not pro-grammed to detect the mode change and in-valid status bits, no longer corrected for theeffects of wind, current, or sea.

4. Openly routing the global positioning sys-tem antenna cable in an area where someoneoccasionally walked increased the risk ofdamage to the cable and related connectors.

5. Had the fathometer alarm been set to 3 me-ters, as was the stated practice, or had thesecond officer chosen to display thefathometer data on the control console, hewould have been alerted that the Royal Maj-esty was in far shallower water than ex-pected and, thus, was off course. He wouldhave been alerted perhaps as long as 40minutes before the grounding, and thesituation could have been corrected.

6. The watch officers’ monitoring of the statusof the vessel’s global positioning systemwas deficient throughout the voyage fromSt. George’s.

7. Deliberate cross checking between theglobal positioning system and the Loran-Cto verify the Royal Majesty’s position was

not being performed and should have beenon the voyage from St. George’s.

8. Even though it is likely that the watch offi-cers were not aware of the limitation inher-ent in using the position-fix alarm to moni-tor the accuracy of GPS position data, it wasinappropriate for them to rely solely on thealarm to warn them of any problems withthe GPS data.

9. The sighting of lights not normally observedin the traffic lanes, the second officer’s in-ability to confirm the presence of the BBbuoy, and the sighting of blue and whitewater should have taken precedence overthe automation display on the central con-sole and compelled the second officer topromptly use all available means to verifyhis position.

10. The chief officer and the second officer didnot observe good watchkeeping practices oract with heightened awareness of the pre-cautions that are needed when a vessel ap-proaches the Boston traffic lanes and land-fall.

11. The master’s methods for monitoring theprogress of the voyage did not account forthe technical capabilities and limitations ofthe automated equipment.

12. The watch officers on the Royal Majestymay have believed that because the globalpositioning system had demonstrated suffi-cient reliability over 3 1/2 years, the tradi-tional practice of using at least two inde-pendent sources of position information wasnot necessary.

13. All the watchstanding officers were overlyreliant on the automated position display ofthe navigation and command system 25 andwere, for all intents and purposes, sailingthe map display instead of using navigationaids or lookout information.

Page 54: Royal Majesty

46

14. Because the industry standard 0183 dataprotocol did not provide a documented orstandardized means of communicating orrecognizing that a dead-reckoning position-ing mode was in use by a hybrid, dead reck-oning capable position receiver, Raytheonand STN Atlas adopted different designphilosophies about the communication ofposition-receiver mode changes for theRaytheon 920 global positioning system andthe navigation and command system 25.

15. STN Atlas should have, in order to help en-sure safety and compatibility with differentNational Marine Electronics Association(NMEA) 0183 position receivers, pro-grammed the Royal Majesty’s navigationand command system 25 to recognize thevalid/invalid status bits in the NMEA 0183data, including those specified in the NMEA0183 v1.5 RMC recommended minimumglobal positioning system data sentence.

16. Had the navigation and command system 25autopilot been configured to compare posi-tion data from multiple independent positionreceivers and had a corresponding alarmbeen installed that activated when discrep-ancies were detected, the grounding of theRoyal Majesty may have been avoided.

17. Because watch officers must verify properequipment operation frequently, alternativesources of critical equipment status shouldhave been displayed directly on the consoleor on repeaters located where they could beseen from the central console.

18. The brief aural alarm of the Raytheon 920global positioning system receiver, the re-moteness of the receiver’s location, and thefailure of the installer to connect the globalpositioning system external alarm resultedin the inadequacy of the aural warning sentto the crew when the global positioningsystem defaulted to the dead-reckoningmode.

19. Failure modes and effects analyses of theRoyal Majesty’s integrated bridge systemwould probably have disclosed the short-comings of the system’s components.

20. The on-the-job training program employedby Majesty Cruise Line to train the RoyalMajesty’s watch officers in the operation ofthe integrated bridge system did not ade-quately prepare these officers to identifyand respond to system malfunctions.

21. The Royal Majesty’s integrated bridge sys-tem did not adequately incorporate human-factors engineering.

22. There is a need to have performance stan-dards for integrated bridge systems, and torequire that the systems be inspected andcertified.

Page 55: Royal Majesty

47

PROBABLE CAUSE

The National Transportation Safety Boarddetermines that the probable cause of thegrounding of the Royal Majesty was the watchofficers’ overreliance on the automated featuresof the integrated bridge system, Majesty CruiseLine’s failure to ensure that its officers wereadequately trained in the automated features ofthe integrated bridge system and in the implica-tions of this automation for bridge resourcemanagement, the deficiencies in the design andimplementation of the integrated bridge system

and in the procedures for its operation, and thesecond officer’s failure to take corrective actionafter several cues indicated the vessel was offcourse.

Contributing factors were the inadequacy ofinternational training standards for watch-standers aboard vessels equipped with electronicnavigation systems and integrated bridge sys-tems and the inadequacy of international stan-dards for the design, installation, and testing ofintegrated bridge systems aboard vessels.

Page 56: Royal Majesty

48

RECOMMENDATIONS

As a result of its investigation of this acci-dent, the National Transportation Safety Boardreiterates the following recommendations:

To the U.S. Coast Guard:

Propose to the International MaritimeOrganization that standards and curric-ula be developed for bridge resourcemanagement training for the masters,deck officers, and pilots of ocean-goingships. (M-93-18)

Propose to the International MaritimeOrganization that the masters, deck offi-cers, and pilots of ocean-going ships berequired to successfully complete initialand recurrent training in bridge resourcemanagement. (M-93-19)

Also as a result of the investigation, the Na-tional Transportation Safety Board makes thefollowing recommendations:

To Majesty Cruise Line:

Provide initial and recurrent formaltraining on essential technical informa-tion, equipment functions, and systemoperating procedures to all bridgewatchstanding personnel on all its shipsthat are equipped with integrated bridgesystems. (M-97-1)

Review the bridge watchstanding prac-tices on all its vessels, and revise, asnecessary, to ensure that all watch offi-cers adhere to sound watchstandingpractices and procedures, including us-ing landmarks, soundings, and naviga-tional aids to verify a vessel’s position,relying on more than one source for po-sition information, and reporting to themaster any failure to detect importantnavigational aids. (M-97-2)

Periodically review the performance ofall officers on board its vessels.(M-97-3)

Eliminate the practice of openly routingnavigation equipment cable to decreasethe risk of damage. (M-97-4)

To the U.S. Coast Guard:

Propose to the International MaritimeOrganization that it develop appropriateperformance standards for the trainingof watch officers assigned to vesselsequipped with sophisticated electronicnavigation equipment and integratedbridge systems and then require thistraining. (M-97-5)

Propose to the International MaritimeOrganization that it develop standardsfor integrated bridge system design thatwill require

• multiple independent position-receiver inputs;

• monitoring position-receiver datafor failures/invalid data and subse-quent positive annunciation to thecrew;

• comparing position-receiver data forsignificant discrepancies betweenposition receivers, and subsequentpositive annunciation to the crew;and

• failure modes and effects analyses(FMEAs) during the design processand once again when all peripheraldevices and equipment details havebeen “frozen” if the FMEA duringthe design process does not accountfor all peripheral device/equipmentvariations. (M-97-6)

Propose to the International MaritimeOrganization that it apply existing hu-man-factors engineering standards in thedesign of integrated bridge systems onvessels. (M-97-7)

Page 57: Royal Majesty

49

Propose to the International MaritimeOrganization that a provision be in-cluded in the performance standard forintegrated bridge systems that would re-quire that a competent independentauthority inspect and certify the naviga-tion bridge of each commercial vesselequipped with an integrated bridge sys-tem when the system is installed andthroughout its life. (M-97-8)

Continue its research on shipboardautomation, focusing on watch officers’monitoring and decisionmaking aboardships with automated integrated bridgesystems. (M-97-9)

As part of the foreign flag passengership control verification examinationprogram, assess the adequacy of in-stalled integrated bridge systems andverify that the ships’ officers are prop-erly trained in their operation and possi-ble failure modes. (M-97-10)

As part of the foreign flag passengership control verification examinationprogram, verify that the watchstandingprocedures of ships’ officers include theuse of multiple independent means ofposition verification. (M-97-11)

To STN Atlas Elektronik GmbH:

Design its integrated bridge systems toincorporate multiple independent posi-tion receivers, comparison of positiondata from those receivers, and relatedcrew alerts regarding changes in posi-tion-receiver accuracy, selection, andmode. (M-97-12)

Recommend that all its customers havefinal failure modes and effects analysesfor their integrated bridge system in-stallations. (M-97-13)

To Raytheon Marine:

Design its hybrid positioning systems toidentify themselves as integrated in-struments (II) with an appropriate sys-tem mode identifier (SYS) in coordina-

tion with the National Marine Elec-tronics Association. (M-97-14)

Design its position receivers to providecontinuous aural alarms that require theuser to take action to silence them.(M-97-15)

To the National Marine Electronics Associa-tion:

Revise the 0183 electronic interfacestandard to provide an explicit means ofindicating when hybrid position receiv-ers are transmitting dead reckoning-derived position data. (M-97-16)

Advise its members to (1) immediatelyinform the National Marine ElectronicsAssociation and the International Elec-trotechnical Commission of perceivedinadequacies in electronic interfacestandards and (2), if applicable, designtheir hybrid positioning systems toidentify themselves (“talk”) as inte-grated instruments (II) with an appropri-ate system mode identifier (SYS).(M-97-17)

Recommend to its members that theydesign and install critical aural alarmsthat are continuous and require the userto take action to silence them.(M-97-18)

To the International Electrotechnical Com-mission:

Advise its members to (1) immediatelyinform the National Marine ElectronicsAssociation and the International Elec-trotechnical Commission of perceivedinadequacies in electronic interfacestandards and (2) if applicable, designtheir hybrid positioning systems toidentify themselves (“talk”) as inte-grated instruments (II) with an appropri-ate system mode identifier (SYS).(M-97-19)

Revise the 1162 electronic interfacestandard to provide an explicit means ofindicating when hybrid position receiv-

Page 58: Royal Majesty

50

ers are transmitting dead reckoning-derived position data. (M-97-20)

To the International Council of Cruise Lines:

Recommend that its members provideinitial and recurrent formal training onessential technical information, equip-ment functions, and system operatingprocedures to all bridge watchstandingpersonnel on their ships that areequipped with integrated bridge sys-tems. (M-97-21)

Recommend that its members reviewthe bridge watchstanding practices onall their vessels, and revise as necessaryto ensure that all watch officers adhereto sound watchstanding practices andprocedures, including using landmarks,soundings, and navigational aids to ver-ify a vessel’s position, relying on morethan one source for position informa-tion, and reporting to the master anyfailure to detect important navigationalaids. (M-97-22)

Recommend that its members periodi-cally review the performance of all offi-cers on board their vessels. (M-97-23)

Recommend that its members eliminatethe practice of openly routing naviga-tion equipment cable to decrease therisk of damage. (M-97-24)

Recommend to its members that theyensure that integrated bridge systems in-stalled on their vessels provide criticalaural alarms that are continuous and re-quire the user to take action to silencethem. (M-97-25)

Recommend that its members ensurethat their existing and new integratedbridge systems incorporate the follow-ing:

• multiple independent position-receiver inputs;

• monitoring position-receiver datafor failures/invalid data and subse-quent positive annunciation to thecrew;

• comparing position-receiver data forsignificant discrepancies betweenposition receivers, and subsequentpositive annunciation to the crew;and

• failure modes and effects analyseson existing systems, during the de-sign process for new systems andwhenever peripheral devices orequipment details change.(M-97-26)

To the International Chamber of Shippingand to the International Association of Inde-pendent Tanker Owners:

Recommend to its members that theyensure that integrated bridge systems in-stalled on their vessels provide criticalaural alarms that are continuous and re-quire the user to take action to silencethem. (M-97-27)

Recommend that its members ensurethat their existing and new integratedbridge systems incorporate the follow-ing:

• multiple independent position-receiver inputs;

• monitoring position-receiver datafor failures/invalid data and subse-quent positive annunciation to thecrew;

• comparing position-receiver data forsignificant discrepancies betweenposition receivers, and subsequentpositive annunciation to the crew;and

Page 59: Royal Majesty

51

• failure modes and effects analyseson existing systems, during the de-sign process for new systems and

whenever peripheral devices orequipment details change.(M-97-28)

BY THE NATIONAL TRANSPORTATION SAFETY BOARD

JAMES E. HALLChairman

ROBERT T. FRANCIS IIVice Chairman

JOHN A. HAMMERSCHMIDTMember

JOHN J. GOGLIAMember

GEORGE W. BLACK, JR.Member

April 2, 1997

Page 60: Royal Majesty

This page intentionally left blank

Page 61: Royal Majesty

53

APPENDIX A

INVESTIGATIONAbout 2225 on June 10, 1995, the Panamanian passenger ship Royal Majesty, carrying 1,509 passen-

gers and crewmembers, grounded on Rose and Crown Shoal about 10 miles east of Nantucket Island,Massachusetts.

The Safety Board was notified of the grounding early on June 11, 1995. On Monday morning (June12th), a Go-Team (an investigator-in-charge, an operations specialist, and, later, an aerospace engineer)were dispatched to the scene. When the team arrived on board the vessel, it had already proceeded toBoston. However, because the accident occurred in international waters, beyond the 3-mile limit, theSafety Board lacked jurisdiction to investigate. The Board then requested and was given permission bythe Coast Guard to participate as a party in interest at the Coast Guard Marine Board of Inquiry.

Sworn testimony was taken in Boston, Massachusetts, from June 13 through June 16, 1995. Becausethe Safety Board was participating as a party in interest, the scope of its investigation into the accidentwas limited to the information obtained from the Coast Guard Marine Board. The Board did not have theauthority to depose individuals and subpoena important records.

The Safety Board has considered all facts in the investigative record that are pertinent to the Board’sstatutory responsibility to determine the probable cause of this accident and to make recommendations.This report is based on the information collected and the analyses made during the Safety Board’s inves-tigation.

Page 62: Royal Majesty

This page intentionally left blank

Page 63: Royal Majesty

55

APPENDIX B

MAJESTY CRUISE LINE’S

ROYAL MAJESTY ’S “BRIDGE PROCEDURES GUIDE”The purpose of this guide is to provide you with a description of day-to-day Bridge procedures that

are recognized as good practice and to promote through them safety of the Royal Majesty, her passengersand crew. This guide is posted on the Bridge so that you may keep yourselves thoroughly familiar withits content which is not written in an arbitrary manner but with sincere wish that you will understandyour responsibilities and perform your duties in a professional manner.

The officer on watch is my representative, and your primary responsibility at all times is the safenavigation of the vessel. You must at all times comply with the 1972 International Regulations for Pre-venting Collisions At Sea.

You should keep your watch on the Bridge, which you should in no circumstances leave until prop-erly relieved. A prime responsibility of the Officer on Watch is to ensure the effectiveness of the navi-gating watch. It is of essential importance that all times you ensure that an efficient lookout is main-tained. You may visit the chart room, when essential, for short periods for the necessary performance ofyour navigational duties, but you should previously satisfy yourself that it is safe to do so and ensure thata good lookout is kept.

You continue to be responsible for the safe navigation of the vessel despite my presence on theBridge until I inform you specifically that I have assumed responsibility.

You should not hesitate to use the sound signaling apparatus at your disposal in accordance with the1972 International Regulations for Preventing Collisions At Sea.

You are responsible for the maintenance of a continuous and alert lookout. This is the most importantconsideration in the avoidance of casualties. The keeping of an efficient lookout requires to be inter-preted in its fullest sense which includes the following: A) An alert all round visual and aural lookout toensure a full grasp of the current situation including the presence of ships and landmarks in the vicinity.B) Close observation of the movements and compass bearing of approaching vessels. C) Identification ofships and shore lights. D) The need to ensure that the course is steered accurately and that wheel ordersare correctly executed. E) Observation of the radar and echo sounder displays. F) Observation of changesin the weather, especially the visibility.

You should bear in mind that the engines are at your disposal. You should not hesitate to usethem in case of need. However, timely notice of engine movements should be given when possible. Youshould also keep prominently in mind the maneuvering capabilities of this ship, including its stoppingdistances.

CONTROL OF MAIN ENGINES : There are two aspects with which you are mainly concerned:(A) Control of revolutions and pitch ahead and astern. You should be familiar with the operation of theengine/propellers control mechanism, bow thrusters, and rudders.

CHANGING OVER THE WATCH : The relieving officer on watch should ensure that members ofhis watch are fully capable of performing their duties and, in particular, that they are adjusted to nightvision. You should not take over the watch until your vision is fully adjusted to the light conditions andyou have personally satisfied yourself regarding: A) Standing orders and other special instructions relat-ing to the navigation of the vessel. B) The position, course, speed, and draught of the vessel. C) Prevail-ing and predicted tides, currents, weather, visibility, and the effect of these factors upon course and

Page 64: Royal Majesty

56

speed. D) The navigational situation including: i) The operational condition of all navigation and safetyequipment. ii) Errors of gyro and magnetic compasses. iii) The movement of vessels in the vicinity. iv)Conditions and hazards likely to be encountered during the watch. v) The possible effects of heel, trim,water density, and squat on under keel clearances. If at any time you are to be relieved, a maneuver orother action to avoid any hazard is taking place, your relief should be deferred until such action is com-pleted. You should not hand over the watch to the relieving officer if you have any reason to believe thatthe latter is under any disability which would preclude him from carrying out his duties effectively. If indoubt, you should inform me at once.

You should make regular checks to ensure that: A) The helmsman or the autopilot is steering the cor-rect course. B) The standard compass error is established at least once a watch and, when possible, afterany major alteration of course. C) The standard and gyro compasses are compared frequently and repeat-ers synchronized. D) The automatic pilot is tested in the manual position at least once a watch. E) Thenavigation and signal lights and other navigation equipment are functioning properly.

HELMSMAN/AUTOMATIC PILOT: You should bear in mind the need to station the helmsmanand change over the steering to manual control in good time to allow any potentially hazardous situationto be dealt within a safe manner. With a vessel under automatic steering, it is highly dangerous to allow asituation to develop to the point where you are without assistance and have to break the continuity of thelookout in order to take emergency action. The change-over from automatic to manual steering and visaversa should be made by or under the supervision of a responsible officer.

NAVIGATION IN COASTAL WATERS : The largest scale chart on board, suitable for the areaand corrected with the latest information, should be used. You should identify positively all relevantnavigation marks. Fixes should be taken at intervals whose frequency must depend upon factors such asdistance from nearest hazard, speed of ship, set experienced, etc. In cases such as a planned approach toan anchor berth or harbor entrance, fixing may be virtually continuous.

RESTRICTED VISIBILITY: When restricted visibility is encountered or suspected, your first re-sponsibility is to comply with 1972 International Regulations for Preventing Collisions At Sea with par-ticular regard to the sounding of fog signals, use of safe speed and availability of engines for immediatemaneuver. In addition you should A) Inform me. B) Post lookout(s), helmsman and in congested areas,revert to hand-steering immediately, C) Exhibit navigation lights. D) Operate and use the radar. All of theabove actions should, if possible, be taken in good time before visibility deteriorates.

CALLING THE MASTER: You should notify me immediately under the following circumstances:A) If visibility is deteriorating. B) If the movements of other vessels are causing concern. C) If difficultyis experienced in maintaining course. D) On failure to sight land or a navigation mark or to obtain asounding by the expected time. E) If either land or a navigation mark is sighted or a marked change in thesoundings occurs unexpectedly. F) On the breakdown of the engines, steering gear, or any other essentialnavigational equipment. G) If any doubt about the possibility of weather damage. H) In any other situa-tion in which you are in doubt. Despite the requirement to notify me immediately in the foregone circum-stances, you should not hesitate to take immediate action for the safety of the ship, where circumstancesso require.

NAVIGATION WITH PILOT EMBARKED : The presence of a pilot does not relieve you fromyour duties and obligations. You should cooperate closely with the pilot and maintain an accurate checkon the vessel’s position and movements. Alterations of course and/or changes in wheel and/or engineorders should be transmitted through you. If you are in any doubt as to the pilot’s actions or intentions,you should seek clarification from the pilot and, if still in doubt, notify me immediately and take what-ever action is necessary before I arrive.

Page 65: Royal Majesty

57

THE WATCHKEEPING PERSONNEL : You should give watchkeeping personnel all appropriateinstructions and information which will remove the keeping of a safe watch, including a proper lookout.

SHIP AT ANCHOR : If I consider it necessary, a continuous navigational watch should be main-tained in such circumstances, you should: A) Determine and plot the vessel’s position on the appropriatechart as soon as possible and, at sufficiently frequent intervals, check by taking bearings of fixed naviga-tional marks, or readily identifiable shore objects, whether the anchor is holding. B) Ensure that an ef-fective lookout is maintained. C) Ensure that an inspection of the vessel is made periodically. D) Observeweather, tidal, and sea conditions. E) Notify me and undertake all necessary measures if the vessel drags.F) Ensure that the state of readiness of the main engines and other machinery is in accordance with myinstructions. G) Notify me if visibility deteriorates and comply with the 1972 International Regulationsfor Preventing Collisions at Sea. H) Ensure that the vessel exhibits the appropriate lights and shapes andthat appropriate sound signals are made at all times.

In conclusion, I will always be available to you for advice you may need and I hope that you will atall times endeavor to do your utmost for the benefit of all on board.

STRICT ATTENTION TO DUTY HAS ITS AWARDS.

MASTER M/V Royal Majesty

[This is a retyped copy of the Royal Majesty’s “Bridge Procedures Guide,” which was presented asan exhibit during sworn testimony taken by the joint Coast Guard/Safety Board investigation board.]

Page 66: Royal Majesty

This page intentionally left blank

Page 67: Royal Majesty

59

APPENDIX C

MAJESTY CRUISE LINE’S CIRCULAR NO. 9

DUTIES OF THE OFFICER ON WATCH I OPS I 3

1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

11.

12.

13.

14.

15.

The paper work required during the watch is to be done on the bridge CIRCULAR NO. 9 PAGE 3done in the bridge, never in the chartroom. When you need to goto the chartroom you should be brief.

Smoking in the chartroom is not allowed. JULY 1992

One quartermaster is to always be on the lookout position.

Check the compasses during your watch twice, and enter the readings in the relevant book. Check the course,the position, navigation lights, traffic in the area, course and distance of ships in the vicinity before you takeover the watch.

Check the compass error at least once during your watch (weather condition permitting) and enter thereadings in the relevant book.

Check the ship’s position as often as conditions and circumstances allow, but never longer than 30 minuteintervals.

You summon the Master to the bridge when:

a) The visibility is less than 5 miles.b) The wind changed direction, which could cause drifting from course.c) Another ship is crossing the bow and the bearings are steady.d) You have doubts about the position.e) Traffic is congested or ship is about to pass dangerous areas.

If the Master is not in his office and cannot be found immediately, use the P.A. system by saying “THIS ISTHE BRIDGE” Never say “THE CAPTAIN IS REQUESTED ON THE BRIDGE. ”

In case of fog, after you have summoned the Master to the bridge, do the following:

a) Engines on “stand by. ”b) Radar “on.”c) Whistle “on.”d) Switch from auto pilot to hand steering.e) Close the watertight doors.f) One quartermaster on the “lookout” position on the bridge and one AB at the bow.g) Plot the course, position, and speed of all ships in the vicinity.h) When the fog has cleared, recall all above actions.

Never pass another ship, land, or any other object less than 1.5 miles distance.

Start maneuvering the ship to avoid a collision, never less than 3 miles distance.

Close all the portholes and headlights during bad weather conditions.

One radar is to always be “ON” if the conditions require so. Relevant entry is to be made in the radar book.

Never leave your position before you are relieved by the Officer of the next watch.

Always be alert during your watch.

Page 68: Royal Majesty

This page intentionally left blank

Page 69: Royal Majesty

61

APPENDIX D

POSTACCIDENT TESTING OF GPS RECEIVER AND ANTENNA The Raytheon RAYSTAR 920 Global Positioning System (GPS) receiver and antenna used for

navigation during the grounding of the Royal Majesty were tested at Raytheon headquarters on July 6,1995.1 Present for the tests were representatives from the National Transportation Safety Board, Ray-theon Marine, and Majesty Cruise Line. A new Raytheon RAYSTAR 920 GPS receiver and antenna,randomly removed from Raytheon stock, were first tested to establish a baseline for functionality andperformance. The Raytheon GPS receiver and antenna from the Royal Majesty were then tested for com-parison. Speed log and gyro compass inputs from bench test equipment were used to simulate dead reck-oning (DR) data inputs when necessary. The test results follow:

• The Raytheon RAYSTAR 920 GPS receiver and antenna from the Royal Majesty functionedper design and in a like manner to that of a new Raytheon RAYSTAR 920 GPS receiver andantenna.

• An “open” in the GPS antenna cable shield wire, such as would result if the shield wirepulled out of any connector leading to the antenna, results in the GPS receiver going into theSOL and DR modes within 2 to 3 seconds of the “open” being established, regardless ofwhether speed/course data are being input to the GPS receiver.

• As few as 1 to 3 strands of GPS antenna cable shield wire permit continued operation of theantenna pre-amp and, therefore, system functionality.

• As long as the Raytheon 920 GPS receiver’s internal audio alarm function is active (user se-lectable; “ON” in the case of the Royal Majesty’s unit), going from a satellite fix condition tothe SOL and DR modes results in a brief (<1 second) audio alarm chime (similar to a wrist-watch alarm in volume and tone).

• As long as the Raytheon 920 GPS receiver’s external alarm function is active (user select-able), going from a satellite fix condition to the SOL and DR modes results in a continuousclosing of the external alarm contacts (which could be used to wire up external or remoteaudio alarms of various forms).

• When satellite data input is removed from the operating Raytheon 920 GPS receiver andspeed/course data (e.g., DR data) are available, a single audio alarm chime is emitted, and thereceiver continues to output NMEA 0183 v1.5 data, with the LAT/LONG portion of theNMEA 0183 v1.5 data continuing to update based on the DR data and the last GPS position.

• When both satellite data and speed/course data (e.g., DR data) inputs are removed from theoperating Raytheon GPS receiver, two brief and separate audio alarm chimes are emitted,and the receiver continues to output NMEA 0183 v1.5 data; but the LAT/LONG portion ofthe NMEA 0183 v1.5 data stay fixed at the last position.

• An “open” in the antenna cable center conductor results in the GPS receiver going into theSOL and DR modes within 2 to 3 seconds of the “open” being established, regardless ofwhether speed/course data are being input to the GPS receiver.

1The Safety Board has maintained possession of the Royal Majesty’s GPS receiver and antenna since June 15, 1995.

Page 70: Royal Majesty

62

• Shorting the antenna cable center conductor to the antenna cable shield wire results in theGPS receiver backlights going off immediately, the SOL and DR modes are immediately dis-played, all processor functions stop, and all NMEA 0183 v1.5 data output stops.

Whenever the Raytheon RAYSTAR 920 GPS receiver does not have any satellite data from which toobtain a position fix, the receiver switches to the SOL and DR modes, and the satellite status informationscreen indicates the following: ⇒ no satellites are being tracked ⇒ no signals are presentfor any of the satellites ⇒ the degree of precision (DOP) is 0.0

Whenever the Raytheon 920 GPS receiver is in SOL and DR modes, the NMEA 0183 v1.5 data out-put contains multiple status indications of DR position data. The Royal Majesty’s Raytheon 920 GPSreceiver and antenna functioned properly during all tests and provided temporary aural and continuousvisual and electrical indications of the SOL and DR status. The electrical indications include the re-ceiver’s external alarm contact and NMEA 0183 v1.5 output data, the latter of which containsvalid/invalid position data bits (A = VALID, V = INVALID) within the APA autopilot data sentence andother data sentences.

Page 71: Royal Majesty

63

APPENDIX E

SAFETY BOARD’S URGENT SAFETY RECOMMENDATIONS

ISSUED ON AUGUST 9, 1995M-95-26 and -27 to the U.S. Coast Guard:

Immediately recommend that the International Maritime Organization urge its admini-strations to advise maritime vessel operators of the circumstances of the Royal Majestygrounding and to encourage the operators to review the design of their integrated bridgesystems to identify potential system and operational failure modes that might result inundetected changes to the autopilot function, and develop modifications as required. (M-95-26)

Immediately advise maritime vessel operators of the circumstances of the Royal Majestygrounding and urge them to review the design of their integrated bridge systems with themanufacturer to identify potential system and operational failure modes that might resultin undetected changes to the autopilot function, and develop modifications as required.(M-95-27)

Although Safety Recommendation M-95-26 was not officially entered into IMO’s SUBNAV-42 pro-ceedings because of publication approval and time rules, the Coast Guard did distribute numerous copiesof the recommendation, and it was discussed at several of the technical working group sessions. Conse-quently, Safety Recommendation M-95-26 was classified “Closed—Acceptable Alternate Action” onNovember 14, 1995. In response to Safety Recommendation M-95-27, the Coast Guard published asafety note in the November/December issue of the proceedings of the Marine Safety Council and alsoissued a “Notice to Mariners” advising them to review the operation of their integrated bridge systems toidentify failure modes. As a result, Safety Recommendation M-95-27 was classified “Closed—Accept-able Action” on January 16, 1996.

M-95-28 to the International Council of Cruise Lines, the International Chamber of Shipping,the American Institute of Merchant Shipping, and the International Association of IndependentTanker Owners:

Immediately advise members of the circumstances of the Royal Majesty grounding andurge those members that operate with integrated bridge systems to review the design oftheir integrated bridge systems for potential system and operational failure modes thatmight result in undetected changes to the autopilot functions.

All recipients of Safety Recommendation M-95-28 responded favorably and advised their membersof the circumstances of the Royal Majesty grounding. For the International Chamber of Shipping, therecommendation was classified “Closed—Acceptable Action” on October 27, 1995. For the other threerecipients, the recommendation was classified “Closed—Acceptable Action” on December 12, 1995.

M-95-29 to STN Atlas:

Immediately inform customers with the NACOS 25 integrated bridge system or similarsystems of the circumstances of the Royal Majesty grounding and review the design andimplementation of their systems to identify potential system and operational failuremodes that might result in undetected changes to the autopilot function.

STN Atlas acted promptly and informed all customers of the circumstances of the grounding. Therecommendation was classified “Closed—Acceptable Action” on December 21, 1995.

Page 72: Royal Majesty

64

M-95-30 to the National Marine Electronics Association:

Immediately advise members of the circumstances of the Royal Majesty grounding andurge members to review their products to identify potential system and operational fail-ure modes that might result in undetected changes to system functionality, includingchanges in NMEA 0183 position data validity.

The recommendation was classified as “Closed—Acceptable Action” on May 6, 1996, followingNMEA’s dissemination of information to all of its member companies.

Page 73: Royal Majesty

65

APPENDIX F

PORTIONS OF COAST GUARD TRANSCRIPT OF

VHF-FM RADIO TRANSMISSIONS FROM THE

NANTUCKET SHOAL AREA ON THE EVENING OF JUNE 10, 1995

2042 fishing vessel (f/v) Sao Marcos [in English]: “Fishing vessel, fishingvessel call cruise boat.”

2043 f/v Rachel E [in Portuguese]: “Are you there Toluis [nickname ofTony Sao Marcos]?”

f/v Sao Marcos [in Portuguese]: “Yeah, who is this?”

f/v Rachel E [in Portuguese]: “It’s Antonio Pimental. Hey, that guy isbad where he is. Don’t you think that guy is wrong in that area.”

f/v Sao Marcos [in Portuguese]: “I just tried to call him. He didn’t an-swer back. He is very wrong.”

f/v Rachel E [in Portuguese]: “I’ve been watching him for the last halfhour. He was a big contact on my radar. I picked him up 8 miles away.

[source unknown] [in English]: “Channel 16 is a distress channel andthis is international, please change your channel, please change yourchannel.

[Portions of the remaining conversation were cut off; however, onesalvageable remark in Portuguese was that f/v Rachel E will try to call thecruise boat.]

2045 f/v Rachel E [in English]: “Calling the cruise boat in the position 4102N, 69 24W. Over.”

40 sec.Later

f/v Rachel E [in English]: “Calling the cruise boat 41N, 69 24W.Over.”

2046 f/v Sao Marcos [in Portuguese]: “Maybe nobody on the bridge ispaying attention.”

f/v Rachel E [in Portuguese]: “I don’t know. He is not going the rightway.”

[Both vessels say goodbye to each other in Portuguese.]

Page 74: Royal Majesty

This page intentionally left blank

Page 75: Royal Majesty

67

APPENDIX G

ABBREVIATIONS AND ACRONYMS

ARPA: automatic radar plotting aid

Boston traffic lanes: Port of Boston Traffic Separation Scheme

CFR: Code of Federal Regulations

DNV: Det Norske Veritas

DR: dead reckoning

FMEA: failure modes and effects analyses

GPS: global positioning system

HSI: human systems integration

ICCL: International Council of Cruise Lines

IEC: International Electrotechnical Commission

IMO: International Maritime Organization

INTERTANKO: International Association of Independent Tanker Owners

ISO: International Standards Organization

LR: Lloyd’s Register of Shipping

NACOS 25: navigation and command system

NAUT-C: optional classification notation developed by DNV

NAV: navigation (mode)

NAV1: navigation for 1-man bridge

Nav O: class notation for ocean area

Nav OC: class notation for ocean area/coastal waters

NMEA: the National Marine Electronics Association

SOL: solution

STN Atlas: STN Atlas Elektronik

TC8: Technical Committee 8 of the International Standards Organization (ISO/TC8)

TC80: Technical Committee 80 of the International Electrotechnical Commission (IEC/TC80)

W1: Watch 1, highest class notation in NAUT-C

WG9: working group belonging to the IEC/TC80