Lessons learned: Critical system warnings and alarms must be tested and verified

The incident

A laden roll-on/roll-off (ro-ro) ferry was nearing the end of its sea passage and preparing to enter harbour. In the engine control room (ECR), the engineering team were preparing the main propulsion plant for entering harbour.

The plant consisted of two propeller shafts that were each driven by a main engine via a clutch and gearbox. Each individual power train had a shaft alternator that supplied power to either the main switchboard or a dedicated bow thruster motor.

Two additional diesel generators supplied auxiliary power to the main switchboard when the shaft alternators were connected to the bow thruster motors. A power management system automatically maintained the electrical integrity of all supplies.

An engineer in the ECR attempted a remote start of one of the diesel generators but it failed to start. The engineer then went to the machinery space and started the engine in local control. The second diesel generator was also started. At the same time, the senior engineer went to investigate a stabiliser room bilge alarm that had activated.

At the main switchboard in the ECR, the engineer set the power management system to manual to connect the running generators to the switchboard and manually disconnect the shaft alternator.

During this operation, the first diesel generator engine tripped on low lubricating oil pressure and the vessel lost electrical power. The main engines continued to run for a few minutes before they stopped due to a lack of fuel pressure.

On the bridge, the officer of the watch (OOW) turned the ferry away from danger and an anchor was prepared for letting go. The vessel’s emergency generator automatically started supplying critical systems such as steering and communications when the power failed.

The senior engineer returned to the ECR and saw that the second generator was running but not supplying the main switchboard as both the engine and power management system were under manual control.

He switched the generator and power management system to automatic control, immediately restoring power. On restarting the main engines, the vessel resumed passage without further incident.

Lessons learned

• Equipment: Let the system do the work. The vessel had a fully operational power management system for maintaining electrical power. When the system was set to manual to connect the incoming diesel alternators to the main switchboard, the power management system was thereafter unable to automatically restore power. This extended the period when the vessel was not under command. The design intent for the power management system was to quickly and efficiently detect and isolate power generation issues when operating in automatic mode.
• Check: Be inquisitive. After a local engine start, it is good practice to check that the engine is running correctly and that pressures, temperatures and fluid levels are correct. The first generator stopped when the oil level in the sump fell, causing a loss of lubrication oil pressure and subsequent power failure; An oil level check may have indicated that there was a problem. The failure to start was associated with the low oil level in the sump; it is good practice to check running machinery before standby to ensure that potential critical failures are identified.
• Maintain: Conduct rounds. The low oil level in the generator was caused by a fault with the lubricating oil purifier cleaning the engine’s oil. The purifier had started to dump the oil to a waste tank. Regular and comprehensive machinery rounds may have picked this up before the situation became critical.
• Qualified: Check the system. The vessel’s monitoring and alarm system had recently been upgraded but, due to incorrect wiring, a generator’s low oil pressure alarm was indicated as the stabiliser room bilge alarm. Critical system warnings and alarms must be tested and verified as operating correctly on completion of monitoring and alarm system modification work.