Embed Size (px)
Citation preview
Marine Safety Investigation Unit
MARINE SAFETY INVESTIGATION REPORT
Safety investigation into the escape of steam and hot water
resulting in one fatality and three serious injuries on board the
Maltese registered passenger vessel
CELEBRITY CONSTELLATION
approximately 30 nautical miles East of Bonaire
on 12 April 2012
201204/005
MARINE SAFETY INVESTIGATION REPORT NO. 06/2013
FINAL
ii
Investigations into marine casualties are conducted under the provisions of the Merchant
Shipping (Accident and Incident Safety Investigation) Regulations, 2011 and therefore in
accordance with Regulation XI-I/6 of the International Convention for the Safety of Life at
Sea (SOLAS), and Directive 2009/18/EC of the European Parliament and of the Council of 23
April 2009, establishing the fundamental principles governing the investigation of accidents
in the maritime transport sector and amending Council Directive 1999/35/EC and Directive
2002/59/EC of the European Parliament and of the Council.
This report is not written, in terms of content and style, with litigation in mind and pursuant to
Regulation 13(7) of the Merchant Shipping (Accident and Incident Safety Investigation)
Regulations, 2011, shall be inadmissible in any judicial proceedings whose purpose or one of
whose purposes is to attribute or apportion liability or blame, unless, under prescribed
conditions, a Court determines otherwise.
The objective of this safety investigation report is precautionary and seeks to avoid a repeat
occurrence through an understanding of the events of 12 April 2012. Its sole purpose is
confined to the promulgation of safety lessons and therefore may be misleading if used for
other purposes.
The findings of the safety investigation are not binding on any party and the conclusions
reached and recommendations made shall in no case create a presumption of liability
(criminal and/or civil) or blame. It should be therefore noted that the content of this safety
investigation report does not constitute legal advice in any way and should not be construed
as such.
© Copyright TM, 2013
This document/publication (excluding the logos) may be re-used free of charge in any format
or medium for education purposes. It may be only re-used accurately and not in a misleading
context. The material must be acknowledged as TM copyright.
The document/publication shall be cited and properly referenced. Where the MSIU would
have identified any third party copyright, permission must be obtained from the copyright
holders concerned.
MARINE SAFETY INVESTIGATION UNIT
Malta Transport Centre
Marsa MRS 1917
Malta
iii
CONTENT
LIST OF REFERENCES AND SOURCES OF INFORMATION .......................................... iv
GLOSSARY OF TERMS AND ABBREVIATIONS ................................................................v
SUMMARY ............................................................................................................................. vi
1 FACTUAL INFORMATION .............................................................................................1 1.1 Vessel, Voyage and Marine Casualty Particulars .......................................................1 1.2 Description of Vessel .................................................................................................2 1.3 Narrative .....................................................................................................................3 1.4 The Power Generation System ...................................................................................7 1.5 Training and Qualifications ......................................................................................11 1.6 Company’s Job Safety Analysis Form .....................................................................12
2 ANALYSIS .......................................................................................................................13 2.1 Aim ...........................................................................................................................13 2.2 Accident Dynamics ..................................................................................................13
2.2.1 Preparation for the removal of the safety relief valve ..........................................13 2.2.2 Protective clothing ................................................................................................14 2.2.3 The sudden discharge of hot condensate and steam .............................................14 2.2.4 Drainage of hot condensate and steam .................................................................16
2.3 Risk Assessment .......................................................................................................17 2.3.1 Manifestation of risk assessment issues ...............................................................17 2.3.2 Risk assessments and limited hazards control ......................................................19 2.3.3 Situation awareness ..............................................................................................20
2.4 System Defences ......................................................................................................21 2.5 Operational Safety from a Systemic Perspective......................................................22
3 CONCLUSIONS ...............................................................................................................24 3.1 Immediate Safety Factor ...........................................................................................24 3.2 Latent Conditions and other Safety Factors .............................................................24 3.3 Other Findings ..........................................................................................................25
4 ACTIONS TAKEN ...........................................................................................................25 4.1 Safety Actions Taken During the Course of the Safety Investigation ......................25
5 RECOMMENDATIONS ..................................................................................................26
ANNEXES ...............................................................................................................................28 Annex 1: Job Safety Analysis Form .................................................................................28
iv
LIST OF REFERENCES AND SOURCES OF INFORMATION
Glendon, I. (1998). Management of risks by individuals and organisations. Safety
Science Monitor, 3(Special Edition), 1-11.
Hale, A. R., Heming, B. H. J., Smit, K., Rodenburg, F. G. T., & van Leeuwen, N. D.
(1998). Evaluating safety in the management of maintenance activities in the
chemical process industry. Safety Science, 28(1), 21-44.
Harms-Ringdahl, L. (2001). Safety analysis: principles and practice in occupational
safety (2nd
ed.). Florida: CRC Press LLC.
Managers and crew members MV Celebrity Constellation.
Marine Accident Investigation Branch [MAIB]. (2003). Report on the investigation of the
escape of steam and hot water on board Queen Elizabeth 2 in the mid Atlantic resulting in
one fatality. Report No. 17/2003. Southampton: Author.
Oltedal, H. A., & Engen, O. A. (2011). Safety management in shipping: making
sense of limited success. Safety Science Monitor, 15(3), 1-19.
Owen, C., Béguin, P., & Wackers, G. (Eds.). (2009). Risky work environments:
reappraising human work within fallible systems. Surrey: Ashgate Publishing
Limited.
Raafat, H. M. N. (1989). Risk assessment and machinery safety. Journal of
Occupational Accidents, 11(1), 37-50.
Reason, J. (1997). Managing the risks of organizational accidents. Aldershot:
Ashgate Publishing Limited.
Trimpop, R., & Zimolong, B. (n.d.). Risk perception. Retrieved 27 November, 2006,
from http://www.ilo.org/encyclopedia/?d&nd=857100076&prevDoc=857000106
Vatn, J., & Aven, T. (2010). An approach to maintenance optimization where safety
issues are important. Reliability Engineering and System Safety, 95(1), 58-63.
Wilson, R. (1984). Commentary: risks and their acceptability. Science, Technology,
& Human Values, 9(2), 11-22.
v
GLOSSARY OF TERMS AND ABBREVIATIONS
ABB Asea Brown Boveri
COGES Combined Gas, Electric, and Steam turbines
DHW Domestic Hot Water
DNV Det Norske Veritas
DWT Deadweight
FW Fresh Water
GE General Electric
GMTS Global Maritime Transportation Services
GRT Gross Tonnage
HP High Pressure
HRSG Heat Recovery Steam Generators
IMO International Maritime Organization
ISO International Organization for Standardization
Kgs Kilograms
kV Kilovolts
LP Low Pressure
LR Lloyds Register of Shipping
LT Local Time
MAIB Marine Accident Investigation Branch
MV Motor Vessel
MW Mega Watt
OEM Original Equipment Manufacturer
QE II Queen Elizabeth II
RCCL Royal Caribbean Cruises Ltd.
SMS Safety Management System
SOLAS International Convention for the Safety of Life at Sea, 1974, as
amended
STCW International Convention on Standards of Training, Certification
and Watchkeeping for Seafarers, 1978, as amended
TM Transport Malta
vi
SUMMARY
On 12 April 2012, while on passage from Curacao to Grenada in the Caribbean Sea,
four of the engine-room crew members on board the passenger ship
Celebrity Constellation were badly scalded. The accident happened when steam and
condensate unexpectedly escaped from a three bar safety relief valve that was being
removed in preparation for a classification society ship survey. One of the crew
members subsequently died as a result of his injuries.
The accident happened when the second engineer, under the direct supervision of
chief engineer, was in the process of removing the bonnet of the safety relief valve on
a low pressure (3 bar) steam line that had been identified as being defective (seized).
The valve overhaul started about an hour after it was isolated from the live side of the
steam system and after the system was vented. Hot water and steam escaped from the
line as the bonnet and trim were removed from the valve body, and consequently
seriously injured the four men.
It was concluded that although the relief valve was isolated, the piping contained
residual hot condensate and steam. It was possible that the system did not allow for
adequate draining of residual hot condensate or steam. The safety investigation also
found that the risk assessment was not thorough enough, with the hazard not being
eliminated or mitigated to minimise or even prevent injuries to the crew members.
Further to the safety actions already taken, recommendations were made to the ship
managers and Lloyd’s Register of Shipping regarding the provisions of adequate
drainage arrangements for steam pipelines. Additional recommendations were made
to the ship management company to ensure in-depth risk assessment and continuous
awareness on the importance of efficient drainage of condensate.
1
1 FACTUAL INFORMATION
1.1 Vessel, Voyage and Marine Casualty Particulars
Name Celebrity Constellation
Flag Malta
Classification Society Lloyd’s Register of Shipping
IMO Number 9192399
Type Passenger
Registered Owner Constellation Inc.
Managers Celebrity Cruises Inc.
Construction Steel
Length overall 294.0 m
Registered Length 262.9 m
Gross Tonnage 90,280
Minimum Safe Manning 21
Authorised Cargo N/A
Port of Departure Curacao
Port of Arrival Grenada
Type of Voyage Short International
Cargo Information N/A
Manning 939
Date and Time 12 April 2012 at 23:55 (LT)
Type of Marine Casualty or Incident Very Serious Marine Casualty
Location of Occurrence 12° 10.3’N 067° 42.7’W
Place on Board Engine-room
Injuries/Fatalities One fatality and three seriously injured
Damage/Environmental Impact None
Ship Operation In passage
Voyage Segment Transit
External & Internal Environment Fresh breeze and clear skies, with a visibility of
about 18 nautical miles. The sea was slight with
a south-easterly one metre swell. Sea
temperature was 26°C and the air temperature
was 25°C. Engine-room was well lit with white
neon tubes.
Persons on Board 2,972
2
1.2 Description of Vessel
Celebrity Constellation (Figure 1) was a Millennium class passenger ship1 built at
Chantiers de l’Atlantique Shipyard in St. Nazaire, France. She was launched in May
of 2002 as Constellation. Renamed Celebrity Constellation in May 2007, she has an
overall length of 294 m and a beam of 32.3 m. The vessel has a deadweight (DWT)
of 11,928 and a gross tonnage of 90,280. Celebrity Constellation has 13 decks.
Originally, the 50 MW power was provided by two combined gas, electric and steam
turbines (GE COGES) and this was later augmented by a single Wärtsilä 16V38 diesel
engine that was installed in May 2007. With a propulsive system consisting of two
Rolls-Royce Alstom Mermaid POD with two Azimuth thrusters of 19 MW each and
three variable pitch thrusters, she manages a maximum speed of 22 knots. In her 11
passenger decks, Celebrity Constellation has a capacity to accommodate 2038
passengers.
At the time of the accident, Celebrity Constellation was registered under the Maltese
flag and owned by Constellation Inc.. The vessel is classed with Lloyd’s Register of
Shipping (LR) and had a crew of 941 of different nationalities.
Figure 1: MV Celebrity Constellation
1 The Millennium was the world's first COGES-powered passenger ship.
3
© 2013 Google
U.S. Dept. of State Geographer
Image U.S. Geological Survey
Data SIO, NOAA, U.S. Navy, NGA, Geeco
1.3 Narrative
On 12 April 2012, Celebrity Constellation was en route from Curacao to Grenada in
the Caribbean Sea (Figure 2). Several of the crew members were making the
necessary preparations for an LR survey. One of the items to be surveyed, and which
formed part of the low pressure (LP) steam system of the COGES power generating
system, was a three bar steam safety / relief valve.
Figure 2: Caribbean route of Celebrity Constellation from Curacao to Grenada
This valve was found to have seized and was not operating. The ship’s engineering
crew made the necessary preparations to remove, inspect and repair the valve. The
valve (Figure 3) was a conventional spring loaded type, and which could be actuated
manually by lever.
The make of the valve was RSBD Serial No. 6536.1C.150.115.200PF and weighed
approximately 105 kgs. The valve was part of a compound COGES power system
where the exhaust gases of a gas turbine and those of the prime movers, which drive
electrical generators, heat the medium of a steam system. The high pressure (HP)
steam, at 32 bar, drives a steam turbine. The power generated is used by electric
motors, which eventually drive the propellers.
Fig
ure 3
: A cr
oss-sec
tion
al v
iew o
f the sa
fety re
lief va
lve
4
5
Fitter
Chief engineer
Fitter
Third
Engineer
Deck
Fitter
Second
Engineer
The LP steam (which operates at two pressure levels of three and nine bar), was used
to drive steam driven auxiliary equipment and also for ship and hotel services. Both
the diesel generator and the steam turbine were stopped and the valve was isolated by
closing a number of other valves. Drain valves were opened in order to drain the
steam pipes from condensate and steam. The isolation of this part of the system
necessitated that some of the valves are closed, whilst others had to be opened.
Valves on the steam plant were operated either locally or remotely from the engine
control room. The gas turbine was kept running and it was planned that until the
maintenance task was completed, it would serve as the only source of power on the
vessel.
The chief engineer recalled that the system was allowed about one hour to cool down.
Then, when the local and remote pressure readings read zero2, the engine-room crew
positioned themselves around the relief valve (Figure 4) and started to dismantle the
valve under the instructions of the chief engineer.
Figure 4: Positions of engine-room crew members at time of accident
2 Locally, the pressure gauge is situated close to the relief valve.
6
The second engineer started to undo the eight bolts, which held down the valve in
place (Figure 5).
Figure 5: Safety relief valve and pressure gauge in line
Gradually, the second engineer unscrewed all the bolts except for two, which were
loosened but not removed. There were no signs of steam or water leaking or escaping
from underneath the bonnet. The open gap between the bonnet and the valve body
was substantial whilst the second engineer started to move the bonnet sideways.
Seeing no steam or hot water escaping, the chief engineer instructed the second
engineer to undo the last two bolts and to lift off the bonnet (Figure 6).
7
Figure 6: Safety relief valve bonnet (in the workshop after the accident)
At this stage, steam and hot condensate escaped from the opening. It was
immediately evident that four of the crew members assisting or overseeing the
overhaul operation were seriously injured. The chief engineer managed to escape and
medical assistance was immediately given to the crew members. The four injured
crew members were all transferred ashore for medical treatment. Notwithstanding the
medical treatment being administered in the hospital, one of the fitters succumbed to
his injuries.
1.4 The Power Generation System
The engine-room of Celebrity Constellation is situated on the tank top deck and runs
almost the full length of the ship. Celebrity Constellation was powered by a COGES
plant. The Wärtsilä diesel engine was not part of the original propulsion plant but was
fitted in May 2007 to increase versatility and economy. Figure 7 is a simplified
overview of the steam system fitted on board.
8
Figure 7: Steam plant overview
The economiser, evaporator and superheater housed in the two heat recovery steam
generators (HRSG), use exhaust gases from the prime movers and the gas turbines to
generate steam into the steam drum (Figure 8). The steam drives a steam turbine at
high pressure (32 bar) and is also expanded (to 9 and 3 bar) to drive auxiliary
equipment (e.g. fresh water generators) and hotel services (e.g. kitchen and domestic
hot water (DHW)).
Fig
ure 8
: Bo
iler feed
from
HR
SG
9
10
The gas turbine (Figure 9) is of the two shaft type with a 16 stage 18:1 axial
compressor providing compressed air to an annular burner or combustor where fuel is
injected and burned. The gas produced is fed into the power turbine where it is
expanded and pressure energy converted into rotational kinetic energy. The power
turbine shaft is coupled to the axial compressor shaft by means of a flexible coupling.
The power turbine drives one of the 11kV 25 MW electric generators.
Figure 9: A GE LM2500 gas turbine generator set similar to the one fitted on the vessel
The steam plant consists of a seven stage Fincantieri back pressure steam turbine
(Figure 10), which is coupled through a gearbox to another electrical generator. The
two Heat Recovery Steam Generators (HRSG) are installed in the exhaust ducts of
each of the gas turbine and the diesel generator.
Figure 10: A Fincantieri back pressure steam turbine
The generated steam is led into the steam turbine, into the flash steam fresh water
generators (Serk Como), for sanitary water heating, heating system in galley and
11
laundry and accommodation heating system. Steam enters the turbine at 32 bar and
410 C, while for heating and the operation of auxiliary equipment, steam was
supplied at two pressure levels namely at nine bar and three bar (Figure 11).
Figure 11: Steam distribution
1.5 Training and Qualifications
Managers have made available copies of all certificates and familiarisation checklists
of the crew members involved in the accident. The familiarisation training of the
engineer officers included ‘Boiler and Steam Systems’. The second engineer was
provided this training on 22 February 2012, whilst the third engineer had received his
training on 07 January 2012. The familiarisation training provided to the two fitters
did not seem to include ‘Boilers and Steam Systems’.
The provided documents neither indicated the duration nor the detail provided during
the familiarisation training. The crew members were qualified in accordance with the
relevant requirements of the STCW Convention.
12
1.6 Company’s Job Safety Analysis Form
The Company’s safety management system (SMS) required that a Job Safety Analysis
Form is completed prior to the overhaul of the safety valve. The Form is reproduced
as Annex 1 to this safety investigation report.
There is no indication on the Form as to who should have filled the document. This
would suggest that the pre-job safety analysis process requires neither the
involvement of a safety officer nor a person who would assume responsibility to
oversee and manage the safety component of the task that was identified as potentially
hazardous.
The date and time entered on the Form indicate that it was completed about 24 hours
prior to the accident. However, there were no instructions or guidelines to indicate at
what stage of the job, the Form should have been completed and to whom it should
have been distributed. Moreover, the Form was not authorised / endorsed in any way
by a member of the crew in accordance with the procedures laid down in the
Company’s SMS.
A Det Norske Veritas (DNV) survey report (Renewal DOC and ISO 9001 & 14001
Audits (Being Harmonized with RCCL Audits)) referenced as DNV 145279, Job ID
298226, and conducted for Celebrity Cruises Inc. between 06 and 10 August 2012,
made the following observations:
5. ISO 9001:2008, 7.1: (Equipment & System Failure) OEM and specialist vendors –
how to manage change when operating procedures change on board and some crucial
inspection and maintenance objectives slip between the cracks. (Example: Switchboard
(ABB Sace) - CCI does this during Dry Dock and RCCL annually. When this sort of
change is made, is a Risk/Gap assessment carried out as part of change management?
(GMTS)
6. ISO 9001:2008, 7.1: (Equipment & System failure) Technical bulletins for specialist
equipment: It was not clear as to who the owner of the latest information is and how is
it assessed for implementation and made available to all relevant personnel within the
company (e.g. Marioff’s latest bulletins). Also review in order to share best practices
and keep abreast with latest technical updates within all brands.
13
2 ANALYSIS
2.1 Aim
The purpose of a marine safety investigation is to determine the circumstances and
safety factors of the accident as a basis for making recommendations, to prevent
further marine casualties or incidents from occurring in the future.
2.2 Accident Dynamics
2.2.1 Preparation for the removal of the safety relief valve
The engine-room crew members were preparing for a Class survey, whilst the vessel
was at sea. It was noted that the low pressure (3 bar) safety relief valve was seized.
The seizure of the relief valve was attributed to the lack of periodical testing by the
crew members. The Company’s preventive maintenance system did not include the
periodical testing of any of the relief valves fitted on the low and high pressure
system.
Although the decision was made to isolate the valve and to dismantle it for inspection,
there was no evidence available which indicated that the Company had clear
guidelines and instructions on the isolation of the valve from the system. The way
steam and hot condensate leaked as the safety valve was removed, indicated that the
procedure adopted was not totally effective. However, the matter is seen from a wider
perspective, which would encompass what seemed to be an ad hoc risk assessment
prior to the task was taken in hand.
Most of the normal power systems had to be shut down in order to be able to isolate
the valve, drain, and cool the relevant part of the steam system (only gas turbine no. 1
was left in operation). Moreover, sections of the system had to be isolated from the
live side of the plant, vented to atmosphere and drained of condensate. The decision
to remove the valve bonnet was taken after the pressure upstream of the valve was
reduced to zero and the system allowed to cool for one hour.
The understanding is that the pressure gauge upstream of the valve and the sensing
components of the control system were functioning correctly, and the system drained
and had adequately cooled down. However, it was evident that hot condensate and
14
steam were still present in that part of the system where the maintenance job was
being undertaken.
2.2.2 Protective clothing
There was no doubt that the second engineer, under the supervision of the chief
engineer, was cautious in his actions; he slowly and partially removed the nuts that
held down the bonnet to the valve body. The bonnet was only removed when the
crew members satisfied themselves that there was no indication of residual
pressurised steam or hot condensate. There was no indication that the valves isolating
the relief valve were opened at some stage during its removal.
The removal of the bonnet was also done by moving the body to and fro to further
ensure that no steam was trapped under the valve seat. The release of the steam and
hot condensate is addressed further below. However, it has to be stated that the severe
injuries sustained by the crew members confirmed that they were not wearing
adequate protective clothing.
2.2.3 The sudden discharge of hot condensate and steam
The fact that steam and hot condensate leaked when the top part (bonnet and trim) of
the safety relief valve was removed indicated that actually, steam or hot condensate
was possibly trapped either underneath the valve disc (upstream) or under the valve
guide (downstream). Although it is understood that the pressure gauge upstream of
the valve and the control room monitoring system were in good operational condition,
and that the steam pressure upstream of the valve was zero gauge pressure
(atmospheric pressure), this would not have excluded the presence of condensate at
relatively high temperature inside the pipeline.
At atmospheric pressure, or zero gauge pressure, steam and condensate can co-exist at
100 C. Assuming a one metre length of pipe, 60 minutes should have been adequate
for the system to cool enough for maintenance to be carried out and relieve itself of
steam and hot condensate; but this depends on the amount or mass of any trapped
condensate. Moreover, to determine whether or not sufficient cooling time had
elapsed, one had to take into consideration the pipe insulation and the possibility of
relatively high ambient temperature in the space, which would have significantly
delayed cooling.
15
Figures 4 and 5 indicate that the relief valve is fitted at the bottom of a U shaped pipe.
It was not excluded that hot condensate could have collected at the lower levels of the
pipeline (if not adequately drained). Masses of hot condensate would contain
relatively high levels of enthalpy. With the pressure further reduced, the latent energy
would have vaporised the hot condensate. The (large volumes) of generated steam
would also tend to travel in the direction of the lower pressure, (even if this was
slight), such as where the valve was opened.
If this does not bring into question the accuracy of the pressure gauge and pressure
transducer, it would, however, question their sensitivity and monitoring. The gauge
indicated as P1 4036 (Figure 12) has a full scale deflection of six bar and the minor
graduations read up to 0.1 bar. This would imply that although the pressure gauge
was apparently reading zero, there could actually have been a slight pressure, above
the atmospheric pressure (which is nominally assumed to be 1.013 bar absolute)
within the pipeline and which the gauge or transducer were not sensitive enough to
indicate.
It should also be noted that if condensate was trapped at relatively high temperature,
the thermal energy could change into pressure energy during the cooling down period,
ejecting the steam / condensate through an exit point, such as the one provided as a
result of the removal of the valve. It must be stressed that this could only happen if
the means of drainage in the specific section of pipeline were inadequate.
Figure 12: Pressure gauge fitted close to the relief valve
16
2.2.4 Drainage of hot condensate and steam
As indicated in sub-section 2.2.3, the steam and hot condensate escape would have
happened only if the draining of the steam from the system was inadequate. This was
very possible, taking into consideration that the flushing lines (steam drainage) are at
a level higher than the section of pipe were the relief valve was fitted, making it
difficult, if not impossible, to drain the lower parts of the system.
A very similar occurrence happened on the UK registered Queen Elizabeth II (QE II)
on 23 June of 20023. QE II was on a passage from New York to Southampton when
two engine-room crew members were badly scalded (one eventually succumbed to his
injuries) while removing a steam valve. The safety investigation had revealed that a
slight leak in an isolating steam valve led to localised heating of trapped condensate in
the isolated steam line, which resulted in some of the condensate boiling and escaping
through the dismantled valve. The safety investigation report explained that
…the system of drainage of steam of the installation of the ship presented operational
and structural deficiencies that indicate a lack of care with the safety of human life at
sea, during the conception of the initial project…
Adequate drainage of condensate is also a requirement under SOLAS II-1/33.2, which
requires that
Means shall be provided for draining every steam pipe in which dangerous water
hammer action might otherwise occur.
and LR’s Rules and Regulations for the Classification of Ships, Part 5 Main and
Auxiliary Machinery (Steam Piping Systems):
…the slope of the pipes and the number and position at the drain valves or cocks are
to be such that water can be efficiently drained from any portion of the steam piping
system when the ship is in normal trim and is either upright or has a list of up to 5°.
Whilst the above requirements were designed to ensure adequate facilities for the
drainage of condensate of steam pipes, the accident on board Celebrity Constellation
showed that the installation did not satisfy these requirements. To add further to the
complexity of the situation, the low pressure system did not permit individual
3 UK’s Marine Accident Investigation Branch’s safety investigation report on the investigation of the
escape of steam and hot water on board QE II in the mid Atlantic resulting in one fatality on 23
June 2002. Report No. 17/2003.
17
components to be isolated for maintenance. Whilst the system as designed has the
benefit of having less flanges and therefore less potential for leaks, it does not allow
for access and isolation of the existing components. Moreover, the system does not
have direct bilge drain lines to allow for the system to be de-energised completely and
individual lines emptied. The lack of flanges has also prevented the crew members to
insert blind flanges.
2.3 Risk Assessment
The aim of a risk assessment exercise is to qualify whether the status of any system is
acceptable and help determine what changes are necessary to make it acceptable.
Such exercise is so important that it will not only provide an estimate of the size of
risk but should also enable a comparison of the risk level with some given criteria and
serve as a platform for a professional judgement to be made in determining what
system improvements are needed to increase safety.
2.3.1 Manifestation of risk assessment issues
As it has already been implied in sub-section 1.6, the risk assessment was not
thorough enough and this has been manifested through the following:
1. The hazard was not eliminated or reduced;
2. Appropriate safe guards were not selected;
3. Recommended safe working practices for the overhaul of valves were not
adequately described;
4. The crew members were not sufficiently informed about the residual risk in
the system; and
5. No extra protective clothing was worn or protective equipment used.
It is a fact that whereas some industries have the benefit to judge the level of risk by
analysing relevant accident statistics, this was not the case for Celebrity Constellation.
This meant that a different technique was necessary in order to establish the actual
level of risk which the system posed, especially with the dismantling of the relief
valve; a situation which would have altered the (stable) status of the system. Given
that such assessment was either not done at the design stage or not available to the
18
crew members, there was no other option but to conduct the assessment onboard prior
to the overhaul of the relief valve.
A typical overall risk assessment procedure is represented in figure 13.
Figure 13: A typical risk assessment procedure
Adopted: Raafat, H. M. N. (1989). Risk assessment and machinery safety. Journal of Occupational
Accidents, 11(1), 37-50.
Academic literature provides numerous examples and methods of risk assessment and
Figure 13 depicts a practical way of analysing risk in a dynamic system. Albeit linear,
the procedure may be adopted to represent a situation which indicates the importance
of crew members to be extremely familiar with the system and know where its safety
boundaries were located. The safety investigation did not have evidence which
suggested that the crew members were not familiar with the system. From the
theoretical and operational aspects, the engineers were able to operate the system
safely and take action where required. Sound engineering knowledge was not
considered to be a contributing factor to this accident.
19
To a certain extent, system hazards were known to the crew members. What was
lacking, however, was a clear4 understanding of what is defined as continuing hazards
(i.e. hazards inherent in the system) and those hazards which were a direct result of
the maintenance task. Whilst figure 13 shows a procedure, it is also indicating that
missing on particular hazards will lead to an incomplete assessment of risk,
evaluation, and eventual corrective measures, which may well include protective
barriers.
2.3.2 Risk assessments and limited hazards control
Whilst risk assessments are part of organisational functioning, they are also strongly
influenced by each individual’s unique experiences and interpretation of the ‘input
signal’. Academia shows that understanding risk is vital as it correlates to the degree
with which risk is observable.
Risk perception is the understanding of perceptual realities and hazard indicators. The
residual steam and hot water in the low pressure steam system was a hazard – and a
very serious one. It was not detected. What distorted the perception of the crew on
the severity of the hazard was the lack of perceptible indicators. The way the system
was built and designed (i.e. complexity) was a contributing factor to this distortion.
Thus, the lack of depth in the risk analysis, influenced by the distortion mentioned
above, and the lack of past experience of similar accidents, precipitated into a
situation where the crew members could only react in a reflex mode as a result of the
sudden occurrence of escaping hot water and steam.
The problem with lack of perceptible indicators is a hazard per se and this
phenomenon is not endemic to a particular safety critical domain. Studies in domains
other than transport also revealed similar problems. It was revealed that less than half
of the hazard indicators were perceptible to the human senses and almost a quarter
had to be perceived and inferred from comparisons with standards. Lack of past
experience was also an identified common problem – retrieval from memory would
have only occurred if the crew members had past experience of similar accidents or
incidents.
4 The term ‘clear’ is used on purpose. It is the safety investigation’s view that a significant degree of
hazard understanding was available. Before overhauling the relief valve, the crew members had
taken a number of precautions – per se indicative that there was a degree of awareness of the hazard
and related risks.
20
Studies in hazard perception indicate that the process is intricate with different
cognitive processes involved. It is also acknowledged that inaccurate hazard
perception is a source of limited hazards control.
2.3.3 Situation awareness
Maintenance activities cause deviations during normal operations. Thus, whilst
maintenance increases component reliability and hence safety, accidents often occur
during maintenance. The importance of risk assessment has already been described
above. From the perspective of situation awareness, risk assessment is crucial. Risk
assessment is a process (which depends on, inter alia, perception), that will generate a
person’s knowledge of the system or situation awareness. Naturally, the distinction
between risk assessment and situation awareness may not necessarily be crystal clear
and some scholars even claim that psychology is unable to separate the process from
the product.
To a certain extent, the safety investigation has considered the two separately.
However, what is of utmost importance is the understanding that rather than two
mutually exclusive constructs, risk assessment and situation awareness are
interdependent. It is submitted that situation awareness also arises from the
interaction between crew members and the work environment – and risk assessment is
one way of ensuring crew members-environment interaction. Thus, situation
awareness is a phenomenon, which is not only identifiable with the individual but, as
expressed scientifically, is a function which is achieved by coordination between the
human and the environment within the socio-technical system on board.
The link between risk assessment and situation awareness is that the former is vital to
pave the way for a compatible representation of people and systems i.e. when the
awareness of system status in the minds of the crew members becomes a true
reflection of the actual and real status of the system. Incompatible representations
(either on the crew member’s side or the machine’s status) would definitely mean
potential problems. On board Celebrity Constellation, the information exchanges
were hampered by system complexity and a shallow risk assessment – severely
compromising the information flow between system components that included the
crew members.
21
What actually happened prior and during the unfolding of the events was that the crew
members were neither able to comprehend the system status nor project accurate
future status.
2.4 System Defences
It has already been pointed out in the safety investigation report that the protective
clothing , which the crew members were wearing, did not provide enough protection
against possible injuries from contact with hot water and steam. The main problem
stemmed from the belief that the hazards were mitigated by the:
1. entire steam section being taken off line;
2. closure of valves supplying the three bar and nine bar systems;
3. allowance for the system to cool for approximately one hour;
4. reading on the pressure gauge of zero pressure;
5. release of the safety spring tension; and
6. systematic and cautionary slacking of the bolts holding the bonnet to the valve
body.
Whilst the above points suggest preventive barriers5, effective protection would have
been achieved by the application of skills and the use of protective barriers. The
safety investigation had no doubt that the crew members involved in the job had the
necessary skills. However, protective barriers, i.e. those barriers, which would have
deflected or minimised the consequences were limited. Considering the close
proximity of the crew members to the relief valve, the limited protective barriers were
manifested, for instance, in the lack of adequate protective clothing.
5 Other actions, which could have prevented the accident, could include the monitoring of
temperature as the pipe section was allowed to cool down, replacing the pressure gauge with a more
sensitive one to ensure that the pressure in the pipeline was actually zero, and improvise and ensure
that the pipe section was adequately drained by removing the pressure gauge and opening the cock
upstream of the gauge. These preventive measures would have emerged in a detailed risk
assessment exercise, which is a preventive measure per se.
22
2.5 Operational Safety from a Systemic Perspective
The vessel’s managers had established procedures to ensure that each vessel is
maintained in conformity with the provisions of the relevant National and
International rules and regulations, in addition to the requirements of the Company.
Maintenance is an integral part of the safety management system of the company –
not only because it permits the vessel to remain in Class but also because it
compliments the Company’s safety policy, ensuring compliance with the
requirements of the International Safety Management Code.
Despite the safety management system in place (one of its scopes is to avoid accidents
similar to this one), the risks materialised into an accident. It is the view of the safety
investigation that the problem was not at policy level but at the middle level of the
system. The middle level of the safety management system is the level where general
safety policy objectives are translated into maintenance concepts, planning and
procedures to achieve improved safety. The translation process is the responsibility of
the senior management. The lack of operational procedures (including a detailed risk
assessment) for the overhaul of the relief valves is indicative of a problem in the
translation process.
The accident dynamics suggested that the policy level was not representing the
operational realisation of the system. Safety management relates to the actual
practices (associated with remaining safe) and this is where a formal procedure was
missing and not highlighting potential job safety related issues.
In this particular case, i.e. work on the low pressure steam system, a specific company
procedure was lacking and when the operations did not follow the rules of logic and
unforeseen risk materialised, the crew members became unsafely exposed to the
residual hazards.
23
THE FOLLOWING CONCLUSIONS, SAFETY
ACTIONS AND RECOMMENDATIONS SHALL IN NO
CASE CREATE A PRESUMPTION OF BLAME OR
LIABILITY. NEITHER ARE THEY BINDING OR
LISTED IN ANY ORDER OF PRIORITY.
24
3 CONCLUSIONS
Findings and safety factors are not listed in any order of priority.
3.1 Immediate Safety Factor
.1 The injuries sustained by the four crew was the result of steam and hot
condensate escaping into the machinery space when part of a low pressure
safety relief valve was being removed from the steam system.
3.2 Latent Conditions and other Safety Factors
.1 There was no written procedure on how to isolate the valve from the rest of
the system, how to drain the system, and how to ensure that it was safe to
remove the valve;
.2 Not all the crew members involved in the incident were actually required to
be on site while the valve part was being removed;
.3 The overalls and other protective equipment did not provide adequate
protection against hot condensate and steam;
.4 The ‘Job Safety Analysis’ indicates that the risk assessment exercise was
not thorough enough to provide an accurate situation awareness of the
system status prior to the removal of the valve;
.5 The position of the relief valve in the system was critical in the sense that it
was at the lower end of a U shaped piece of line that contributed to the
collection of hot condensate;
.6 The design and installation of the section of system concerned neither had
an adequate steam drainage nor a drainage facility to ensure safe drainage;
.7 The routine operation and testing of the relief valves on the steam system
were not part of the vessel’s preventive maintenance procedure.
.8 Although the crew members relied on the installed pressure gauge to
determine the conditions of system, the sensitivity of the gauge was not
verified before the task was initiated.
25
3.3 Other Findings
.1 The crew members took all the necessary general precautions, during the
removal of the valve from the system;
.2 Although the system is very complex, the vessel did not have a schematic
drawing which would have clearly indicated which valves had to be closed
and / or opened prior to the removal of the relief valve.
4 ACTIONS TAKEN
4.1 Safety Actions Taken During the Course of the Safety Investigation
1. As a short term action, soon after the accident, Celebrity Cruises Inc. issued a
Fleet Bulletin, which was sent to all the vessel under its management. In its
Bulletin, the Company has highlighted the precautions which should be
followed when working on the system, mainly:
1.1. Ensuring that all lockout procedures are implemented so that the entire
system is isolated and de-energised, including the draining of standing
water and residual pressure in the lines by opening flanges or removing
steam traps;
1.2. Minimise the number of crew members in the area;
1.3. Allow for as much cooling time as possible before working on the system,
taking into consideration itinerary and ports;
1.4. Remove heavy components using a block and tackle to keep crew members
as far away from the component as possible;
1.5. Provide barriers or fire blankets to cover any components being serviced
before they are removed to provide a barrier between the crew and
potential release of steam or hot water.
26
2. Aluminised safety clothing has been provided on company ships which has to
be worn whenever work is to be carried out on the steam system.
3. A Steam System Permit-to-Work Form has been created and added to the
Company’s standard practice. The completion of the Job Safety Analysis Form
remains obligatory.
4. The testing of the low and high pressure steam safety valves has now been
included in the vessel’s preventive maintenance system. The crew is now
required to ensure that the valve properly lifts in accordance with the
manufacturers specifications. Any deviations from this are to be reported to the
Company. For Millennium Class vessels, the safety valves listed are the three
and nine bar valves, and those on the stream drum, superheater, de-aerator and
all auxiliary and waste gas boilers.
5 RECOMMENDATIONS
In view of the conclusions reached and taking into consideration the safety actions
taken during the course of the safety investigation,
Celebrity Cruises Inc. is recommended to:
06/2013_R1 Consider establishing an internal safety committee where high safety
impact maintenance tasks identified from the preventive maintenance system
are transferred from the maintenance team to this safety committee and
discussed with respect to impact on safety and risk analysis;
06/2013_R2 Fit adequate drains to the steam system of this vessel and other vessels
under its management in such a way that efficient means of draining
condensate can be achieved;
06/2013_R3 Ensure that the safety management system highlights continuous
awareness of the importance of efficient drainage of condensate.
27
Lloyd’s Register of Shipping is recommended to:
06/2013_R4 Consider raising the matter with the International Association of
Classification Societies in order to provide advice to shipbuilders,
classification societies, owners, surveyors and ship management companies on
the need to ensure that efficient draining of steam pipelines on board vessels is
available in accordance with mandatory requirements.
28
ANNEXES
Annex 1: Job Safety Analysis Form
