Marine Investigation Report M05W0111

• Table of contents

  1. Factual information
  2. Analysis
  3. Findings
  4. Safety action
  5. Appendices

Summary

At approximately 1008 Pacific daylight time on 30 June 2005, while approaching berth No. 1 at Horseshoe Bay, the Queen of Oak Bay suffered loss of propulsion and a reduction of steerage. As a result, the vessel deviated off course and struck 28 pleasure craft berthed in the adjacent marina before running aground. There were no casualties; however, there was considerable damage to the pleasure craft and marina.

1.0 Factual information

1.1 Particulars of the vessel

1.1.1 Description of the vessel

The Queen of Oak Bay is a double-ended vessel having a wheelhouse, a controllable-pitch propeller and a rudder at each end, and the engine room at midships. The two ends are almost identical and, for the purposes of identification, are numbered 1 and 2. This establishes the port and starboard sides of the vessel and the numbering system of the machinery in the engine room (see Figure 1).

The vessel is equipped with one anchor (along with the associated windlass, power unit, and controls), which is housed in a separate dedicated compartment located on the starboard forward part of the main car deck, at the No. 1 end. (When the ferry is sailing with its No. 2 end forward, the anchor is located at and deployed from the vessel's port quarter.) The compartment can only be entered via a door that is normally kept closed. Releasing the anchor is accomplished by removing its securing device and then taking the tension off the windlass brake.^{Footnote 3}

The engine room contains two main propulsion engines, three auxiliary engines for electrical power generation, and their associated machinery and equipment. Two propeller shafts and intermediate shafts connect the main engines to the propellers via reduction gears.

An engine control room is located within the engine room, on the port side.^{Footnote 4} It contains the main electric switchboard and the means to remotely start, stop, and monitor the main engines and associated machinery. The engine control room's inboard side is fitted with windows, and both main engines are partially visible.

1.1.2 Engine room and wheelhouse manoeuvring stations

The engine room manoeuvring station is located in the engine control room and contains the telegraphs and the engine-speed levers, along with pneumatic controls to engage/disengage the clutches, stop the main engines, and change control between the engine room/wheelhouse. Gauges for monitoring the propulsion plant, as well as alarm panels, are also located there.

Each wheelhouse has a manoeuvring station forward of the steering console, providing the operator with an unrestricted view forward. Like the engine room station, the telegraphs and the engine-speed levers are located there, as are pneumatic selector switches for changing between the two wheelhouses and the two modes of vessel operation. The two engine/propeller pitch-control levers have differently shaped handles: the T-shaped handle, corresponding to the stern propeller, is situated on the right-hand side; the L-shaped handle, which controls the forward propeller, is to the operator's left (see Photo 2).

The steering wheel in each wheelhouse controls the corresponding stern rudder; thus, the wheel in the No. 2 end wheelhouse controls the No. 1 end rudder, and vice versa. As a rule, the steering wheel is used by a helmsman to make course alterations while the ship is on passage. A wheelhouse can also control the corresponding bow rudder by means of a jog steering lever on the manoeuvring station. Another jog steering lever, located above the one for the No. 2 rudder, controls the No. 1 rudder.

The two jog steering controls are used during berthing operations, when increased manoeuvrability is required. In such instances, the master uses both the two pitch-control and two jog steering levers in combination.

1.1.3 Two modes of propulsion

There are two main engines, each with two pneumatic clutches; the combination yields two ways to operate the propellers. Propeller pitch can be varied, and the main engines operate between 325 and 450 rpm. Vessel speed is controlled by a pneumatic combinator connected to the speed-control lever; this automatically varies propeller pitch and engine rpm (see Figure 2 for modes of operation).

Mode 1

All power generated by the two main engines is used by one propeller. This mode is used when the vessel has finished manoeuvring and is under way on passage. Only the stern propeller is used; this is done by engaging clutches 1A and 2B or 1B and 2A.

Mode 2

All four clutches are engaged, providing power to both propellers. This mode is primarily used during berthing and unberthing. The amount of power absorbed by each propeller can be varied by adjusting the blade pitch, but the default is a ratio of 70:30 or 60:40, with the forward propeller taking the lesser amount, because it is used to slow the vessel.

In both modes, the two main engines are mechanically coupled, effectively behaving as a single unit. There is no automatic means to isolate them in the event of a fault in one; any change in the operating condition of one is automatically, and instantaneously, reflected in the other.^{Footnote 5}

Various other combinations of engines/clutches/propellers are also possible from the control station in the engine control room, and either engine can provide power to either propeller.

1.1.4 Mode selection switches on the control consoles

Under normal circumstances, the vessel is manoeuvred and the engine rpm and the propeller pitch are controlled from the wheelhouse. The wheelhouse console has one pneumatic switch for changing modes. There are no indicators to show if the command given by the switch has been correctly executed and how many, or which, of the four clutches have been engaged. An operator in the wheelhouse can ascertain clutch engagement only by looking at the propeller shaft rpm indicators on the same console (see Photo 2).

Lights on the engine control room console indicate which of the four clutch-control switches are engaged. A mimic board continuously displays the status of the clutches, main engines, propeller pitch, wheelhouse in use, etc. (see Photo 3), allowing engineers to always see the operational conditions of the clutches and the propulsion plant.

In the event of a malfunction, neither the engine control room nor the wheelhouse has a direct, audible alarm to alert operators to an accidental or inadvertent disengagement of one or more clutches.

1.1.5 Description of a typical berthing and unberthing manoeuvre

After ringing "stand by" at the end of a full-speed passage, the master begins slowing the vessel. As propulsion is still in Mode 1, this is done by using the T-shaped speed-control lever. At an appropriate time, the master switches over to Mode 2 and, now that the forward propeller also has power, uses the L handle to vary rpm and pitch, slowing the vessel's forward progress. This is achieved by operating the forward propeller in its ahead-thrust direction. (Both the forward and stern propellers are thus turning in their respective "ahead" direction.)

During berthing, the stern and forward rudders are controlled by their respective jog steering levers. The force of the wash created by the propellers acts upon the rudders, causing the vessel's bow or stern to swing in the required direction. Placing the forward jog steering lever to port, for example, makes the bow swing to port.^{Footnote 6} In these circumstances, the forward rudder's function is similar to a bow thruster. This is very important for safe manoeuvring, particularly in rough weather.

Once in the berth, the propulsion system remains in Mode 2 and the forward propeller is set to a slight astern pitch, while the stern propeller is set at a slightly forward pitch.^{Footnote 7} Both propellers thus develop a little forward thrust, pushing the vessel against the dock.

To unberth, manoeuvring control is transferred to the opposite wheelhouse. The forward propeller becomes the stern propeller, providing thrust for the ferry to move forward. Once the ferry is clear of the berth, the system returns to Mode 1.

1.2 History of the voyage

At the time of the occurrence, the Queen of Oak Bay was based at Horseshoe Bay, B.C., and employed on the Departure Bay-Nanaimo, B.C., route. On 30 June 2005, the ferry started its scheduled run at 0624 Pacific daylight time.^{Footnote 8} A single 30-nautical mile crossing takes about 95 minutes, and the ferry made the first crossing without incident. At 0834, the vessel left Departure Bay in occasionally foggy but calm conditions, on its second trip of the day, with 544 passengers, 76 vehicles, and 36 crew members on board. It arrived at Lookout Point at 1002. During the crossing, the main engines were operating in Mode 1 and, via clutches 1A and 2B, were supplying power to the stern propeller. The ferry usually berths at the No. 2 berth at Horseshoe Bay terminal, but was assigned the No. 1 berth because the No. 2 was occupied by the Queen of Coquitlam. The No. 1 berth is adjacent to Sewell's Marina.

At 1002, the master placed the engine room on "standby" for arrival at Horseshoe Bay and at 1005 changed over to Mode 2, engaging all four clutches. The vessel was lined up for the centre of the No. 1 berth, but at 1008, while about 200 m away from the floating leads, all propulsive power was lost. Seeing that the propellers had stopped turning, the master telephoned the engine room, informed them of the power loss, and ordered the engines to be restarted and power restored.

In the engine room, the engineers could see that the clutch-control levers were still in the lock position but that the clutches themselves had become disengaged and that the No. 1 main engine had stopped while the No. 2 was still running, apparently at its idling rpm. Various alarms had also triggered. The engineers tried to restart the No. 1 main engine to restore power.

Repeatedly sounding the vessel's whistle, the master called for the anchor to be deployed, but the anchor station was not crewed; consistent with onboard practices, the deckhand whose designated duty was to release the brake in an emergency was performing other duties elsewhere on the vessel. The anchor was not released.

An imminent impact was announced, and passengers were instructed to brace themselves.

Under the influence of the last starboard helm input to keep the vessel aligned with the dock, the vessel slowly turned to starboard towards the marina, and the master gave orders and corrective port helm was applied. With the approach speed of three to four knots, the port rudder did not take effect and the ferry continued on its starboard heading, striking a number of boats in the marina before running aground on the seabed and coming to a stop.

There were only a few people on jetties and in boats at the marina at the time of the occurrence; there were no casualties.

1.3 Damage

The vessel suffered minor damage to the No. 2 propeller and some scraping damage to its hull. There was extensive damage to the marina and 28 pleasure craft moored there.

1.4 Speed regulation of the main engines

The operating range of the main engines is between 325 and 450 rpm, and speed and loading can be varied by the speed-and pitch-control levers in the wheelhouse or in the engine control room. Each engine has a hydraulic governor that serves to keep the rpm constant. The governor also keeps the rpm steady, reacting to changing external conditions - wind, weather, seas, vessel movements - that affect the loading on the engine.

Input signals to the governor are pneumatic, whereas the output shaft of the governor is mechanically connected to the fuel racks. In response to the input signal, the governor directly controls the fuel racks, increasing or decreasing the fuel injected into the cylinders so as to keep the rpm within fixed limits.

Each engine has two banks of six cylinders, arranged in a V. Each cylinder has a fuel pump, the fuel rack of which is connected to a common shaft running the length of the engine. Another shaft runs transversely across the engine and, via linkages, connects the two common shafts to the governor's output lever. Connection between the governor output shaft and the engine shafts, levers, and linkages is via steel pins and castellated nuts, with positive tensioning ensured by split pins fitted through the pins and nuts. The drive for the governor is taken off the engine's camshaft and mounted at its power take-off end. Four foundation bolts secure the governor to the engine.

Rotary motion of the governor output shaft is transmitted to the common shaft and converted at the fuel pump racks. Various stops and condition-monitoring sensors are connected to the common shafts; these include an engine overspeed trip, a fuel rack position indicator, and a manual emergency shutdown.

In the event of a failure, there is no arrangement within the fuel-regulation mechanism to return the fuel racks to zero, nor is this a regulatory requirement.

1.4.1 Post-accident faults found on main engine fuel and governor linkages

After the accident, inspection of the linkages on the two main engines revealed the following:

A castellated nut on the link pin for connecting the governor's output lever on the No. 1 main engine governor's output shaft to a control linkage was found on the floor plates beneath the governor. The linkage had slid out of the governor's output lever link pin, causing the governor to become disconnected from the engine's fuel control rack linkages (see Photo 4).

No broken pieces of the locking split pin were found in the vicinity of the nut, nor were any left behind in the bore of the link pin or the nut.

The orientation of the fitted link pin was contrary to that indicated in the manufacturer's drawings, which indicated that the pin was to be inserted with its head on the side of the link rod, with the nut lying on the outer side of the output lever. There was no indication that the orientation of the pin would have resulted in a detrimental effect or condition.

The link pin was designed to slide into its designated bored hole in the output lever. Wear from usage created an excessive clearance between itself and the bored hole.

The link pin and nut assembly on the No. 2 main engine was found to be different from that on the No. 1 engine and not of the manufacturer's supply. It had been fabricated out of hexagonal bar stock, and its locking arrangement was by means of a spring lock washer under a regular hexagonal nut, instead of a split pin. Its thread was from the ½-20 UNF series. Testing revealed excessive play between the bolt, flat washers, lock washer, and nut.^{Footnote 9} The method of locking the nut was found inappropriate for this type of application.

Some linkages had been assembled so that they lay at an angle to other linkages and rods, rather than at right angles. The linkages incorporate spherical joints that allow a degree of misalignment. The angles formed were sufficiently large as to place a small amount of bending moment on the link rods, instead of the pure tension and compression required by their design; this was not significant enough to cause any damage.

Another link pin connected to the output shaft of the governor on the No. 2 main engine was found bent and damaged. This linkage from the output shaft of the governor provides a signal to the pitch controller as well as to the fuel rack position indicator in the control room. This was deemed to be a pre-existing condition because there are no significant couples acting upon the linkage for the damage to have occurred as a result of the engine's overspeeding.

1.4.2 Description of linkages on main engine and governors of other vessels

The Queen of Oak Bay has four sister vessels. Of these C Class vessels, the Queen of Surrey and the Queen of Coquitlam were inspected. The main engines and arrangement of the governors on the Queen of Surrey were found similar to those on the Queen of Oak Bay, and some linkages had been assembled so that they lay at an angle - instead of perpendicular - to other linkages and rods.

The governor's output lever has a number of drilled holes for fitting the connecting pin. On both vessels, the pin was fitted in one of the bottom holes. Locating it in an upper hole would increase the moment produced by the output shaft, enabling the governor to produce less torque to move the fuel racks. The total radial travel of the output shaft and the corresponding linear travel of the fuel racks would also increase; this would also increase the sensitivity of the governor and the potential for the engine to hunt. Selection of the optimum location of the pin is done at the time of the initial setting up of the engine, or after major component renewal or overhaul.

1.5 Protection devices on the main engines

Protection devices are fitted on all engines to safeguard against abnormal operating conditions. These devices can be alarms that are triggered at pre-set values, or switches that automatically shut down the engine if an abnormality is not rectified.

The main engines on the Queen of Oak Bay are fitted with two kinds of instant shutdowns - an automatic overspeed protection device and a manual emergency stop. In the event of low lubricating oil pressure, high cooling-water temperature, or other such irregularity, an alarm is set off and a watchkeeping engineer may choose to activate the emergency stop. This works through a pneumatic cylinder, which upon activation, trips a latch and releases a spring that pushes the fuel racks to zero. After the engine has stopped, resetting the overspeed trip requires turning it with starting air for one complete revolution to reset the pneumatic cylinder. To reset the pneumatic cylinder after a manual shutdown requires setting the controller to the normal position.

To prevent the faulty engine from dragging the other engine with it, and to shut down safely, as soon as the fuel racks reach zero, a micro-switch is triggered, which in turn sends a signal to disengage the clutch as the engine shuts down.

The engines do not have automatic emergency shutdowns corresponding to low lubricating oil pressure or high jacket cooling water temperature nor were they required by regulations.

1.6 Mid-life upgrade

The Queen of Oak Bay was built in 1981, and, in order to renew and repair many of its facilities, underwent a mid-life upgrade (MLU) in 2004-2005 at the shipyard, Vancouver Drydock Company. The work was done by the shipyard and various suggested sub-contractors. Prime Mover Controls is one of these contractors. The shipyard set up an independent project office, under the charge of a project manager, to organize, execute, supervise, and test the repairs.

Included in the MLU were:

• surveys, planned maintenance, and repair items for machinery and equipment in the engine room and deck;
• an overhaul and servicing of the main engine governors and the pneumatic control system; and
• re-calibration and replacement of many analog engine control room gauges with digital ones.

1.6.1 Work generation, tracking, and control

The vessel uses a PC-based software application for planned maintenance, its equipment database, inventory control, work-order generation and, at the time of the accident, inter-watch communication. After repair lists were drawn up, discussed with management, and finalized, engineers entered the items in the software application and generated work-order numbers for them.

1.6.2 Crewing and watchkeeping

A ferry is crewed by personnel attached to the terminal to which the ferry is assigned. When a ferry such as the Queen of Oak Bay is operational, it has four watches of engineers assigned to it; three watches actively work on the vessel while the fourth is on its days off. There are three duty periods, or shifts: a morning shift, an afternoon shift, and a night shift. The morning and afternoon shifts are under the charge of either the senior chief engineer or a chief engineer; the night shift is under the charge of a first engineer.

During the MLU, the shift system was suspended and work was done by day workers. The senior chief engineer worked from 0600 to 1430, and the chief engineer worked from 1415 to 2300. Both had appropriate junior engineers to assist them. Weekends and night shifts were not worked. A 15-minute overlap enabled handovers.

The MLU began on 15 November 2004 and ended on 30 May 2005. When the MLU was being planned and also during its first few months, until mid-January 2005, the Queen of Oak Bay was assigned to Departure Bay, Nanaimo, and was crewed by people attached to that terminal. The repair lists were drawn up by this crew and most of the repairs and renovations were either started directly by them, or assigned to contractors at this time.

In December 2004, BC Ferries management assigned the Queen of Oak Bay to Horseshoe Bay. Responsibility of the vessel and oversight of the MLU project thus transferred from the Nanaimo-based crew to the Horseshoe Bay-based crew. As the MLU would now have to be done by a new crew, it was decided to allow some time for the new (Horseshoe Bay) senior chief engineer to familiarize himself with the project, so as to maintain continuity. Accordingly, he joined the vessel on 04 January 2005 and, for the next two weeks, was familiarized with the work being done. After two weeks, the crews changed over, though the previous senior chief engineer remained attached to the MLU and maintained regular contact.

1.6.3 Procedure for repairing the governors

It is BC Ferries' practice to send governors to an authorized specialist, Prime Mover Controls, for periodic overhaul or when they break down. Either vessel staff, or the contractor and sub contractor would disconnect the governor from the engine, and make arrangements for the governor to be shipped for repairs. After servicing, governors are tested and adjusted on a test bench that duplicates actual engine parameters. The governors on some BC Ferries vessels are subsequently reconnected and the engines run up with Prime Mover Controls verifying the governors' settings, calibrations and operation. This is not normally the case for C Class vessels; however, the MLU was an unusual event.

On 20 January 2005, both of the vessel's governors were disconnected from the main engines. Technicians representing Prime Mover Controls, who happened to be in the engine room at that time, then took them to their workshop. The contract issued by BC Ferries to the Vancouver Drydock Company specified that the shipyard was to remove and re-install the governors, and that the governors be shipped to Prime Mover Controls to perform the overhaul. Written records lacked detail, and other information gathered during the investigation was unable to confirm who actually performed the work in this instance.

At the request of vessel staff, Prime Mover Controls returned to the vessel on 23 June 2005 to investigate a reported engine hunting problem; this included adjustments to the No. 1 main engine governor.

1.7 Description of post-repair sea trials

Following the accident, on 06 July 2005, the Queen of Oak Bay was taken to sea for post-occurrence sea trials, where various main engine operational conditions and shutdown scenarios were simulated. The main findings included the following:

• The overspeed trip for the No. 1 main engine was set at 524 rpm.
• The overspeed trip for the No. 2 main engine was set at 511 rpm.
• With the No. 2 main engine running and the No. 1 main engine stopped, the governor on the No. 1 main engine was disconnected from its fuel-control linkages. No consequent movement was observed on the fuel racks.
• With the No. 1 main engine running and the No. 2 main engine stopped, the governor on the No. 2 main engine was disconnected from its fuel-control linkages. No consequent movement was observed on the fuel racks.
• The two fuel control racks for A and B banks of the No. 2 main engine were not set equally. When the engine was stopped by its overspeed trip, the B bank fuel pump racks were at zero, but the A bank fuel pump racks remained at approximately 10 mm.
• With propulsion control set in Mode 2, that is, both main engines clutched in and thereby coupled together, the No. 1 engine was manually speeded up. This caused the No. 2 engine to speed up instantly, and its governor output shaft moved to reduce fuel racks to zero.
• Average time for clutches to disengage when the engines tripped on overspeed was found to be five seconds.

1.8 Safety management system and fleet regulations

Although not required to comply with the International Safety Management (ISM) Code, BC Ferries has elected to do so. It obtained a document of compliance for its fleet and a safety management certificate for the Queen of Oak Bay in 1995. Safety management systems (SMSs) had been developed for all BC Ferries vessels and safety management certificates obtained for them. The issuing authority for the document of compliance and the safety management certificates is Lloyd's Register North America, Inc.

In order to ensure continued compliance with ISM requirements and to maintain validity of its document of compliance and safety management certificates, BC Ferries management as well as all BC Ferries vessels underwent periodic renewal and verification audits by Lloyd's Register.

The SMS for the Queen of Oak Bay required, amongst other things, the drawing up and implementation of vessel-inspection and planned-maintenance routines, effective document control, internal and external communications, contingency plans, and procedures for dealing with various potential shipboard emergencies.

As part of the SMS, BC Ferries has developed a Fleet Regulations policy and procedures manual. The Fleet Regulations manual took effect in March 2005. It formalizes all BC Ferries policies, and is to be used as a reference.

1.8.1 Inspection and planned maintenance procedures

In addition to annual inspections and servicing of critical control systems by competent professionals, engine room watchkeepers were required to periodically inspect the engine room and the main and auxiliary engines. Items to be checked by engine room watchkeepers, and the nature of these checks, were specified in checklists drafted pursuant to the ship's SMS and Fleet Regulations manual. Inspection of the main and auxiliary engine governors and fuel linkages was required before morning startup and at regular intervals thereafter. Incoming watches were also required to do this, and ensure proper functioning of all machinery before beginning a shift.

As checklists for engine room operations cannot enumerate every detail, the watchkeeping staff was also required to use their experience, knowledge, and training to advantage.

According to the SMS, planned maintenance routines required the main engines to be dismantled and overhauled on the basis of running hours, with different routines established for different components. The work was performed by ship staff or shore-based contractors. Neither the engine manufacturer, the company management's engineering department, nor the vessel's senior engineers had specified planned maintenance routines for the inspection or renewal of the governor's output lever or link pin following a safety-critical maintenance task.

1.8.2 Internal communications and record keeping

During the MLU, most communication between the two different shifts of engineering crews, the project manager and his team, and the shore contractors was verbal. The ship's engineering staff kept daily progress records of all work in the engine room, making suitable entries on the PC-based software application's watch log report page. Another section of the software application deals with planned maintenance, and contains an engineering history of different items of the ship's machinery.

The SMS requires that records be maintained for many of the vessel's activities, including machinery operations and maintenance. Neither the watch log report nor the planned maintenance records are controlled documents as defined by the SMS and the Fleet Regulations manual; however, they are kept for two years.

The watch log report pages show that the two governors were disconnected from the main engines, removed from the vessel, and then received back on board, but neither the watch log page nor the individual equipment database indicates the specific work carried out - nor do they indicate who reconnected them back onto the engines, or whether any problems were experienced during refitting and the subsequent engine run-up.

1.9 Vessel and crew certification

The Queen of Oak Bay was certified, equipped, and crewed in accordance with existing regulations. Additionally, BC Ferries and the vessel voluntarily held valid certification in accordance with ISM requirements.

2.0 Analysis

2.1 Loss of propulsion

The function of a governor is to limit an engine's rpm around a set point, preventing it from overspeeding. As the castellated nut loosened under vibrations, the control linkage fell out. This allowed the No. 1 main engine's governor to become disconnected from its fuel-control racks, leaving the engine without speed control. Neither the engine fuel-control shafts nor individual fuel pump racks were fitted with return springs (nor were they required to be). Therefore, overspeeding of the engine could not be prevented because the fuel racks could not be brought back to zero.

The engine was stopped by its overspeed protection trip. This could have been activated when the engine sped up as its fuel racks moved towards full fuel admission. However, when simulated during the sea trials (by disconnecting the governor of an engine), the fuel racks did not move in either direction.

The trial conditions, however, did not exactly mirror those at the time of the accident; the engine being tested was not running, nor had it warmed up to the same extent. Since this is a 60° V engine, the fuel racks are inclined 30°. It was expected that, under the influence of gravity and induced vibrations from all the running machinery, the fuel racks would move downwards, towards full fuel admission. Although this did not happen in the test case, it is still possible that, had the simulated conditions been identical, the racks may have moved downwards towards full fuel and caused the engine to overspeed.

A more likely scenario is that, as the vessel was engaged in manoeuvring operations, the load on the engines was being constantly reduced by the navigating officers. It is possible that the governor became disconnected just as the pitch of the propellers was reduced. As shown in the simulation, the fuel racks would not have moved, thus the quantity of fuel being admitted into the cylinders remained unchanged, but the load on the engines dropped sharply. This reduction in load, without a corresponding reduction in fuel injected, caused the engines to rotate faster and eventually trip on overspeed.

The vessel was in Mode 2 operation, and since the two engines were coupled together, the increase in the No. 1 engine's rpm also caused an immediate and corresponding increase in the No. 2 engine's rpm. The No. 2 engine's overspeed trip was found to be set at 511 rpm and the No. 1's at 524 rpm; the No. 2 engine thus tripped first, followed closely by the No. 1 main engine, the entire shutdown scenario probably taking no more than a few seconds.

As verified in post-accident trials, the governor on the No. 2 engine - sensing the increasing rpm - would have moved to reduce the fuel input into the engine. The interconnection of the two engines would have caused the No. 1 engine to take the No. 2 engine with it, even if the governor had reduced fuel admission to zero.

The activation of both the overspeed trips would have sent a signal to the clutches, causing them to declutch. This would not have been indicated on the wheelhouse console, where the control switch would still be in the forward and aft propeller position (Mode 2).

The No. 2 main engine continued to run in spite of having tripped on overspeed because, even though the overspeed protection device had pushed the fuel-control shafts to zero, the fuel pump racks on the A bank side had been improperly calibrated and remained set at a stroke of about 10 mm. This was sufficient to allow the engine to keep turning over, but not enough to let it take any appreciable load. The declutching of the engine also removed its connection with the propellers, further reducing all applied load.

The absence of a split pin on the securing nut on a governor linkage of the No. 1 main engine thus caused the governor to become disconnected from the fuel racks. The two main engines were interconnected at this time, and this caused the overspeeding No. 1 main engine to drag the No. 2 main engine into a shutdown condition with it, leaving the vessel without propulsion.

The Queen of Oak Bay's speed at this time was three to four knots. Without the propellers providing a wash over the rudders, this was too low a speed to enable steerage, and the vessel's heading could not be altered.

2.1.1 Absent split pin on the securing nut of the governor link pin

Reconnecting the governor to the main engine requires placing it on its stand, aligning the drive gear and then tightening the four securing nuts. The link arm on the governor output shaft is then connected to the linkages of the fuel-control shafts. A split pin fitted through the castellated nut secures the linkages to the governor's output lever link pin.

The Queen of Oak Bay finished its MLU on 08 June 2005. Less than a month later, the nut worked itself loose and fell off. In order for this to occur, the locking split pin that is used to secure the nut was either not fitted or was fitted improperly.

Supervision or verification is essential to ensure that assigned work is completed properly, irrespective of whether the work is done by ship staff or contractor. This is crucial when safety-critical components of an engine are not readily visible under routine operations. The fact that the problem with the split pin was not detected would indicate that supervision/verification of the work was ineffective at all levels.

2.2 Engine shutdown and the effect on interconnected engines

2.2.1 Overspeed shutdowns

The two main engines are clutched together in both Mode 1 and Mode 2, effectively making them one entity. A speed change in one engine instantly causes a corresponding speed change in the other, and an overspeed shutdown of one will cause the other to shut down.

This is because the engines have similar operating revolutions and therefore similar overspeed trip settings.^{Footnote 10} The tripping devices work by cutting off the fuel to the engine, but because they are of mechanical design, there will be a difference of a few revolutions between the two engines' settings. Assuming that the overspeed shutdown setting of one is at 520 rpm and the other at 524 rpm, this creates two shutdown conditions:

• If the 524 rpm engine starts to overspeed, it will drag the 520 rpm engine with it. Both will shut down.
• If the 520 rpm engine starts to overspeed, because of the inertia of rotating parts, it would in all probability go past 524 rpm even after its fuel supply has been cut off. It could then, in low-load conditions, drag the 524 rpm engine into an overspeed condition, causing both engines to shut down.

If the trips on both the engines are set to the same value, overspeeding by either engine will cause the other to shut down.

This condition of the good engine also shutting down occurs because the same overspeed sensor is used to send a signal to both the overspeed shutdown cylinder and the declutching cylinder.

2.2.2 Shutdowns caused by other fault conditions and design of the stop switch

BC Ferries is operating four other vessels with similar propulsion features as the Queen of Oak Bay. Inherently, these vessels have redundancy in propulsion power in that they are fitted with multiple engines, shafts, and propellers. It is not uncommon to have two or more engines clutched to common propulsion shafting. However, their configuration should be such that fault conditions on one engine are not allowed to detrimentally influence the other engine(s) in the propulsion system.

These fault conditions may include

• engine overspeed,
• low fuel pressure,
• low scavenge air pressure,
• high operating temperature,
• low lubricating oil pressure, and
• control failure.

Some of these fault conditions are monitored by the engine room alarm system, which will trigger an alarm. However, on the C Class vessels, only engine overspeed is connected to an automatic engine shutdown device. For all other faults, it is up to the engineer to stop the faulty engine using the manual emergency stop switch before it causes the other interconnected engine to stop.

The manual emergency stop switch sends sequential signals for declutching and stopping the engine. Notwithstanding, once an engineer hears an alarm and initiates a manual shutdown, it takes five seconds for the clutches to disengage, during which time the faulty engine is slowing down because its fuel supply has been shut off. However, in the event that one of the above fault conditions occurs and the faulty engine's clutch is still engaged, the faulty engine increases the load on the good engine. The control system on the good engine tries to maintain the set rpm, and consequently sensing the load from the faulty engine, the governor on the good engine moves the fuel racks, increasing the amount of fuel. When the clutches connected to the faulty engine are finally disengaged using the manual shutdown, the load imposed by the faulty engine is removed and the governor on the good engine may not be able to pull back the fuel racks in time to prevent the good engine from overspeeding and also shutting down.

On 13 and 14 February 2007, BC Ferries conducted trials aboard the Queen of Surrey to test the possibility of this scenario. The two main engines were put in Mode 2 operation and loading conditions existing during a docking were simulated. Under these conditions, it was found that, when the manual emergency stop was activated to shut down one main engine, it disengaged safely and did not bring about a shutdown of the other running interconnected engine.

The sea trials, however, were conducted at relatively low engine speeds and did not simulate the response of an engine operating in the upper rpm and load range, when a faulty engine suddenly declutches.

It is still possible that there are fault conditions that may require a main engine on the C Class ferries to be shut down quickly for which automated isolation from the other connected engine has not been incorporated, thereby placing at risk the vessel, passengers, crew, and the environment.

2.3 Evaluation of emergency situations

Wheelhouse manoeuvring consoles on C Class ferries do not have a mimic board showing the propulsion plant's condition. Relying on the propeller rpm gauges may therefore be misleading and, without gauges to likewise indicate engine rpm or the position of the clutches, it is impossible to tell if an engine is declutched but running, idling, or fully stopped.

At 1008, when the Queen of Oak Bay lost all propulsive power, the wheelhouse crew did not know that the clutches had become disengaged and that the No. 2 engine was still running. They could only see that both propeller shafts had stopped turning, and so they telephoned the engine control room and, without knowing the status of the propulsion plant, ordered the engine crew to restart the engines. The order, therefore, distracted the engine crew from effectively evaluating the nature of the failure.

In an emergency situation, decisions must be made taking into consideration all available information. Otherwise, subsequent actions intended to resolve the situation may be ineffective, thus placing the vessel at risk.

2.4 Safety management system

2.4.1 Internal communications and record keeping

Given that ferries change operating routes and terminals, are crewed from different pools, and their system of rotational watchkeeping does not enable direct communication between different shifts, it is crucial to ensure an accurate and detailed information exchange.^{Footnote 11} The exchange of appropriate operational information improves operational efficiencies, optimises utilization of resources, improves performance, and helps to minimize errors. It also provides a historical account of the performance and repair records of both personnel and machinery. Additionally, this enables effective gauging of staff capabilities, and performance trend monitoring and preventive maintenance of equipment - all of which are required by the ISM Code, the vessel's SMS and the company's Fleet Regulations.

The watch log report page in the software application for planned maintenance is the primary means to store and pass pertinent information from watch to watch on all BC Ferries vessels, and also from shift to shift, crew to crew, and ship to superintendent's office. It contains information about work completed during a watch, and details of work not yet done. This page, however, is not a controlled document; beyond requiring the identification of the person making the entry, his/her shift, and the date, there is no set format. Furthermore, there are no instructions from BC Ferries management or the senior chief engineer on how to fill out the page.

Reliance on verbal communication and lack of detail in the records prevented the conclusive resolution of the question regarding why the split pin was absent or improperly fitted, thereby hindering the determination of appropriate corrective action as required by the vessel's SMS.

2.4.2 Actions of the wheelhouse and engineering crews

2.4.2.1 Anchor deployment

The anchors on vessels may be used to slow or stop the vessel in the event of a loss of propulsion or manoeuvrability. On this trip, the anchor was on the vessel's port quarter.

While a deckhand on board the Queen of Oak Bay is designated to release the anchor in an emergency, normal shipboard practices did not call for a person to stand by the anchor during docking/undocking operations. At the time of the occurrence, the deckhand was occupied with duties elsewhere, and the anchor could not be dropped, depriving the vessel of a potentially important tool for use in an emergency.

2.4.2.2 Emergency response

When the Queen of Oak Bay lost propulsion, the limited information available to the bridge prevented the bridge team from ascertaining the status of the propulsion plant. They could only see that the two propellers had stopped turning, and, realizing that the vessel was about to run into the marina, asked the engine room crew to restart the engines and restore power.

The wheelhouse crew arrived at an incorrect conclusion because instrumentation on the manoeuvring console did not provide a complete picture of the engines/clutch status. Consequently, communication between the wheelhouse and engine control room included instructions that interfered with the engineers' efforts toward potential resolution of technical problems.

Engine room staff would normally troubleshoot operational problems with engine room machinery and its systems. In this occurrence, when the two main engines tripped, alarms indicating the cause were set off in both the engine control room and the engine room; this information was readily available to the engineering staff. However, given the urgency of the situation, the engineering staff responded by restarting the engine without fully ascertaining the cause of the shutdown.

Attempts to restart the No. 1 main engine were unsuccessful because the fault condition that caused the engine to stop was neither diagnosed nor rectified. Restarting machinery without first determining the cause of the fault condition increases the potential for further damage. For example, had the fault condition been due to a lack of lubricating oil or mechanical damage, restarting the engine under such conditions would likely have caused further damage.

2.4.3 Inspection and planned maintenance procedures

Inspection of the governor and fuel linkages was regularly done by the vessel's engineers, especially before startup. The missing or improperly fitted split pin on the castellated nut on the governor's output lever link pin was small (not more than 30 mm by 3 mm), and the problem was overlooked while inspecting the entire engine. The No. 2 main engine's governor, however, had a severely bent link pin that was connected to the output shaft, which should have been fairly obvious. This was not observed during inspection rounds. Other linkage-related defects on both engines, such as the use of a fabricated link pin and lock nut, and the improper angular arrangement of link rods (which had the potential to compromise the functionality of the fuel control system), had also existed for a while; they too were easy to see and, once noticed, to rectify.

The link pin is designed to be a sliding fit in the governor's output lever. Over time, wear resulted in increased clearances, leading to the generation and propagation of vibrations. A correctly tightened nut will not normally lose tension, even if it has been assembled without a locking device. In this case, induced engine vibrations, amplified by wear between mating components, loosened the fastener and allowed the disconnection of the linkages.

Major components generally have manufacturer's guidelines for inspection and maintenance. These are based on running hours, with the objective being timely repair or replacement of worn out parts. Company practice is to have the governors overhauled annually. By contrast, no inspection and planned maintenance routines are in place for checking wear in the linkages.

Although routines and checklists could conceivably be drawn up for the maintenance and assembly of every item or component of a machine, to do so would be an onerous task. Rather, it is up to the engineer or technician to take the initiative - using his/her education, training, and experience - and identify components where usage over time has caused wear. Suitable corrective action must then follow, with the discovery made known both to other engineers and to company management.

The SMS developed by BC Ferries require senior engineers to inculcate good engineering practices amongst the junior engineers and to foster an atmosphere that actively seeks to increase workplace efficiency and safety. In this case, the governors had been disconnected from and reconnected to the engines many times by different engineers and technicians, yet no one recognized the increased clearances in the pins and linkages.

2.4.4 Supervision of tasks

Proper supervision can be effective in making sure assigned work has been done satisfactorily.

Operational and maintenance-related activity to keep machinery running smoothly must be selectively delegated by the person in charge of a watch. The chief engineer ought to be aware of the complexity and risks associated with such work. This means that he gives timely direction when required, and makes sure that the entire job has been satisfactorily completed and tested.

In the airline industry, mandatory^{Footnote 12} supervisory systems require vigorous cross-checking and independent verification to ensure proper completion of work. No such system exists in the marine industry, though the introduction of the ISM Code and associated SMSs supports the objectives of providing safe operating practices and establishing safeguards against identified risks.

The SMS developed by BC Ferries identifies many shipboard activities that present a risk, and it implements procedures to minimize or eliminate them.

Examination of the SMS indicates that BC Ferries has not done an assessment of the systems requiring maintenance in order to identify ones that are safety critical, nor has it developed procedures to prevent mistakes occurring during maintenance activities on such systems.

There has been at least one other occurrence where the absence of effective supervision of maintenance activity has resulted in major machinery failure. The TSB investigated that occurrence (fire on board the ferry Queen of Surrey) and identified causal factors, and determined that the risks associated with it could have been mitigated by effective supervision.

That the missing or improperly fitted split pin was not noticed before the Queen of Oak Bay re-entered service, or subsequently, indicates some inadequacies related to supervision and verification of the contractor's work by BC Ferries.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 24 May 2007.

Appendices

Appendix A - Glossary

B.C.

British Columbia

BC Ferries

British Columbia Ferry Services Inc.

BHP

brake horsepower

FMECA

failure modes, effects and criticality analysis

ISM

International Safety Management

m

metre

MLU

mid-life upgrade

mm

millimetre

rpm

revolutions per minute

SMS

safety management system

TSB

Transportation Safety Board of Canada

UNF

Unified National Fine (screw thread)

°

degree