NTSB Accident Report, Data Entry Error

[anorlunda]

On September 8, 2019, the 200m long vehicle carrier ship Golden Ray (carrying 4067 Kia, Chevrolet, GMC, GM, Mercedes-Benz, and Ram vehicles) capsized in St. Simons Sound, Georgia, USA The accident caused the loss of a $62 million ship, $142 million in lost cargo, and $250 million in salvage costs. Fortunately, no-one was injured or killed. Only recently were the last remains of the wreckage removed from St. Simons Sound.

The NTSB report https://www.ntsb.gov/investigations/AccidentReports/Reports/MAR2103.pdf

Cause of the accident was insufficient water ballast, causing a too high center of gravity. The report says:

The chief officer made errors with the ballast tank level data entry into the shipboard stability calculation computer (LOADCOM), which led to his incorrect determination of the vessel’s stability.

The operator did not have a method in place to ensure that the chief officer was proficient in using the shipboard stability calculation computer (LOADCOM) to perform his duty of calculating the ship’s stability.

The operator’s lack of oversight and procedures for auditing and verifying the accuracy of their officers’ vessel stability calculations before departure contributed to the Golden Ray not meeting international stability standards.

My conclusion: modern technology is not a cure for operator error, nor can it ever be.

 

[jedishrfu]

This is reminiscent of the Air New Zealand tourist flight that crashed into Mt Erebus Antarctica in 1979. Initially it was blamed on pilot error, but then an inquiry discovered way-points were incorrectly entered into the flight's navigational computer and the flight crew wasn't informed of the change.

https://en.wikipedia.org/wiki/Mount_Erebus_disaster

The flight was a tour of Antarctica and then back to New Zealand.

 

[Vanadium 50]

Or AC143.

 

[sandy stone]

I used to work in the control room of a medium-sized oil refinery. I can confidently say that more than one process unit was inadvertently shut down due to the control board operator fumble-fingering a setpoint entry. Needless to say, sanity checks were quickly implemented in the process control software.

 

[hutchphd]

My conclusion: modern technology is not a cure for operator error, nor can it ever be.

I do not disagree, but the system design here is terrible. Why would anybody implement a system without cross-checks? For instance "close the loop" by correlating the ballast weight to loaded freeboard...a single additional datum. This is very bad systems engineering. One should always expect operator error.
The airplane jet fuel metric snafu (don't forget the Mars polar thingy) are a bit more problematic and beg the question: How many warning labels should you need on a stepladder ?

 

[anorlunda]

Why would anybody implement a system without cross-checks?

The report says that the LOADCOM computer did have automated data gathering. The calculations may also have had cross checks. But the chief officer put it in "manual" mode which turns off some of those features. Therefore, the report can not be used to conclude bad design.

The other element is cross checking by other people. In #1, the report says that they failed to assure such cross checks were done.

Some types of human errors can be eliminated by eliminating human operators. But the discussion about self driving cars shows that majority opinion is that we are not yet ready for that.

Here is the relevant passage from the report.

The chief officer entered the IMACS data for the ballast, fuels, and fresh water as well as the cargo weight into the LOADCOM computer to calculate the vessel’s center of gravity. Although the LOADCOM computer was capable of automatically receiving IMACS data (such as ballast tank levels), according to the chief officer, he manually entered the necessary data from the IMACS into the LOADCOM computer. The IMACS also had a GM measurement feature that, if used, automatically transferred ballast to heel the vessel up to 1° to either side and measured the quantity of ballast transferred to calculate the ship’s GM. The postaccident review of the IMACS data revealed that the GM measurement program was not used before the vessel departed on the accident voyage from Brunswick. The LOADCOM computer did not calculate the vessel’s vertical center of gravity (KG)—that is, the distance from the bottom of the hull (or keel) to the center of gravity.

The operator’s SMS provided the following guidelines for using the LOADCOM computer: “the stability as calculated by using [LOADCOM] must be OK condition and above the IMO required Min. GM for that condition.” Once the chief officer finalized the stability calculations using the LOADCOM computer, he reported to the master the vessel’s GM, which he calculated to be 2.45 meters (8.3 feet) (and which he reported the LOADCOM said “was ok”), and draft, which he determined to be 30.8 feet (9.4 meters) forward, 30.9 feet (9.3 meters) midships, and 31.2 feet (9.5 meters) aft (the same fore and aft drafts reported by the pilot in the master/pilot exchange). The master, who was required by the operator’s SMS “to be satisfied that the ship has sufficient stability at all times,” did not review the chief officer’s calculations or report any issues with the chief officer’s calculations to the company.

 

[hutchphd]

Clearly these guys require many warning labels on their stepladder. My standard restatement of your conclusion is "You Can't Fix Stupid".
But does this argue for more intrusive automation or more attention to human factors? Truly I don't know

 

[valenumr]

I do not disagree, but the system design here is terrible. Why would anybody implement a system without cross-checks? For instance "close the loop" by correlating the ballast weight to loaded freeboard...a single additional datum. This is very bad systems engineering. One should always expect operator error.
The airplane jet fuel metric snafu (don't forget the Mars polar thingy) are a bit more problematic and beg the question: How many warning labels should you need on a stepladder ?

ships often have two tone paint jobs. Or sometimes a big fat stripe painted on the hull. That's where the waterline should be more or less... One just has to look outside and make sure the boat isn't floating too high or too low. Cargo vessels can have weird centers of gravity though, as well as significant wind resistance.

 

[russ_watters]

One just has to look outside and make sure the boat isn't floating too high or too low.

I wonder if that's visible from on the ship though? Maybe if you lean over a bridge wing?

Still, along the same lines I would think the captain/crew would be able to feel it unless it was exceptionally calm.

 

[anorlunda]

I wonder if that's visible from on the ship though? Maybe if you lean over a bridge wing?

Still, along the same lines I would think the captain/crew would be able to feel it unless it was exceptionally calm.

The lines on the hull reflect the total mass of ship plus cargo. But the center of gravity also depends on how high the cargo is. For example, moving a car from the bottom car deck to the top car deck, keeps the mass constant but raises the center of gravity.

The NTSB report does note that the river pilot did sense the instability, but he sensed it too late to do anything about it.

The canonical example is the famous ship Wasa that has been raised and is in the Wasa Museum in Stockholm.

http://thegreatoceanliners.com/extras/the-royal-warship-wasa/
In 1627, the Wasa was launched, and the following year she was moved to receive her ballast and cannons. All together, Wasa’s cannons weighed over 81 tons, all above the surface inside a wooden ship. A stability test done on all new ships was carried through. It consisted of letting thirty men run from the port side to the starboard side, back and forth. The rolling motion that then occurred was so alarming that the test had to be stopped.

 

[berkeman]

It consisted of letting thirty men run from the port side to the starboard side

Good thing they weren't Polish. And on an airplane...

(Sorry, EE humor there)

Spoiler

Having all of your poles in the right-half plane leads to instability and oscillations...

 

[anorlunda]

Good thing they weren't Polish.

On that day, they were honorary Poles.

 

[jedishrfu]

If there had been farm animals present it would have been the barn pole paradox.

 

[Mike S.]

I don't know anything about ships, but think about how your brain is set up. There's a special set of glutamate-secreting neurons in your prefrontal lobe that keeps track of self-preservation independently of other activities. People using psychedelic drugs get all kinds of weird ideas in their heads, but they still report a "watcher" that makes sure they don't do something genuinely nuts. (People on PCP, on the other hand, say the "watcher" goes away...)

Whatever system is used to determine the ballast, there ought to be some other system that continually measures the g-force from turning at the top and the bottom of the boat. The sensor should be very precise but it would basically see if there's a "tippy canoe" feeling, the same as you would if you were standing in a rowboat. It should only make itself known if there's something hinky.

 

[anorlunda]

Whatever system is used to determine the ballast, there ought to be some other system

Good thinking, but that "other" system really used is for other people to cross check.

Stability is something that marine architects study a lot.
https://www.marineinsight.com/naval...bility-understanding-curves-static-stability/
Here is the righting moment, versus angle of heel (tilt).

The automated system you hypothesize might measure the righting moment in real time. It could use a model of the ship's FBD (free body diagram), compare it to real time measurements, and then estimate the critical model parameter. It would make a good postgrad project. Other automated fault detection systems use that basic strategy. GE aircraft engines report suspected engine problems back to GE by satellite.

It would make a good student project to try to make a monitoring system as you suggest. I would be surprised if it hasn't been investigated before. I suspect that the reason it is not used is signal to noise ratio. Here's some real time data from the Golden Ray incident. Not shown are wind speed and angle, tidal current speed and angle, the depth under the keel, and wave action.

At time 0136:58, the pilot asked, “what’s the GM [metacentric height] on this thing?”. That's when the "tippy" feeling was first noticed. Could the computer have done it faster?