Forum menu
Something I read on an American site said Dali with a full load weighed 116,000 tonnes, at 8kts her stopping distance would be 6000yds/3 miles, or thereabouts. There were ‘Dolphins’ set either side of the channel to act to stop vessels colliding with the bridge. However, they were installed when the bridge was built in 1977, and they’re timber - I don’t know what sort of kinetic energy a 16,000 tonne ship carries when travelling at 8 knots, but I’m pretty certain they would have been hopelessly inadequate at stopping something of that size.
don’t know what sort of kinetic energy a 116,000 tonne ship carries when travelling at 8 knots
About 982 megajoules.
About 982 megajoules.
Or 1346585848 nautical calories.
https://www.nsia.no/Marine/Published-reports/2024-05
Timely publication of the report on the loss of propulsion on the Viking Sky cruise ship, which nearly drifted onto rocks after all three available diesel generators shut down repeatedly in rough seas due to oil starvation.
While human factors related to ignoring oil level alarms are implicated, it’s interesting that their blackout drills never considered a situation where all diesel generators are unavailable, always assuming there’s at least one in standby.
Also of interest is no capability for the Chief Engineer to inhibit the automatic engine shut downs. When the blackout occurred, over a thousand separate alarm messages were generated, none of which were sorted by priority. Compare this to a modern passenger aircraft which identifies the problem and (usually) presents the appropriate steps to take automatically.
The report does praise the actions of the bridge crew who appeared to demonstrate exemplary decision making. And I learnt where the term “to the bitter end” originates.
I don’t know what sort of kinetic energy a 16,000 tonne ship carries when travelling at 8 knots
Lots.
When at university I had a job as crew on the P&OSL Aquitaine when it hit Calais quay at 7 kts. That was enough to put the ship and quay out of action for nearly a year and to ripple the entire car deck for the length of the ship and she was only 28000 tons. There were over 200 injuries on board.
Incidentally, I was also on her a few year later when we had a blackout running parallel to the French coast. The main generator failed and everything shut down including the main engines and the stabiliser system. We drifted for nearly 6 minutes before power was restored and reach a list to stbd of about 34 degrees. That's probably the most scared I have been on any form of transport as the angle from which we wouldn't recover was just under 40 degrees according to the Chief Engineer.
@jonm81 how did Aquitaine’s loss of power lead to such a list? Sounds terrifying!
The stabilisers were in operation and stopped in a position that the direction of the currents and waves as she drifted pushed the ship further over rather than countering the motion.
TheFlyingOx
don’t know what sort of kinetic energy a 116,000 tonne ship carries when travelling at 8 knots
About 982 megajoules.
For those of you not on the metric system, that's 2162 superhans
While human factors related to ignoring oil level alarms are implicated, it’s interesting that their blackout drills never considered a situation where all diesel generators are unavailable, always assuming there’s at least one in standby.
This is similar to the Fukushima nuclear disaster - the reactors survived the earthquake but all the diesel backup generators were knocked out by the tsunami. There were multiple generators, but they weren't dispersed. Having multiple backups doesn't work if they are all vulnerable to the same problem.
Also of interest is no capability for the Chief Engineer to inhibit the automatic engine shut downs. When the blackout occurred, over a thousand separate alarm messages were generated, none of which were sorted by priority. Compare this to a modern passenger aircraft which identifies the problem and (usually) presents the appropriate steps to take automatically.
Similar to the Three Mile Island disaster. The operators just had panels of red lights flashing and alarms ringing. They knew something was wrong, but having every warning going off simultaneously doesn't help them to understand what went wrong and how to deal with it.
Also of interest is no capability for the Chief Engineer to inhibit the automatic engine shut downs.
I'd say there will be very sound reasons for that, I can't think of a scenario where running to destruction would be necessary. That's just bad operation and the fix for that is NOT to just cancel alarms! I'm also not sure how you could implement a system that only the chief can disable, they're designed to be run by whoever is on watch and that's still not going to help at 2am when the generators fall over and everyone is in bed.
In an ideal world you would design a ship using the DRIFTS principle - Diversity, Redundancy, Independence, Fail-safe, Testable & Segregation. They already have the failsafe and redundancy in that there is a blackout generator and multiple generator units but diversity is rarely if ever used and I've never seen proper segregation (compartmentalised into separate locations). Without diversity you're at the mercy of common mode (latent) failure, segregation is supposed to account for common cause failure.
But it all comes down to cost, owners want to pay as little as possible so without legislation to say otherwise nobody is going to design a ship like a nuclear power station.
@thols3 picked up the multiple alarm issue as well, TMI is the classic example that sprung to my mind.
Apparently this is going to be the biggest maritime insurance payout of all time.
Here’s another article with more details and close inspection drone footage from the NTSB:
One thing that’s really obvious and crucial is that the bridge structure played an important role, in particular the points where the main supporting pillars go down to the river bed - they’re nothing more than rows of steel piles driven in with steel and timber cladding around, and they’re just effectively rectangular boxes, there’s little structural mass to them to fend off an approaching vessel, other than a small cargo boat of maybe a couple of thousand tonnes. This caught my attention:
As for the failure, the NTSB chief explained the bridge’s design had a role to play. “It’s a fracture critical bridge,” said Homendy. “What that means is if a member fails that would likely cause a portion of or the entire bridge to collapse.” She noted that unlike modern designs, which prioritize redundancy, the bridge in question had none.
At this stage, the NTSB has determined that 21 crew were present on the vessel at the time of the incident, plus two pilots. Pilots are specialists in navigating local waterways and board vessels for critical transits in and out of port areas. At least six workers are believed dead as per The Washington Post, with two bodies recovered at this stage.
The cargo manifest recovered by the NTSB featured 56 containers of hazardous materials, weighing a total of 764 tons. Most of these materials were in the corrosive or flammable categories, along with miscellaneous Class 9 hazardous materials including lithium-ion batteries. Some of the hazmat containers were breached and a sheen has been spotted on the water in the area.
The NTSB’s Operations and Engineering group boarded the ship, taking in the bridge and engine room. The team has been looking for cameras, CCTV systems, or other downloadable recordings. The search continues, but nothing has been turned up as of yet. The team will be looking at the maintenance history of the vessel and are doing interviews with crew on board.
The Recorders group has had more luck. This group is responsible for “locating, retrieving and downloading any recorder or recorded information that may relate to the accident.” The team has found the voyage data recorder (VDR) and has a printout of the vessel alarms log.
Information from the VDR was successfully recovered on the morning of the accident by the Coast Guard, which was later provided to the NTSB. At this stage, approximately six hours of VDR data is in NTSB hands, covering the period from midnight to 6 a.m. on the night of interest.
NTSB officials have been on board the Dali to capture images, take interviews, and recover evidence.
By regulation, the VDR should record 30 days of history. Homendy notes the six hour period is a “standard timeframe” provided immediately to capture the time frame around the incident. NTSB teams will recover the full 30 days of recording in due time.However, at times during the press conference, Homendy hinted that the full period may not be available. Noting unconfirmed reports of prior outages for the vessel, Homendy didn’t commit to what the NTSB will actually find. “We are going to look at what we can get from the VDR data because there should be 30 days,” she said. “Hopefully we’ll be able to find something in that data if the entire 30 days is there.”
The NTSB chief also pointed out that VDR data is “basic” compared to flight data recorders used in aviation. “An FDR would give you 1000 parameters, that’s not this,” explained Homendy. “VDR is basic, it is a snapshot of the major systems on a vessel.” She notes the NTSB has long wanted more recording and more parameters to be recorded on VDRs for assessment in cases like these.
Muise noted that most sensors recorded by the VDR are from the bridge. This includes GPS data, audio, rudder feedback, and rudder commands. However, more detailed engineering information like the temperature of each cylinder or power distribution status was not recorded on a voyage data recorder. “We are looking for other sources of data in the engine room that would give us that data,” says Marcel. At this stage, the agency noted it’s not clear yet if data is available to determine the cause of the power outage on the ship.
For now, the NTSB has reconstructed a timeline of events based on recordings from the vessel’s VDR. Times are converted to Eastern Daylight Time, and the agency noted the information is preliminary and subject to validation. The VDR recorded limited sensor data including speed, engine rpm, heading, rudder angle, and some alarm information.
The VDR recorded Dali’s departure from Seagirt Marine Terminal at 12:39 a.m. local time. By 1:07 a.m., the ship entered the Fort McHenry channel, and by 1:24 a.m. the ship was underway on true heading 141 in the channel at a speed of 8 knots (9.2 mph) overground. Alarms started ringing at 1:24 and 59 seconds based on audio recorded on the bridge. Around the same time, VDR sensor data ceased recording, while audio kept recording thanks to redundant backup power. At around 1:26 and 2 seconds, the VDR resumed recording sensor data, with steering commands and rudder orders recorded on the audio.
The first open call for assistance appears to have occurred at 1:26 a.m. and 39 seconds, when the pilot made a general VHF radio call for tugs in the area to assist. At this time, the dispatcher for the local pilot association phoned the Maryland Transportation Authority (MDTA) duty officer regarding the ship’s blackout.
At approximately 1:27 and 4 seconds, the pilot ordered the Dali to drop its port anchor and made additional steering commands. Around 1:27 and 25 seconds, the pilot issued a radio call over VHF reporting the Dali had lost all power and was approaching the bridge. MDTA records indicate the duty officer radioed two units already in the area due to local construction at this time, ordering them to close traffic on the bridge. All lanes were thus shut down by the MDTA. Around 1:29 a.m., the speed of ship was 7 knots (8mph). From this moment until 129 and 33 seconds, the VDR audio recorded sounds “consistent with the collision with the bridge” according to Muise. MDTA cameras showed bridge lights flickering out at this time. At 1:29 a.m. and 39 seconds, the pilot reported the bridge was down to the Coast Guard.
Muise noted additional analysis was needed to verify the exact time of impact. The NTSB will convene an expert group to review the recording and develop a detailed transcript of dialogue and event alarms as part of its report.
The Challenge Of The Bridge’s Construction
Homendy noted the Francis Scott Key bridge was built in 1976. It had three spans, with a main span of 1200 feet and a total length of 9090 feet. The average annual daily traffic is 30,767 vehicles per day.
As for the failure, the NTSB chief explained the bridge’s design had a role to play. “It’s a fracture critical bridge,” said Homendy. “What that means is if a member fails that would likely cause a portion of or the entire bridge to collapse.” She noted that unlike modern designs, which prioritize redundancy, the bridge in question had none.
The bridge was in satisfactory condition prior to the incident, according to the NTSB. The last fracture critical inspection was in May 2023. Homendy also noted there are presently 17,468 fracture critical bridges in the US out of 615,000 bridges total, according to the Federal Highway Administration. In due time, the NTSB will analyze all available inspection documents for the bridge. The agency also requested information on pier protection on all MDTA-owned bridges.
The agency’s full investigation is expected to take 12 to 24 months, with a preliminary report out in 2 to 4 weeks. Homendy stated the NTSB won’t hesitate to issue urgent recommendations prior to that time if needed
squirrelkingFree Member
In an ideal world you would design a ship using the DRIFTS principle – Diversity, Redundancy, Independence, Fail-safe, Testable & Segregation. They already have the failsafe and redundancy in that there is a blackout generator and multiple generator units but diversity is rarely if ever used and I’ve never seen proper segregation (compartmentalised into separate locations). Without diversity you’re at the mercy of common mode (latent) failure, segregation is supposed to account for common cause failure.
DP2 or DP3 Classification gives full segregation of systems. Single failure will not result in the vessels ability to hold position. Common in offshore industry and also now in cruise ships and some tankers. Granted not much use in a ship with a single form of propulsion.
As with most things in life, a lot of design decisions come down to £££. Especially when balancing very-low-probability events like this, vs costs of implementing things like dual power paths, segregation, etc across tens of thousands of ships.
The NTSB will of course want a 1000 channel, 100 samples a second recording rate, etc data recorder. Because they don't have to pay for it.
Shipping is also notorious for it's worldwide adoption of the race to the bottom principle - hence all the dodgy boats registered in Panama, Belize, etc. There's a whole lot of shit rotten boats out there on the seas.
(Here's a simple comparison- how many cars have full rally or race level roll cages or 5 point harnesses ? Definitely safer. But... maybe 1 in 10,000 and then that's in an enthusiast's car).
@paladin I exited long ago, newest ship was 2003 vintage! Glad to hear they're catching up.
And yeah, if they can save money they will. Look at the trash they use as fuel at sea.
they’re nothing more than rows of steel piles driven in with steel and timber cladding around, and they’re just effectively rectangular boxes, there’s little structural mass to them to fend off an approaching vessel, other than a small cargo boat of maybe a couple of thousand tonnes. This caught my attention:
You wouldn't design a bridge so the structural components would resist any significant ship impact. The competing criteria is to great. It's the same principal as squirrel king is getting at.
You build the bridge efficiently to hold up, the bridge in question achieved that but Apparently it's a simple structure (determinate, each component is required very easy to design) rather than a complex structure (indeterminate, you can remove one or more components and the structure stays up or fails very very slowly, if thr deck was cantilevered AND supported by the piers, lots more complicated to design, requires modelling and much more complex techniques). It's weird seeing a bridge like that built when it was, I'd expects something that looks more modern, particularly suspension, not sure why, maybe Tacoma Narrows and Silver Bridge disasters making a reluctance.
Then you worry about the ship impact using mass, energy absorbtion (plastic or elastic deformation), deflection and separation preferably a combination. Essentially you don't let the ship hit the delicate bits.
What's weird is they KNOW there is a risk, they have fenced the cable pylons right next to the bridge. On a navigable bridge crossing a massive access to a huge container port this incident is completely foreseeable. Which makes the loss of life that little bit more tragic. I've alluded to it previously but America's record on bridges is quite shocking!
Being educated in a subject under discussion on the internet really gives you perspective on how low quality internet forum chat can be. Makes you want to switch off and do something worthwhile instead........
Is that directed at me? I'm educated ish on a subject. I just might not be very good at my job 😀
And I can write a mean DRA.
As I'm not educated in the subject so I haven't contributed, Waderider, but have found some posts and some of the links compliment well what I've seen in the press and on TV. Multi21's link to the Pistonheads Captain's post explains why the ship turned and Squirrelking's anchor comments explained why an anchor wouldn't have stopped it in time even if deployed.
So from STW I have it that some sytems blipped but not for long, however, someone panicked and reversed engines which caused the boat to veer right into the bridge. Oops.
Being educated in a subject under discussion on the internet really gives you perspective on how low quality internet forum chat can be. Makes you want to switch off and do something worthwhile instead……..
And yet here you are, being educated in a subject under discussion, posting something that is (well, was) arguably the lowest quality contribution in the thread.
I hope sneering at the uneducated peasants made your day better.
however, someone panicked and reversed engines which caused the boat to veer right into the bridge. Oops.
Not necessarily…
Yes prop walk is absolutely a thing, that’s not in doubt, but it just so happens that the Dali started turning just as the Curtis Bay Channel meets the main channel. This would have had had an interaction effect on the ship, pulling it to starboard (due to drop in pressure where there is no bank). This effect would happen anyway in normal circumstances and you’d steer away, but this is also the point of the power outages so maybe they couldn’t.
Good little explanation here:
And the interesting contributions continue. 🙂
It’s weird seeing a bridge like that built when it was
I'd been thinking this too. It was built very close to the time of the Tasman Bridge disaster.
Or 1346585848 nautical calories.
That’s about one and half Finniston Stonners.
[blockquote] I’d say there will be very sound reasons for that, I can’t think of a scenario where running to destruction would be necessary. [/blockquote]
In this situation the choice would be between running the engine with intermittent loss of oil pressure or drifting into a rocky shoreline under a severe gale and losing the ship. I know which one I’d choose.
@flaperon Also sure I read something about flying stations and the need to keep the ship moving forwards no matter what, until the aircraft were recovered or diverted.
I'm a marine engineer and this caused long discussion in the office yesterday, the consensus reached was that the auxiliary DG tripped and caused a blackout resulting in loss of steering and the turn probably caused by a combination of current/windage and possibly the rudder being locked in an off-centre position when the blackout happened.
The only time I've ever seen smoke like that was when a turbocharger suffered a catastrophic failure. You wouldn't see that much from a normal start up or reversing a two-stroke engine.
So DG breaks, blackout occurs, loss of steering and subsequent impact. As someone mentioned above these ships will have 3-4 diesel generators but as far as I know there's no requirement for two to be online when manoeuvring, its best practice but not code. Alternativly it could have two online and one failed and the load-shedding process didn't function as it should, causing the other to trip. The emergency DG should be capable of accepting loads very quickly (~45 seconds), but that might have no functioned as intended or it was simply too late.
Of course the above is entirely speculation based on the grainy videos of the collision so I may be way of the mark.
In this situation the choice would be between running the engine with intermittent loss of oil pressure or drifting into a rocky shoreline under a severe gale and losing the ship. I know which one I’d choose.
Yes but building a facility to override safety/integrity critical alarms rarely goes well as it would just be abused. The emergency generator serves this purpose and will likely have less automatic protections for this reason.
The only time I’ve ever seen smoke like that was when a turbocharger suffered a catastrophic failure. You wouldn’t see that much from a normal start up or reversing a two-stroke engine.
Yeah, either that or the auxy blowers weren't running and they tried to struggle through a manual start from the engine side. Time frame is about right that they could have got the manual governor engaged if it was an MCC, I don't know how that's done on an electronic camshaft type but again, speculation.
It's only the emergency generator that is designed to run to destruction, IE it has no protection systems fitted.
There should never be overrides fitted to any protection systems on either Main Engines or Auxiliary generators.