Serious safety issues have been revealed about failures in human-machine interaction to safely navigate ships and watercraft of all kinds around the ocean.
The issue came to light in an Australian Transport Safety Bureau (ATSB) investigation report “Grounding of ABFC Roebuck Bay.” The report details how and why a highly qualified, experienced and well-rested crew of a Border Force cutter managed to run aground on the very well-known and very well-charted Henry Reef inside the Great Barrier Reef Marine Park.
Although the Roebuck Bay is a law enforcement vessel, the underlying safety issues are relevant to maritime navigation around the world. As the ATSB points out, there have been at least six merchant ship groundings in the last few years that had “common recurring themes.”
All of these groundings had one factor in common: incorrect use of the globally mandated “Electronic Chart Display and Information System.” This is commonly known as “ECDIS.” ECDIS integrates electronics, software and maritime charts. It superimposes data on the charts such as a vessel’s position, planned passage, velocity and so on. There are numerous makers of ECDIS systems and, in practice, several different update versions (although they’re all supposed to be updated with the most up-to-date charts and data).
By the late 1990s, computers could adequately display real-time navigation information. It was potentially a huge boon for navigation – navigators could easily keep their charts up-to-date in less time and with less chance of error. Recognising the advantages of ECDIS, the International Maritime Organization mandated that, by July 2018 carriage of ECDIS would be required for nearly all passenger ships and cargo-carrying ships.
Grounding of the Roebuck Bay
On September 13, 2017, the Australian Border Force Cutter Roebuck Bay left the port at Cairns, in far north Queensland, to carry out a routine three-week patrol northwards to the Torres Strait (the body of water between Northern Australia and Papua New Guinea).
On September 26, the cutter was at anchor near Sabai Island, which is Australian territory despite being only 2.4 miles off the Papua New Guinea coast.
The navigation officer worked out a passage plan for the return voyage to Cairns. The officer presented the plan to the master who reviewed and amended it.
Unfortunately, his amendments resulted in the cutter’s passage plan being laid directly over Henry Reef.
On September 29, just before 10:00 a.m. local time, the Roebuck Way got underway heading for Cairns. Nothing of significance happened throughout the day as the cutter’s autopilot followed the passage plan as saved in ECDIS.
Nothing significant, that is, until 00:25 (12:25 a.m.) on September 30, at a speed of about 16 knots (about 18.4 mph) when, in the words of the ATSB report, “the bridge team felt a bump and a shuddering sensation through the cutter’s hull. Almost immediately after, ABFC Roebuck Bay abruptly grounded on Henry Reef and came to a complete stop. The OOW [officer of the watch] and lookout were thrown out of their seats onto the display screens in front of them.”
The cutter master, who was asleep in has cabin, woke up because of the grounding, went to the bridge and mustered the crew. No one was injured. The cutter was rendered unseaworthy and had to be rescued by specialised salvage craft.
Safety findings of the investigation
The Roebuck Bay had a wide range of appropriate navigation equipment on board including Global Positioning Satellite receivers, radars, gyro-compass and so on. The master was well qualified with appropriate certification and 27 years of sea experience.
The navigation officer also had his marine tickets and about 21 years of sea experience in a wide variety of roles.
All the crew had certificates of competency; they had also been audited for competency by the Border Force, and they had completed both general and specific ECDIS training.
Yet they still ran aground on a known and well-charted reef. And one that the ECDIS system had actually highlighted as being a dangerous hazard to their navigation.
Fatigue was eliminated as a potential cause of the accident.
So what went wrong?
When this particular version of ECDIS checks the planned passage it does so in two different ways at the same time. Firstly, it validates the route’s geometry (such as, for instance, the turn radius of the vessel). These errors are highlighted as a yellow-colored tab on a dark background. ECDIS will not allow an error-containing route to be used until it is fixed. Route-validation does not check for dangers.
The route dangers safety check does look for hazards to navigation that might intersect with the planned route. But ECDIS allows routes to be saved, loaded and used even though hazards to navigation pose a threat to the vessel. Hazards to navigation that intersect with the passage plan are saved in a “dangers” folder separate from the “errors” tab.
When the cutter master saved the amended route, the error in the route (an incorrect turn radius) was highlighted in yellow by the route validation process. When the incorrect turn radius was fixed, the error note disappeared.
Both the cutter master and the navigator wrongly thought that this process also checked for dangers. So both officers therefore thought that there were no dangers on their planned route. They didn’t check the “dangers” folder in the other part of the software.
“It was almost certain that Henry Reef was identified as a danger by the ECDIS… this was confirmed during ATSB testing,” the report reads.
The officers also wrongly believed that ECDIS would not allow them to save a dangerous route.
Symbolic confusion
A further problem was that computerised charts introduced a new “isolated danger symbol”. It shows potential hazards to navigation in waters that are otherwise thought to be safe. The symbol is a purple-ish circle with a white cross. Australian nautical paper charts show that kind of hazard as a five-pointed green star.
Unfortunately, the master and navigator did not have a complete awareness of the new computerized isolated danger symbol. And so they didn’t immediately recognize it as a hazard to navigation.
“When [the master and navigator] subsequently checked the paper chart of the area… they reported an immediate awareness of the reef. They attributed this to the green, star-shaped, coral pinnacle symbol that represented the reef on the paper chart… This symbology and colour was familiar to them (probably due to their considerably longer use of paper charts in their careers)… The officers’ understanding of the isolated danger symbol was that it represented a rock, wreck or obstruction but not necessarily one that was dangerous to the navigation of their cutter. However, Henry Reef displayed as an isolated danger symbol to warn the mariner that a potential hazard to navigation existed in waters that were otherwise considered ‘safe’,” the ATSB said.
Look-ahead and listen
IMO rules require ECDIS systems to “look-ahead” on the passage plan and alert crew if it detects dangers from hazards to navigation. The default setting was for 15 minutes ahead. However, the Australian Border Force had reduced that to about three minutes ahead.
The look-ahead feature was also set by default to scan for hazards to navigation up to about 65.6 feet either side of the cutter. The Australian Border Force added an extra 65.6 feet as a safety buffer. The idea is that any dangers outside of that zone can be safely ignored as the vessel would not strike them.
But ATSB tests showed that it was possible for the look-ahead feature to fail to detect the isolated danger symbol when its sensitivity was set at a few tens of feet either side of the vessel. In that situation, the look ahead feature might completely fail to see the isolated danger symbol and a vessel could crash into the furthest reaches of a hazard to navigation. But the look ahead feature would have detected the isolated danger symbol if the width setting of the scanning zone was a lot wider, say, 606 feet.
And then an alarm could have sounded.
But even that would not have saved the cutter because the “audible alert buzzer of ABFC Roebuck Bay’s ECDIS was permanently silenced,” the ATSB found.
The cutter master had ordered alarms to be silenced to reduce “alarm fatigue” and to prevent alarms from distracting officers during their watchkeeping.
The ATSB also found that the cutter was using an old version of the computerised charts and software. The enhanced safety features of the most up-to-date version “would have potentially alerted the officers to the danger produced by the reef.”
Ultimately the ATSB concluded that the crew did not have an adequate level of knowledge to operate their ECDIS as their primary means of navigation. And they did not have that knowledge largely due to ineffective training by the Australian Border Force.
Wider applicability
This grounding, and others like it around the world, have raised concerns about the safety of using ECDIS, especially as the IMO has mandated the use of ECDIS around the world.
For example, in June 2017 the box ship Kea Trader grounded on an isolated danger (a well-known reef) in the Pacific Ocean after an amendment to a passage plan in ECDIS. An almost identical grounding happened on the other side of the planet in December 2016 when a bulker, Muros, ran aground off the coast of England on an isolated danger (a submerged but well-charted sandbank) after the alteration of a passage plan in ECDIS.
There are several more examples such as the groundings of the ships Universal Durban, Nova Cura, Ovit and the CFL Performer.
Concerns raised with ECDIS systems include issues with alarms (and the ability to disable them); duplication of alarms; difficulties with the way in which information is presented; variation in the quality of training; diminished traditional skills owing to reliance on ECDIS and automatic radar plotting; variation in understanding among certified officers; and gaps in knowledge of symbols.
Two marine accident authorities, one in the U.K. and the other in Denmark, are carrying out an international study into the problem. They are due to report this year.