Marine Investigation Report M98F0023

The Canadian-registered passenger hydrofoil Seaflight I, with eight passengers on board, was travelling up the lower Niagara River. Near the Youngstown Yacht Club mooring area, the vessel's rudder swung, uncommanded, hard to port. Despite attempts to regain steering control, the vessel veered to port and struck four pleasure craft moored off-shore. The Seaflight I was not damaged; however, one pleasure craft was sunk. No one was injured and there was no pollution.

The Seaflight I is a 138-passenger hydrofoil of welded aluminum alloy hull and superstructure. The forward and aft, upper and lower foils are constructed of stainless steel. The bridge is located forward and the machinery space aft. Main propulsion power is from two high-speed diesel engines driving highly skewed propellers through "V-drive" reduction gears.

The Seaflight I departed Toronto on August 29 at 1800 eastern daylight time (EDT) ^{Note de bas de page 2} with eight passengers on a regularly scheduled voyage to Queenston, Ontario. The lake crossing was uneventful and the vessel crossed the Niagara River Bar and proceeded up the American side of the Niagara River at a speed of 33 knots (kn). At 1858, as it was passing 60 m off the mooring area of the Youngstown Yacht Club (YYC), the rudder swung uncommanded to port. The master, who had conduct of the vessel, switched to the backup steering pump and then the backup steering system. The mate put the engines full astern and began to sound the danger signal on the ship's horn; however, only three blasts of the horn were sounded before the Seaflight I entered the mooring area at an angle of approximately 45 degrees.

As the vessel approached the moorings, the master noted six people on board a yacht and purposely allowed the hydrofoil to continue to port to avoid striking this vessel, even though it meant colliding with four other unoccupied sailing yachts. The sailing yacht Awakin was damaged by the forward port lower foil and remained hung-up on foil before sinking in 21 m of water approximately three minutes after the collision. Since then, the Awakin has been salvaged and declared a constructive total loss. No one was on board any of the moored vessels, and there were no injuries.

The Seaflight I broadcast a Mayday call on very high frequency (VHF) channel 16, as did the YYC tender Half Moon. Canadian Coast Guard Search and Rescue boat CGR 100 heard the distress call and arrived on the scene three minutes after the collision. The Half Moon immediately proceeded to the Seaflight I to offer assistance and checked the other moored vessels involved in the collision for injured crew. Before the Awakin sank, the master of the tender noted that the main hatch was closed and locked from the outside, and that his manifest indicated that no person was on board.

The Seaflight I was towed to an anchorage at the mouth of the Niagara River, where it was boarded and inspected by United States Coast Guard (USCG) inspectors. Inspection revealed that the electronic-hydraulic steering system would only function intermittently, and continually went hard to port. The electric-hydraulic backup system functioned correctly.

At 2230 the passengers were transferred from the Seaflight I to the CGR 100 and transported to their original destination at Queenston. The electronic-hydraulic steering system was still not functioning but the Seaflight I departed Youngstown at 2340 bound for Toronto, using the backup electric steering control system.

At the time of the occurrence the wind was from the north-northwest at 10 kn and visibility was approximately seven miles.

The Seaflight I routinely used the American side of the Niagara River on her passages to Queenston because of complaints from the marinas on the Canadian side of the river. Although the Seaflight I leaves very little wake when travelling in the foil-borne mode, it is reported that an underwater "shock wave" radiates outwards from the vessel. When travelling in displacement mode, a large wake is left unless the vessel is slowed to dead slow ahead. Before the occurrence, the USCG had also received numerous complaints from American residents and boat owners, noting that the vessel passed consistently within 23 m of the outer edge of the moorings. The USCG had conveyed these concerns in several letters to the hydrofoil's operator, the last being sent the day before the occurrence.

Following the return voyage to Toronto, the operator's chief engineer, upon seeing the malfunction, indicated that he knew what the problem was and immediately went to the gyro room. There, he identified a control board in the electronic-hydraulic control system which showed signs of overheated diodes and replaced it with a spare. During sea trials of the vessel attended by the TSB and Transport Canada Marine Safety (TCMS) staff, this damaged board was put back into service; however, the problem did not recur.

There are no domestic Canadian regulations for the inspection of high-speed vessels. Until regulations can be developed, the Board of Steamship Inspection has allowed the use of the Code of Safety for Dynamically Supported Craft (DSC Code), ^{Note de bas de page 3} and the International Code of Safety for High Speed Craft (HSC Code) for inspecting high speed craft.^{Note de bas de page 4}

The DSC Code was prepared by the IMO in 1977 to facilitate research and development of dynamically supported craft so that they would be accepted internationally. It was predicated on the idea that the traditional method of regulating passenger ships should not be accepted as the only possible way of providing an appropriate level of safety. Over a period of 30 years, new vessel designs had been developed which could not fully comply with existing safety conventions. These vessels, however, had demonstrated an acceptable level of safety when operating on restricted voyages under approved maintenance and supervision schedules.

The HSC Code was prepared by the IMO in 1994 as an update to the previous DSC Code. The safety philosophy of the HSC Code is based on the management of risk through accommodation arrangement, active safety systems, restricted operation, quality management, and human factors engineering. An example of this philosophy is the newest high speed craft to begin operation in Canada, the British Columbia Ferry Corporation's Pacificat Explorer. As a condition of her certification, the Pacificat Explorer is required to carry a "route operational manual" which, amongst other requirements, outlines safe voyage tracks for the vessel.

Following a 1992 occurrence involving a collision between the high speed ferry Royal Vancouver and the conventional ferry Queen of Saanich, the TSB made several recommendations respecting: Passenger Safety (Recommendations M94-23, M94-24, M94-25 and M94-26), and Operational Guidelines/Training (Recommendations M94-27 and M94-28). TCMS agreed with the recommendations and, referring to the forthcoming HSC Code, indicated that "the HSC Code deals with all aspects of ships such as the Royal Vancouver." As the HSC Code does not apply to vessels operating in the Great Lakes, TCMS inspected the vessel under the provisions of the older DSC Code, which did not require an approved "route operational manual" to be on board. TCMS did participate in sea trials during the two months prior to the vessel's certification, during which the vessel used the American side of the Niagara River without steering problems.

The Seaflight I was certified to carry 138 passengers and 5 crew members on voyages across western Lake Ontario, not more than 23 miles from a port of refuge. When travelling at full ahead in the foil-borne mode, operation of the vessel is restricted to conditions where wave heights are 3 m or less. In this mode and at this speed, the vessel has a maximum stopping distance of 335 m. The Permit to Operate a High Speed Craft (SIC 54), issued 16 June 1998, had expired 28 August 1998 (the day before the occurrence) and, as a result, the vessel did not have a valid certificate at the time of the occurrence.

Because hydrofoil technology is new to Canada, few ship's officers have experience in the operation of such vessels. Canada has not yet included high speed craft/dynamically supported craft (HSC/DSC) in the certification regulations. The vessel's owners have nonetheless voluntarily agreed to follow the HSC Code for crewing. The Ontario, Maritimes, and Western regions of TCMS are issuing HSC endorsements for masters, mates, and engineers. At the time of the occurrence, the ship's officers had been trained by Russian officers experienced in the operation of this type of vessel, and been issued appropriate HSC endorsements after examination by TCMS.

Steering System

The steering system on the Seaflight I consists of double-hydraulic rams powered by constant-flow hydraulic pumps mounted on the main engines. Normally, one pump is used, with a second pump available in the event of failure, or when the stabilizer flaps are in service.

Steering control from the bridge consists of three systems:

1. Electronic-hydraulic
   
   

   This system is used as the main steering and operates as a follow-up system, i.e., the rudder will move a distance corresponding to the movement of the wheel and then stop. An electronic signal from the bridge operates two solenoid valves in the steering compartment directing hydraulic fluid to the appropriate ram. An electric rudder-angle indicator sensor, mechanically linked to the tiller head, provides position information for the follow-up circuit and the bridge rudder-angle indicator. No alarm is fitted to indicate a loss of electrical power to the electronic control.

   When the vessel is travelling at speeds below 24 kn, the rudder may travel up to its maximum of 35 degrees port and starboard. As the vessel's speed increases beyond 18 kn, the rudder angle is limited to 10 degrees. This feature limits the hydrodynamic forces on the rudder to an acceptable level and ensures stability of the vessel while travelling at high speed in foil-borne mode.

2. Electric-hydraulic
   
   

   This system consists of two push buttons which, when pressed, directly energize the solenoid valves and direct fluid to the appropriate hydraulic ram. To operate this system, the main electronic steering is turned off and a toggle switch is actuated in the cockpit. A light indicates that the system is on. A second change-over switch is available in the steering flat (provided with a protective guard) and each solenoid valve has a manual push button to allow local control.

   Common to both the electronic and electric steering control systems are the solenoid valves, which direct hydraulic fluid to the appropriate cylinder upon receiving a signal from the bridge.

3. Direct manual
   
   

   A direct manual telemotor system is available using the wheel on the bridge. The wheel turns a rotary pump, which transmits a hydraulic signal directly to the steering rams.

The Steering Appliance and Equipment Regulations and the Machinery Regulations of the Canada Shipping Act provide detailed requirements for steering gear systems on Canadian vessels; however, the provisions of the Canada Shipping Act do not apply to hydrofoils such as the Seaflight I. Instead, TCMS inspected the vessel under the provisions of the DSC Code, which states in part:

The administration should determine by demonstration any adverse effects upon safe operation of the craft in the event of uncontrollable total deflection of any one steering device, and should prescribe any limitation on the operation of the craft as may be necessary to ensure that the redundancy or safeguard in the systems provide equivalent safety. ^{Note de bas de page 5}

The troubleshooting manual provided by the manufacturer of the steering control system indicates several possible scenarios which would cause the rudder to move hard over in either direction without warning:

• no pressure in the hydraulic system;
• faulty fuses in the "Biryuza" electronic steering control;
• faulty rudder-angle position sensor and feedback circuitry.

In addition to these, the electronic steering control system is designed such that the rudder will swing uncommanded to starboard or port when the power is re-established after a momentary interruption. This is a self-test function of the steering system. The Seaflight I was tested for a period of two months prior to certification, without steering problems. However, tests conducted by TSB and TCMS representatives at sea on 23 March 2000 confirmed that a power interruption for as little as one second will initiate this self-test and result in an uncommanded rudder movement of 10 degrees to port or starboard. During high speed trials in foil-borne mode this uncommanded rudder movement resulted in the vessel sheering quickly off course. Tests conducted by simulating faulty fuses, however, did not result in rudder movement.

The electronic steering control system of the Seaflight I has no audible power failure warning alarm, but is equipped with indicator lights for the availability of 220 V and 27 V steering control power. An alarm to indicate failure of the steering hydraulic system is provided; however, at the time of the occurrence, it did not sound.

Inspection by the TSB also noted that the rudder-angle indicator operates only when power is applied to the main electronic or electric steering control systems. When control is switched to the manual backup steering, there is no rudder-angle indication. No written instructions for steering system change-over are displayed at the conning position on the bridge.

Although the master has overall command of a vessel, a basic premise of modern safety management is that shore management has the ultimate responsibility for setting policies, procedures, and operating instructions for the safe operation of the entire enterprise. The introduction of a safety management system requires that a company develop and implement safety management procedures to ensure that conditions and activities, both ashore and afloat, affecting safety and environmental protection are planned, executed and checked in accordance with regulatory and company requirements. A structured system also enables the company to focus on the enhancement of safe ship operations and on preparing for emergencies. Companies that are successful in establishing a safety management system may expect to see a reduction in accidents.

The safety philosophy behind the HSC Code is based, inter alia, on the management and reduction of risk through quality management, and goes on to state that "the management of the company operating the craft exercises strict control over its operation and maintenance by a quality management system."^{Note de bas de page 6} The HSC Code, however, does not apply to high speed vessels operating within the Great Lakes.

For the Seaflight I, the establishment of a company quality management system incorporating formal approved procedures, in particular for voyage planning, might have provided better guidance to the vessel's crew when conducting the vessel within the confined waters of the Niagara River.

The design of the electronic steering control system limits the rudder angle to 10 degrees; however, at the time of the occurrence, the rudder moved hard to port (32 degrees). This indicates that the electronic control was not functioning correctly at the time. The uncommanded rudder movement is more indicative of the self-test function, which puts the rudder hard over to port or starboard following a power interruption to the electronic steering system. Because the electronic steering control system is not equipped with an alarm warning of power failure, the bridge crew would not have been aware that an interruption to the control system power supply had occurred until they moved the wheel or when the power supply was re-established and the rudder moved uncommanded.

Subsequent to the occurrence, the electronic control system remained unserviceable and, as a result, the electric-hydraulic control system was used during the return trip to Toronto. The fact that the steering solenoid valves (which are the common factor between the two control systems) were functioning properly is a further indication that the steering malfunction occurred within the electronic control system.

The DSC Code states that the administration should determine by demonstration any adverse effects upon safe operation of the craft in the event of uncontrollable total deflection of any one steering device. The electronic steering system on board the Seaflight I is a complex control system that integrates information from the vessel's log and stabilizer system to limit the vessel's rudder movement to design limits. A more detailed examination of the electronic steering control characteristics (as they relate to vessel manoeuverability) at the time the vessel was inspected, would have revealed the undesirable self-test inherent in the electronic steering control system, and elicited a better understanding of the vessel's limits by TCMS.

Despite numerous complaints from residents and warnings from the USCG, the Seaflight I routinely passed within 23 m of the mooring area. Prudence would dictate that an adequate distance be maintained from possible hazards to navigation; however, at the time of the occurrence, the Seaflight I was approximately 60 m from the moored yachts.

Taking into account:

• the vessel's stopping distance of 335 m at 33 kn (17 m/sec);
• the time required for the crew to recognize the failure and change steering control modes; and
• the rudder response time (five seconds for the rudder to go from hard-over to midships using the electric steering control);

the proximity of the moored yachts was such that the Seaflight I could not have avoided striking them once the rudder had moved, uncommanded, hard to port.

The Niagara River is 550 m wide at Youngstown, New York; however, with the mooring area of the YYC taken into account, the usable width of the river is 365 m. Given the vessel's required stopping distance of 335 m, the river is not wide enough to allow the vessel safe passage at 33 kn in the foil-borne mode. A voyage route operational manual, similar to those required on other HSC, could have required the vessel to follow a course closer to the middle of the Niagara River, in displacement mode, giving the crew more time to regain steering control or stop the vessel.

1. Because theSeaflight I operated within the Great Lakes, it was inspected under the provisions of the DSC Code and, as a result, there was no requirement for the company and vessel to have a safety management system.
2. No fixed voyage speeds or routes were required for the vessel as a condition of her certification.
3. Before the occurrence, the Seaflight I routinely passed close to the mooring area of the Youngstown Yacht Club.
4. The Seaflight I was upbound in the Niagara River in foil-borne mode travelling at 33 kn, approximately 60 m from the mooring area at the time of the occurrence.
5. Travelling at 33 kn, the Seaflight I has a stopping distance of approximately 335 m.
6. The action of the master of the Seaflight I to avoid a yacht with six people on board mitigated the consequences of the occurrence and prevented injuries.
7. Following the occurrence, the main electronic steering control system was found to be functioning erratically; however, the backup electric steering control was working properly.
8. The service manual for the electronic control system clearly lists several failure modes which could cause the rudder to move uncommanded to port.
9. When power is restored to the electronic steering control system following a power interruption of more than one second, the rudder will move, uncommanded, 10 degrees to port or starboard.
10. No alarms are fitted to indicate a power failure to the electronic-hydraulic steering control system.
11. The Niagara River at Youngstown, New York, is not wide enough to allow safe passage of the Seaflight I in the foil-borne mode.

Causes and Contributing Factors

The Seaflight I lost steering and struck four moored yachts as a result of a failure of her electronic steering control system. Contributing to the occurrence was the vessel's high speed in relatively confined waters, and her close passage to the mooring area.

Safety Action Taken

In April 1999 a Marine Safety Advisory (MSA 04/99) was sent to TCMS describing several unsafe design characteristics of the steering control system installed on the Seaflight I and its sistership Seaflight II. In response, TCMS indicated that these unsafe characteristics will be examined in depth at the time of the annual inspection of the vessels.

On 23 March 2000, sea trials were conducted on Seaflight I and its sister ship Seaflight II in the presence of TCMS and TSB representatives. The trials confirmed the propensity for the rudder to move uncommanded to port or starboard when the 220 V steering control power is re-established following an interruption of as little as one second. It was demonstrated that such an interruption could result from the power being manually switched off, on the bridge or in the electrical control room, or from a failure of the motor-generator supplying the system. Subsequently, TCMS has required that the vessel's owners install an audible alarm on the bridge to indicate failure of the 220 V steering control power supply.

Tests conducted by removing the various power fuses associated with the failure modes in the service manual did not result in a rudder movement.

Subsequent to several occurrences involving HSC, TCMS had concerns regarding the safety of these operations. As a result, TCMS Ontario Region produced a report entitled High Speed Craft Operations on Lake Ontario during 1998. This report recommended, inter-alia, that:

• manufacturers' design parameters be determined prior to determining areas of operation;
• electronic steering control systems be regularly inspected and tested to ensure proper operation;
• all hydrofoils be restricted to displacement mode when operating in congested waters, narrow channels, harbours or in close proximity to marinas and steered by either hand-hydraulic or electric-hydraulic modes.
  • Speed trials to be conducted to determine appropriate maximum speed in the displacement mode that will minimize wake.
  • TCMS has specifically endorsed the certificate of Seaflight I requiring that only the electric-hydraulic or the manual hydraulic steering control systems be used when the vessel is in confined waters.
• There should be instructions regarding the particular voyage the vessel is engaged on in the vessel's Operations Manual.

The vessel's operators report that steering tests are now conducted using all steering control systems six miles before entering the Niagara River and that the vessel will transit the YYC mooring area in displacement mode. Additionally, representatives of the vessel's builders have modified the steering system to limit the rudder angle to 10 degrees while operating in the electronic steering mode, regardless of speed.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 24 August 2000.

Appendix A— Sketch of the Occurrence Area

Image

Appendix B— Photographs

Image

Image

Image