Marine transportation safety investigation report M18A0001

On 02 February 2018, the passenger ferry Deer Island Princess II, with 4 people on board, made bottom contact while transiting from Butler Point, Deer Island, New Brunswick to Letete, New Brunswick. As a result, 1 of 2 Z-drive thruster units detached from the vessel. The crew aborted its voyage and was proceeding back to Butler Point using the remaining thruster when the vessel made bottom contact a 2nd time and the remaining thruster detached from the vessel. With no propulsion, the vessel was anchored until the following day when it was towed to Letete by the tug Atlantic Spruce. There were no injuries as a result of the occurrence. There was minor pollution.

1.1 Particulars of the vessel

Name	Deer Island Princess II
Official number	823396
Port of registry	Saint John
Flag	Canada
Type	Ferry
Materials	Steel
Gross tonnage	312
Length overall	42.0 m
Registered length	39.86 m
Draft (estimated at the time of the occurrence)	1.99 m*
Built	2001
Propulsion	2 diesel engines driving 2 independent Z-drive azimuth thrusters, providing 746 kW (1000 BHP**) in total
Maximum complement	99 (maximum 95 passengers, minimum 4 crew)
Complement on board at the time of the occurrence	4 (0 passengers, 4 crew)
Maximum number of cars	24
Number of cars on board at the time of the occurrence	0
Registered owner	New Brunswick Minister of Transportation
Managing company	Coastal Transport Limited
Recognized organization	Lloyd’s Register

1.2 Description of the vessel

The Deer Island Princess II (Figure 1) is a single-decked, double-ended^{Footnote 1} passenger ferry with an elevated bridge positioned above the open car deck. Loading ramps are located at both ends of the car deck. A narrow superstructure runs the length of one side of the vessel adjacent to the open car deck, providing a passenger space, washrooms, workshop, crew space, and 2 engine spaces (1 at each end of the vessel). The general arrangement of the vessel is shown in Appendix A.

The vessel propulsion consists of two 373 kW (500 BHP) diesel engines that drive 2 independent azimuth thrusters in a Z-drive arrangement. The thrusters are positioned at each end of the vessel and completely off to one side, directly below the superstructure. These thrusters are able to rotate 360 degrees, which quickly changes the direction of thrust and eliminates the need for a conventional rudder. Each thruster is controlled independently by a corresponding rotating joystick on the bridge; the thruster’s position and revolutions per minute are displayed near its corresponding joystick.

The bridge is equipped with two 3 cm wavelength radars located at either end of the centre console, a gyro compass and repeater, 2 very high frequency (VHF) radiotelephones, a differential global positioning system (DGPS), and an electronic chart system (ECS).

The vessel is not fitted with a depth sounder, nor is it required to by regulation.^{Footnote 2}

Because the vessel’s double-ended design does not have a distinct bow or stern, the vessel’s fore and aft are relative to the direction the vessel is travelling. To distinguish one end from the other, vessel operators^{Footnote 3} identify the end used to load and unload vehicles at Butler Point as the Deer Island end, and the other end of the vessel as the Letete end.

Image

1.2.1 Description of vessel manoeuvring characteristics with Z-drive thruster

The positioning of 1 Z-drive thruster unit on each end of a double-ended ferry is common on short routes, because it provides equally efficient propulsion ahead or astern. This allows either end of the vessel to serve as the bow, eliminating the need to turn the vessel after departing. This arrangement also allows the vessel to turn quickly or move sideways because thrust can be applied both fore and aft of the vessel’s apparent pivot point. ^{Footnote 4}

On the Deer Island Princess II, both Z-drive thruster units are used to propel and steer the vessel, with the forward drive used to quickly alter the vessel’s heading. The loss of the forward Z-drive thruster unitmakes the vessel harder to manoeuvre because it loses power to propel itself and to counteract the effects of wind and current, and because the remaining thruster must be used to rotate the vessel around its apparent pivot point rather than to perform its usual function, which is to apply more lateral thrust. As a result, the vessel requires increased time and distance to turn and to counteract the effects of a crosswind and current.

1.3 Description of the ferry service

Deer Island is located in the Bay of Fundy, at the mouth of Passamaquoddy Bay, near the border between New Brunswick and Maine, U.S., approximately 2.5 nautical miles (NM) southwest of Letete. The island’s permanent residents, and those who work in the island’s fishing, aquaculture and tourism industries, access the island by ferry.

Two ferries, the Deer Island Princess II and the Abnaki II, owned by the New Brunswick Minister of Transportation and operated by Coastal Transport Limited (CTL), run between Letete and Butler Point daily from 0600 to 2300.^{Footnote 5} Departures occur from each port every 30 minutes until 2000, and every 60 minutes afterward.

Deer Island has a large tidal range; at times, the difference between high and low water levels is more than 8 m. The primary route between Butler Point and Letete runs through the passage between Macs Island and Jameson Island. The route is narrow and shallow, and winds through numerous islands and shoals, with minimum depths of 2.5 m above chart datum. Each vessel displays the route on its ECS. Before 2010, a longer and less sheltered route north of Macs Island^{Footnote 6} was used at extreme low tides, because a segment of the primary route south of Macs Island was too shallow for the vessels to transit.

In 2010, the Province of New Brunswick (at the time both the owner and operator of the ferry service), extensively blasted and dredged the segment of the primary route that was too shallow for the vessels, immediately east of the passage between Macs Island and Jameson Island. Once the project was completed, the primary route was used in all tidal conditions.

CTL had developed a detailed passage plan that complements the route displayed on each vessel’s ECS. For each leg of the route, information about parallel indexing,^{Footnote 7} alteration points, direction of tidal current, meeting areas, and areas to be avoided is provided. For the route leg between Goat Point and Pomeroy Ledge, the passage plan states that “shoal sounding area near the isolated danger buoys, should be avoided when water depths under the drives do not allow 1–meter [sic] clearance.”^{Footnote 8}

Typically, the vessels depart their respective ports at the same time and meet mid-route, just west of Pomeroy Ledge. The vessels have a standing passing arrangement, in which the Butler Point-bound vessel moves north of the route displayed on the ECS and into Otter Cove,^{Footnote 9} and the Letete-bound vessel stays as far south of the route as possible, passing close to isolated danger buoys SJA and SJB.

1.4 History of the voyage

On 02 February, the crew of the Deer Island Princess II, consisting of a master, mate, engineer, and deckhand, started its shift at 1100 with a crossing from Butler Point to Letete. The vessel continued to depart every 30 minutes and complete subsequent crossings as scheduled.

At 1900, the Deer Island Princess II departed Butler Point with no passengers or vehicles on board and the master at the helm. The route was displayed on the vessel’s ECS and radar. The master followed the displayed route toward the narrow passage between Macs Island and Jameson Island (Figure 2).

Image

At 1907, the vessel passed the light tower marking the northernmost point of Jameson Island, known as Goat Point, at approximately 10 knots. The vessel continued east, passing south of buoy SJ2 (Figure 3). At 1908, the vessel passed north of a shoal of 2.6 m charted depth.

Image

The Deer Island Princess II maintained a course along or slightly south of the displayed route, passing close to isolated danger buoys SJA and SJB as the vessel rounded Pomeroy Ledge.

At 1909, the Deer Island Princess II was abeam and north of isolated danger buoy SJA, which marks a shoal of 2.2 m charted depth, when the Z-drive thruster unit on the Deer Island end of the vessel made contact with the bottom and detached. The vessel was 2 m or less south of the route displayed on the ECS. The master had travelled over this exact position the previous day^{Footnote 10} without incident. Following the bottom contact, the vessel continued to make way at a reduced speed.

After departure, the mate had gone to the crew space to enter the passenger and traffic count for the trip in the traffic log and enter the names of the crew on board on the time sheet for the evening shift. He was on his way back to the bridge when the vessel made bottom contact. At approximately 1910, the mate entered the bridge. The master and mate discussed the incident and whether the Z-drive thruster unit on the Deer Island end of the vessel was still attached. The master turned the thruster’s joystick to change the direction of the prop wash. No wash was visible, confirming that the Z-drive thruster unit was non-operational and likely detached. At 1911, the master called Fundy Traffic, the Canadian Coast Guard’s Vessel Traffic Services centre, on VHF radio channel 14 to advise that one of the Z-drive thruster units had made contact with the bottom and detached and that the vessel was continuing toward Letete.

At 1913, the vessel passed south of Pomeroy Ledge and approached Mohawk Island. The master and mate discussed their options and then called another experienced master on the Deer Island ferry service for advice. It was decided that the vessel would return to Butler Point, because docking in the confined harbour at Letete with 1 Z-drive thruster unit would be difficult with the low tide and strong northwesterly wind. The mate then contacted the master of the Abnaki II to advise that they would be returning to Deer Island.

At approximately 1925, the Deer Island Princess II proceeded toward Butler Point at 8.5 knots, with the remaining Z-drive thruster located at the Letete end of the vessel. At 1933, the Deer Island Princess II was positioned approximately 15 m north of the route displayed on the ECS, and again passed abeam and north of isolated danger buoy SJA. At 1934, as the Deer Island Princess II was approaching the shoal ordinarily marked by isolated danger buoy SJB, which was missing, the remaining Z-drive thruster unit made contact with the bottom and detached from the vessel. Without propulsion, the vessel drifted toward Goat Point. The mate and the engineer proceeded to the car deck and dropped the anchors on both ends of the vessel. The mate paid out anchor chain, alternating between both anchors, to manoeuvre the vessel away from the shoreline as the flood tide pushed it toward the channel north of Goat Point. At 1937, the master called the Abnaki II to advise that the vessel had contacted the bottom again and was now anchored in the channel north of Goat Point. At 1939, the anchors held the vessel in position approximately 45 m north-northeast of the light tower on Goat Point. As the vessel swung about the anchors, it approached the shoreline near the light tower. The mate lowered the vehicle loading ramp to the waterline where it acted as a fender to prevent the vessel’s hull from contacting the shoreline. The master called Fundy Traffic on VHF radio channel 14 to advise that the vessel had made contact with the bottom again, that all propulsion had been lost, and that the vessel’s anchors had been deployed. At 1947, the master contacted CTL’s director of vessel operations to inform him of the situation. The director of vessel operations then began arranging for a commercial tug to tow the Deer Island Princess II.

At 2047, the vessel began to drag anchor, drifting through the channel north of Goat Point, and then stopped dragging anchor at approximately 200 m west of the Goat Point light tower.

At 2142, the director of vessel operations contacted Lloyd’s Register, the Recognized Organization (RO)^{Footnote 11} that inspected and certified the vessel, to inform them of the situation on board the Deer Island Princess II.

The following day, the Deer Island Princess II was towed to Letete by the tug Atlantic Spruce.

1.5 Environmental conditions

At the time of the occurrence, it was dark and there was intermittent blowing snow, reducing visibility. The winds were from the northwest at 20 to 25 knots, gusting to 30 knots, and had been blowing from this direction for 10 hours before the occurrence. The confined nature of the ferry route prevents any significant sea state from developing in this area. The air temperature was −8 °C.

A low tide of 0.2 m above chart datum was predicted for nearby Saint John, New Brunswick at 1917. However, the actual low tide level observed ^{Footnote 12} at Saint John was 0.054 m below chart datum, approximately 0.25 m less than predicted.

The initial bottom contact occurred at low tide, with little to no tidal current. At the time of the second bottom contact, a flood tide current was running to the south-southwest, out of Otter Cove.

1.6 Damage to the vessel

Each Z-drive thruster unit is made up of a horizontal shaft, a vertical leg, and a lower end. The lower end of the vessel’s Z-drive thruster unit includes the propeller, kort nozzle, and an attachment collar. It is secured to the leg’s attachment collar by 14 bolts (Figure 4). When the Z-drive thruster unit on the Deer Island end of the vessel made contact with the bottom, these securing bolts were sheared off when the lower end detached from the leg. The attachment collar on the leg was also pushed up and deformed. When the Z-drive thruster unit on the Letete end of the vessel made contact with the bottom, those securing bolts were also sheared off when the lower end detached from the leg. The lower ends of both Z-drive thruster units were later recovered by divers. There was superficial damage to the paint coating on the lower end units and there was no damage to the vessel’s hull.

Image

1.7 Vessel certification and inspection

The Deer Island Princess II was certified and equipped in accordance with existing regulations, and limited to sheltered waters voyages. The last inspection was carried out by the RO on 27 September 2017.

1.8 Personnel certification and experience

The master held a Master, Limited for a Vessel of 60 Gross Tonnage or More certificate, first issued in 2010 and valid until 19 November 2020. This certificate is valid only on board the ferries operating on the Deer Island to Letete service, and only on voyages in Passamaquoddy Bay. The master also held a Master, Limited for a Vessel of Less Than 60 Gross Tonnage certificate, first issued in 2006 and valid until 13 June 2021. This certificate is valid only on board specific vessels operated by another company with whom the master was also employed, and only on voyages in Passamaquoddy Bay and the Bay of Fundy, not more than 25 nautical miles from shore. In addition to the above, the master held the following certificates:

• Restricted Operator’s Certificate – Maritime Commercial (ROC-MC)
• Marine Basic First Aid
• Small Vessel Machinery Operator (Restricted to Specific Vessels)
• SEN-L – Simulated Electronic Navigation Limited
• MED (Marine Emergency Duties) with respect to STCW (Standards of Training, Certification and Watchkeeping) Basic Safety
• Small Vessel Safety (MED A2)
• MED Proficiency in Survival Craft and Rescue Boats other than Fast Rescue Boats (STCW)
• MED for Senior Officers (MED D)

Starting as a master with a local whale-watching company in 2000, the master began working full time on the Deer Island ferries in 2010 as a master and mate. In 2012, he returned to the whale watching company during the summer tourism season and continued to work on the ferries as a relief master and mate during the winter. The master transited the passage south of Macs Island several times each day with both companies.

The mate held a Master 150 Gross Tonnage, Domestic certificate, first issued in 2013 and valid until 25 March 2023. He began working full time as a mate on the Deer Island ferries in 2013, and occasionally worked as a relief master.

1.9 Local tides

Tides are the result of the combined gravitational pull of astronomical bodies, primarily the moon and sun. Tidal predictions are based on tidal observations taken over an extended period of time, correlated to the positions of astronomical bodies at the time the observation was made. The forecast positions of these astronomical bodies are then compared with their past positions. The corresponding tidal level is taken as the prediction. Tidal predictions are an important part of coastal navigation in Canada and are made available to mariners in the Canadian Tide and Current Tables.

Meteorological conditions, such as barometric pressure and strong winds over a prolonged period, also affect tide levels, creating a difference between predicted and observed levels. Sea level is lowered by high atmospheric pressure and raised by low atmospheric pressure. Also, as wind blows across the water’s surface, it exerts a drag force on the water, causing the water to gain momentum and move in the direction of the wind, an effect known as wind stress. Its magnitude is determined by the strength of the wind, how long the wind blows, and the distance the wind is blowing over water (also known as fetch).^{Footnote 13}

When a strong wind blows onshore, the associated wind stress increases the water level near the shore. This phenomenon is most noticeable in long shallow bays. When these increased water levels coincide with the low barometric pressure of a passing storm, the result is known as a storm surge.^{Footnote 14}

Similarly, wind stress from a strong wind blowing offshore decreases the water level near the shore, a phenomenon commonly referred to as a negative surge. According to the Canadian Tidal Manual, negative surges “are not usually as extreme as storm surges. Negative surges may, however, be of considerable concern to mariners, since they can create unusually shallow water if they occur near the low tide stage.”^{Footnote 15}

Local topography and water depth also affect the tides, amplifying the meteorological phenomena discussed above. When the topography of the coastline consists of a bay or inlet, the water is funnelled toward the head of the bay, further increasing the water level created by a storm surge. During a negative surge, the flow of water into a long narrow bay to replace the water pushed out by the wind is restricted, further lowering the water level. Similarly, when the bay is shallow, the flow of water from below to replace the water pushed out by the wind is further restricted. That is why the shallow waters of Passamaquoddy Bay allow negative surges to occur in the area. Other dynamics that propagate long-period waves (i.e., tides) can also contribute to localized higher or lower than predicted water levels, which are particularly noticeable in shallow bays and channels.

Meteorological conditions can only be forecast for a few days, whereas tidal predictions are calculated for years into the future. The effects that meteorological conditions have on water levels are not included in tidal prediction tables, and must also be considered by mariners.^{Footnote 16}

The operators of the Deer Island ferries are very aware of the large tidal range in the area, and the resulting strong currents. A copy of the Canadian Tide and Current Tables,^{Footnote 17} used by vessel operators to refer to the predicted tides for Saint John, was on board the Deer Island Princess II the day of the occurrence. Saint John is a reference port for the occurrence area, located approximately 40 NM northeast of the occurrence site. With the combined effect of spring tides^{Footnote 18} and the moon in perigee,^{Footnote 19} the predicted low tide at Saint John for the evening of 02 February 2018 was 0.2 m above chart datum.^{Footnote 20} Although this is at the lower end of the tidal range, a low tide of this depth or less is not unusual for Saint John; it appears in the tide tables approximately 40 times each year.

The predicted time and height of tides differ for locations outside Saint John. Mariners must take tidal information from a reference port and apply the calculations provided in the tables for the nearest secondary port to determine the predicted tide level for their area.

Back Bay, located 2.4 NM east-northeast of the occurrence area, is the secondary port nearest the occurrence site, as listed in the published version of the Canadian Tide and Current Tables. The Canadian Hydrographic Service (CHS) website also provides predicted highs and lows for the secondary ports listed in the published version of the tide tables, as well as other secondary ports not included in the published document.

The CHS website provides predicted highs and lows for Matthews Cove, the closest secondary port to the occurrence area. Matthews Cove is located at Letete, 1.25 NM from the occurrence site. A low tide of 0.2 m below chart datum was predicted to occur at 1923 on the evening of 02 February 2018 at Matthews Cove, 0.4 m less than the tidal prediction for Saint John referenced by the vessel operators. Information for Matthews Cove is not included in the published version of the Canadian Tide and Current Tables.

Tidal observations at Saint John for 02 February 2018 showed that the actual low tide was 0.05 m below chart datum, 0.25 m below the predicted low tide level. Tidal observations are not collected for Back Bay or Matthews Cove. However, because the tidal predictions for these secondary ports are based on the tide level at Saint John, the tide at these ports would also have been lower than predicted. A reduction in the predicted tide at Matthews Cove by 0.25 m (the difference between predicted and observed at Saint John) would therefore have resulted in a new predicted tide of 0.45 m below datum.^{Footnote 21}

When a northwesterly wind blows out of Passamaquoddy Bay for a prolonged period, wind stress can result in a negative surge, further lowering the area’s actual water level beyond the predicted level for Saint John. This phenomenon had been observed by other vessel operators during strong northwesterly winds in this area. The combined result of these astronomical and meteorological conditions, as well as the local topographic and bathymetric features, likely resulted in a water level significantly lower than expected at the time of the occurrence.

An extreme low tide of 1.20 m below chart datum was recorded at Eastport, Maine, U.S., on 02 February 2018 at 1924.^{Footnote 22} Eastport is located within Passamaquoddy Bay and is 8 NM southwest of the occurrence area, closer than Saint John. The tides observed at Eastport would have been affected by meteorological conditions similar to those experienced in the occurrence area.

Mariners can determine the actual water level by various means, such as referencing a tide board installed at a wharf, or using a depth sounder fitted to their vessel. However, the tide boards at the Letete and Butler Point wharves were in disrepair and unusable, and the Deer Island Princess II was not fitted with a depth sounder. CTL did not have a policy or procedure in place directing vessel operators to determine actualwater levels before departure, nor was it routine practice for vessel operators to do so. The vessel operators only referenced the predicted tides for Saint John as published in the Canadian Tide and Current Tables, not the nearest secondary port, and did not determine actual water levels.

1.10 Safety management

The principal objectives of safety management on board vessels are to ensure safety at sea, prevent human injury or loss of life, and avoid damage to the environment. To manage safety, a company, ideally, identifies existing and potential risks, establishes safety policies and procedures to mitigate those risks, and provides a means of continuously gauging effectiveness to improve organizational safety where necessary.

A documented, systematic approach to safety management is known as a safety management system (SMS). An SMS is one means of providing individuals at all levels of an organization with the information and tools they need to make sound decisions in both routine and emergency operations.

Identifying and mitigating risk is central to an SMS. According to the International Association of Classification Societies (IACS):

Although it is not often referred to as such, the development and implementation of a documented safety management system is an exercise in risk management. The drafting or amendment of written procedures involves looking at the company’s activities and operations, identifying what could go wrong, and deciding what should be done to try to prevent it. The documented procedures are the means by which the controls are applied.^{Footnote 23}

The international marine standard for safety management is the International Safety Management (ISM) Code.^{Footnote 24} An SMS needs to meet the following functional requirements to comply with the ISM Code:

1. a safety and environmental-protection policy;
2. instructions and procedures to ensure safe operation of ships and protection of the environment in compliance with relevant international and flag State legislation;
3. defined levels of authority and lines of communication between, and amongst, shore and shipboard personnel;
4. procedures for reporting accidents and non-conformities with the provisions of this Code;
5. procedures to prepare for and respond to emergency situations; and
6. procedures for internal audits and management reviews.^{Footnote 25}

An SMS that complies with the ISM Code is currently mandatory under Transport Canada’s (TC) Safety Management Regulations for Canadian vessels to which Chapter IX of the International Convention for the Safety of Life at Sea (SOLAS) applies (called convention vessels). Chapter IX applies to the following types of vessels that operate on international voyages:

1. Passenger ships including passenger high-speed craft;
2. Oil tankers, chemical tankers, gas carriers, bulk carriers and cargo high-speed craft of 500 gross tonnage and upwards; and
3. Other cargo ships and mobile offshore drilling units of 500 gross tonnage and upwards.^{Footnote 26}

At the time this investigation report was written, proposed amendments to the Safety Management Regulations would also require the following Canadian non-convention vessels (including the Deer Island Princess II) to have an SMS that complies with part A^{Footnote 27} of the ISM Code, as indicated:

• A vessel of 500 GT and upwards or a vessel that is certified to carry 50 passengers or more will comply with Part A of the ISM Code; and
• A vessel that is more than 24 m in length and less than 500 GT will comply with Part A of the ISM Code, except sections 4 and 12.

Proposed amendments would also require the following non-convention vessels to have an SMS with varying requirements that are less stringent than the ISM Code:

• A vessel of more than 15 GT;
• A passenger-carrying vessel or tug of not more than 15 GT; and
• A vessel of not more than 15 GT.

Until the proposed amendments come into force, TC is encouraging vessel owners and operators to voluntarily develop an SMS that complies with the ISM Code.^{Footnote 28}

Although an SMS is used by a company to manage risk internally, a key component of an SMS that complies with the ISM Code^{Footnote 29} is external certification and verification. According to the ISM Code, the regulator, or organization recognized by the regulator, should periodically verify that the company is operating in accordance with the approved SMS, and that the SMS is functioning.^{Footnote 30} In Canada, TC is the regulator and has delegated this task to several ROs,^{Footnote 31} who fulfill this duty through periodic external audits.

1.10.1 Safety management system for the Deer Island Princess II

The SMS, along with CTL’s quality management system,^{Footnote 32} is documented in a manual entitled Integrated Management System ISO/ISM Operations Manual.

TC does not carry out oversight of voluntary SMS. However, vessel owners can have their voluntary SMS certified and audited by an RO. The SMS for the Deer Island Princess II is certified and periodically audited by Lloyd’s Register; the initial audit was conducted in March 2013 and the most recent intermediate audit in February 2016.

Implementing an effective SMS requires the owners or authorized representative to analyze the company’s operations, to identify hazards, and to develop procedures to mitigate the risks posed by those hazards. The SMS on board the Deer Island Princess II contains no procedure for operations during periods of extreme low tide.

The ISM Code requires an SMS to include procedures for reporting accidents. The Integrated Management System ISO/ISM Operations Manual contains a procedure titled Incident/Accident Reporting, which states:

The company has procedures which ensure accidents, incidents, hazardous situations and near misses are reported, investigated and analysed with the objective of improving quality, safety and pollution prevention. Implementation of corrective action includes measures intended to prevent reoccurrences. ^{Footnote 33}

In its initial and intermediate audits, the Deer Island Princess II’s RO audited the vessel’s process for reporting hazardous occurrences, including subsequent internal investigations into those occurrences and any associated corrective actions. The initial audit resulted in an observation^{Footnote 34} that reported incidents did not include a record of action taken, action planned, or date rectified. CTL provided the TSB with internal investigation reports for incidents, not limited to grounding / bottom contact incidents, that occurred on the Deer Island ferry service after the initial audit. Several of these reports were incomplete and did not include a record of action taken, action planned, or date rectified.

An interim audit^{Footnote 35} was conducted in October 2012, 5 months before the SMS was implemented on board the Deer Island Princess II. This audit noted issues regarding crew familiarization with the SMS. The interim audit resulted in an observation that SMS familiarization had been carried out for the officers, but that the process needed improvement. The next scheduled audit, occurring 28 March 2013, found no issues with familiarization on board the Deer Island Princess II. However, the intermediate audit of February 2016 resulted in a non-conformity note,^{Footnote 36} stating, “Master and Officers [sic] familiarization of the Company's Safety Management System is not always effective.”^{Footnote 37} Further familiarization was recommended. However, the company’s corrective action focused on individual crew members and did not consider issues with the SMS familiarization process itself.

During the occurrence, neither the master nor the mate referenced the vessel’s emergency checklists that form part of the SMS, specifically the Main Propulsion Failure and Stranding/Grounding checklists. The investigation determined that both the master and the mate were aware of the SMS on board and had been familiarized with the system, and that in May 2017, the mate had participated in a propulsion failure emergency drill to exercise the vessel’s Main Propulsion Failure emergency procedure, which simulated the failure of a Z-drive thruster unit as the vessel sailed from Letete to Butler’s Point. Nevertheless, the investigation determined that neither the master nor the mate was familiar with the details of the emergency procedures or where they could be found.

Although these 2 checklists were not referenced, the master and mate had completed most of the items listed. The Main Propulsion Failure checklist instructs the crew to prepare to anchor; this was not done after the first Z-drive thruster unit was lost, but was done after the vessel had lost both drives.

The master and mate were aware of the company’s passage plan, but were not aware of its specific restriction to maintain 1 m clearance under the vessel in the area of the isolated danger buoys. This requirement was not enforced by the company or practised by vessel operators.

On 27 March 2018, 7 weeks after the occurrence, the RO conducted an SMS renewal audit on board the Deer Island Princess II. Familiarization of officers and crew was once again audited. Randomly selected familiarization documents were found up to date and the master and crew were found to be familiar with the SMS. The non-conformity note issued in 2016 was closed out. During this same renewal audit, the RO issued an observation stating that the back-up master needed further familiarization with the SMS.

The SMS on board the Deer Island Princess II states:

It is to be standard practice that there are two people on the bridge while the vessel is at sea except in exceptional circumstances.^{Footnote 38}

Although this standing order was known to the master and mate, it was not strictly practised. For example, there were periods when only 1 person was on the bridge while administrative tasks were being carried out, as in this occurrence, or during meal breaks. There was also a regulatory requirement to have 2 people on the bridge of this vessel between sunset and sunrise.^{Footnote 39}

1.10.2 Previous occurrences

Since 2000, the TSB has received 7 reports of the Deer Island Princess II making bottom contact or grounding, 5 of which involved damage to or loss of a Z-drive thruster unit. Similarly, the TSB has received 9 reports since 2000 of the second vessel operating on this service and of similar design, the John E. Rigby,^{Footnote 40} making bottom contact or grounding. Six of these occurrences involved damage to or loss of a Z-drive thruster unit.

Of the 16 occurrences (Appendix B) mentioned above, 4 have taken place since 2012, when CTL assumed the operation of the Deer Island ferry service and an SMS was put in place. Two of these occurrences (M13M0004^{Footnote 41} and M17A0035) resulted in internal investigations, which determined that the bottom contact resulted from the mechanical failure of a component in the propulsion control system. Corrective action was taken to prevent this from recurring.

The TSB’s review of all 16 occurrences indicates that 4 of the occurrences before and 2 of the occurrences since the implementation of the SMS in 2012 were a direct result of normal operations conducted at low tide.

In November of 2015, the John E. Rigby’s Z-drive thruster unit made contact with the bottom and detached from the vessel while departing the north side of the wharf at Butler Point. A Non-Conformance, Corrective and Preventative Action (NCCP) report was completed indicating that the corrective and preventive action taken was to advise the RO and to submit a marine occurrence report. Neither the state of tide at the time of the occurrence nor any other contributing factors were mentioned in the report. The TSB received a report of the 2015 occurrence that included a mitigating measure: following the occurrence, a restriction was put in place, where the John E. Rigby and the Deer Island Princess II were prohibited from using the north side of the wharf when the tide is less than 0.5 m above chart datum, until the obstruction could be removed. Neither the hazard nor the corrective action to prevent recurrence was included in the NCCP report for the November 2015 occurrence.

A similar occurrence took place in February 2015. The company determined it was due to the same obstruction, although no restriction was put in place at that time. No NCCP report or other investigation documentation required by the SMS was found for the February 2015 occurrence.

Only during the TSB’s investigation into the February 2018 occurrence did the company provide internal communications indicating the mitigating measures imposed until an obstruction could be removed. Aside from the above-mentioned restriction, no other corrective actions have been put in place as a result of either of the 2 previous occurrences, which were a direct result of normal operations at low tide and that have occurred since CTL began operating the Deer Island service.

1.11 Navigation buoys

Navigation buoys are aids to navigation and are positioned to advise mariners of the safest route or to mark the location of dangers or obstructions. In Canadian waters, such buoys are positioned and maintained primarily by the Canadian Coast Guard (CCG).

Navigation buoys are not under continuous observation, so mariners should be aware that failures and displacements caused by storms, ice, and vessel strikes do occur. The CCG cautions mariners not to rely solely on buoys for navigation purposes.^{Footnote 42}

Mariners who observe navigation buoys that are not operating correctly, damaged, out of position, or missing, are required to immediately report such problems to the nearest CCG Marine Communication and Traffic Services (MCTS) Centre.^{Footnote 43}

Numerous navigation buoys mark hazards along the ferry route from Deer Island to Letete. At the time of the occurrence, 1 of these buoys was off position and another was missing. Starboard hand buoy SJ4, normally positioned 0.33 NM west-southwest of Goat Point, was off position and had drifted east into the ferry route. In addition, isolated danger buoy SJB, which marks a 2.6 m shoal located 0.18 NM east-northeast of Goat Point, was missing. Both these buoys had been out of position for a month or more. The CCG has no record of these buoys being reported out of position or missing before the occurrence. At the time of the occurrence, no active notices to shipping^{Footnote 44} were in effect to indicate the buoys were not on position.

Both the master and mate were aware that buoy SJB was missing.

1.12 Active TSB recommendations

Although not required by regulation, CTL had voluntarily implemented an SMS on board the Deer Island Princess II. This SMS was audited and certified in accordance with the ISM Code by an RO. Because this SMS was voluntarily implemented, it receives no regulatory oversight from TC.

Following an occurrence on 23 June 2002, in which the amphibious passenger vehicle Lady Duck took on water and sank in the Ottawa River, and 4 passengers drowned, ^{Footnote 46} the Board recommended that

The TSB has repeatedly identified the need for domestic vessels to have an effective SMS, an issue that has been on the TSB's Watchlist ^{Footnote 47} since 2010. The Board has noted that effective oversight of SMS by TC is not always provided, and that an SMS is not required for some companies. To address this safety issue, the Board also noted the following:

Requiring companies to have an effective SMS is only half of the issue, however: there must also be appropriate regulatory oversight. Numerous TSB investigation reports have found that Transport Canada (TC) is not always effective at identifying companies’ ineffective processes and intervening in a timely manner. ^{Footnote 48}

This issue was added to the 2010 Watchlist as the result of several investigations ^{Footnote 49} in which the Board found hazards and risks in the operation of a vessel that had either not been identified or not been addressed by the company. Other investigations ^{Footnote 50} have also addressed shortcomings in the implementation of SMS, in which companies had not identified hazards associated with an operation, resulting in a lack of mitigation strategies for those hazards.

In 2014 and again in 2018, TC updated industry on the proposed amendments to the Safety Management Regulations, which would apply to 3 groups of vessels and the companies that manage them. Tier 1 would include vessels that fall under the International Convention for the Safety of Life at Sea (SOLAS). Tier 2 would include non-convention vessels over 500 GT and non-convention vessels certified to carry more than 50 passengers. Tier 3 would include non-convention vessels over 24 m long and less than 500 GT. ^{Footnote 51} Under the proposed amendments to the regulations, the Deer Island Princess II would be required to have an SMS subject to audit and certification.

In February 2020, the Board was informed that TC was analyzing the Safety Management Regulations to determine if the scope of the proposed amendments could be expanded. At the time it was reassessing TC’s response, the Board was unaware of the scope of the consultations and what a new proposal for the Safety Management Regulations could contain. Therefore, the Board’s response to recommendation M04-01 was most recently assessed as Unable to Assess. ^{Footnote 52} Since that time, TC has provided additional information to the Board regarding proposed amendments to the Safety Management Regulations, as outlined in section 1.10.

1.13 TSB Watchlist

The TSB Watchlist identifies the key safety issues that need to be addressed to make Canada’s transportation system even safer.

Safety management is a Watchlist 2020 issue. To date, only Canadian vessels that operate on international voyages and are subject to Chapter IX of SOLAS must comply with the existing Safety Management Regulations. These regulations do not apply to the majority of domestic vessels, although the recent “tiered” proposal by TC would expand their applicability.

However, as this occurrence demonstrates, even when operators do have safety management processes in place, they are not always able to demonstrate that hazards are being identified and that effective risk mitigation measures are being implemented.

This investigation determined that the passenger vessel Deer Island Princess II made contact with the bottom at 2 locations along its route during a period of extreme low tide.

This analysis will focus on extreme tide conditions, safety management systems, and aids to navigation.

2.1 Factors leading to the occurrence

As the Deer Island Princess II prepared to depart Butler Point, the master was aware that low tide was approaching, and that a predicted low tide of 0.2 m above chart datum was indicated for Saint John in the Canadian Tide and Current Tables. Having successfully completed the crossing between Butler Point and Letete many times in tides lower than those predicted on the occurrence date, the master was not concerned about the predicted depth of water along his planned route.

There are no recorded water levels for the occurrence area. However, the actual water level in the area was significantly lower than tide table predictions, as indicated by tidal observations in nearby Eastport.

The master followed the route displayed on the electronic chart system (ECS), maintaining the vessel’s position within several metres of the route and to the extreme south of the channel in preparation for meeting the returning ferry. The vessel passed abeam and north of isolated danger buoy SJA, in exactly the same position the master had passed the previous day.

On the return trip to Butler Point, the vessel’s position was maintained slightly north of the route displayed on the ECS.

The master and mate were aware that isolated danger buoy SJB was missing and therefore did not rely on it to aid in the navigation of the vessel. However, the absence of isolated danger buoy SJB prevented the crew from having any visual reference for the shoal to the south of the route and the vessel’s drift toward it. With the extreme low tide, there was not enough water above the shoal to accommodate the vessel’s draft.

2.2 Tides

Although the operators of the Deer Island ferries paid close attention to the tidal predictions contained in the Canadian Tide and Current Tables, little attention was given to the actual water level. The master and mate regularly referenced the publication’s tidal predictions for Saint John but did not reference the more accurate prediction for the nearest secondary port at Matthews Cove. The investigation determined that, using the tidal prediction for Matthews Cove, the depth of water predicted above the shoal marked by isolated danger buoy SJA at low tide was 2 m, equal to the draft of the vessel. In comparison, the Saint John tidal prediction gave a predicted water depth of 2.4 m above the shoal.

These were only predictions and did not consider the effects of meteorological conditions on the level of water at any given time. The actual water level observed at Saint John was 0.25 m below the predicted level. A similar reduction at Matthews Cove would have resulted in a predicted water depth of 1.75 m above the shoal, 25 cm less than the vessel’s draft, allowing the vessel to make contact with the shoal marked by isolated danger buoy SJA.

A strong northwesterly wind was blowing out of Passamaquoddy Bay at the time of the occurrence. This likely created a negative surge that further lowered the water level at the occurrence site below predicted levels, allowing the vessel to make contact with the 2.6 m shoal normally marked by missing isolated danger buoy SJB.

To determine the actual water levels expected along the route, the master would have had to measure the water level, using either a depth sounder or a tide gauge.

2.3 Safety management

One functional requirement of a safety management system (SMS) is reporting and investigating near misses and hazardous occurrences, because they are a way of identifying hazards and risks. A thorough investigation provides in-depth knowledge of a hazard, enabling changes in policies and procedures to mitigate the associated risk.

The Deer Island Princess II and the John E. Rigby have been involved in 16 previous grounding or bottom contact occurrences since 2000, 4 of which have occurred since Coastal Transport Limited’s (CTL) SMS was put in place in 2012. CTL conducted an internal investigation into 2 of the occurrences and implemented an operational restriction as a result of another occurrence. The TSB determined that 6 of the previous occurrences took place during normal operations and at extreme low tide, without risk factors such as mechanical failure.

CTL’s SMS did not always result in a thorough investigation into the previous occurrences, and therefore did not identify extreme low tide as a common contributing factor. Although mitigation measures were put in place after several of these occurrences, how to mitigate the common risk of grounding or striking bottom during low tide was not identified. Furthermore, when the SMS was initially implemented, extreme low tides were not identified as a hazard despite the numerous occurrences before 2012.

The hazard of extreme low tides encountered by the vessels of the Deer Island ferry service may not exist for all operations across the marine industry. Therefore, each company must determine the hazards unique to its operations, and put in place procedures to mitigate the associated risks.

An SMS is effective only when all members of an organization are familiar with and participate in all aspects of the system. Otherwise, the benefits of an SMS are not fully realized. Furthermore, the system does not continue to improve if shortcomings are not identified and corrective action is not taken. Under these circumstances, an SMS ceases to be a robust, active safety system; it is a safety system on paper alone.

External SMS audits conducted on board the Deer Island Princess II identified persistent issues with crew familiarization. The investigation determined that the master and mate were not familiar with the relevant emergency procedures at the time of the occurrence, even though CTL had a record of the master and mate being familiarized with the SMS. In addition, neither the master nor the mate was aware of the details of the passage plan, that it required a 1 m clearance under the vessel in the area of the isolated danger buoys.

The SMS requirement to have 2 people on the bridge was not always practised. Although the absence of a second person on the bridge was not determined to have caused or contributed to this occurrence, it illustrates a gap between the SMS procedures implemented and those practised on board the Deer Island Princess II.

Furthermore, the observations and non-conformities brought to light by the external audits were addressed directly with the individual crew members on board at the time of the audits. The corrective actions that followed did not examine CTL’s familiarization procedure or implement improvements to ensure that all employees were familiarized with the SMS. For example, during an SMS renewal audit 7 weeks post-occurrence, the RO issued an observation stating that the back-up master was not familiar with the SMS. Therefore, the corrective action had not been effective in addressing the recurrence of familiarization issues.

When a company is unaware of, or unsuccessful in, addressing shortcomings within its SMS, it is the RO’s role to identify these shortcomings through external audits and to ensure corrective action is implemented. The effectiveness of this corrective action is then gauged in subsequent audits and through the recurrence of hazardous events and non-conformities.

The non-conformity issued during the external audit in 2016 was closed out in a post-occurrence audit when the RO determined that the corrective action taken by the company was effective and that issues with familiarization no longer existed on board. However, in a renewal audit in 2018, the RO then issued an observation indicating an ongoing issue with familiarization. This observation shows that the corrective action taken by the company and approved by the RO was not effective in dealing with familiarization issues on board and supporting the ongoing familiarization issue that had been identified during the investigation.

Similarly, the RO was aware of the 4 previous grounding or bottom contact occurrences since CTL’s SMS was put in place in 2012. However, there is no indication that the RO’s auditing process sought evidence of any internal investigation or any corrective action that was implemented as a result of these occurrences. Although CTL’s accident reporting and investigation process was audited and observations noted, the RO did not mention that these recurring grounding incidents had not been investigated.

Because TC does not carry out oversight of voluntary SMS, there is no oversight of the effectiveness of the audits carried out by ROs or anyone else. This gap will remain until proposed amendments to the Safety Management Regulations come into force. Therefore, ROs are the final defence in ensuring that an SMS is operating as intended. If an RO does not identify gaps in a company’s SMS and, more important, ensure that the company takes the necessary corrective action to close those gaps, the intended benefits of an SMS will not be realized.

2.4 Navigation buoys

Navigation buoys are positioned to mark a safe passage for mariners or identify a hazard. They can be damaged or move from their charted position. The buoys are not constantly monitored, and the Canadian Coast Guard (CCG) is not automatically alerted when a navigation buoy is no longer on position or lit.

Mariners who find a navigation buoy that is damaged, has shifted, or is missing are required to notify the CCG immediately. This notification triggers a process to fix, reposition or replace the navigation buoy so it can effectively mark a navigational hazard or safe passage for mariners. Without such notifications, the CCG would not know the navigation buoy’s status and could not take corrective action.

At the time of the occurrence, 2 navigation buoys along the ferry route were off position and not functioning as intended. Buoy SJ4 had drifted from its charted position directly onto the route. Isolated danger buoy SJB was missing from its position, leaving unmarked the shoal where the vessel’s second bottom contact occurred. These buoys had been out of position for weeks before the occurrence.

At the time of the occurrence, the CCG had no record of any issues with the navigational buoys in the Deer Island area. Therefore, the shoal ordinarily marked by isolated danger buoy SJB remained unmarked, providing no visual reference to mariners of the hazard’s location.

3.1 Findings as to causes and contributing factors

These are conditions, acts or safety deficiencies that were found to have caused or contributed to this occurrence.

1. Due to the combination of the lower-than-predicted tide level observed at Saint John, local topography, and a persistent northwesterly wind, an extreme low tide occurred, resulting in a water level in the area that was significantly lower than tide table predictions.
2. Due to the extreme low tide, there was not enough water along the route the master followed to accommodate the vessel’s draft. As a consequence, the Z-drive thruster unit on the Deer Island end of the vessel made contact with the shoal marked by isolated danger buoy SJA, and detached.
3. With only 1 operational Z-drive thruster unit, the vessel’s response to helm corrections aimed at counteracting the effects of the strong northwesterly wind and the flood tide current running out of Otter Cove was likely delayed and less effective than it would have been with 2 units. As a consequence, after passing isolated danger buoy SJA, the vessel began to set to the south toward the shoal.
4. As the vessel passed over the shoal normally marked by buoy SJB, its remaining Z-drive thruster unit made contact with the shoal and detached.
5. The master relied on the tide tables only for the primary port and did not reference predictions for the nearest secondary port, which would have provided more accurate information on the predicted tidal level.
6. Because the tide boards at Butler Point Wharf and Letete were in disrepair and unusable, and the vessel was not equipped with a depth sounder, the master had no means of determining actual water depth, nor was it routine practice to do so. As a consequence, the master was not aware of the actual height of the tide.
7. The hazard posed by normal operations in times of extreme low tide was not identified and mitigation strategies were not put in place to reduce the associated risk.

3.2 Findings as to risk

These are conditions, unsafe acts, or safety deficiencies that were found not to be a factor in this occurrence but could have adverse consequences in future occurrences.

1. If companies do not identify the hazards in their vessel operations, there is a risk that their safety management systems will not contain the risk-mitigating strategies intended for the safe operation of their vessels.
2. If companies do not implement a robust familiarization process for their safety management systems, operators might not follow established procedures. This creates a risk that the intended safety benefits of those systems will not be realized.
3. If companies do not identify and implement the appropriate corrective action required to address shortcomings within their safety management systems, there is a risk that non-conformities with the system will persist.
4. If recognized organizations do not ensure occurrences are investigated and corrective actions are effective, there is a risk that companies and shipboard management will not operate in accordance with the approved safety management system, allowing unsafe practices to continue.
5. If mariners do not alert the Canadian Coast Guard about issues with navigation buoys, there is a risk that navigational hazards will not be properly identified, which could lead to accidents.

3.3 Other findings

These items could enhance safety, resolve an issue of controversy, or provide a data point for future safety studies.

1. Under current regulations, the Deer Island Princess II is not required to have a safety management system. However, the partnership agreement between the Province of New Brunswick and the vessel’s managing company, Coastal Transport Limited, required the company to comply with the ISM Code. Coastal Transport Limited therefore developed and implemented a safety management system in 2012.
2. The shoal where the Deer Island Princess II made contact the second time was ordinarily marked by isolated danger buoy SJB. However, the buoy was missing from its charted position and had been for some time, without it being reported to the Canadian Coast Guard.

4.1 Safety action taken

4.1.1 Coastal Transport Limited

Following the occurrence, Coastal Transport Limited completed an internal investigation of the occurrence with respect to weather, timeline of events, damage, observations, root causes, recommendations, and costs by consulting with the masters working on the Deer Island ferry service. The review resulted in no changes to the safety management system for operations at low tide. Following the occurrence, CTL repaired the tide boards located at Letete and Butler Point.

This report concludes the Transportation Safety Board of Canada’s investigation into this occurrence. The Board authorized the release of this report on 10 March 2021. It was officially released on 29 April 2021.

Appendix A – Deer Island Princess II general arrangement

Image

Image

Appendix B – Previous grounding / bottom contact occurrences involving the Deer Island ferry service

Occurrence Number	Date	Vessel	Summary
M00M0065	2002-06-27	John E. Rigby	While approaching Letete, a suspected malfunction in the steering control unit caused the John E. Rigby to ground at low tide on a submerged ledge. The vessel refloated with the flood tide and was secured alongside.
M02M0153	2002-12-03	Deer Island Princess II	The Deer Island Princess II made momentary contact with the bottom while transiting to Butler Point. One Z-drive thruster unit detached from the hull. This occurrence resulted from normal operations conducted at low tide.
M03M0180	2003-10-29	Deer Island Princess II	The Deer Island Princess II touched bottom in poor visibility and heavy rain, and its Z-drive thruster unit was damaged. This occurrence resulted from normal operations conducted at low tide.
M04M0005	2004-01-12	Deer Island Princess II	The Deer Island Princess II made contact with the bottom while transiting Letete Passage. The vessel sustained damage to its hull and a Z-drive thruster unit.
M04M0019	2004-04-21	John E. Rigby	The John E. Rigby made momentary contact with the bottom while transiting Letete Passage. One of the vessel’s Z-drive thruster units detached. This occurrence resulted from normal operations conducted at low tide.
M04M0039	2004-06-01	John E. Rigby	The John E. Rigby ran aground near the Letete wharf. One of the vessel's Z-drive thruster units was damaged. The vessel refloated on the next high tide.
M05M0060	2005-07-01	Deer Island Princess II	The Deer Island Princess II made momentary contact with the bottom while transiting Little Letete Passage. The vessel continued to Butler Point.
M05M0073	2005-07-25	Deer Island Princess II	The Deer Island Princess II made momentary contact with the bottom while transiting from Letete to Butler Point. One of the vessel’s Z-drive thruster units detached as a result of the impact. This occurrence resulted from normal operations conducted at low tide.
M05M0105	2005-11-30	John E. Rigby	The John E. Rigby ran aground on the beach while docking at Butler Point. The vessel refloated on the tide.
M07M0006	2007-03-03	John E. Rigby	The John E. Rigby was reported to have made contact with the bottom while transiting the Little Letete Passage. Vessel subsequently made its way to Butler Point. One Z-drive thruster unit detached.
M07M0087	2007-11-15	John E. Rigby	The John E. Rigby made contact with the bottom while transiting the Letete Passage. The vessel returned to Butler Point without further incident. One of the vessel’s Z-drive thruster units was damaged.
M09M0054	2007-09-27	John E. Rigby	The John E. Rigby ran aground while coming alongside the wharf at Letete.
M13M0004	2013-02-12	Deer Island Princess II	The Z-drive thruster unit on the Letete end of the Deer Island Princess II made bottom contact while approaching the wharf at Letete. The vessel sustained minor damage.
M15A0030	2015-02-21	John E. Rigby	The John E. Rigby made light contact with the bottom while departing the wharf at Butler Point during extreme low tide. The vessel was inspected by divers and no damage was found. This occurrence resulted from normal operations conducted at low tide.
M15A0353	2015-11-25	John E. Rigby	The John E. Rigby made bottom contact while departing from Butler Point. One of the vessel’s Z-drive thruster units detached and approximately 3 gallons of oil was released into the water. The vessel returned to the wharf without further incident. This occurrence resulted from normal operations conducted at low tide. Following this occurrence, Coastal Transport Limited implemented an operational restriction, prohibiting its vessels from using the north side of the wharf at Butler Point when the tide is less than 0.5 m above chart datum.
M17A0035	2017-02-07	Deer Island Princess II	While departing the wharf at Letete, one of the Deer Island Princess II’s Z-drive thruster units detached. The vessel sustained minor damage.