A 2002 paper by Pomeroy and Sherwood on “Managing the Human Element in Modern Ship Design and Operation” observes that “anecdotal evidence suggests that ship bridge crews are going through a similar change to that in aircraft cockpits. Older, but apparently more experienced operators, may not fully appreciate the capabilities and demands of the current technology, but in an emergency would concentrate on the fundamentals of the situation. Conversely, younger, less experienced operators would attempt to fix the computer and not look out of the window.”
The same paper also points out that “there have been a number of instances where technical solutions have been proposed to human-system problems; typically introducing more alarms… it is important that solutions go beyond the specifics of an incident and do not make systems more brittle. We should be wary of any proposal to introduce a new alarm channel as a solution.”
Writing for the Institute of Electrical and Electronics Engineer’s Spectrum on automation in aviation, Robert N. Charette in his “Automated to Death” suggests that “maybe one way to remind ourselves of the potential effects of the ironies and paradoxes of automation is to simply pull the plug.” He quotes Martyn Thomas, a fellow of the Royal Academy of Engineering: “If we don’t want people to depend on automated systems, we need to turn them off sometimes. People, after all, are the backup systems, and they aren’t being exercised.”
A stranding 15 years ago is offered in the context of the above.
The 568-foot, 32,396-grt Panamanian-registered passenger vessel Royal Majesty with 1,509 aboard departed St. George’s, Bermuda, at noon, bound for Boston. Her integrated bridge system included: gyro compass with bridge repeaters; a bell log recording time, engine rpm, propeller pitch and true course and speed (per the GPS output); a fathometer with display, recording and alarm capability; speed log; two ARPA-equipped radars; one ARPA-capable slave radar; Loran-C; STN Atlas autopilot; course recorder; and the NACOS 25 (NC25) navigation and control system.
Prior to departure, the navigator had checked the navigational and communication equipment and found all in “perfect” operating condition.
The NC25 performed a “navigation and control” role via two functions, map and autopilot. The former provided for a pre-programmed “map” to be displayed on the ARPA, including the planned track, buoys, waypoints, traffic lanes, etc. The vessel’s position, provided by the selected “external position receiver” (customarily the GPS unit), would be continually displayed against the pre-programmed map as well as real-time radar targets consistent with the range setting.
The autopilot received input from that same selected “external position receiver” (the GPS unit), compared that position with the desired track and adjusted course accordingly. In addition, the autopilot received gyro/speed-log inputs via an “interface box,” enabling it to independently generate a continuous DR position. Should the difference between the position data transmitted by the GPS and the DR position generated by the autopilot exceed 200 meters, the autopilot’s “position-fix alarm” would sound.
A caution: when reading summaries (NTSB or otherwise) of the event, the term “GPS” is used in two contexts: (a) the unit or “box” that transmits “position data” to other integrated system components, data that may or may not be satellite derived and (b) an actual satellite-determined position. To explain further — an important (and to later prove pivotal to the story) factor was that two default pathways designed into the GPS unit for position data output in case of satellite signal degradation or outright loss were (a) hybrid and (b) DR. The former could include Loran-C or Omega; DR was possible because gyro and speed log data were transmitted to the GPS unit (as well as the autopilot) allowing for a running DR to be maintained by the GPS unit itself. According to STN Atlas, “during construction of Royal Majesty … (they were) …told that the GPS would be backed up by a Loran-C system during periods of GPS data loss.” Having clarified the nav gear setup, the story returns to the bridge.
On her second and last day at sea, clear skies, 10-mile visibility and 8- to 10-knot winds from the ENE prevailed — much the same wind pattern the ship experienced since leaving Bermuda. Now less than 12 hours away from her scheduled Boston arrival, she approached the precautionary zone some 60 miles SE of Nantucket where the Nantucket/Ambrose (E/W) and the Nantucket/Boston (NW/SE) traffic separation schemes diverge.
Transiting the northbound lane of the Boston scheme, she would encounter a series of six buoys at approximately 10-mile intervals, BA through BF. At about 1845, a radar target appeared on the port bow at approximately the time, range and bearing that BA was expected — consistent with the pre-programmed location of BA on the ARPA map presentation; 35 minutes later, a mark was sighted passing abeam to port and consistent with the radar target detected earlier. This information was given to the oncoming 20-24 OOW as he would expect to pick up BB and BC on his watch. During the preceding 16-20 watch, the vessel’s progress had been plotted hourly using the lat/long supplied by the GPS, the paper plot remaining consistent with the pre-programmed track on the ARPA display. The master was advised that BA had been detected on radar and subsequently passed.
The 20-24 OOW continued to plot hourly fixes using data from the GPS and reduced the radar range scale from 12 to six miles. About 2030 both lookouts reported a “yellow light” and somewhat later “several high red lights” to port.
The mate acknowledged both reports. Somewhat later the master called the bridge inquiring as to whether BB had been sighted — the second officer replied that he had “seen it.” During that watch, the master had made several bridge visits, and about 2200 he again asked about BB being sighted and was again told that it had been, but he was not told of the lookout’s sighting of the high red lights; checking the chart and the ARPA pre-programmed track, he then left the bridge.
Not long after, the port lookout reported “blue and white water dead ahead.” That report was acknowledged by the second officer, who again took no action. Shortly later, the vessel’s lurch to port, followed by heels to starboard and port, brought the master rapidly back to the bridge. Once the radar scale was increased, the southeast coast of Nantucket appeared about 10 miles to the northwest. Based on data from the Loran-C, a plot confirmed that at about 2225, Royal Majesty was astride Rose and Crown Shoal — some 17 miles west of her intended track, where the GPS-directed autopilot had taken her.
Fortunately there were no injuries and no pollution, but some $7 million in damages and lost revenue and many questions — the inevitable “How? Why?” etc. With a nod to the memory of Paul Harvey, stay tuned next time “for the rest of the story.”
About the Author:
Following graduation from the U.S. Naval Academy, Jim Austin served aboard both a destroyer and cruiser with duties that included navigator, assistant CIC (combat information center) officer and air intercept controller. He subsequently worked on the submarine launched ballistic missile program for the General Electric Co.’s Ordnance Division. He holds a U.S. Coast Guard master’s license and writes frequently on ship collisions as seen through the twin lenses of the navigation rules and maritime law. He’s a retired physician living in Burlington, Vt.
