PB97-916401

NTSB/MAR-97/0l

NATIONAL

TRANSPORTATION

SAFETY

BOARD

WASHINGTON, DC 20594

MARINE ACCIDENT REPORT

GROUNDING OF THE PANAMANIAN PASSENGER SHIP

ROYAL MAJESTY ON ROSE AND CROWN SHOAL

NEAR NANTUCKET, MASSACHUSETTS

JUNE 10, 1995

6598A
Abstract: On June 10, 1995, the Panamanian passenger ship Royal Majesty grounded on Rose and

Crown Shoal about 10 miles east of Nantucket Island, Massachusetts, and about 17 miles from where the

watch officers thought the vessel was. The vessel, with 1,509 persons on board, was en route from St.

George’s, Bermuda, to Boston, Massachusetts. There were no deaths or injuries as a result of this

accident. Damage to the vessel and lost revenue, however, were estimated at about $7 million.

This report examines the following major safety issues: performance of the Royal Majesty’s integrated

bridge system and the global positioning system, performance of the Royal Majesty’s watch officers,

effects of automation on watch officers’ performance, training standards for watch officers aboard

vessels equipped with electronic navigation systems and integrated bridge systems, and design,

installation, and testing standards for integrated bridge systems.

As a result of its investigation, the National Transportation Safety Board issued safety recommendations

to Majesty Cruise Line, the U.S. Coast Guard, STN Atlas Elektronik GmbH, Raytheon Marine, the

National Marine Electronics Association, the International Electrotechnical Commission, the

International Council of Cruise Lines, the International Chamber of Shipping, and the International

Association of Independent Tanker Owners.

The National Transportation Safety Board is an independent Federal agency dedicated to promoting

aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the

agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate

transportation accidents, determine the probable causes of the accidents, issue safety recommendations,

study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in

transportation. The Safety Board makes public its actions and decisions through accident reports, safety

studies, special investigation reports, safety recommendations, and statistical reviews.

Information about available publications may be obtained by contacting:

National Transportation Safety Board

Public Inquiries Section, RE-51

490 L'Enfant Plaza, SW

Washington, DC 20594

(202) 314-6551

Safety Board publications may be purchased, by individual copy or by subscription, from:

National Technical Information Service

5285 Port Royal Road

Springfield, Virginia 22161

(703) 487-4600
GROUNDING OF THE PANAMANIAN

PASSENGER SHIP ROYAL MAJESTY

ON ROSE AND CROWN SHOAL

NEAR NANTUCKET, MASSACHUSETTS

JUNE 10, 1995

MARINE ACCIDENT REPORT

Adopted: April 2, 1997

Notation 6598A

NATIONAL

TRANSPORTATION

SAFETY BOARD

	
 
 



CONTENTS

	

 



	


 






 

 

 


  

!
  

"
  

#
  

$
"
  


 %

&%



'$(
 %



'$(
 

)

&
*#	"$ +

)
(


!


 %

,


 %

)






%






&$ -

$
('.*
$
(/

 -

$
('.0
12

!

2

$
"3
 2



$

 4



& 

	


 

)

"
.
 %5

67
7

%

1

	%

&$$

%

8

9

%

*
8,	 % 




#
	% 

!
.!
.%%



	

)

"
.
 %-



'$(
:

 %2


;$(


 %

)

"
.*

'$(
 -5

;8

 - 






'$(
 -%

-+


	 -4

-<

	77,	=

; +%

	77,'=!
(:.	
. >'
&? ++

	77,=!
(:.
# +

	77,=




&$/
	
 2

	77,=$
('.*
$
(/

2%

	77,1=/#

9
$	@5A+ 2+

	77,&=	00
	
(24
v

EXECUTIVE SUMMARY

About 2225 on June 10, 1995, the Panamanian passenger ship Royal Majesty grounded on

Rose and Crown Shoal about 10 miles east of

Nantucket Island, Massachusetts. The vessel,

with 1,509 persons on board, was en route from

St. George’s, Bermuda, to Boston, Massachusetts. Initial attempts to free the vessel were unsuccessful. Deteriorating weather and sea conditions prevented the evacuation of passengers

and crewmembers from the vessel.

On June 11, the Royal Majesty, with the aid

of five tugboats, was freed from its strand. Initial damage surveys revealed deformation of the

vessel’s double bottom hull. However, no penetration or cracking of the hull was detected, and

no fuel oil had been spilled. The U.S. Coast

Guard gave the vessel permission to proceed to

Boston. On June 12, the vessel arrived in Boston

and disembarked its passengers.

There were no deaths or injuries as a result

of this accident. Damage to the vessel and lost

revenue, however, were estimated at about $7

million.

The National Transportation Safety Board

determines that the probable cause of the

grounding of the Royal Majesty was the watch

officers’ overreliance on the automated features

of the integrated bridge system, Majesty Cruise

Line’s failure to ensure that its officers were

adequately trained in the automated features of

the integrated bridge system and in the implications of this automation for bridge resource

management, the deficiencies in the design and

implementation of the integrated bridge system

and in the procedures for its operation, and the

second officer’s failure to take corrective action

after several cues indicated the vessel was off

course.

Contributing factors were the inadequacy of

international training standards for watchstanders aboard vessels equipped with electronic

navigation systems and integrated bridge systems and the inadequacy of international standards for the design, installation, and testing of

integrated bridge systems aboard vessels.

This report examines the following major

safety issues:

• Performance of the Royal Majesty’s

integrated bridge system and the

global positioning system.

• Performance of the Royal Majesty’s

watch officers.

• Effects of automation on watch officers’ performance.

• Training standards for watch officers aboard vessels equipped with

electronic navigation systems and

integrated bridge systems.

• Design, installation, and testing

standards for integrated bridge systems.

As a result of its investigation of this accident, the Safety Board issued safety recommendations to Majesty Cruise Line, the U.S. Coast

Guard, STN Atlas Elektronik GmbH, Raytheon

Marine, the National Marine Electronics Association, the International Electrotechnical Commission, the International Council of Cruise

Lines, the International Chamber of Shipping,

and the International Association of Independent

Tanker Owners.

1

The Accident

About 22251

 on June 10, 1995, the Panamanian passenger ship Royal Majesty (see figure 1)

grounded on Rose and Crown Shoal near Nantucket Island, Massachusetts. The Royal Majesty, carrying 1,509 passengers and crewmembers, was en route from St. George’s, Bermuda,

to Boston, Massachusetts. No injuries or deaths

resulted from the grounding.

On the night of the accident, the Royal Majesty was on the last day of a 7-day voyage. The

ship had left Boston for Bermuda on June 5. The

vessel had arrived in St. George’s on June 7,

where it was berthed until it departed Bermuda

on June 9 for the return trip to Boston. The vessel was scheduled to arrive in Boston about

0530 on June 11.

The return trip to Boston was divided into

two legs. The first leg normally extended from

St. George’s to the entrance of the approach to

the Port of Boston Traffic Separation Scheme

(Boston traffic lanes)—a distance of more than

500 miles over open ocean. The second leg

normally took the vessel in a northerly direction

through the traffic lanes along the eastern edge

of Nantucket Shoals and around the eastern

shores of Cape Cod. The entire voyage to Boston (a distance of about 677 miles—see figure

2) normally took about 41 hours.

The navigator testified that on June 9, he

went on duty about an hour before the scheduled

departure time of 1200. He said that he customarily tested the vessel’s navigational equipment

before getting underway. He stated that when he

tested the navigation equipment, including

“compasses, repeaters, radars, NACOS 25, GPS,

Loran-C, and the communications systems”

during the half hour before the vessel departed

St. George’s, he found the equipment to be in

 1

This report uses eastern standard times based on the 24-

hour clock.

“perfect” operating condition. He said that

shortly after departure, he set the navigation and

command system (NACOS) 25 autopilot on the

navigation (NAV) mode.2

 He further stated that

later when the vessel dropped off the harbor pilot (about 1230), he compared the position data

displayed by the global positioning system

(GPS)3

 and by the Loran-C4 and found that the

two sets of position data indicated positions

within about a mile5

 of each other.

According to the watch officers on duty, the

northbound trip was uneventful during the first

24 hours. The watch officers stated that the

Royal Majesty followed its programmed track,

as indicated on the display of the automatic radar plotting aid (ARPA) maintaining a course of

about 336°.6

 2

A description of the vessel’s radar and navigational

equipment is contained in a section on vessel information

later in the report. When set on the NAV mode, the

NACOS 25 autopilot automatically corrected for the effect

of set and drift caused by the wind, sea, and current to keep

the vessel within a preset distance of its programmed track.

3

The GPS is a satellite-based radio navigation system designed to provide continuous and accurate position data

under all weather and sea conditions. The accuracy of the

system is based on the GPS unit’s ability to receive, identify, and measure radio signals from orbiting satellites. The

GPS receiver on the Royal Majesty, when fully operational,

was capable of providing position data accurate to within

100 meters to the NACOS 25 autopilot (see discussion later

in this section).

4

The Loran-C is a radio-based navigation system designed to provide position data along the coasts of the

United States. The system is based on the Loran-C unit’s

ability to receive, identify, and measure time-difference

radio signals from a series of land-based Loran stations.

The accuracy of the system is largely dependent on the

user’s location in relation to the transmitting stations. For

example, the Loran lines of position in the Bermuda area

cross at oblique angles, whereas along the U. S. coast, numerous lines of position cross at much sharper angles to

provide greater accuracy.

5

In this report, the term mile means nautical mile.

6

Unless otherwise specified, only true courses and bearings are noted in this report.

INVESTIGATION

3

Figure 2—Map of route between Bermuda and Boston.
4

At 1200 on June 10, the navigator was again

on watch, assisted by a quartermaster. According to the navigator, the Royal Majesty maintained its course of 336°, and its speed was 14.1

knots (over ground). Entries in the vessel’s

bridge log indicated cloudy skies, winds out of

the east-northeast at 8 knots, and seas between 1

and 3 feet. Meteorological visibility was reportedly at least 10 miles.

The navigator stated that during his watch,

he was using the port ARPA on the 12-milerange scale. (See figure 3.) He also stated that

he was plotting hourly fixes on the chart of the

area using position data from the GPS. He stated

that although he frequently checked the position

data displayed by the Loran-C, all of the fixes

that he plotted during the voyage from Bermuda

were derived from position data taken from the

GPS and not the Loran-C. (See figure 4. In the

lower photograph, the lower receiver was installed after the accident.) The navigator further

stated that in the open sea near Bermuda, the

positions indicated by the GPS and Loran-C

would have been expected to be within 1⁄2 to 1

mile of each other. As the vessel approached

closer to the United States, the positions would

have been expected to be within about 500 meters of each other.

At 1600, the watch changed, and the vessel’s chief officer relieved the navigator. The

chief officer was assisted by a quartermaster,

who acted as either a helmsman or a lookout on

an as-needed basis. The chief officer stated that

he used the port radar set on the 12-mile range.

He further stated that no procedure specified the

number of radars to use, but that usually two

were used in bad weather. He stated that because the weather was good and visibility was

clear, he used one radar. The chief officer also

indicated that he relied on the position data from

the GPS to plot hourly fixes during his watches

and that the Loran-C was used as a backup system in case the GPS malfunctioned. He stated,

however, that for the 1700 and 1800 hourly

fixes he compared the data from the GPS with

the data from the Loran-C and that in both instances the Loran-C indicated a position about 1

mile to the southeast of the GPS position.

The chief officer testified that before the

1700 hourly fix, at about 1645, the master telephoned the bridge and asked him when he expected to see the BA buoy, the buoy that marked

the southern entrance to the Boston traffic lanes

(see figure 5). The chief officer responded that

the vessel was about 21⁄2 hours away (35.25

miles at 14.1 knots) from the buoy. The master

testified that he asked the chief officer to call

him when he saw the buoy. According to the

chief officer, about 45 minutes later (1730), the

master visited the bridge, checked the vessel’s

progress by looking at the positions plotted on

the chart and at the map overlay exhibited on the

ARPA display, and asked a second time whether

the chief officer had seen the BA buoy.7

 The

chief officer responded that he had not. Shortly

thereafter, the master left the bridge.

According to the chief officer, about 1845,

he detected on radar a target off his port bow at

a range of about 7 miles and concluded that the

target was the BA buoy. He stated that his conclusion had been based on the GPS position

data, which indicated that the Royal Majesty

was following its intended track, and on the fact

that the target had been detected about the time,

bearing, and distance that he had anticipated

detecting the BA buoy. He further testified that

on radar the location of the target coincided with

the plotted position of the buoy on the ARPA

display. He said that about 1920, the radar target

that he believed to be the BA buoy passed down

the Royal Majesty’s port side at a distance of 1.5

miles. He stated that he could not visually confirm the target’s identity because of the glare on

the ocean surface caused by the rays of the setting sun.

He testified that about 1930, the master

telephoned the bridge and asked him for the

third time whether he had seen the BA buoy.

According to the chief officer, he responded that

 7

The master testified that it was his practice to visit the

bridge about 10 to 15 minutes after the change of the watch

and that he typically called or visited the bridge between

two and four times during each watch. Each visit to the

bridge lasted between 10 and 15 minutes. He also testified

that when he visited the bridge he typically checked the

vessel’s position by looking around and by examining the

chart and the NACOS 25 map overlay on the ARPA.
5

3

u

7

7 n WA, ., . . *oO%n( -, W....

w Aoti

-,.. AR03no .. --,. W

Figure 5-Intended track and approximately actual track.
8

the ship had passed the BA buoy about 10 minutes earlier (about 1920). The master then asked

whether the chief officer had detected the buoy

on radar; the chief officer replied that he had.

According to the testimony of the chief officer

and the master, the chief officer did not tell the

master that he had been unable to visually confirm the identify of the BA buoy, and the master

did not ask whether the buoy had been visually

confirmed.

The second safety officer (second officer)

testified that he arrived on the bridge about 1955

and prepared to assume the watch from the chief

officer. According to the testimony of both officers, during the subsequent change-of-the-watch

briefing (2000), they discussed the traffic conditions and the vessel’s course, speed, and position. According to the testimony, the chief officer did not discuss with his relief the circumstances surrounding his identification of the BA

buoy. The second officer testified that at 2000,

he assumed the watch, assisted by two quartermasters,8

 and that the chief officer left the

bridge. The second officer stated that shortly

after assuming the watch, he reduced the range

setting on the port radar from the 12-mile range

to the 6-mile range. He testified that he relied on

the position data from the GPS in plotting

hourly fixes during his watches and that he considered the Loran-C to be a backup system. He

also stated that it was not his practice to use the

Loran-C to verify the accuracy of the GPS.

The quartermaster standing lookout on the

port bridge wing (port lookout) stated that about

2030 he saw a yellow light off the vessel’s port

side and reported the sighting to the second officer. According to the quartermaster, the second

officer acknowledged the report, but took no

further action. At the time of the sighting, the

NACOS 25 was showing the Royal Majesty’s

position to be about halfway between the BA

and BB buoys. (The BB buoy is the second buoy

encountered when traveling northbound in the

Boston traffic lanes.) Shortly after the sighting

of the yellow light, both the starboard and port

lookouts reported the sighting of several high

 8

The two quartermasters served as port and starboard

lookouts.

red lights off the vessel’s port side.9 According

to the lookouts, the second officer acknowledged the report, but took no further action.

The port lookout stated that shortly after the

sightings of the yellow and red lights, the master

came to the bridge. The master testified that he

spent several minutes talking with the second

officer and checking the vessel’s progress by

looking at the plotted fixes on the chart and the

map overlay on the ARPA display. According to

the master, the GPS and ARPA displays were

showing that the vessel was within 200 meters

of its intended track. The master then left the

bridge. According to the testimony of both the

master and the second officer, no one told the

master about the yellow and red lights that the

lookouts had sighted earlier.

The master testified that about 2145, he

telephoned the bridge and asked the second officer whether he had seen the BB buoy. The master stated that the second officer told him that he

had seen it.

According to the master, about 2200 he arrived on the bridge for the second time during

that watch. He testified that after talking with

the second officer for several minutes, he

checked the vessel’s progress by looking at the

positions plotted on the chart and at the map

overlay on the ARPA display. He stated that he

again asked the second officer whether he had

seen the BB buoy and the second officer replied

that he had. Satisfied that the positions plotted

on the chart and that the map displayed on the

radar continued to show the vessel to be following its intended track, the master left the

bridge about 2210. He stated that he did not

verify the vessel’s position using either the GPS

or the Loran-C for two reasons: (1) his officers

had reported that the BA and BB buoys had

been sighted, and (2) he had observed that the

map overlay on the ARPA display showed that

the vessel was following its intended track.

 9

A series of radio towers with flashing red lights are on

the eastern end of Nantucket. Because the towers are about

30 miles from the traffic lanes, the lights are not generally

visible to vessels transiting the traffic lanes.
9

The second officer testified that he had not

seen the BB buoy but had informed the master

otherwise because he had “checked the GPS and

was on track” and because “perhaps the radar

did not reflect the buoy.” He also testified that

on the previous transits of the traffic lanes, he

had sighted buoys both visually and by radar.

According to the testimony of the lookouts,

a few minutes after the master left the bridge,

the port lookout reported to the second officer

the sighting of blue and white water dead ahead.

According to this lookout, the second officer

acknowledged receiving the information, but did

not discuss it or take action. The port lookout

stated that the vessel later passed through the

area where the blue and white water had been

sighted.

The second officer testified that about 2220,

the Royal Majesty unexpectedly veered to port

and then sharply to starboard and heeled to port.

The second officer stated that because he was

alarmed and did not know why the vessel was

sheering off course, he immediately switched

from autopilot to manual steering. The master,

who was working at his desk in his office, felt

the vessel heel to port and ran to the bridge. He

stated that when he arrived on the bridge, he

saw the second officer steering the ship manually and instructed one of the lookouts to take

over the helm. The master then turned on the

starboard radar, set it on the 12-mile range,10

and observed that Nantucket was less than 10

miles away. According to the master, he immediately went into the chart room to verify his

position. He stated that he then immediately ordered the helmsman to apply hard right rudder.

However, before the helmsman could respond,

the vessel grounded, at 2225. The master stated

that he then had the vessel’s GPS and Loran-C

checked and realized for the first time that the

GPS position data was in error by at least 15

miles. The Loran-C position data showed the

vessel where it had grounded, about 1 mile

 10According to the master, the starboard radar was typically turned off during good weather. When he used the

starboard radar, he normally set it on the 12-mile range. He

further stated that no procedures prescribed the radar scale

to use; it was the option of the watch officer on duty.

south of Rose and Crown Shoal.11 (See figure

6.) Charts of the area indicate that the shoal,

which is about 10 miles east of Nantucket’s

Sankaty Head Light, has a hard sandy bottom.

Postaccident Events

The master testified that immediately after

the grounding, he called the engineroom and

told the engineering officer on duty that the vessel had grounded and that he should immediately inspect the vessel’s double bottom hull and

fuel tanks for signs of leakage. According to the

master, several minutes later, the engineroom

called the bridge and reported that there was no

evidence that the vessel was taking on any water. The master responded by asking the engineroom personnel to repeat the inspection, which

they did. The master stated that about 2245 the

engineroom again reported to him that no evidence of leakage had been found. Shortly thereafter, the master instructed the vessel’s cruise

director to inform the passengers and crewmembers that the vessel had run aground, that it was

not in any danger, and that the crew was trying

to free the vessel by using its engines. At 2310,

the U.S. Coast Guard, after receiving a message

from a passenger via cellular telephone, called

the Royal Majesty, at which point the Royal

Majesty requested Coast Guard assistance. According to the testimony of the master, he had

been about to notify the Coast Guard when the

Coast Guard called him.12

Several unsuccessful attempts were made

between 2245 and 0015 to free the vessel using

the main engines. Shortly thereafter, Majesty

Cruise Line, the owner of the vessel, made

 11Rose and Crown Shoal is one of numerous shoals that

lie east and south of Nantucket Island, making the area one

of the most dangerous for ships. (See “Waterway Information” later in this report for a more detailed discussion.)

12According to 46 Code of Federal Regulations 4.05-

1(a), immediately after the addressing of resultant safety

concerns, the owner, agent, master, operator, or person in

charge shall notify the nearest Marine Safety Office, Marine Inspection Office, or Coast Guard Group Office whenever a vessel is involved in a marine casualty consisting of

an unintended grounding. According to the Coast Guard,

the time interval was reasonable and the Coast Guard took

no enforcement action regarding the notification.

11

arrangements to hire tugboats to pull the vessel

off the shoal.

At 0024 on June 11, the passengers were

told that the efforts to free the vessel had been

unsuccessful and that the vessel was awaiting

the arrival of tugboats. Later that morning, the

passengers were told that they and their luggage

would be transferred to ferries for transport to

Hyannis, Massachusetts, and then to Boston.

At 1330 on June 11, the ferries M/V Brant

Point and Point Gammon arrived on scene.13

The Brant Point and Point Gammon together

could hold about 1,200 persons.

At 1550, the tugboats Vincent Tibbets, Harold Rheinhauer, Resolute, Reliance, and Venus

arrived on scene. Meanwhile, sea conditions

continued to deteriorate. About 1600, plans to

offload passengers to the ferries were canceled

because sea conditions had become too hazardous. Shortly thereafter, the Brant Point and the

Point Gammon returned to Hyannis.

At 2154, the Royal Majesty, with the aid of

five tugboats, was refloated and escorted to a

safe anchorage near Chatham, Massachusetts,

where the damage was surveyed. At 0742 on the

morning of June 12, the Coast Guard gave the

vessel permission to begin the 6-hour trip to

Boston. At 1535, the vessel was safely moored

with its port side to the Black Falcon Passenger

Terminal in Boston. Passengers began disembarking the vessel at 1710.

The Coast Guard/Safety Board hearing into

the grounding of the Royal Majesty was held

June 14 through June 16 in Boston. After the

hearing, the Safety Board learned that two fishing vessels were just east of Fishing Rip Shoal

on the evening of June 10. They observed a

cruise ship pass about 3⁄4 mile west of the fishing

vessels’ position heading in a northerly direction. About 2042, one of the fishing vessels radioed a cruise ship at “41 02N, 69 24W” via

VHF-FM channel 16. They later stated it was

their intent to inform the vessel that it was in an

 13Hyline Cruises in Hyannis, Massachusetts, owned and

operated the two ferries. Hyline Cruises operates a ferry

service between Cape Cod and Nantucket and Martha’s

Vineyard.

area not frequented by large cruise ships. The

calls to the cruise ship were in English; however, all the transmissions between the fishing

vessels, including the transmission regarding the

ship being in the wrong location, were in Portuguese. An unknown person interrupted the Portuguese conversation and requested that the

fishermen change channels. (See appendix F.)

According to international regulations

(SOLAS-Regulation 8), when ships such as the

Royal Majesty are at sea they are required to

maintain a continuous listening watch on the

navigating bridge on 156.8 MHz (channel 16).

During the Coast Guard Marine Board of Inquiry, the second officer was not asked whether

he was monitoring channel 16 on the night of

the accident.14 Since that time, a spokesperson

for Majesty Cruise Line has identified the person who interrupted as possibly the second officer. The Safety Board could not confirm this.

According to the Coast Guard, the call to the

cruise ship from the fishing vessel did not convey any urgency and would not have alerted the

second officer aboard the Royal Majesty or the

radio operator at U.S. Coast Guard Group

Woods Hole, where the transmissions were recorded, that the Royal Majesty or any other

cruise ship was in danger.

Injuries

The accident did not cause any deaths or

injuries.

Vessel Damage

On June 16, the Royal Majesty left Boston

for the Sparrows Point Shipyard in Baltimore,

Maryland, where it was drydocked and repaired.

The grounding of the Royal Majesty had damaged its outer hull extensively. According to the

field survey conducted by Lloyds Register on

June 19, a portion of the vessel’s outer shell

plating, which was about 51 feet wide and 41

feet long, needed to be cropped and renewed.

The report also indicated that the bottom fuel oil

 14The second officer was released by Majesty Cruise

Line after the accident and is not available in this country.
12

tanks and the internal steel structure between the

vessel’s internal tank tops and hull plating had

been substantially damaged. No oil spilled as a

result of the accident.

On June 22, the vessel was refloated and

returned to Boston. On June 24, the vessel resumed passenger service. Total structural damage was estimated at about $2 million. Lost

revenue for the period the vessel was out of

service was estimated at about $5 million.

Crew Information

Master.—The master, age 53, held a master’s certificate for seagoing vessels that had

been issued by Panama on June 7, 1991. He also

held a master’s certificate from the Greek government that was originally issued in 1974. He

had been going to sea for 32 years. During his

career, he had served in a variety of licensed

deck officer positions on tankships and passenger ships. Between 1968 and 1992, he had sailed

as chief officer and master on several passenger

vessels built in the 1950s. Majesty Cruise Line

assigned him as master of the Royal Majesty in

November 1992. He stated that the Royal Majesty was the first vessel that he had served on

that had an integrated bridge system.15

The master testified that he had not consumed any alcohol before the grounding, that he

had not taken any prescription medicine, and

that he was not required to wear eyeglasses. He

stated that he typically slept about 7 hours each

night, from 2400 to 0700, and then took a 1-hour

or 11⁄2-hour nap in the afternoon, schedule permitting.

Chief Officer.—The chief officer, age 43,

held a master’s certificate for seagoing vessels

that had been issued by Panama on May 20,

1994. He also held a chief officer’s certificate

issued by the Greek government in 1982. He had

been going to sea since 1971. During his career,

he had served in a variety of licensed deck officer positions on cargo ships, tankships, and passenger ships. Between 1981 and 1992, he had

been chief officer on four passenger vessels

 15“Vessel Information,” the next section of the report,

discusses integrated bridge systems.

built in the 1950s. Majesty Cruise Line hired

him as chief officer on the Royal Majesty in

1992. The Royal Majesty was the first vessel he

had served on that had an integrated bridge system. At the time of the grounding, he had spent

30 of the previous 36 months as a bridge watch

officer aboard the Royal Majesty.

The chief officer stated that routinely after

finishing his 1600-to-2000 watch, he would jog

on deck (weather permitting) for about 45 minutes, work out in the vessel’s gym for about 15

minutes, and retire around 2200. He normally

slept until about 0330. He stated that typically

he also slept about 21⁄2 hours before starting his

1600 watch.

Navigator.—The navigator, age 30, held a

second officer’s certificate for seagoing vessels

that had been issued by the Greek government

on May 18, 1994. He also held a second officer’s license from Panama. He had been going

to sea in a licensed capacity since March 20,

1987. During his career, he had served 8 months

as second officer on a tankship and 7 months as

second officer on two passenger ships that had

been built in the 1950s. Majesty Cruise Line

hired him as a second officer on the S/S Seabreeze on July 18, 1994. He was assigned as

navigator aboard the Royal Majesty on August

1, 1994. The Royal Majesty was the first vessel

that he had served on that had an integrated

bridge system.

The navigator testified that he had not consumed alcohol in the 24 hours before his last

watch, that he was not taking any prescription

drugs, and that he was not required to wear eyeglasses.16

Second Officer.—The second officer, age

33, held a chief officer’s certificate for seagoing

vessels that had been issued by the Greek government on January 4, 1991. He also held a

chief officer’s license from Panama. He had

been going to sea in a licensed capacity since

May 1984. During his career, he had served in a

variety of licensed deck officer positions on

 16There was no information in the navigator’s testimony

about the amount of sleep he received in the 24 hours before his last watchstand or about his sleep pattern.
13

bulk carriers and passenger ships. He had sailed

as second officer and chief officer on five passenger vessels between 1987 and 1994. Majesty

Cruise Line hired him as a second officer on

May 1, 1995. After 3 weeks of on-the-job training, the master allowed him to stand a navigation watch alone. On May 21, 1995, he assumed

his duties as watch officer for the 0800-to-1200

watch. The Royal Majesty was the first vessel

that he had served on that had an integrated

bridge system.

The second officer testified that he had not

consumed alcohol or taken any prescription

medicine in the 24 hours before his last watch.

He stated that he slept about 7 hours after finishing his previous 2000-to-2400 watch and that

he had also taken a 2-hour nap before beginning

his 2000 watch on June 10.

Vessel Information

General.—The Royal Majesty was a conventional steel-hull, bulbous-bow, passenger

liner designed for unrestricted international

voyages. The vessel was constructed in 1992 at

Kvaener Masa Yard in Turku, Finland. Panama

had certified the vessel to carry 1,256 passengers and 490 crewmembers, a total of 1,746 persons. The vessel held the highest vessel classification for construction issued by Det Norske

Veritas (DNV). The vessel’s principal characteristics follow:

Length overall: 568 feet (173.16 meters)

Breadth: 91 feet (27.60 meters)

Draft (departure

Bermuda): forward: 18 feet, 0.5 inches 

(5.5 meters); aft: 19 feet, 6 

inches (5.95 meters)

Gross registered

tonnage: 32,396

Displacement: 17,214 tons

Service speed: 19 knots

Propellers: two controllable pitch

The Royal Majesty was fitted with the following navigation, communications, shiphandling, and collision-avoidance equipment:

Radar: Two Krupp Atlas17 Model 8600 

A/CAS with ARPA

Radar: One Krupp Atlas slave radar 

with ARPA

Autopilot: STN Atlas Elektronik

GPS: Raytheon RAYSTAR 920 with 

dead-reckoning backup mode option

installed (NNE-205 DR interface)

Loran-C: Raytheon RAYNAV 780

VHF radios: Two Sailor radios (with dual 

monitoring capabilities)

Speed log: Atlas Dolog 23

Gyro

compass: Anschutz

Course

recorder: Anschutz

Integrated Bridge System.—The Royal

Majesty had an integrated bridge system. According to the definition of the International

Electrotechnical Commission (IEC),18 issued

after the vessel was built, an integrated bridge

system is a combination of systems that are integrated in order to allow centralized access to

sensor information and command/control from

workstations. One of the main components of

the vessel’s integrated bridge system was STN

Atlas Elektronik (STN Atlas) NACOS 25.19 The

NACOS 25 was a special upgrade of the first

generation NACOS 20 integrated navigation

system, of which approximately 130 have been

sold and installed on vessels of various types

and service. The NACOS 25 was specifically

designed for service on six Baltic Sea ferries

constructed at Kvaener Masa Yard. Some were

sold to Italian vessel owners. According to STN

Atlas, 14 NACOS 25 units were sold to owners

of passenger ships. The last unit was sold in

May 1988 to the shipyard constructing the Royal

Majesty. However, because of construction delays, the Royal Majesty’s NACOS 25 equipment

 17Krupp Atlas was the previous name of STN Atlas

Elektronik.

18A later section of the report discusses the IEC and integrated bridge systems in general.

19According to STN Atlas, 260 such units have been sold

worldwide; 200 are currently in service. (Safety At Sea.

June 1995, page 36.)
14

was held in stock until installation in the spring

of 1992.

The Royal Majesty’s NACOS 25 was capable of

creating radar maps and exhibiting them on the

ARPA display (see figure 7). The radar maps

could be tailored to include reference points

along the vessel’s intended track (aids to navigation, navigation marks, waypoints, turning

points, etc.). Navigation lines could also be

added to these maps for the purpose of outlining

the perimeter of traffic lanes, channels, and areas containing hazards to safe navigation.

The navigator testified that a radar map had

been created for the voyage between St.

George’s and Boston. He also testified that the

map, showing the vessel’s preprogrammed

track, waypoints, and the location of the buoys

near the intended track, was exhibited on the

ARPA display before the accident.

The autopilot portion of the NACOS 25,

using programmed information (latitude and

longitude of waypoints and the vessel’s maneuvering characteristics), gyro and speed data, and

position data from the GPS or the Loran-C, was

capable of automatically steering the vessel

along a preprogrammed track. When engaged

and operating in the NAV mode, the autopilot

steered the ship in accordance with the programmed track while automatically compensating for the effect of gyro error, wind, current,

and sea. According to the Royal Majesty’s

bridge officers, the NACOS 25 autopilot was

engaged and operating in the NAV mode from

the time the vessel departed St. George’s (1400

on June 9) to before the grounding.

The Raytheon GPS unit installed on the

Royal Majesty had been designed as a standalone navigation device in the mid- to late

1980s, when navigating by dead reckoning

(DR)20 was common and before the GPS satellite system was fully operational. The GPS unit

was designed to default to either a DR mode or

 20DR is a means of navigating. After an initial position is

established, the position is estimated over time using data

input from the vessel’s speed log and gyro. The accuracy of

DR calculations depends on the accuracy of the speed input

and the effects of wind and current.

a hybrid navigation mode (accepting position

data from a Loran-C, Omega, or Transit satellite

navigation receiver). The Royal Majesty’s GPS

was configured by Majesty Cruise Line to

automatically default to the DR mode when satellite data were not available.21 When the

RAYSTAR 920 GPS unit switches to DR mode,

it

• issues a series of aural chirps similar to those of a wristwatch alarm

(the total duration of the series is 1

second);

• continuously displays SOL (solution)22 and DR on a liquid crystal

display; the display measures 3

inches high by 3.5 inches wide (see

figure 8);

• changes the state of National Marine Electronics Association

(NMEA)23 0183 status field bits

from valid to invalid, indicating that

valid position data are no longer

being transmitted; and

• closes an electronic switch that is

provided as a means of activating an

external alarm or other device of the

installer’s choice (such as an external flashing light, audio alarm,

etc.).24

 21RAYSTAR 920 DR mode capability requires course

and speed input either by manual entry or via an optional

interface box. The Royal Majesty’s RAYSTAR 920 was

configured to use the DR interface box. According to STN

Atlas, during the construction of the Royal Majesty, STN

Atlas was told that the GPS would be backed up by a Loran-C system during periods of GPS data loss, but was not

told that the GPS receiver would default to the DR mode.

22Raytheon engineers informed the Safety Board that

SOL is meant to indicate that the GPS satellite position

solution is invalid or not available. According to the Raystar 920 operation manual, SOL means the unit cannot

calculate its lat/long position.

23The NMEA 0183 is an industry-standard electronic

signal specification that defines how data are to be transmitted from an electronic device.

24An external alarm was not connected to this switch on

the Royal Majesty.
15

Lal

L.g
“Y3Z

,.a: 7?3..,..., ,., ;.’

--:-

sg=

QD6.... # ..: -

t “7

m

I

Figure 8—GPS display showing SOL and DR.
17

All the watch officers testified that they did

not see SOL and DR displayed on the GPS unit

during their watches before the grounding. Their

testimony indicated that they understood the

meaning of these symbols and had seen them on

previous occasions.

The Raytheon RAYSTAR 920 GPS and the

Raytheon RAYNAV 780 Loran-C were designed to output position and other navigation

data in NMEA 0183 v1.5 format.25 The output

included the recommended minimum GPS data

sentence, RMC, which contained, among other

data, latitude/longitude position coordinates.26

A position receiver that transmits data is a

“talker” device in NMEA nomenclature; the

Raytheon 920 GPS identified itself as a GP

talker, which signified a GPS position receiver

sending GPS position data. A position receiver

such as the Raytheon 920 GPS, while operating

in different position modes, could identify itself

as an integrated instrument (II) talker. At the

time the system was designed, the NMEA specified a SYS sentence to identify the operational

mode of a hybrid system. The SYS sentence defines the mode in which the receiver is operating: GPS (G), Loran (L), Omega (O), Transit

(T), or Decca (D). However, DR is not a specified system mode in the NMEA 0183 SYS sentence. Thus, Raytheon designed the 920 GPS to

identify itself as a “GP” talker regardless of

GPS or DR mode and used the NMEA 0183

valid/invalid data bits as the means of notifying

“listeners” that its data were invalid when in DR

mode. However, the sentence formatter GDP

was available in NMEA 0183 v1.5 to indicate

dead reckoned geographic position fixes.

Although both the GPS and Loran-C simultaneously sent position data to the NACOS 25,

the NACOS 25 was designed to use position

data from only one external position receiver at

 25NMEA 0183 v1.5 was released in December 1987.

26According to STN Atlas, the NACOS, at the time of

delivery for Royal Majesty, was programmed to read the

NMEA 0183 v1.1 sentence GLL (geographic longitude/latitude) for position input. The sentence RMC was

only introduced with the NMEA 0183 v1.5 after the design

of the Radar Atlas 8600 was finished. (The radar provides

the interfaces to the position receiver(s), in a NACOS system.)

a time, as selected by the crew. That is, the

NACOS 25 was not designed to compare the

GPS and the Loran-C position inputs, nor was it

designed to display both sets of position data to

the bridge officers simultaneously so that they

could compare the data. On June 9 and throughout the voyage, the autopilot was set by the crew

to accept and display position data from the

GPS receiver, which was the position receiver

normally selected by the crew during the 3 years

the vessel had been in service.

Once the position receiver is selected, the

NACOS 25 recognizes the chosen position receiver based on the talker identifier codes in the

NMEA 0183 data stream; for example, GP in

the data stream from the Raytheon 920 GPS.

According to STN Atlas, its designers did not

expect a device identifying itself as GP to send

position data based on anything other than GPS

satellite data, particularly not DR-derived position data. Further, STN Atlas expected invalid

GPS position data to be recognizable by nulled

position data fields, by halted data transmission,

by a separate proprietary SLL sentence,27 or by

no changes in the position latitude/longitude.

The latter case would trigger the NACOS position-fix alarm; the other cases would cause the

NACOS to switch its position input to estimated

(its own DR mode) and to highlight this information at all NACOS and radar displays until

the transmission is resumed and/or the SLL sentence contains the valid data bit.

According to the NMEA, NMEA 0183 provides three methods to indicate whether the

transmitted data are inaccurate or unavailable:

(1) null fields where the sentence is transmitted

but no data are inserted in the fields in question;

(2) by using system-specific status sentences

(available only for Loran-C; and (3) by the use

of “status” or “quality indicator” characters in

specific sentences. There are no other provisions

within NMEA 0183 to indicate invalid data in

transmitted sentences. In version 1.5, the use of

 27NMEA 0183 provides proprietary data sentences for

special use between devices produced by the same manufacturer, but not between devices by two different manufacturers unless the two different manufacturers have coordinated use of such data sentences.
18

null fields is the most common method, as most

sentences do not have status fields. According to

STN Atlas’s interpretation of this specification,

when a position receiver with a GPS talker

identifier has no GPS position data available, it

must transmit null fields instead.

The NACOS 25 autopilot was programmed

to continuously calculate its own independent

DR position in order to provide a comparison

with the position data provided by the external

position receiver (GPS or the Loran-C in the

case of the Royal Majesty). If the autopilot’s DR

position and the external position-receiver’s position (GPS or Loran-C positions in the case of

the Royal Majesty) are within a specified distance of each other,28 the autopilot considers the

position data from the external position receiver

to be valid, makes any necessary course corrections, and uses the new external position receiver’s position to continue its own independent DR calculations. If, however, the two positions are more than the specified distance apart,

the autopilot sounds a loud alarm29 and presents

a visual indication (warning position fix) on all

the NACOS displays, including the radars,

meaning that a position discrepancy has been

detected that requires the watch officers’ immediate attention. If the lateral distance between

the GPS position and the preprogrammed track

line exceeds the specified distance, the autopilot

sounds a loud alarm and presents a visual indication (warning track limit exceeded) on the

NACOS display, meaning that the vessel is off

the intended track.

The navigator stated that during the 11

months he had been aboard the vessel, he had

observed a phenomenon he called “chopping.”

Other deck officers stated that they too had witnessed this phenomenon. According to the navigator, chopping occurred when, for whatever

 28The NACOS 25 autopilot has off-track and position-fix

alarms that allow the operator to set the off-track and position-comparison limits anywhere between 10 and 990 meters. On the day of the accident, the limit was set at 200

meters. This value, which is displayed to the crew as

TRACK LIMIT, is used for both the off-track and the position-fix alarm calculations.

29The alarm is designed to be audible within a range of

about 10 meters under normal ambient noise conditions.

reason, the position data displayed by the GPS

were unreliable. Majesty Cruise Line’s electronics technician and the Raytheon staff indicated that chopping could have been the result

of atmospheric interference with GPS signals or

the obstruction of the GPS antenna’s view of the

satellites by the vessel’s superstructure and/or

tall buildings or other structures while the vessel

was in port. These circumstances degraded the

GPS signal, changing the calculated position,

and consequently caused the radar map display

to jump erratically, which the crew referred to

as chopping.

According to the navigator’s testimony,

when chopping occurred, the 1-second series of

aural chirps sounded and SOL and DR appeared

on the GPS display. The master testified that

chopping also usually set off the NACOS 25

position-fix alarm, indicating that the difference

between the NACOS 25 DR position and the

GPS position was greater than 200 meters. He

stated that watchstanders had found, through

trial and error, that if they acknowledged the

alarm before switching to the COURSE mode,30

the autopilot automatically accepted the erroneous position data and the radar map moved

about the ARPA display. To avoid this, watchstanders switched the autopilot from the NAV

mode to the COURSE mode before acknowledging the alarm. Thus, they could use the map

until the GPS returned to normal. According to

the master, chopping generally lasted a few

minutes. Nothing in the testimony of the watch

officers suggested that chopping had occurred

during the trip from Bermuda to Boston.

According to Majesty Cruise Line, the GPS

antenna, originally installed on the radar mast,

had been moved in February 1995, several

months before the grounding, as part of an effort

to eliminate the chopping. Majesty Cruise

Line’s electronics technician indicated that as a

result of the move, the antenna’s view of the

satellites was less obstructed and the crew complained much less about chopping.

 30In COURSE mode, the NACOS 25 system steers a selected course while correcting for drift using the Doppler

log traverse speed component.
19

The Royal Majesty’s integrated bridge system was also fitted with an automatic bell logger

(bell log), which was located against the after

bridge bulkhead. At regular intervals, the bell

log recorded the propeller pitch settings, engine

revolutions per minute, true course, and speed.

It also recorded the time of each entry in

Greenwich mean time.31 The course and speed

data that were recorded by the bell log came

from the vessel’s GPS.

The bell log showed that it was turned on at

1131:54 on June 9. Between 1131:55 and

1133:17, the bell log recorded a course of 197°,

000°, and 197°, indicating that the GPS data

were invalid. This could be the result of the GPS

receiver being turned on and going through its

satellite acquisition process, chopping, antenna

connection problems, or other problems. The

record also showed that between 1133:18 and

1202, the Royal Majesty was steering various

courses. Between 1130 and 1202, the vessel was

still moored alongside the pier.32 Such course

variation while the vessel is stationary is consistent with normal GPS position variation and

the resulting calculation of courses between

those slightly different positions. The bell log

recorded various courses between 1203, when

the ship left the pier, and 1252, consistent with

port departure. At 1252:02, the bell log once

again began recording consecutive courses of

197° and 000°, when, in fact, the vessel was

steering a course of 333°, as shown by the ship’s

course recorder. At 1309:06, the bell log recorded a course of 336°. After that recording,

the bell log recorded 197°/000° headings continuously until after the vessel’s arrival in Boston.33 (See table 1.) After the accident, Majesty

Cruise Line advised the Safety Board that the

 31Mean solar time in which the day begins at midnight

on the meridian of Greenwich. For this report, the entry

times have been converted to local time.

32During this time, the Royal Majesty was moored with

its port side to the Ordnance Island Passenger Terminal in

St. George’s.

33The Royal Majesty’s bridge logs indicated that the vessel departed the Ordnance Island Passenger Terminal at

1203, dropped off its pilot at 1230, and then altered course

to 059°. Shortly before 1300, the vessel altered course to

336° and remained within 1° to 3° of this heading until the

grounding.

anomalous 197°/000° courses recorded by the

bell log were the result of the GPS receiver being in the SOL and DR modes.

The bell log also recorded speed calculations based on information provided by the GPS.

The bell log recorded 18 speed calculations

between 1200 on June 9 (departure time from

the pier) and 2000 on June 10. These speed calculations and the time at which they were recorded are listed in table 2. The Royal Majesty’s

watch officers also maintained written records

of the vessel’s speed during the voyage in the

bridge log and in the speed record. According to

entries made in the bridge log between 1400 on

June 9 and 1200 on June 10, the vessel’s average speed was 19.06 knots. The bridge-log

speed data, however, were calculated using position data from the GPS. If the GPS was in DR

mode, the bridge-log speed data would not account for wind, seas, and current. The speed

data recorded by watchstanders in the speed record were based on distances between DR positions shown on the GPS. The distances between

DR positions depended on the speed supplied by

the Doppler speed log.34 The speed data, which

were recorded at hourly intervals between 1500

on June 9 and 2200 on June 10, indicated that

between 1400 on June 9 and 2200 on June 10

the vessel’s average speed was 18.79 knots. The

speed record also showed that between 1200 and

2200 on the day of the accident, the vessel’s

average speed was 13.87 knots.

 34The Doppler speed log provided watchstanders with a

digital readout of the vessel’s speed (over ground) at any

given moment in time. The readout did account for wind,

sea, and current.
20

The Royal Majesty was also fitted with an

Atlas 481 echo sounder (fathometer)35 with

digital readout. The fathometer data could be

displayed on the NACOS screen by pressing a

button. The fathometer had a recorder, which

was in the chart room. Postaccident examination

of the fathometer recorder indicated that it was

not turned on at the time of the accident.36

 35An echo sounder, or electronic depth sounder, is an instrument that indicates water depth below the bottom hull

plating. Hereinafter, the term fathometer will be used in the

report.

36The chief officer, the navigator, and the second officer

testified that the echo sounder was turned on before the

accident. The recorder had a separate on/off button.

The fathometer was also fitted with alarms

that were activated whenever the vessel transited waters shallower than the water for which

the alarms were set. In addition to an aural

alarm, a flashing message appeared on the

NACOS display. Both the aural alarm and the

flashing message could be overridden by watchstanders.

Table 1—Bell-log record of courses, June 9, 1995 (based on data from the GPS unit)

Time

Course

Made Good Time

Course

Made Good Time

Course

Made Good Time

Course

Made Good

1131:54

(GPS unit

turned on)

(continued from

previous column)

(continued from

previous column)

(continued from

previous column)

1132:46 197.0 1147:11 094.0 1201:35 210.0 1321:59 0

1133:01 0 1147:59 115.0 1201:52 203.0 1322:47 197.0

1133:17 197.0 1149:35 159.0 1202:07 212.0 1324:41 0

1137:17 291.0 1150:07 129.0 1202:40 206.0 1324:55 197.0

1138:05 275.0 1150:23 181.0 1203:11 213.0 1332:57 0

1138:21 258.0 1150:55 064.0 1204:15 169.0 1333:45 197.0

1138:37 306.0 1151:11 097.0 1205:51 091.0 1349:29 0

1139:09 215.0 1151:59 0 1206:23 097.0 1349:45 197.0

1139:25 250.0 1152:15 047.0 1206:55 088.0 1357:45 0

1139:41 232.0 1152:31 078.0 1211:11 082.0 1358:07 197.0

1139:57 250.0 1152:47 131.0 1219:12 090.0 1406:01 0

1140:13 261.0 1153:19 092.0 1219:27 082.0 1406:33 197.0a

1141:01 038.0 1153:35 151.0 1228:32 076.0

1141:17 242.0 1153:51 133.0 1229:19 070.0

1141:49 298.0 1154:55 174.0 1230:09 064.0

1142:07 326.0 1155:11 130.0 1242:41 055.0

1142:23 345.0 1155:43 213.0 1244:33 037.0

1142:39 289.0 1155:59 320.0 1245:37 025.0

1143:41 074.0 1156:15 271.0 1252:02 197.0

1144:31 025.0 1156:31 261.0 1255:45 0

1145:03 100.0 1156:47 217.0 1256:01 197.0

1145:19 079.0 1157:03 227.0 1304:01 0

1145:35 068.0 1157:19 208.0 1305:05 197.0

1146:07 080.0 1158:39 216.0 1309:06 336.0

1146:33 008.0 1200:04 221.0 1311:46 197.0 a

 The bell log continued to record the 197o/000o headings until after the vessel’s arrival in Boston.
21

The chief officer and

the navigator testified that

the fathometer alarm was

normally set to go off

when the water beneath

the keel was less than 3

meters (9.75 feet) deep.

On the night of the

grounding, the Royal Majesty’s deep draft was 19

feet 6 inches. Based on

statements from the chief

officer and the navigator,

the alarm should have activated when the Royal

Majesty entered water

with a depth of 29 feet 4

inches or less. During the

hour preceding the

grounding, the Royal Majesty passed over Great Rip and Davis Shoals,

where in some areas the depth of the water was

less than 29 feet 4 inches. The master, chief officer, and second officer did not recall seeing or

hearing the fathometer alarm before the

grounding. Postaccident examination revealed

that the fathometer alarm was set at 0 meters.

According to the navigator, the alarm was normally set at 0 when the vessel was in port or in a

harbor to prevent the alarm from being continuously activated.

Crew Training on Integrated Bridge System.—The Royal Majesty entered service in

June 1992. The master, who joined the vessel in

November of that year, stated that before joining

the vessel, he had read all the manuals and technical documents related to the integrated bridge

system (see next section). He stayed aboard the

ship for 1 month with the master he was relieving and received on-the-job training related to

the integrated bridge system from that master

and the navigator who was aboard the vessel

when it entered service.

The chief officer of the Royal Majesty had

joined the ship in 1992. He stated that he had

also received on-the-job training (3 weeks) from

the same navigator as the master had.

The navigator who was aboard the Royal

Majesty at the time of the accident had joined

the ship in August 1994. According to him, he

was responsible for the orientation and training

of new officers in the operation of the NACOS

25, GPS, Loran-C, Decca, fathometer, gyro(s),

speed log, ARPA radars, and engine controls.

He stated that he was solely responsible for programming the radar maps onto the ARPA display. He stated that it was his responsibility to

ensure that watch officers fully understood how

the different systems worked and interacted with

each other. He further stated that one of his responsibilities was to tell the master when a

newly assigned watch officer was fully prepared

to stand a bridge watch alone. The navigator

stated that the master made the final decision

about whether an individual was sufficiently

qualified to operate the bridge equipment and

was fully conversant in the ship’s watchstanding

procedures.

The second officer joined the Royal Majesty

on May 1, 1995. He received 3 weeks of on-thejob training—2 weeks with the navigator and 1

week with the chief officer. According to his

testimony, the 3 weeks of on-the-job training

included his being familiarized with the components of the integrated bridge system but also

with other bridge watchstanding duties and reTable 2—Bell-log record of the speed calculations based on information obtained from the GPS unit

June 9, 1995 June 10, 1995

Time Speed (Knots) Time Speed (Knots)

1200:03 13.3 0000:03 12.7

1206:39 14.7 0400:03 12.7

1210:23 16.0 0800:03 12.7

1223:43 17.3 1200:03 12.7

1225:03 18.8 1600:03 12.7

1228:31 21.1 2000:04 12.7a

1233:19 22.3

1252:01 12.7

1309:05 21.3

1311:45 12.7

1600:03 12.7

2000:04 12.7 a

 The bell-logger printout continued to record a speed made good of 12.7 knots

from 2000 (June 10) up to the time of the vessel’s arrival in Boston on June 12.
22

sponsibilities, fire and boat drills, vessel maintenance, and various other officer duties and

responsibilities.

According to the testimony of the watch officers, there was no formal classroom or simulator-based training on the integrated bridge

system, nor was any curriculum, checklist, or

exam used during the 3 weeks of on-the-job

training to measure the extent of the trainee’s

knowledge of the system or its components.

According to STN Atlas, the manufacturer

of the NACOS 25, STN Atlas offers classroom

and simulator training in the operation of its

equipment at an additional cost to the purchaser.

STN Atlas also indicated that several companies

and organizations in Europe were qualified to

provide formal classroom and simulator-based

training in the operation of the STN Atlas

NACOS 25. Majesty Cruise Line did not obtain

such training from STN Atlas or any other organization, nor was it required to by any international regulations or standards.

Written Guidance on Use of the NACOS

25.—STN Atlas supplied several supporting

manuals with the NACOS 25 on the Royal Majesty. Manuals for the Atlas NACOS 25 system

included Specifications, Navigation Instructions, “Brief Navigation Instructions,” Operating Instructions, and “Brief Operating Instructions.”37 In addition, STN Atlas provided manuals for the Atlas 8600 ARPA radar and the programming of maps using the ARPA radar. STN

Atlas notes the following in its concluding remarks in the Navigation Instructions:

The navigator’s role is that of overseer

of the ship’s progress and proper functioning of the automatic equipment. If

the system performs faultlessly, it could

happen that the navigator loses interest

in overseeing a faultlessly functioning

system. Before entering into this situation one must set about planning the

next stage of development.

 37The briefs were laminated two-page summaries of the

larger manuals and were meant to be used as quick reference material.

In the next stage of development, one

must consider changing the automation

so that the supervising of the navigation

will be done automatically instead of by

the navigator.

Waterway Information

The Royal Majesty grounded on Rose and

Crown Shoal about 10 miles east of Sankaty

Head Light, which is on the eastern shore of

Nantucket Island and about 17.0 miles west of

the vessel’s intended track (the northbound

Boston traffic lane). The shoal extends approximately 5 miles in a north-south direction

and about 3 miles in an east-west direction. The

minimum depth of the water in this area ranges

between 3 and 7 feet at mean low water. The

area is also known to contain breakers. The

shoal is marked by a lighted whistle buoy

(2RC). The buoy’s red light flashes at 2.5-

second intervals and is visible at a distance of at

least 6 miles when visibility is clear.

Rose and Crown Shoal is one of several

broken shoals that compose Nantucket Shoals—

the general name of the shoals that extend 23

miles east and 40 miles south of Nantucket Island. The currents in this area are strong and

erratic, reaching a velocity of 3 to 5 knots

around the edges of the shoals. According to

Volume 2 of U.S. Coast Pilots (Atlantic Coast:

Cape Cod to Sandy Hook), Nantucket Shoals is

“one of the most dangerous parts of the coast of

the United States.” It also states that “this area

should be entirely avoided by deep draft vessels

when possible and by light draft vessels without

local knowledge.”

The shoals, which are shifting in nature, are

bordered to the south and east by several aids to

navigation. The southwest corner of Nantucket

Shoals is marked by the Davis South Shoal

lighted whistle buoy. The buoy has a red light

that flashes at 4-second intervals and is visible

at a distance of about 4 miles when visibility is

clear. Marking the southeast corner of Nantucket Shoals is the Asia Rip (AR) lighted bell

buoy. This buoy, which is about 17 miles west

of the Royal Majesty’s intended track and

15 miles (on a bearing of 248°) away from the

BA buoy, has a yellow light that flashes at 2.5-
23

second intervals. Fifteen miles to the southsouthwest of the AR buoy and 30 miles west of

the Royal Majesty’s intended track is the Nantucket Shoals lighted horn buoy. This buoy,

which replaced the original Nantucket Lightship, is a large navigational buoy38 that has a

yellow light that is 40 feet above the water and

flashes at 6-second intervals.

Large deep-draft vessels operating between

Bermuda and Boston generally use the Boston

traffic lanes east of Nantucket and Cape Cod.

The purpose of the traffic lanes is to separate

northbound and southbound vessels and to provide a deep-water route for vessels en route to

and from Boston that keeps them clear of Nantucket Shoals. A traffic separation zone separates the northbound and southbound lanes.

Marking the separation zone are a series of

lighted buoys (BA, BB, BC, BD, BE, and BF).

Each buoy has a flashing yellow light and a radar reflector and has a distinctive flashing characteristic. For example, the yellow light on the

BA buoy, which marks the southeast entrance to

the traffic lanes, flashes four times at 20-second

intervals. The BA buoy also sounds a whistle at

10-second intervals when certain rough sea conditions exist.

Meteorological Information

The weather and sea conditions recorded by

the Royal Majesty crew between 1800 and 2230

on June 10 generally indicated cloudy skies,

force 4 winds39 (between 11 and 16 knots) out

of the east, and seas between 2 and 4 feet. Visibility at sea level was reported to be at least 10

miles.

A review of the bridge log for the 24-hour

period beginning at 2100 on June 9 indicated

that the Royal Majesty encountered winds averaging 15.9 knots out of the east-northeast. Based

on the Beaufort scale, a 16-knot wind could

 38A 40-foot-diameter, automated disc-shaped buoy used

to replace lightships. Most large navigational buoys are

used in conjunction with major traffic separation schemes.

39Based on the Beaufort scale, a numerical scale from 0

to 12 that rates wind according to ascending velocities (0

corresponds to calm winds at 0 to 1 knots, and 12 corresponds to hurricane winds above 65 knots).

generate a wind-driven current capable of setting the Royal Majesty toward the westsouthwest at a rate of 0.32 knots, or a distance

of about 8 miles over a 24-hour period. The effect of the wind on the vessel’s vast superstructure would have also contributed to the vessel’s

westerly drift.

Toxicological Information

The Coast Guard does not have the authority to order postaccident toxicological testing in

accidents on foreign vessels that occur in international waters.40 However, Majesty Cruise

Line requested that all watchstanders on the

bridge at the time of the grounding and the

master provide specimens for toxicological

testing. The company tried to obtain the services

of a testing firm that could travel to the site of

the grounding. On the following day, June 11,

the company found a contractor in New Hampshire who agreed to collect the specimens. He

arrived on scene in a chartered fishing vessel

and was transported to the Royal Majesty on a

Coast Guard vessel about midnight. The Coast

Guard requested that the contractor wait until it

was safe to board, as the Coast Guard was still

in the process of freeing the vessel. After

boarding, he was directed to the office of the

ship’s doctor and began collecting the specimens soon thereafter.

Twenty-five to 28 hours after the grounding,

the master, the second officer, and the two lookouts on duty at the time of the grounding gave

blood and urine specimens for alcohol and drug

testing specified in 46 Code of Federal Regulations (CFR) Part 4 and in 49 CFR Part 40. The

specimens were shipped for testing to the Methodist Medical Center in Peoria, Illinois. The results of the tests were negative.

Watchstanding Policies and Practices

Three licensed deck officers and six unlicensed crewmen were assigned to the watchstanding duties aboard the Royal Majesty. Each

stood a 4-hour-on/8-hour-off watch rotation.

The watches for the three licensed deck officers

were as follows:

 4033 CFR Chapter 1, Subpart 2.05-5.
24

0000-0400/1200-1600 Navigator

0400-0800/1600-2000 Chief Officer

0800-1200/2000-2400 Second Officer

The master of the Royal Majesty, who did

not stand a regular watch, oversaw the performance of the watch officers. According to the

master, in good weather he typically visited the

bridge two to three times during the course of a

watch and frequently telephoned the officer of

the watch for navigation and traffic updates. He

stated that he visited the bridge more frequently

when the weather or sea conditions were bad or

when visibility was poor.

Company policy governing the activities of

the bridge watchstanders aboard the Royal Majesty are contained in its “Bridge Procedures

Guide” and the Majesty Cruise Line’s Operations Manual. The two-page “Bridge Procedures

Guide” (see appendix B) was posted on the

bridge of the Royal Majesty before the accident.

According to Majesty Cruise Line, the purpose

of the “Bridge Procedures Guide” is to provide

watchstanders “with a description of the day-today bridge procedures that are recognized as

good practice and to promote through them the

safety of the M/V Royal Majesty, her passengers, and crew.”

The Operations Manual contains a collection of policies, letters, and circulars covering

such topics as checking the vessel’s position,

fire and boat drills, and payroll and accounting

procedures. Duties of the officer on watch are

listed on page 3 of Majesty Cruise Line’s Circular No. 9, dated July 9, 1992 (see appendix

C). The circular states that deck watch officers

are to “check the ship’s position as often as

conditions and circumstances allow, but never

longer than 30-minute intervals.” The circular

does not state how the ship’s position is to be

checked, nor does it require that GPS and Loran-C position data be compared. The circular

also does not require that a written record be

maintained of GPS or Loran-C observations or

of radar ranges and bearings of nearby floating

aids to navigation and/or landmarks.

The master testified that he required his

watch officers to plot the vessel’s position on an

hourly basis. A postaccident examination of

National Oceanic and Atmospheric Administration chart No. 13200 (Georges Bank and Nantucket Shoals) indicated that hourly fixes had

been plotted on the chart of the area starting

about 100 miles to the south of the accident site

and continuing up into the Boston traffic lanes.

Circular No. 9 and the “Bridge Procedures

Guide” discuss when the master should be

summoned to the bridge. Among the circumstances that should prompt a call to the master is

the failure of watch officers to sight land or a

navigation mark or to obtain a sounding by the

expected time.

Postaccident Testing of GPS

After the accident, representatives from

Majesty Cruise Line and the Coast Guard examined the Royal Majesty’s GPS antenna and

receiver. They found that the GPS antenna cable

had separated from the factory connection at the

antenna. The antenna cable, which was factoryassembled, showed no sign of physical damage,

other than having been separated from the connection. The Safety Board examination also revealed that the cable was openly routed on the

roof of the bridge and that it had been painted

with a brush or roller at least twice when the

bridge was being painted (see figure 9). Traffic

on the roof of the bridge was limited to Majesty

Cruise Line employees. However, the GPS cable

was not secured to the roof or protected from

someone tripping over it, kicking it, or otherwise damaging it and the nearby antenna connector.

Postaccident testing at Raytheon41 indicated

that because the GPS antenna cable was separated from the connection, the GPS receiver

transmitted DR-derived position data instead of

satellite-derived position data to the NACOS 25

autopilot.

Safety Board’s Urgent Safety Recommendations

The Safety Board’s postaccident testing and

inspection of the integrated bridge system on the

 41Appendix D has more details about the postaccident

testing done by representatives of the Safety Board, Raytheon Marine, and Majesty Cruise Lines.
25

0

u 15/16”

n

o

w

GPS antenna and

on deck of Royal

cabling as installed

Majesty fly bridge

\ Taped antenna connections

- ..—— Receiver/ Antenna

processor

PVC (vinyl) tape layers “SUM IN” tape layers

Figure 9—GPS antenna assembly (photograph shows antenna and cabling as installed

on deck of fly bridge). .
26

Royal Majesty raised concerns about the safety

of the world’s maritime fleet and the safety of

passengers and crews on vessels with similar

integrated bridge systems, as well as the potential damage to the environment that could result

from a release of hazardous cargo. Consequently, on August 9, 1995, the Safety Board

issued five urgent safety recommendations to

the Coast Guard, the International Council of

Cruise Lines (ICCL), the International Chamber

of Shipping, the American Institute of Merchant

Shipping, the International Association of Independent Tanker Owners (INTERTANKO), STN

Atlas, and the NMEA. The recommendations

urged the organizations to immediately advise

maritime vessel operators of the circumstances

of the Royal Majesty’s grounding and to encourage the operators to review the design of

their integrated bridge systems to identify potential system and operational failure modes. All

five recommendations were acted upon and,

consequently, have been classified either

“Closed—Acceptable Action” or “Closed—Acceptable Alternate Action.”42

Safety Board’s Public Forum

The grounding of the Royal Majesty suggested to the Safety Board a need to assess the

current state of the art in integrated bridge systems. As a first step, the Safety Board held a

public forum on integrated bridge systems on

March 6-7, 1996, to examine data-transmission

standards, design standards for integrated bridge

systems, human-factors considerations in the

design of integrated bridge systems, training and

certification of mariners responsible for operating integrated bridge systems, and the impact of

integrated bridge systems on safety, workload,

and watchkeeping. Participating in the public

forum were representatives of the vessel operators, standards organizations, manufacturers of

integrated bridge systems, and classification

societies. Government representatives and marine educators from the major maritime schools,

colleges, and universities also participated.

 42Appendix E has the full text and status of each urgent

safety recommendation.

The following sections highlight some of

the comments from the various participants.

Manufacturers.—The public forum showed

that manufacturers of integrated bridge systems

are designing and building the components of

their systems in accordance with internationally

recognized standards, proprietary standards, and

the standards of the classification societies.

Manufacturers stated that problems were occasionally encountered in matching subsystems,

such as Loran-C and GPS, speed logs, and gyro

compasses, with the integrated bridge system

that they manufacture. They expressed concern

about the maintenance of system integrity

throughout the life of the integrated system as

subcomponents are added or replaced. They expressed the belief that an independent authority

is needed to ensure system integrity.

Standards Organizations.—The International Maritime Organization (IMO), a United

Nations organization, produces performance

standards for navigation equipment required on

commercial vessels. Such standards are normally cast in general terms. Once adopted, each

of the IMO performance standards is reviewed

by either Technical Committee 8 (TC8) of the

International Standards Organization (ISO) or,

more often, by Technical Committee 80 (TC80)

of the IEC, depending upon whether the equipment is mechanical or electric/electronic. Normally, one of the two organizations will develop

specifications (called standards) that enable

manufacturers to design and build navigation

equipment that will meet the appropriate IMO

performance standard. It is not unusual for the

ISO and the IEC to work jointly to produce

standards.

The ISO and the IEC are parallel international organizations, working in close cooperation to form a world system of standardized

working procedures, terminology, and documentation presentation. The TC8 has 10 subcommittees working on various areas, including
27

ship bridge layout43 for one-person watchkeeping.44

The work of the IEC is managed through

more than 200 technical committees, and the

TC80, formed in 1979, is the technical committee concerned with marine navigation and radiocommunication equipment and systems. The

TC80 has 10 working groups.

In 1990, the TC80 notified the IMO that it

was forming a working group (WG9) to develop

a draft IMO performance standard for integrated

bridge systems. The proposed standard was

completed and submitted to the IMO in July

1996. The proposed standard is expected to become an IMO performance standard by about

1999.

In the absence of an ISO or IEC standard,

manufacturers use other internationally recognized standards, such as those of the NMEA.

The NMEA, a U.S. organization of manufacturers, dealers, and installers of marine electronic

equipment, actively encourages international

membership and participation. The NMEA Interface Standards Committee, for example, has

representatives from nearly all the companies in

the world that manufacture marine electronic

equipment.

The NMEA and the IEC have members on

each other’s working groups and in 1995 collaborated to produce a harmonized standard for

data transmission (NMEA 0183 and IEC 1162-

1), which will facilitate matching subsystems

like GPS with integrated bridge systems and the

Global Maritime Distress and Safety System.45

The NMEA and the IEC have agreed to work

 43ISO standard ISO 8468 currently covers ship bridge design and layout.

44One-person watchkeeping, sometimes referred to as

one-man or solo watchkeeping, means that the officer of

the watch is the sole person on the bridge. This concept

envisages reducing cost by eliminating the lookout position

from the navigation watch.

45The Global Maritime Distress and Safety System is an

automated radio transmitting and receiving device on the

bridge. It can automatically send distress messages that give

the vessel’s identification and position and receive telex information on navigation, weather, and search and rescue.

together on future transmission standards and to

keep both standards in harmony.

The NMEA representative stated that manufacturers have sometimes made different interpretations of the NMEA standards and that

electronic equipment has been mismatched. The

NMEA representative further stated that the

0183 standard by itself does not regulate the use

of the data in NMEA-provided sentences. The

NMEA counts on the knowledgeable input to,

and sensible implementation of, the NMEA

standard by equipment designers. This process

has improved vastly over the past few years and

many of the early problems with implementation

no longer exist. Helping in this regard is the

trend in international performance standards for

marine electronic equipment to specify the use

of specific NMEA 0183/IEC 1162-1 sentences.

The representative stated that he believes that

the new improved standards have reduced the

possibility of mismatching.

Classification Societies.—The DNV has

been involved in bridge navigation issues since

the early 1970s; the classification society was

motivated to enter this nontraditional area by the

high number of groundings and collisions attributable to human error. The DNV studied the

bridge environment, including design of work

stations, organizational matters, range and quality of instrumentation, and man/machine interface. The DNV then developed some standards

for bridge design and equipment that might reduce situation-induced errors. These standards

were offered as an optional classification notation,46 NAUT-C.

 46Classification societies have normally been concerned

solely with developing classification rules (notations) for a

vessel's hull, the machinery, and certain essential systems

(ballast systems, piping, sanitation systems, ventilation, etc.).

For a vessel to be classed by a society, the vessel must be

constructed and maintained in accordance with the rules of

the classification society. Surveyors (inspectors) employed by

the selected classification society inspect the vessel during

construction and periodically afterward as long as the vessel

is classed. Classification is essential for obtaining insurance.

Navigation equipment is not required to be classed; thus, the

navigation bridge does not have to be constructed or outfitted

in accordance with classification society rules. With growing

interest in reducing navigation errors and with the interest in

using technology to reduce bridge manning, most classification societies now offer optional classification rules (nota-
28

Currently, the highest class notation offered

by the DNV is Watch 1 (W1), which addresses

equipment requirements, qualifications of the

integrated bridge system operator, operating

procedures, documentation on maneuvering performance, and a contingency plan. The DNV

requires that vessel officers attend classes provided by the integrated bridge system manufacturer. An officer who has been trained by the

manufacturer and has operated an integrated

bridge system at sea may instruct other officers.

All operators of an integrated bridge system

must be certified by the DNV.

Germanischer Lloyd was the coordinator for

the German Ship of the Future program, which

involved various elements of the German maritime industry. The intention of this research

program was to employ automatic navigation

systems to do routine functions; as a result,

watchkeeping at any time, day or night, could be

handled by one person. The culmination of the

Ship of the Future program was marked in 1985

by the commissioning of a prototype vessel with

an integrated bridge system. In 1991, Germanischer Lloyd published its Rules for Bridge Design on Sea-Going Ships - One-man Control

Console. The rules were based on 5 years of

operational experience with advanced navigation systems. A ship complying with the rules

receives the optional class notation Nav O

(ocean area) or Nav OC (ocean area/coastal

waters).

Lloyd’s Register of Shipping (LR) published rules for navigation bridge arrangements

in 1988 and in January 1996, after completing

further research, replaced those rules with a

more comprehensive notation (NAV-1).47 The

LR is planning to offer an integrated bridge

 

tions) covering bridge design, layout, and equipment.

47The development of NAV-1 followed a 3-year research

project known in Europe as Advanced Technology to Optimize Manpower Onboard Ships. The object of the project

was to improve the competitiveness of European Common

Market commercial vessels by using advanced technology,

including the integration of bridge equipment and functions,

to reduce bridge manning and contribute to navigation safety.

The participants in the research project included nine European companies and, in addition to the LR, equipment

manufacturers, ship owners, research organizations, and one

national authority.

system notation, IBS, which will be an enhancement of NAV-1. The notation also will

address software, and will require that the “development, modification, replication and installation of the software be subject to quality plans

which meet the requirements of acceptable standards, e.g. the ISO 9000 series.” The LR will

accept certification of the software quality procedures by a recognized authority as evidence of

compliance. Also, the LR can now provide

comprehensive software assessment to manufacturers. (The DNV tests software at the manufacturer’s plant for each model of an integrated

bridge system and whenever there are changes

in software.)

Nippon Kaiji Kyoukai published rules for

navigation bridge systems in February 1995. In

preparing the rules, the organization considered

current Japanese technology, other technical

developments, vessel-owner desires, and international standards, including those of the IMO,

the ISO, and the IEC.

The Nippon Kaiji Kyoukai notation BRS1

covers “functionality of the bridge design layout, configuration, bridge environment, and essential navigational equipment to be installed

and work stations for one officer bridge operation on the open sea.”

The Korean Registry of Shipping has introduced requirements for one-man bridge operated

ships. In developing its rules, the organization

gave a high priority to the safety and reliability

of systems. The organization also focused on the

human element, including ergonomic criteria

and bridge design and installation, as well as on

technical performance standards, system redundancy, and reliability.

The American Bureau of Shipping published guidelines for one-man bridge operation

in 1992.
29

ANALYSIS

General

The weather at the time of the accident was

clear, visibility was at least 10 miles, seas were

calm, and winds were light. Except for the GPS

antenna cable connection, all other navigation

equipment and the main propulsion, steering,

and auxiliary systems were fully operational

before and after the accident. The investigation

indicated that the certifications of the master

and the deck officers were in accordance with

current international requirements. Accordingly,

the Safety Board concludes that the weather, the

mechanical condition of the Royal Majesty, except for the GPS antenna cable, and the officers’

certifications were not factors in the accident.

Because the accident happened in international waters, the Coast Guard did not have the

authority to order toxicological testing. However, the master, the second officer, and the two

lookouts on duty at the time of the accident provided blood and urine specimens for alcohol and

drug testing, as requested by Majesty Cruise

Line. On the basis of test results, the Safety

Board concludes that drugs were not a factor in

the accident. However, because the specimens

were obtained more than 24 hours after the accident, the alcohol tests were of little value; had

there been any alcohol, it probably would have

been metabolized and eliminated. Although investigating Coast Guard personnel observed no

indications that the officers had been under the

influence of alcohol, the Safety Board could not

determine conclusively that alcohol was not a

factor in the accident.

The master and two of the deck officers, including the second officer, who was on duty at

the time of the accident, testified that their

work/rest routines during the days preceding the

accident were normal. In particular, the second

officer slept about 7 hours after finishing his

2000-to-2400 watch and had also taken a 2-hour

nap before beginning his 2000 watch on

June 10, the day of the accident. In short, the

Safety Board concludes that fatigue was not a

factor in the grounding of the Royal Majesty.

The Safety Board assessed the fishing vessel’s attempts to call a cruise ship shortly before

the grounding of the Royal Majesty. Although

the Safety Board could not conclusively determine whether the second officer was in fact

monitoring channel 16, international requirements and company procedures required him to

do so. Because the position transmitted by the

fishing vessel was approximately 17 miles away

from where the second officer believed the vessel to be and because the English transmissions

made by the fishing vessel to the cruise ship did

not convey any urgency or immediacy and were

interspersed with Portuguese conversation, the

Safety Board believes it was reasonable that the

second officer did not respond to these transmissions. The transmissions do, however, provide evidence of the location of the Royal Majesty almost 2 hours before the grounding.

The grounding occurred near Nantucket Island in an area known as Rose and Crown

Shoal—a location more than 17 miles west of

the vessel’s intended track. The investigation,

therefore, focused on determining how a large

passenger vessel with a sophisticated integrated

bridge system, manned by experienced watch

officers, and operated in clear weather through

calm seas could travel, unknown to the crew,

more than 17 miles off course.

The Accident

Shortly after the vessel left St. George’s, the

navigator set the NACOS 25 autopilot on the

NAV mode. When engaged and operating in the

NAV mode, the autopilot could steer the vessel

along a predetermined route using programmed

information (latitude and longitude of waypoints

and the vessel’s maneuvering characteristics),

gyro and speed data, and position data from either the GPS or the Loran-C while automatically

compensating for the effect of gyro error, wind,

current, and sea. On the day of the accident, the
30

crew had selected, as it normally had done since

the vessel entered service, the GPS as the source

of position data for the NACOS 25.

To compensate for the possible lack of satellite data, the GPS unit on the Royal Majesty

had been designed to receive speed and gyro

heading data so that when GPS satellite data

were not available, the unit would automatically

default to a DR mode, in which the latitude/longitude data transmitted to the autopilot

were derived from DR calculations rather than

satellite-based position data. When the GPS unit

defaulted to the DR mode after the vessel left

Bermuda, the autopilot was unable to recognize

the status change; and, thus, its subsequent

navigation did not correct for the effect of wind,

current, or sea.

The bell-log record provided evidence that

complete interruption of valid satellite-based

position data occurred about 1311:46, which

was about an hour after the vessel left St.

George’s. From that point on, the bell log continued to record alternate courses of 197° and

000° until after the vessel’s arrival in Boston,

although, in fact, the vessel was maintaining a

course of about 336° during that time. It appeared that a temporary interruption of valid

satellite-based data occurred at 1252:02, about

52 minutes after the vessel left Bermuda, as the

course and speed recorded were 197° and 12.7

knots, respectively—the same readings that

were later recorded. The course of 336° recorded at 1309:06 was consistent with the vessel’s course at that time. Similarly, the bell-log

record of speed calculations based on the data

provided by the GPS unit indicated that the last

accurate recording occurred at 1309:05 when

the bell log recorded a speed of 21.3 knots.

However, from that point on until the vessel’s

arrival in Boston on June 12, the bell log continued to record a speed of 12.7 knots, a speed

not consistent with the speeds recorded in the

bridge log and speed record. In summary, the

Safety Board concludes that starting about 52

minutes after the Royal Majesty left St.

George’s, the GPS receiver antenna cable connection had separated enough that the GPS

switched to DR mode, and the autopilot, not

programmed to detect the mode change and invalid status bits, no longer corrected for the effects of wind, current, or sea. Over time, the

effects of the east-northeasterly wind and sea set

the Royal Majesty in a west-southwesterly direction and away from its intended track, resulting in the 17-mile error. Further evidence

came from a Coast Guard transcript of radio

transmissions from two fishing vessels that were

in the vicinity of Fishing Rip Shoal on the evening of June 10 and had seen a large passenger

cruise ship about 16 miles west of the Boston

traffic lanes.

The investigation determined that the GPS

antenna, which was originally installed on the

radar mast, had been moved in February 1995,

several months before the grounding, as part of

an effort to eliminate chopping. An examination

of the GPS antenna cable indicated that it was

routed in such a way that it could be kicked or

tripped over, which could induce separating

stress at the antenna cable connection, and that

it had been painted on at least two occasions.

However, precisely when the painting was done

was not known. In short, it could not be determined whether the GPS antenna failed as a result of crewmembers’ inadvertently damaging it

while they were doing routine maintenance, as a

result of crewmembers’ tripping over the cable,

or as a result of other unknown factors. Nevertheless, the Safety Board concludes that openly

routing the GPS antenna cable in an area where

someone occasionally walked increased the risk

of damage to the cable and related connectors.

The Safety Board believes, therefore, that to

decrease the risk of damage, Majesty Cruise

Line should eliminate the practice of openly

routing navigation equipment cable to decrease

the risk of damage and that the ICCL should

encourage its members to do the same.

Watch Officers’ Performance

The crew’s failure to detect the ship’s errant

navigation for more than 34 hours raises serious

concerns about the performance of the watch

officers and the master. None of the three watch

officers or the master determined that the GPS

had switched to DR mode or that the Royal

Majesty had been on an errant course throughout the trip from St. George’s. Further, the chief
31

officer and the second officer, who stood the

last two watches before the grounding, failed to

recognize that the Royal Majesty was on an errant course despite several indications that the

vessel was not on its intended track. The investigation, therefore, examined the events leading

up to the accident from the time the Royal Majesty departed St. George’s, including the inspecting of equipment and the setting of the

fathometer alarm. The investigation also examined the watchstanding practices of the watch

officers and their lack of response to several

indications that the vessel was not following its

intended track, including the sighting of red

lights, the failure to sight the BB buoy, and the

sighting of blue and white water.

Equipment Inspection.—The navigator said

that he had tested the navigational equipment

before the vessel left St. George’s and found the

equipment to be in “perfect” operating condition. Because the evidence from the bell log indicated that interruption of GPS data did not

occur until about 1252, about an hour after the

vessel had left port, the GPS receiver would

probably not have shown the SOL and DR messages before that time. Consequently, the navigator may indeed have inspected the GPS receiver before the departure when the other navigation equipment was inspected and found no

anomalies.

Fathometer Alarm.—Although the testimony indicated that the fathometer alarm was

usually set at 3 meters, the postacccident investigation determined that the fathometer alarm

was set at 0 meters—the setting used when the

vessel was in port or in harbor so that the alarm

would not be continuously activated. During the

voyage, no one detected that the fathometer setting was improper, and the fathometer recorder

was not turned on. Because the fathometer

alarm was set at 0 meters, the aural fathometer

alarm would not have activated; thus, the setting

effectively rendered the alarm useless.

Before it grounded, the Royal Majesty

passed over several areas in which the depth of

water beneath the keel was significantly less

than 3 meters. Had the alarm been set as usual to

3 meters, it would have activated several times

before the vessel grounded. The Safety Board

concludes that had the fathometer alarm been set

to 3 meters, as was the stated practice, or had

the second officer chosen to display the

fathometer data on the control console, he

would have been alerted in time for him to take

corrective action that the Royal Majesty was in

far shallower water than expected and, thus, was

off course. Because of the proximity of Davis

Bank (a shoal about 8 miles southeast of the

grounding site; the water is between 15 and 40

feet deep) it is possible that he would have been

alerted perhaps as long as 40 minutes before the

grounding.

GPS Status.—Once the ship had been

placed under the control of the automated navigation system, the watch officers’ operating

tasks were to ensure that the automated navigation system equipment was operating properly

and to verify that the Royal Majesty was following the intended track. The testimony of the

watch officers and the charts used by these officers indicated that hourly fixes were being

plotted during the voyage, as instructed by the

master. The navigator and the second officer

both testified that the hourly fixes they plotted

were based on position data from the vessel’s

GPS. However, according to testimony, no officer, including the master, recognized the SOL

and DR messages, indicating that the GPS position data were not reliable, until after the

grounding. Because the crew noticed the SOL

and DR messages immediately after the

grounding and because postaccident testing confirmed that the SOL and DR messages were

functioning properly and should have been displayed, the watch officers apparently read the

position coordinates on the GPS unit to accomplish their manual plotting task, without attending to the SOL and DR messages. The Safety

Board concludes that the watch officers’ monitoring of the status of the vessel’s GPS was deficient throughout the voyage from St. George’s.

Cross-checking of Position Data.—Despite

failing to recognize the SOL and DR indicators,

the officers could have discovered that the GPS

had defaulted to DR mode by using an independent source of information, such as the Loran-C. According to the chief officer and the
32

navigator, they periodically compared the GPS

data with the Loran-C data during the voyage.

The second officer, however, stated that he did

not check the Loran-C because it was used as a

backup only if the GPS failed. At the site of the

grounding, the Loran-C indicated the correct

position of the Royal Majesty, and there was no

evidence that the Loran-C was malfunctioning

during the voyage. Thus, had the officers regularly compared position information from the

GPS and the Loran-C, they should not have

missed the discrepant coordinates, particularly

as the vessel progressed farther from its intended track. The Safety Board concludes that

deliberate cross checking between the GPS and

the Loran-C to verify the vessel’s position was

not being performed and should have been on

the voyage from St. George’s.

Use of Position-fix Alarm.—Evidence suggested that instead of monitoring the position

instrumentation, the watch officers relied on the

position-fix alarm, a feature of the autopilot designed to alert watchstanders to any degradation

of position data from the position sensor in use.

According to the officers, the only times the

GPS positions could not be depended on for accuracy were during chopping episodes, which

could usually be recognized because they were

accompanied by an erratic movement of the radar map and the sounding of the position-fix

alarm. Because chopping did not occur on the

accident voyage and because the position-fix

alarm never activated, the crew probably believed there was no need to suspect that the GPS

was not providing satellite-derived position

data. On this voyage, the position-fix alarm was

set to activate only when the position data generated by the GPS and the DR position data

generated by the autopilot differed by more than

200 meters. Because the GPS and autopilot

shared common gyro and speed inputs, the DR

position data transmitted by the GPS when it

defaulted to the DR mode was essentially identical to the DR position data calculated by the

autopilot. Consequently, the position-fix alarm

would not have activated after the GPS defaulted to the DR mode. The Safety Board concludes that even though it is likely that the

watch officers were not aware of the inherent

limitation in using the position-fix alarm to

monitor the accuracy of GPS position data, it

was inappropriate for them to rely solely on the

alarm to warn them of any problems with the

GPS data.

Identification of Navigation Aids.—Although the officers’ inadequate monitoring led

to the errant track and was a serious deviation

from acceptable methods of operating automated equipment, the grounding itself could

have been avoided had the chief officer and the

second officer followed longstanding good

watchkeeping practices when approaching land.

During the 1600-to-2000 watch preceding the

accident, the chief officer did not visually identify the buoy he saw on the radar about 1900

and apparently assumed that it was the BA

buoy, which marked the entrance to the traffic

lanes. The target that he probably observed was

the AR buoy, which marked a wreck about 17

miles west of the traffic lanes, and it was probably coincidental that he detected it when and

where he anticipated seeing the BA buoy. He

later explained that he was not concerned about

confirming that the target was the BA buoy because the information displayed at the time on

the GPS and ARPA displays indicated to him

that confirmation was not necessary.

When the second officer assumed the following watch, he did not detect, either visually

or by radar, the next buoy in the traffic lanes,

the BB buoy, when it was expected. Contrary to

standing orders from the master, he failed to

report that he had not seen the BB buoy; and

when the master called the bridge anticipating

passing the buoy, the second officer stated that

he had observed it.

The second officer continued to miss opportunities to avoid the grounding when the

lookouts reported sighting several high red

lights (later determined to be on Nantucket Island), sighting a flashing red light on the port

bow, and sighting blue and white water ahead of

the Royal Majesty. He acknowledged these observations, but he failed to take any action.

The second officer’s response to these

sightings should have been deliberate and

straightforward. He should have been concerned
33

as soon as the BB buoy was not sighted and then

again when the lookouts sighted the red lights.

Had he then increased the radar range from 6

miles to 12 miles on the port radar, the one radar

in use, or turned on the starboard radar and set it

to the 12-mile range, he would have detected

Nantucket Island. He would also have seen that

the radar pictures did not conform to the radar

maps exhibited on the ARPA display. In addition, had he checked a chart of the area for the

source of the flashing red light, he would have

learned that the nearest flashing red light was

the Rose and Crown Shoal buoy and, thus,

would have been warned that the ship was not in

the traffic lanes, as he believed it was.

Additionally, the second officer should have

checked the Loran-C to cross check his position,

as he knew the Loran-C to be accurate in this

area. Had he still been uncertain about the position of the Royal Majesty after checking the Loran-C, he should have called the master and the

navigator to the bridge for assistance. The

Safety Board concludes that the sighting of

lights not normally observed in this area and the

second officer’s inability to confirm the presence of the BB buoy should have taken precedence over the automation display on the central

console and compelled the second officer to

promptly use all available means to verify his

position.

Fundamental seamanship practices caution

against exclusive reliance on any one source of

position information for navigation. When a

watch officer finds visually sighted navigation

aids that conflict with a position determined by

automated instrumentation, he should promptly

verify the vessel’s position by using proper procedures. The Safety Board concludes that the

chief officer and the second officer did not observe good watchkeeping practices or act with

heightened awareness of the precautions that are

needed when a vessel approaches the Boston

traffic lanes and landfall. Consequently, in view

of the actions of the watch officers on the Royal

Majesty, the Safety Board believes that Majesty

Cruise Line should review and revise as necessary the bridge watchstanding practices on all its

vessels to ensure that all watch officers adhere

to sound watchstanding practices and procedures, including using landmarks, soundings,

and navigational aids to verify a vessel’s position, relying on more than one source for position information, and reporting to the master any

failure to detect important navigational aids.

The Safety Board believes that the ICCL should

encourage its members to take the same steps.

The Safety Board further believes that Majesty

Cruise Line and the members of the ICCL

should periodically review the performance of

all officers on board their vessels.

Master’s Monitoring of the Vessel’s Progress.—The investigation determined that the

master of the Royal Majesty frequently visited

the bridge to keep himself informed about

bridge operations and to confirm that the passage was progressing satisfactorily. By requesting that the chief officer and the second officer

report their sightings of the BA and BB buoys,

the master made a reasonable effort to assure

himself that the Royal Majesty was following its

intended track. It is likely that the chief officer

was not aware that he had misidentified the BA

buoy, which marked the entrance to the traffic

lanes, and unknowingly passed on erroneous

information about the buoy to the master and the

second officer. The second officer, however,

deliberately misinformed the master when asked

whether he had seen the BB buoy. Thus, the

master was grossly misled by the second officer

and was denied the opportunity to investigate

clues indicating that the ship was not following

the intended track.

The evidence suggests, however, that the

master did not have any better understanding of

the automated navigation system and the functioning of the GPS than the watch officers. His

requirement that the officers plot courses manually did not result in anyone monitoring the vessel position by using an independent source of

position information. Because the officers used

the GPS data to get the coordinates for the manual plotting, the fixes on the chart corresponded

with the map and positions displayed on the

central console; thus the manual plotting in no

way verified the validity of the GPS data. The

master appeared to share the deck officers’ reliance on the automated navigation system, since

he did not ask for deliberate cross checks be-
34

tween the GPS and the Loran-C or make any

comparisons himself. The Safety Board concludes that the master’s methods for monitoring

the progress of the voyage did not account for

the technical capabilities and limitations of the

automated equipment.

Effects of Automation on Watch Officers’

Performance

Innovations in technology have led to the

use of advanced automated systems on modern

maritime vessels. However, bridge automation

has also changed the role of the watch officer on

the ship. The watch officer, who previously was

active in obtaining information about the environment and used this information for controlling the ship, is now “out of the control loop.”

The watch officer is relegated to passively

monitoring the status and performance of the

automated systems. As a result of passive

monitoring, the crewmembers of the Royal Majesty missed numerous opportunities to recognize

that the GPS was transmitting in DR mode and

that the ship had deviated from its intended

track. The Safety Board examined why the

watch officers missed the opportunities.

When the GPS unit defaulted to its DR

mode, it displayed both SOL and DR, indicating

that the GPS solution was no longer valid and

that the unit had switched to a DR mode. Although the watch officers testified they used the

GPS data for plotting, each officer also testified

that he did not see SOL displayed on the GPS

unit. Ineffective monitoring of sophisticated

automated equipment is not new. The Safety

Board has investigated several aviation accidents in which pilots failed to monitor flight

instruments during automated flight.48 Likewise,

empirical research on the monitoring of auto-

 48(a) National Transportation Safety Board. 1986. China

Airlines Boeing 747-SP, N4522V, 300 nautical miles

northwest of San Francisco, California, Feb. 19, 1985.

Aviation Accident Report NTSB/AAR-86/03. (b) National

Transportation Safety Board. 1984. Scandinavian Airlines

System Flight 901, McDonnell Douglas DC-10-30, John F.

Kennedy Airport, Jamaica, New York, February 28, 1984.

Aviation Accident Report NTSB/AAR-84/15. (c) National

Transportation Safety Board. 1973. Eastern Air Lines, Inc.,

L-1011, N310EA, Miami, Florida, December 29, 1972.

Aviation Accident Report NTSB/AAR-73/14.

mation has shown that humans are poor monitors of automated systems.49 The problem of

poor monitoring of automated systems was also

known to STN Atlas, the manufacturer of the

NACOS 25 system. STN Atlas warns in its operating manual for the NACOS 25 that operators, with little to do, may fail to monitor the

automated NACOS 25 system.

The watch officers’ failure to recognize the

SOL or DR messages may also have been related

to the absence of any loud alarm signifying poor

GPS data. Before the separation of the antenna

cable connection, failures of the GPS system

triggered the NACOS 25 position-fix alarm.

This could have led to what Wiener and Curry

(1980) referred to as a primary/backup inversion.50 The primary indicators of the status of

the GPS unit are SOL and DR. As a backup to

these primary indicators, the watch officers

could use the position-fix alarm to signal inaccurate GPS data. As Wiener and Curry warned,

the watch officers and the master of the Royal

Majesty relied exclusively on the position-fix

alarm instead of monitoring for SOL or DR. In

1988, the Safety Board investigated another case

of primary/backup inversion in the crash of a

Northwest Airlines Boeing 737 in Romulus,

Michigan.51 The plane crashed while the crew

was attempting to take off in the wrong flight

configuration. The crew apparently relied on an

onboard configuration warning system instead

of manually checking the position of the flaps

and slats.

The Board’s investigation also found that

the watch officers failed to use independent alternative means to verify the Royal Majesty's

 49(a) Parasuraman, R.; Molloy, R.; Singh, I. 1993. “The

performance consequences of automation-induced complacency.” The International Journal of Aviation Psychology,

3(1): 1-23. (b) Kessel, C. J.; Wickens, C. D. 1982. “The

transfer of failure-detection skills between monitoring and

controlling dynamic systems.” Human Factors, 24(1), 49-

60.

50Wiener, E. L.; Curry, R. E. 1980 “Flight deck automation: problems and promises.” Ergonomics, 23 995-1011.

51National Transportation Safety Board. 1988. Northwest

Airlines, Inc., McDonnell Douglas DC-9-382, N312RC,

Detroit Metropolitan Wayne County Airport, Romulus,

Michigan, August 16, 1987. Aviation Accident Report

NTSB/AAR-88/05.
35

position. Research on operator monitoring performance suggests that the reliability or trustworthiness of an automated system52 could have

affected the officers’ verification of the GPS

position data. The complete automated navigation system, including the GPS, on the Royal

Majesty had proven to be a highly reliable and

accurate system, and the watch officers’ testimony suggested that they believed the GPS was

superior to other onboard position instrumentation. Also, the watchkeeping procedures of the

master and the watch officers did not include an

effective mechanism for comparing the GPS

with other position instrumentation. Although

the master required the watch officers to plot

fixes manually as an apparent check on the system, this procedure did not provide an independent verification of the GPS information.

The Safety Board concludes that the watch officers on the Royal Majesty may have believed

that because the GPS had demonstrated sufficient reliability over 3 1⁄2 years, the traditional

practice of using at least two independent

sources of position information was not necessary.

After failing to recognize the mode change

on the GPS system, the watch officers had numerous opportunities to detect that the vessel

had drifted away from its intended track. The

failure of the chief officer and the second officer

to recognize that the Royal Majesty was off

course may be explained by how convincing the

display of position information was. The

NACOS 25 presented the watch officers with a

detailed map view (on the ARPA display) that

indicated the position of the ship. The map display provided a very salient and seemingly accurate picture of the Royal Majesty's course. Research on decisionmaking indicates that cues

that are most salient, such as the map display,

tend to bias operators when they make diagnostic decisions.53 Further, research on decisionmaking in the presence of automation has indi-

 52Mosier, K. L., Skitka, L. J., and Heers, S. T. Automation and Accountability for Performance. In: Proceedings

of the 8th International Symposium on Aviation Psychology. Columbus, OG: The Ohio State University, 1995.

53Wickens, C. D. 1984. Engineering Psychology and

Human Performance. Columbus, Ohio: Merrill.

cated that automation can bias an operator’s decisions.54

Both the chief officer and the second officer

exhibited decisionmaking bias toward the automated map display. Based on information from

the map display, the chief officer felt no need to

visually verify his identification of the BA buoy.

The second officer was overly reliant on the

map display when he failed to cross check the

vessel’s position despite repeated indications of

the Royal Majesty's deviation from its intended

track. The Safety Board concludes that all the

watchstanding officers were overly reliant on

the automated position display of the NACOS

25 and were, for all intents and purposes, sailing

the map display instead of using navigation aids

or lookout information.

Notwithstanding the merits of advanced

systems for high-technology navigation, the

Safety Board does not consider the automation

of a bridge navigation system as the exclusive

means of navigating a ship, nor does the Board

believe that electronic displays should replace

visually verifiable navigation aids and landmarks. The human operator must have the primary responsibility for the navigation; he must

oversee the automation and exercise his informed judgment about when to intervene

manually.

As the grounding of the Royal Majesty

shows, shipboard automated systems, such as

the integrated bridge system and the GPS, can

have a profound influence on a watchstander’s

performance. However, the full impact of automated systems on watchstanding performance

has yet to be examined in detail. The Coast

Guard has begun this effort by examining how

automation affects watch officers’ tasks and

workload. The Safety Board believes further

research is necessary. Therefore, the Safety

Board recommends that the Coast Guard continue its research on shipboard automation, focusing on watch officers’ monitoring and deci-

 54Mosier, K. L.; Skitka, L. J. 1966. “Humans & automation, Made for each other?” In Raja Parasuraman and

Mustapha Mouloua. Eds. Automation and Human Performance: Theory and Applications. Mahwah, NJ: Lawrence Erlbaum Associates.
36

sionmaking aboard ships with automated integrated bridge systems.

Integrated Bridge System Design and

Location

The performance of the watch officers during the voyage and the circumstances leading to

the grounding were linked to several errorinducing deficiencies in the design of the

equipment and to an inefficient layout of system

displays on the bridge.

Although the Raytheon 920 GPS receiver’s

NMEA 0183 output data should have been programmed to identify the receiver as an integrated instrument (II) talker with a system mode

(SYS) sentence to indicate GPS or DR mode, the

industry standard NMEA 0183 data protocol did

not provide a SYS identifier for DR mode. In

short, the NMEA did not consider that hybrid

mode receivers could use DR as one of their

modes of determining position. Consequently,

the Raytheon designers chose to use the GPS

GP identifier in the NMEA 0183 output, regardless of whether the Raytheon 920 GPS device was transmitting valid GPS data or DRderived position data.

To account for this, however, Raytheon also

programmed the Raytheon 920 GPS to automatically set the NMEA 0183 valid/invalid position data bits to the invalid state when the GPS

was operating in the SOL and/or DR mode. In

doing so, Raytheon assumed that a listener device, such as the NACOS 25, using position data

from a GP talker would recognize when the data

were flagged invalid.

Once the desired position receiver is selected by the crew, the NACOS 25 takes position data from the chosen position receiver

based on the “talker” identifier code in the

NMEA 0183 data stream; in this case, GP in the

data stream from the Royal Majesty’s Raytheon

920 GPS. STN Atlas designers did not expect a

device identifying itself as GP to send position

data based on anything other than GPS data,

particularly not on DR-derived position data.

Further, STN Atlas expected inaccurate or failed

GPS position data to be recognizable by nulled

position data fields or by no change in the position latitude/longitude, the latter of which would

trigger the NACOS 25 position-fix alarm. STN

Atlas therefore chose not to program the

NACOS 25 to check the valid/invalid bits in the

NMEA 0183 data stream as a means of detecting invalid GPS data. Consequently, when the

GPS defaulted to the DR mode, the NACOS 25

autopilot was unable to recognize the status

change; and thus its subsequent navigation did

not correct for the effect of wind, current, or

sea. The Safety Board concludes that because

the industry standard NMEA 0183 data protocol

did not provide a documented or standardized

means of communicating or recognizing that a

DR positioning mode was in use by a hybrid,

DR-capable position receiver, Raytheon and

STN Atlas adopted different design philosophies about the communication of positionreceiver mode changes for the Raytheon 920

GPS and the NACOS 25.

Nevertheless, STN Atlas was aware of and

claimed compatibility with the NMEA 0183

protocol containing the valid/invalid status bits

used by Raytheon and was capable of making

the NACOS 25 NMEA 0183 interface fully

compatible with those specifications if it wanted

to do so (including the recommended minimum

GPS data sentence RMC). Therefore, the Safety

Board further concludes that STN Atlas should

have, in order to help ensure safety and compatibility with different NMEA 0183 position

receivers, programmed the Royal Majesty’s

NACOS 25 to recognize the valid/invalid status

bits in the NMEA 0183 data, including those

specified in the NMEA 0183 v1.5 RMC recommended minimum GPS data sentence. The

Safety Board is aware that since the accident,

STN Atlas has taken steps to program its integrated navigation system NMEA 0183 interfaces to meet a newer, more comprehensive

NMEA 0183 version and to ensure that no DRcapable position receivers are used with its

NACOS-integrated navigation system. The

Safety Board believes that Raytheon should design its hybrid positioning systems to identify

themselves as integrated instruments (II) with an

appropriate system mode identifier (SYS) in coordination with the NMEA. Further, the Board

believes that the NMEA and the IEC should re-
37

vise their electronic interface standards to provide an explicit means of indicating when hybrid position receivers are transmitting DRderived position data. Finally, the Board believes that the NMEA and the IEC should advise

their members to (1) immediately inform the

NMEA and the IEC of perceived inadequacies

in electronic interface standards and (2), if applicable, design their hybrid positioning systems

to identify themselves (“talk”) as integrated instruments (II) with an appropriate system mode

identifier (SYS).

Although the Royal Majesty was equipped

with multiple position receivers, the NACOS 25

autopilot was not configured to compare position data from multiple independent position

receivers, such as the Raytheon 920 GPS and

the 780 Loran-C receivers. Given the Royal

Majesty’s frequent proximity to land and the

expected reasonable accuracy of the Loran-C in

that area, the NACOS 25 could have recognized

the large discrepancy between the GPS and the

Loran-C positions as the vessel approached

Nantucket Shoals had it been able to compare

them. The Safety Board concludes that had the

autopilot been configured to compare position

data from multiple independent position receivers and had a corresponding alarm been installed

that activated when discrepancies were detected,

the accident may have been avoided. The safety

benefits associated with the redundancy of such

critical systems as position receivers would help

prevent such single-point catastrophic failures

as occurred on the Royal Majesty. The Safety

Board believes, therefore, that STN Atlas should

design its integrated bridge systems to incorporate multiple independent position receivers,

comparison of position data from those receivers, and related crew alerts regarding changes in

position-receiver accuracy, selection, and mode.

The NACOS 25 central console provided efficient access to and display of most information

needed to conduct a passage when the GPS was

fully operational. However, where various

sources of position information were possible

(i.e., GPS, Loran-C, or DR), as with the NACOS

25 autopilot, it was important to delineate

clearly which mode was in use. On the Royal

Majesty, because the NACOS 25 could not detect the GPS’s change to DR mode, the central

console display switched from GPS to DRderived positions without changing its display in

any perceivable way or notifying the crew. The

integrated bridge system, as configured, did not

indicate to the officers at the central console that

the navigation system had defaulted to the DR

mode.

The design of the integrated bridge system

consolidated most of the officers’ watchstanding

navigation activities at the central console when

the Royal Majesty was underway. The officer on

watch could remain in the console seat for most

of his watch and execute maneuvers along with

most of the essential navigation tasks. However,

key components of the system were installed

elsewhere so that the officers needed to leave

the console area to do monitoring tasks. In order

to cross check the position instrumentation and

to verify that the navigation system was not in

the DR mode, officers needed to see equipment

displays in the chart room behind the console

area on the bridge. The GPS and the Loran-C

receivers were convenient only when manual

chart work was being performed. The Safety

Board concludes that because watch officers

must verify proper equipment operation frequently, alternative sources of critical equipment status should have been displayed directly

on the console or on repeaters located where

they could be seen from the central console.

Of particular concern was the alarm system

for the GPS. The internal aural alarm for the

GPS lasted 1 second, despite its critical function. Neither the brief aural alarm nor the visual

alarm, in the form of very small DR and SOL

characters on the GPS receiver’s screen, could

be easily seen or heard at the command console.

Rather, the GPS receiver was in the chart room.

The remoteness of the location probably precluded the watch officers’ hearing the alarm or

initially noticing the DR and SOL indications

when the GPS defaulted to the DR mode. Further, the installer of the integrated bridge system

did not connect the GPS receiver’s external

alarm switch to a loud and continuous external

alarm, even though one was available. Had the

GPS external alarm been installed or had its internal aural alarm required the user to take ac-
38

tion to silence it, the officers would have been

alerted to the GPS antenna problem shortly after

leaving St. George’s. Consequently, the Safety

Board concludes that the Raytheon 920 GPS

receiver’s brief aural alarm, the remoteness of

the receiver’s location, and the failure of the

installer to connect the GPS external alarm resulted in the inadequacy of the aural warning

sent to the crew when the GPS defaulted to the

DR mode. In view of the foregoing, the Safety

Board believes that Raytheon should design its

position receivers to provide continuous aural

alarms that require the user to take action to silence them. The Board further believes that the

NMEA should recommend that its members design and install critical aural alarms that are

continuous and require the user to take action to

silence them. Finally, the Safety Board believes

that the ICCL, the International Chamber of

Shipping, and INTERTANKO should recommend to their members that they ensure that integrated bridge systems installed on their vessels

provide critical aural alarms that are continuous

and require the user to take action to silence

them.

The failure of the GPS antenna connection

and the subsequent failure of the NACOS 25

autopilot to recognize the GPS data as invalid

and to sound an alarm resulted in a single-point,

“silent” failure mode on the Royal Majesty.

Aeronautical and aerospace design safety practices typically require the analysis of potential

failure modes via failure modes and effects

analyses (FMEAs). FMEAs of the Royal Majesty’s integrated bridge system could have highlighted the need for multiple independent comparisons of positioning systems to detect discrepancies between systems, the need for removal of the DR input to the Raytheon 920 GPS

receiver, and the need for the NACOS 25 to interrogate the NMEA 0183 valid/invalid position

data bits. The Safety Board concludes that

FMEAs of the Royal Majesty’s integrated bridge

system would probably have disclosed the

shortcomings of the system’s components.

Therefore, the Safety Board believes that the

Coast Guard should propose to the IMO that it

develop standards for integrated bridge system

design that will require:

• multiple independent positionreceiver inputs;

• monitoring position-receiver data

for failures/invalid data and subsequent positive annunciation to the

crew;

• comparing position-receiver data for

significant discrepancies between

position receivers, and subsequent

positive annunciation to the crew;

and

• FMEAs during the design process

and once again when all peripheral

devices and equip-ment details have

been “frozen” if the FMEA during

the design process does not account

for all peripheral device/equipment

variations.

The Safety Board also believes that STN

Atlas should recommend that all of its customers have final FMEAs for their installations,

because overall integrated bridge system and

peripheral device installation details frequently

vary from installation to installation.

Further, the Safety Board believes that, in

the interim, the ICCL, the International Chamber of Shipping, and INTERTANKO should

recommend that each of their members ensure

that their existing and new integrated bridge

systems incorporate the following:

• multiple independent positionreceiver inputs;

• monitoring position-receiver data

for failures/invalid data and subsequent positive annunciation to the

crew;

• comparing position-receiver data for

significant discrepancies between

position receivers, and subsequent

positive annunciation to the crew;

and

• FMEAs on existing systems, during

the design process for new systems,
39

and whenever peripheral devices or

equipment details change.

Human Systems Integration

It is apparent that the marine industry is undergoing the same evolution in automation that

the aviation and other transportation industries

are. Accidents involving automated systems,

like the grounding of the Royal Majesty, highlight the importance of considering the abilities

of the human operator in automated systems.

Rothblum et al. concluded:

Automation is becoming more prevalent

on commercial ships, affecting such areas as engineering, bridge, and cargo

operations. When designed properly and

used by trained personnel, such automation can be helpful in improving operational efficiency and safety. However, when designed poorly or misused

by undertrained or untrained personnel,

automated equipment can be a contributing cause to accidents. In one study of

100 marine casualties, inadequate

knowledge about equipment was found

to be a contributing cause in 35 percent

of the casualties. The most frequently

cited problem was the misuse or nonuse

of radar. Lack of training is not the only

problem. Poor equipment design can induce the mariner to make mistakes. In

the same study, one-third of the accidents were found to be caused partly by

poor human-factors design of the

equipment.55

Inadequate training and poor human-factors

design are often the result of applying a technology-centered philosophy to automated systems.56 This approach seeks to replace mariner

functions with machine functions without considering the mariners’ capabilities and limita-

 55Rothblum, Sanquist, Lee, and McCallum. “Identifying

the Effects of Shipboard Automation on Mariner Qualifications and Training and Equipment Design.” Paper prepared for ISHFOB ’95: Informational Symposium—Human Factors on Board. Bremen, Germany. November 15-

17, 1995.

56Norman, S; Billings, C.E.; and others. 1988. Aircraft

automation philosophy: A source document. Moffett Field,

CA: NASA Ames Research Center.

tions. As a result, the approach has the effect of

leaving the mariner out of meaningful control or

active participation in the operation of the ship.

A human-centered philosophy towards automation recognizes that the mariner is the central

element in the operation of the ship. Consequently, the philosophy emphasizes designs that

fully utilize human capabilities and protect

against human limitations, such as unreliable

monitoring and bias in decisionmaking.

Human systems integration (HSI), part of

the systems engineering57 process addressing

the psycho-social aspects of system design, represents a method by which automation can be

designed with a human-centered philosophy.

HSI addresses such areas as human-factors engineering,58 training, manpower, and personnel.

The types of human engineering analyses associated with HSI (i.e., task analysis, and error

analysis) help us to understand the impact of

automation on human tasks and on the entire

system’s performance.

Several standards and guidelines have been

produced to ensure that human factors are addressed in system designs, thus reducing the

potential for human error. These standards address behaviors related to automation and specify design parameters that keep the systems’

operating characteristics within the physical and

cognitive capabilities of humans. The U.S. Department of Defense and the National Aeronautics and Space Administration have long recognized the importance of addressing human factors early in the system design, development,

and overall acquisition processes and have published relevant human engineering standards and

guidelines.59

 57Systems engineering is the management function that

controls the total system development effort for the purpose

of achieving an optimum balance of all system elements.

Generally, those elements are equipment, software, personnel, facilities, and data. HSI specifically addresses the personnel, or human interactive, aspects of the system.

58Human-factors engineering is the application of the principles of human behavior to the design of equipment and

systems to enhance performance, safety, and quality.

59Department of Defense: DOD 5000.2 “Defense Acquisition Management Policies and Procedures;” MIL-H-46855,

“Human Engineering Requirements for Military Systems,
40

Other sectors of the maritime industry have

incorporated human-factors engineering routinely. For example, the American Society of

Testing and Materials has adopted much of the

Department of Defense human engineering

standards in designing off-shore oil platforms.60

Thus, while human engineering is a known concept in the marine industry, there have not been

any unifying efforts to integrate this concept

into the marine engineering and manufacturing

sector. Additionally, human engineering in the

broader context of HSI has been given little or

no consideration. Consequently, the potential

for error causing behavior related to these systems has not been adequately addressed by the

marine industry.

To assess the HSI involved in the automated

systems on the Royal Majesty, the Safety Board

examined the training the officers received and

the design of the automated systems in the context of human-factors engineering.

Watch Officers’ Training in Using the Integrated Bridge System.—The investigation

determined that although the manufacturer of

the NACOS autopilot, STN Atlas, had classroom and simulator training available to purchasers of the system, the owner of the Royal

Majesty had not purchased any training. When

the vessel was placed in service, the manufacturer provided an orientation during sea trials to

the first complement of officers assigned to the

ship; however, of the officers on the Royal Majesty at the time of the grounding, only the chief

officer had been a part of that complement.

The investigation determined that the watch

officers on the Royal Majesty during the

grounding were familiar with the basic operation of the automated navigation equipment, but

that no one, with the possible exception of the

navigator, appeared to be fully proficient with

the system, as evidenced by the lack of knowl-

 

Equipment, and Facilities;” MIL-STD-1472, “Human Engineering Design Criteria for Military Systems, Equipment, and

Facilities;” MIL-STD 1800, “Human Factors Engineering;”

MIL-STD 1801, “User-System Interface.”

60ASTM Standard F1166-88, Standard practice for human engineering design for marine systems, equipment and

facilities. ASTM Philadelphia, Pennsylvania.

edge about the GPS receiver’s DR mode capability. The crew’s automated navigation equipment training consisted primarily of on-the-job

training, the type of training on which the marine industry has historically relied. For example, the second officer’s preparation to operate

the automated navigation system was described

as him reading the equipment manuals acquired

with the system installation, observing bridge

operations by the other officers, and using the

equipment under their supervision. Because the

second officer’s introduction to the system consisted of watching others or operating the system himself during routine conditions, he

probably had very little experience in recognizing and coping with system malfunctions.

The Safety Board has long supported onthe-job training as an important aspect of an operator’s training. However, with the implementation of sophisticated, automated navigational

equipment, the Safety Board believes that onthe-job training alone may not be sufficient. The

Safety Board is particularly concerned that there

were no procedures to determine the proficiency

of the officers in operating the automated navigation system, including the navigator who, according to his testimony, was responsible for all

instruments on the bridge and the orientation

and training of new officers. The Safety Board

concludes that the on-the-job training program

employed by Majesty Cruise Line to train the

Royal Majesty’s watch officers in the operation

of the integrated bridge system did not adequately prepare the officers to identify and respond to system malfunctions. Therefore, the

Safety Board believes that Majesty Cruise Line

should provide initial and recurrent formal

training on essential technical information,

equipment functions, and system operating procedures to all bridge watchstanding personnel

on all of its ships that are equipped with integrated bridge systems. The Safety Board also

believes that the ICCL should encourage its

members to take the same steps.

As discussed earlier, the watch officers, in

particular the second officer and the chief officer, abandoned the good watchstanding practices of properly monitoring and cross checking

the progress of their vessel and instead relied
41

almost solely on the GPS and the ARPA display

to provide them with information about the vessel’s movements. The circumstances of the

grounding of the Royal Majesty and the discussions at the Safety Board’s public forum suggest

that there is a need for the international maritime community to address the issue of improving training for deck officers assigned to vessels

equipped with electronic navigation equipment

and integrated bridge systems. The Safety Board

is concerned that the inadequacy of training

given to the crew of the Royal Majesty in the

use of sophisticated electronic navigation

equipment and integrated bridge systems may be

typical of the industry. Therefore, the Safety

Board believes that the Coast Guard should propose to the IMO that it develop appropriate performance standards for the training of watch

officers assigned to vessels equipped with sophisticated electronic navigation equipment and

integrated bridge systems and then require this

training.

The deficient monitoring of the integrated

navigation system by the deck officers and the

second officer’s failure to recognize the danger

to the Royal Majesty before the grounding point

to the usefulness of training in bridge resource

management. As shown by its issuance of Safety

Recommendations M-93-18, and -19, the Safety

Board has advocated such training for deck officers who operate conventional navigation

bridges. The grounding of the Royal Majesty,

however, shows the need to address procedures

for and training in effective monitoring of automated navigation equipment.

Bridge resource management training

adapted for watch officers working with fully

automated navigation systems or integrated

bridge systems could improve the officers’ performance. The training would help them make

decisions that are not biased by their use of

automated equipment. It would improve their

situational awareness,61 which, research

 61Situational awareness is a concept referring to perception of an operating environment, comprehension of events

and circumstances pertaining to that environment, and a

projection of their status. Endsley, M., Situational Awareness. Presentation to National Transportation Safety Board,

June 6, 1996.

shows,62 declines when operations are automated.

On June 25, 1993, as a result of its investigation of the grounding of the United Kingdom

passenger vessel RMS Queen Elizabeth 2 (near

Cuttyhunk Island, Vineyard Sound, Massachusetts, on August 7, 1992, the Safety Board issued Safety Recommendations M-93-18 and -19

to the Coast Guard. The Safety Board requested

that the Coast Guard:

Propose to the IMO that standards and

curricula be developed for bridge resource management training for the

masters, deck officers, and pilots of

ocean-going ships. (M-93-18)

Propose to the IMO that the masters,

deck officers, and pilots of ocean-going

ships be required to successfully complete initial and recurrent training in

bridge resource management. (M-93-19)

On September 27, 1993, responding to

Safety Recommendation M-93-18, the Coast

Guard Commandant wrote:

I partially concur with this recommendation. The U.S. will propose at the

25th Session of the IMO Subcommittee

on STW that standards and curricula be

developed for bridge resource management training for masters and deck officers of seagoing ships. However, the

Coast Guard views pilot qualifications

as a matter for port State regulation. I

will keep the Board informed of our

progress regarding this recommendation.

On January 7, 1994, the Safety Board responded:

 

62Pew, R.W. Situational Awareness and its Analysis in

Accident Situations. Presentation by Bold, Beranek and

Newman, Inc., to the National Transportation Safety Board,

June 7, 1995. Also, Endsley, M.L. and Kiris, E.O., The

Out-of-the-Loop Performance Problem: Impact of Level of

Automation and Situational Awareness., ref. In Mouloua,

M. and Parasuraman, R., Eds., Human Performance in

Automated Systems: Current Research and Trends,

Hillsdale, New Jersey, Lawrence Erlbaum Associates,

1994. Pp. 51,55.
42

The Safety Board agrees that, in the

end, pilot qualifications are a matter for

the port State to enforce. The intent of

the recommendation is for the IMO to

develop a specified standard that would

serve as a model that the port States

could adopt. The United States has recently been more receptive to the idea

of developing a unilateral standard if it

is included in the Standards of Training

and Watchkeeping. Consequently, the

Board encourages the Coast Guard to

pursue this issue at the IMO. Because

the Coast Guard states it will propose

the recommendation to the IMO, Safety

Recommendation M-93-18 has been

classified “Open--Acceptable Response,” pending implementation by the

IMO.

On September 27, 1993, responding to

Safety Recommendation M-93-19, the Coast

Guard Commandant wrote:

I partially concur with this recommendation. The United States will propose

that IMO agree in principle to requiring

masters and deck officers on seagoing

ships to complete initial and recurrent

training in bridge resource management.

However, the Coast Guard views pilot

qualifications as a matter for port State

regulation. I will keep the Board informed of our progress regarding this

recommendation.

On January 7, 1994, the Safety Board responded that for the reasons stated in the discussion of Safety Recommendation M-93-18, the

Safety Board encouraged the Coast Guard to

actively promote the IMO’s acceptance of

Safety Recommendation M-93-19. Because the

Coast Guard had agreed to “proposing in principle” the recommendation, the Board classified

Safety Recommendation M-93-19 “Open--

Acceptable Alternate Response,” pending the

outcome of the Coast Guard’s efforts.

Therefore, the Safety Board reiterates

Safety Recommendations M-93-18 and -19 and

urges the Coast Guard to work closely with the

IMO in order to expedite the intended outcome

of these recommendations.

The Safety Board also believes that the

Coast Guard, as part of the foreign flag passenger ship control verification examination program, should assess the adequacy of installed

integrated bridge systems and verify that the

ships’ officers are properly trained in their operation and possible failure modes. Furthermore,

as part of the same program, the Coast Guard

should verify that the watchstanding procedures

of ships’ officers include the use of multiple

independent means of position verification.

Human-factors Engineering.—Where multiple modes of operation are possible on a system, an important human-factors engineering

principle is the clear delineation to the operator

of what mode is in use and of when a change in

mode occurs. Because different operating procedures may be required for the different modes

in use, the operator must be aware of the mode

to remain in the decisionmaking process. Thus,

the display of which modes and functions are in

use should be clearly evident to the operator.

A good example of automation mode confusion occurred on January 20, 1992, when an Air

Inter Airbus A320 crashed on a mountainside

while on approach to the Strasbourg-Entzheim

Airport. The French Transport Ministry’s investigation determined that the pilots had become confused with the vertical speed/flight

path angle display mode on the A320’s flight

control unit and had entered a 3,300 foot/minute

automatic rate of descent instead of an intended

3.3 angle of descent to the airport. The displays

of the vertical speed and the flight path angle

were almost identical and thus easily confused.

Not only did the GPS receiver on the Royal

Majesty display the DR coordinates in the same

character size and format as the coordinates derived from satellite data, it switched to the DR

mode automatically, without requiring a human

to acknowledge that the mode was acceptable.

However, as previously discussed, deficiencies

in the alarm, the distance of the receiver from

the operator, and the inadequacy of the crew’s

procedures also contributed to the crew’s failure

to recognize the change to DR mode.
43

The size of characters, the viewing distance,

and the use of contrasting colors are a few of the

factors that should be considered in designing

character displays for alerts and warnings. Alert

messages and status indicators about critical

information, such as the GPS defaulting to the

DR mode, should be distinctively displayed. In

this case, the SOL and DR alert messages were

much smaller than the normal status information.

An operator may also become desensitized

when an alert appears frequently with normal

status information. In this case, whenever chopping occurred, SOL and DR were displayed. The

watch officers had noticed these messages many

times before and perhaps had learned to pay little attention to them.

The Safety Board concludes that the Royal

Majesty’s integrated bridge system had several

shortcomings with respect to human-factors engineering. First, mode information was not

available to the crew at the central console (the

normal position). Second, the GPS/DR alarm

and status indicators, which could have alerted

the crew to the mode change, were either not

installed (external alarm) or not salient enough

(internal alarm) to attract the watchstanders’

attention. Finally, the integrated bridge system

as implemented on the Royal Majesty failed to

adequately define the watch officers’ tasks and

procedures. If the automation on board the

Royal Majesty had been appropriately implemented and integrated with the human operator,

the vessel probably would not have grounded.

Because of the Safety Board’s concern that

automation on other vessels has not been appropriately implemented and integrated with the

human operator, the Board believes that the

Coast Guard should propose to the IMO that it

apply existing human-factors engineering standards in the design of integrated bridge systems

on vessels.

Certification of Integrated Bridge Systems

A draft IMO performance standard for integrated bridge systems is currently under review

and is expected to be adopted and implemented

by 1999. At the Safety Board’s public forum on

integrated bridge systems, manufacturers of integrated bridge systems pointed out that integrating the various components like ARPA,

autopilot, electronic chart system (or radar

map), and monitoring systems involves careful

matching and FMEAs to eliminate any potential

interface problems. The recently developed interface standards from the IEC and the NMEA

(IEC 1162-2 and NMEA 0183) should facilitate

the matching of subsystems manufactured by

one manufacturer to an integrated bridge system

manufactured by another. These standards and

an IMO performance standard should eliminate

many of the potential interface problems. The

Safety Board concludes that there is a need to

have performance standards for integrated

bridge systems, and to require that the systems

be inspected and certified.

The proposed IMO performance standard

for integrated bridge systems includes a requirement that the manufacturers of integrated

bridge systems be certified by the ISO. Thus, it

would appear that the safeguards for guaranteeing the quality of software during manufacturing

likely will become an IMO requirement. Such a

requirement could ensure that the people responsible for developing the software are well

qualified and that the manufacturer has procedures for verifying the quality of the software.

Developments in electronic equipment,

however, are very rapid, and it is sometimes

possible for developments to occur more quickly

than standards can be produced. Further, the

possibility exists that software may be changed,

possibly inappropriately, during the life of an

integrated bridge system. Therefore, the selection and matching of electronic equipment will

still require highly qualified personnel who are

familiar with the equipment, the data to be

transmitted, the format of the data, and the applicable standards. The Safety Board believes

that there is a need for some competent authority to conduct continuing oversight to ensure

that future changes in subsystems or software on

integrated bridge systems are compatible and

that system integrity is maintained. Also, the

Safety Board believes that certifying navigation

bridges equipped with integrated bridge systems
44

should be done by a qualified, independent

authority. In summary, the Safety Board believes that the Coast Guard should propose to

the IMO that a provision be included in the performance standard for integrated bridge systems

that would require that a competent independent

authority inspect and certify the navigation

bridge of each commercial vessel equipped with

an integrated bridge system when the system is

installed and periodically throughout its life.
45

CONCLUSIONS

1. The weather, the mechanical condition of

the Royal Majesty, except for the global positioning system receiver, the officers’ certifications, drugs, and fatigue were not factors

in the accident.

2. Although Coast Guard personnel observed

no indications that the officers had been under the influence of alcohol, alcohol could

not be conclusively ruled out as a factor in

the accident because of the delay in collecting the blood and urine specimens.

3. About 52 minutes after the Royal Majesty

left St. George’s, Bermuda, the global positioning system receiver antenna cable connection had separated enough that the global

positioning system switched to deadreckoning mode, and the autopilot, not programmed to detect the mode change and invalid status bits, no longer corrected for the

effects of wind, current, or sea.

4. Openly routing the global positioning system antenna cable in an area where someone

occasionally walked increased the risk of

damage to the cable and related connectors.

5. Had the fathometer alarm been set to 3 meters, as was the stated practice, or had the

second officer chosen to display the

fathometer data on the control console, he

would have been alerted that the Royal Majesty was in far shallower water than expected and, thus, was off course. He would

have been alerted perhaps as long as 40

minutes before the grounding, and the

situation could have been corrected.

6. The watch officers’ monitoring of the status

of the vessel’s global positioning system

was deficient throughout the voyage from

St. George’s.

7. Deliberate cross checking between the

global positioning system and the Loran-C

to verify the Royal Majesty’s position was

not being performed and should have been

on the voyage from St. George’s.

8. Even though it is likely that the watch officers were not aware of the limitation inherent in using the position-fix alarm to monitor the accuracy of GPS position data, it was

inappropriate for them to rely solely on the

alarm to warn them of any problems with

the GPS data.

9. The sighting of lights not normally observed

in the traffic lanes, the second officer’s inability to confirm the presence of the BB

buoy, and the sighting of blue and white

water should have taken precedence over

the automation display on the central console and compelled the second officer to

promptly use all available means to verify

his position.

10. The chief officer and the second officer did

not observe good watchkeeping practices or

act with heightened awareness of the precautions that are needed when a vessel approaches the Boston traffic lanes and landfall.

11. The master’s methods for monitoring the

progress of the voyage did not account for

the technical capabilities and limitations of

the automated equipment.

12. The watch officers on the Royal Majesty

may have believed that because the global

positioning system had demonstrated sufficient reliability over 3 1/2 years, the traditional practice of using at least two independent sources of position information was

not necessary.

13. All the watchstanding officers were overly

reliant on the automated position display of

the navigation and command system 25 and

were, for all intents and purposes, sailing

the map display instead of using navigation

aids or lookout information.
46

14. Because the industry standard 0183 data

protocol did not provide a documented or

standardized means of communicating or

recognizing that a dead-reckoning positioning mode was in use by a hybrid, dead reckoning capable position receiver, Raytheon

and STN Atlas adopted different design

philosophies about the communication of

position-receiver mode changes for the

Raytheon 920 global positioning system and

the navigation and command system 25.

15. STN Atlas should have, in order to help ensure safety and compatibility with different

National Marine Electronics Association

(NMEA) 0183 position receivers, programmed the Royal Majesty’s navigation

and command system 25 to recognize the

valid/invalid status bits in the NMEA 0183

data, including those specified in the NMEA

0183 v1.5 RMC recommended minimum

global positioning system data sentence.

16. Had the navigation and command system 25

autopilot been configured to compare position data from multiple independent position

receivers and had a corresponding alarm

been installed that activated when discrepancies were detected, the grounding of the

Royal Majesty may have been avoided.

17. Because watch officers must verify proper

equipment operation frequently, alternative

sources of critical equipment status should

have been displayed directly on the console

or on repeaters located where they could be

seen from the central console.

18. The brief aural alarm of the Raytheon 920

global positioning system receiver, the remoteness of the receiver’s location, and the

failure of the installer to connect the global

positioning system external alarm resulted

in the inadequacy of the aural warning sent

to the crew when the global positioning

system defaulted to the dead-reckoning

mode.

19. Failure modes and effects analyses of the

Royal Majesty’s integrated bridge system

would probably have disclosed the shortcomings of the system’s components.

20. The on-the-job training program employed

by Majesty Cruise Line to train the Royal

Majesty’s watch officers in the operation of

the integrated bridge system did not adequately prepare these officers to identify

and respond to system malfunctions.

21. The Royal Majesty’s integrated bridge system did not adequately incorporate humanfactors engineering.

22. There is a need to have performance standards for integrated bridge systems, and to

require that the systems be inspected and

certified.
47

PROBABLE CAUSE

The National Transportation Safety Board

determines that the probable cause of the

grounding of the Royal Majesty was the watch

officers’ overreliance on the automated features

of the integrated bridge system, Majesty Cruise

Line’s failure to ensure that its officers were

adequately trained in the automated features of

the integrated bridge system and in the implications of this automation for bridge resource

management, the deficiencies in the design and

implementation of the integrated bridge system

and in the procedures for its operation, and the

second officer’s failure to take corrective action

after several cues indicated the vessel was off

course.

Contributing factors were the inadequacy of

international training standards for watchstanders aboard vessels equipped with electronic

navigation systems and integrated bridge systems and the inadequacy of international standards for the design, installation, and testing of

integrated bridge systems aboard vessels.
48

RECOMMENDATIONS

As a result of its investigation of this accident, the National Transportation Safety Board

reiterates the following recommendations:

To the U.S. Coast Guard:

Propose to the International Maritime

Organization that standards and curricula be developed for bridge resource

management training for the masters,

deck officers, and pilots of ocean-going

ships. (M-93-18)

Propose to the International Maritime

Organization that the masters, deck officers, and pilots of ocean-going ships be

required to successfully complete initial

and recurrent training in bridge resource

management. (M-93-19)

Also as a result of the investigation, the National Transportation Safety Board makes the

following recommendations:

To Majesty Cruise Line:

Provide initial and recurrent formal

training on essential technical information, equipment functions, and system

operating procedures to all bridge

watchstanding personnel on all its ships

that are equipped with integrated bridge

systems. (M-97-1)

Review the bridge watchstanding practices on all its vessels, and revise, as

necessary, to ensure that all watch officers adhere to sound watchstanding

practices and procedures, including using landmarks, soundings, and navigational aids to verify a vessel’s position,

relying on more than one source for position information, and reporting to the

master any failure to detect important

navigational aids. (M-97-2)

Periodically review the performance of

all officers on board its vessels.

(M-97-3)

Eliminate the practice of openly routing

navigation equipment cable to decrease

the risk of damage. (M-97-4)

To the U.S. Coast Guard:

Propose to the International Maritime

Organization that it develop appropriate

performance standards for the training

of watch officers assigned to vessels

equipped with sophisticated electronic

navigation equipment and integrated

bridge systems and then require this

training. (M-97-5)

Propose to the International Maritime

Organization that it develop standards

for integrated bridge system design that

will require

• multiple independent positionreceiver inputs;

• monitoring position-receiver data

for failures/invalid data and subsequent positive annunciation to the

crew;

• comparing position-receiver data for

significant discrepancies between

position receivers, and subsequent

positive annunciation to the crew;

and

• failure modes and effects analyses

(FMEAs) during the design process

and once again when all peripheral

devices and equipment details have

been “frozen” if the FMEA during

the design process does not account

for all peripheral device/equipment

variations. (M-97-6)

Propose to the International Maritime

Organization that it apply existing human-factors engineering standards in the

design of integrated bridge systems on

vessels. (M-97-7)
49

Propose to the International Maritime

Organization that a provision be included in the performance standard for

integrated bridge systems that would require that a competent independent

authority inspect and certify the navigation bridge of each commercial vessel

equipped with an integrated bridge system when the system is installed and

throughout its life. (M-97-8)

Continue its research on shipboard

automation, focusing on watch officers’

monitoring and decisionmaking aboard

ships with automated integrated bridge

systems. (M-97-9)

As part of the foreign flag passenger

ship control verification examination

program, assess the adequacy of installed integrated bridge systems and

verify that the ships’ officers are properly trained in their operation and possible failure modes. (M-97-10)

As part of the foreign flag passenger

ship control verification examination

program, verify that the watchstanding

procedures of ships’ officers include the

use of multiple independent means of

position verification. (M-97-11)

To STN Atlas Elektronik GmbH:

Design its integrated bridge systems to

incorporate multiple independent position receivers, comparison of position

data from those receivers, and related

crew alerts regarding changes in position-receiver accuracy, selection, and

mode. (M-97-12)

Recommend that all its customers have

final failure modes and effects analyses

for their integrated bridge system installations. (M-97-13)

To Raytheon Marine:

Design its hybrid positioning systems to

identify themselves as integrated instruments (II) with an appropriate system mode identifier (SYS) in coordination with the National Marine Electronics Association. (M-97-14)

Design its position receivers to provide

continuous aural alarms that require the

user to take action to silence them.

(M-97-15)

To the National Marine Electronics Association:

Revise the 0183 electronic interface

standard to provide an explicit means of

indicating when hybrid position receivers are transmitting dead reckoningderived position data. (M-97-16)

Advise its members to (1) immediately

inform the National Marine Electronics

Association and the International Electrotechnical Commission of perceived

inadequacies in electronic interface

standards and (2), if applicable, design

their hybrid positioning systems to

identify themselves (“talk”) as integrated instruments (II) with an appropriate system mode identifier (SYS).

(M-97-17)

Recommend to its members that they

design and install critical aural alarms

that are continuous and require the user

to take action to silence them.

(M-97-18)

To the International Electrotechnical Commission:

Advise its members to (1) immediately

inform the National Marine Electronics

Association and the International Electrotechnical Commission of perceived

inadequacies in electronic interface

standards and (2) if applicable, design

their hybrid positioning systems to

identify themselves (“talk”) as integrated instruments (II) with an appropriate system mode identifier (SYS).

(M-97-19)

Revise the 1162 electronic interface

standard to provide an explicit means of

indicating when hybrid position receiv-
50

ers are transmitting dead reckoningderived position data. (M-97-20)

To the International Council of Cruise Lines:

Recommend that its members provide

initial and recurrent formal training on

essential technical information, equipment functions, and system operating

procedures to all bridge watchstanding

personnel on their ships that are

equipped with integrated bridge systems. (M-97-21)

Recommend that its members review

the bridge watchstanding practices on

all their vessels, and revise as necessary

to ensure that all watch officers adhere

to sound watchstanding practices and

procedures, including using landmarks,

soundings, and navigational aids to verify a vessel’s position, relying on more

than one source for position information, and reporting to the master any

failure to detect important navigational

aids. (M-97-22)

Recommend that its members periodically review the performance of all officers on board their vessels. (M-97-23)

Recommend that its members eliminate

the practice of openly routing navigation equipment cable to decrease the

risk of damage. (M-97-24)

Recommend to its members that they

ensure that integrated bridge systems installed on their vessels provide critical

aural alarms that are continuous and require the user to take action to silence

them. (M-97-25)

Recommend that its members ensure

that their existing and new integrated

bridge systems incorporate the following:

• multiple independent positionreceiver inputs;

• monitoring position-receiver data

for failures/invalid data and subsequent positive annunciation to the

crew;

• comparing position-receiver data for

significant discrepancies between

position receivers, and subsequent

positive annunciation to the crew;

and

• failure modes and effects analyses

on existing systems, during the design process for new systems and

whenever peripheral devices or

equipment details change.

(M-97-26)

To the International Chamber of Shipping

and to the International Association of Independent Tanker Owners:

Recommend to its members that they

ensure that integrated bridge systems installed on their vessels provide critical

aural alarms that are continuous and require the user to take action to silence

them. (M-97-27)

Recommend that its members ensure

that their existing and new integrated

bridge systems incorporate the following:

• multiple independent positionreceiver inputs;

• monitoring position-receiver data

for failures/invalid data and subsequent positive annunciation to the

crew;

• comparing position-receiver data for

significant discrepancies between

position receivers, and subsequent

positive annunciation to the crew;

and
51

• failure modes and effects analyses

on existing systems, during the design process for new systems and

whenever peripheral devices or

equipment details change.

(M-97-28) 

BY THE NATIONAL TRANSPORTATION SAFETY BOARD

JAMES E. HALL

Chairman

ROBERT T. FRANCIS II

Vice Chairman

JOHN A. HAMMERSCHMIDT

Member

JOHN J. GOGLIA

Member

GEORGE W. BLACK, JR.

Member

April 2, 1997
This page intentionally left blank
53

APPENDIX A

INVESTIGATION

About 2225 on June 10, 1995, the Panamanian passenger ship Royal Majesty, carrying 1,509 passengers and crewmembers, grounded on Rose and Crown Shoal about 10 miles east of Nantucket Island,

Massachusetts.

The Safety Board was notified of the grounding early on June 11, 1995. On Monday morning (June

12th), a Go-Team (an investigator-in-charge, an operations specialist, and, later, an aerospace engineer)

were dispatched to the scene. When the team arrived on board the vessel, it had already proceeded to

Boston. However, because the accident occurred in international waters, beyond the 3-mile limit, the

Safety Board lacked jurisdiction to investigate. The Board then requested and was given permission by

the Coast Guard to participate as a party in interest at the Coast Guard Marine Board of Inquiry.

Sworn testimony was taken in Boston, Massachusetts, from June 13 through June 16, 1995. Because

the Safety Board was participating as a party in interest, the scope of its investigation into the accident

was limited to the information obtained from the Coast Guard Marine Board. The Board did not have the

authority to depose individuals and subpoena important records.

The Safety Board has considered all facts in the investigative record that are pertinent to the Board’s

statutory responsibility to determine the probable cause of this accident and to make recommendations.

This report is based on the information collected and the analyses made during the Safety Board’s investigation.
This page intentionally left blank
55

APPENDIX B

MAJESTY CRUISE LINE’S

ROYAL MAJESTY’S “BRIDGE PROCEDURES GUIDE”

The purpose of this guide is to provide you with a description of day-to-day Bridge procedures that

are recognized as good practice and to promote through them safety of the Royal Majesty, her passengers

and crew. This guide is posted on the Bridge so that you may keep yourselves thoroughly familiar with

its content which is not written in an arbitrary manner but with sincere wish that you will understand

your responsibilities and perform your duties in a professional manner.

The officer on watch is my representative, and your primary responsibility at all times is the safe

navigation of the vessel. You must at all times comply with the 1972 International Regulations for Preventing Collisions At Sea.

You should keep your watch on the Bridge, which you should in no circumstances leave until properly relieved. A prime responsibility of the Officer on Watch is to ensure the effectiveness of the navigating watch. It is of essential importance that all times you ensure that an efficient lookout is maintained. You may visit the chart room, when essential, for short periods for the necessary performance of

your navigational duties, but you should previously satisfy yourself that it is safe to do so and ensure that

a good lookout is kept.

You continue to be responsible for the safe navigation of the vessel despite my presence on the

Bridge until I inform you specifically that I have assumed responsibility.

You should not hesitate to use the sound signaling apparatus at your disposal in accordance with the

1972 International Regulations for Preventing Collisions At Sea.

You are responsible for the maintenance of a continuous and alert lookout. This is the most important

consideration in the avoidance of casualties. The keeping of an efficient lookout requires to be interpreted in its fullest sense which includes the following: A) An alert all round visual and aural lookout to

ensure a full grasp of the current situation including the presence of ships and landmarks in the vicinity.

B) Close observation of the movements and compass bearing of approaching vessels. C) Identification of

ships and shore lights. D) The need to ensure that the course is steered accurately and that wheel orders

are correctly executed. E) Observation of the radar and echo sounder displays. F) Observation of changes

in the weather, especially the visibility.

You should bear in mind that the engines are at your disposal. You should not hesitate to use

them in case of need. However, timely notice of engine movements should be given when possible. You

should also keep prominently in mind the maneuvering capabilities of this ship, including its stopping

distances.

CONTROL OF MAIN ENGINES: There are two aspects with which you are mainly concerned:

(A) Control of revolutions and pitch ahead and astern. You should be familiar with the operation of the

engine/propellers control mechanism, bow thrusters, and rudders.

CHANGING OVER THE WATCH: The relieving officer on watch should ensure that members of

his watch are fully capable of performing their duties and, in particular, that they are adjusted to night

vision. You should not take over the watch until your vision is fully adjusted to the light conditions and

you have personally satisfied yourself regarding: A) Standing orders and other special instructions relating to the navigation of the vessel. B) The position, course, speed, and draught of the vessel. C) Prevailing and predicted tides, currents, weather, visibility, and the effect of these factors upon course and
56

speed. D) The navigational situation including: i) The operational condition of all navigation and safety

equipment. ii) Errors of gyro and magnetic compasses. iii) The movement of vessels in the vicinity. iv)

Conditions and hazards likely to be encountered during the watch. v) The possible effects of heel, trim,

water density, and squat on under keel clearances. If at any time you are to be relieved, a maneuver or

other action to avoid any hazard is taking place, your relief should be deferred until such action is completed. You should not hand over the watch to the relieving officer if you have any reason to believe that

the latter is under any disability which would preclude him from carrying out his duties effectively. If in

doubt, you should inform me at once.

You should make regular checks to ensure that: A) The helmsman or the autopilot is steering the correct course. B) The standard compass error is established at least once a watch and, when possible, after

any major alteration of course. C) The standard and gyro compasses are compared frequently and repeaters synchronized. D) The automatic pilot is tested in the manual position at least once a watch. E) The

navigation and signal lights and other navigation equipment are functioning properly.

HELMSMAN/AUTOMATIC PILOT: You should bear in mind the need to station the helmsman

and change over the steering to manual control in good time to allow any potentially hazardous situation

to be dealt within a safe manner. With a vessel under automatic steering, it is highly dangerous to allow a

situation to develop to the point where you are without assistance and have to break the continuity of the

lookout in order to take emergency action. The change-over from automatic to manual steering and visa

versa should be made by or under the supervision of a responsible officer.

NAVIGATION IN COASTAL WATERS: The largest scale chart on board, suitable for the area

and corrected with the latest information, should be used. You should identify positively all relevant

navigation marks. Fixes should be taken at intervals whose frequency must depend upon factors such as

distance from nearest hazard, speed of ship, set experienced, etc. In cases such as a planned approach to

an anchor berth or harbor entrance, fixing may be virtually continuous.

RESTRICTED VISIBILITY: When restricted visibility is encountered or suspected, your first responsibility is to comply with 1972 International Regulations for Preventing Collisions At Sea with particular regard to the sounding of fog signals, use of safe speed and availability of engines for immediate

maneuver. In addition you should A) Inform me. B) Post lookout(s), helmsman and in congested areas,

revert to hand-steering immediately, C) Exhibit navigation lights. D) Operate and use the radar. All of the

above actions should, if possible, be taken in good time before visibility deteriorates.

CALLING THE MASTER: You should notify me immediately under the following circumstances:

A) If visibility is deteriorating. B) If the movements of other vessels are causing concern. C) If difficulty

is experienced in maintaining course. D) On failure to sight land or a navigation mark or to obtain a

sounding by the expected time. E) If either land or a navigation mark is sighted or a marked change in the

soundings occurs unexpectedly. F) On the breakdown of the engines, steering gear, or any other essential

navigational equipment. G) If any doubt about the possibility of weather damage. H) In any other situation in which you are in doubt. Despite the requirement to notify me immediately in the foregone circumstances, you should not hesitate to take immediate action for the safety of the ship, where circumstances

so require.

NAVIGATION WITH PILOT EMBARKED: The presence of a pilot does not relieve you from

your duties and obligations. You should cooperate closely with the pilot and maintain an accurate check

on the vessel’s position and movements. Alterations of course and/or changes in wheel and/or engine

orders should be transmitted through you. If you are in any doubt as to the pilot’s actions or intentions,

you should seek clarification from the pilot and, if still in doubt, notify me immediately and take whatever action is necessary before I arrive.
57

THE WATCHKEEPING PERSONNEL: You should give watchkeeping personnel all appropriate

instructions and information which will remove the keeping of a safe watch, including a proper lookout.

SHIP AT ANCHOR: If I consider it necessary, a continuous navigational watch should be maintained in such circumstances, you should: A) Determine and plot the vessel’s position on the appropriate

chart as soon as possible and, at sufficiently frequent intervals, check by taking bearings of fixed navigational marks, or readily identifiable shore objects, whether the anchor is holding. B) Ensure that an effective lookout is maintained. C) Ensure that an inspection of the vessel is made periodically. D) Observe

weather, tidal, and sea conditions. E) Notify me and undertake all necessary measures if the vessel drags.

F) Ensure that the state of readiness of the main engines and other machinery is in accordance with my

instructions. G) Notify me if visibility deteriorates and comply with the 1972 International Regulations

for Preventing Collisions at Sea. H) Ensure that the vessel exhibits the appropriate lights and shapes and

that appropriate sound signals are made at all times.

In conclusion, I will always be available to you for advice you may need and I hope that you will at

all times endeavor to do your utmost for the benefit of all on board.

STRICT ATTENTION TO DUTY HAS ITS AWARDS.

 MASTER 

M/V Royal Majesty

[This is a retyped copy of the Royal Majesty’s “Bridge Procedures Guide,” which was presented as

an exhibit during sworn testimony taken by the joint Coast Guard/Safety Board investigation board.]
This page intentionally left blank
59

APPENDIX C

MAJESTY CRUISE LINE’S CIRCULAR NO. 9

DUTIES OF THE OFFICER ON WATCH I OPS I 3

1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

11.

12.

13.

14.

15.

The paper work required during the watch is to be done on the bridge CIRCULAR NO. 9 PAGE 3

done in the bridge, never in the chartroom. When yo u need to go

to the chartroom you should be brief.

Smoking in the chartroom is not allowed. JULY 1992

One quartermaster is to always be on the lookout position.

Check the compasses during your watch twice, and enter the readings in the relevant book. Check the course,

the position, navigation lights, traffic in the area, course and distance of ships in the vicinity before you take

over the watch.

Check the compass error at least once during your watch (weather condition permitting) and enter the

readings in the relevant book.

Check the ship’s position as often as conditions and circumstances allow, but never longer than 30 minute

intervals.

You summon the Master to the bridge when:

a) The visibility is less than 5 miles.

b) The wind changed direction, which could cause drifting from course.

c) Another ship is crossing the bow and the bearings are steady.

d) You have doubts about the position.

e) Traffic is congested or ship is about to pass dangerous areas.

If the Master is not in his office and cannot be found immediately, use the P.A. system by saying “THIS IS

THE BRIDGE” Never say “THE CAPTAIN IS REQUESTED ON THE BRIDGE. ”

In case of fog, after you have summoned the Master to the bridge, do the following:

a) Engines on “stand by. ”

b) Radar “on.”

c) Whistle “on.”

d) Switch from auto pilot to hand steering.

e) Close the watertight doors.

f) One quartermaster on the “lookout” position on the bridge and one AB at the bow.

g) Plot the course, position, and speed of all ships in the vicinity.

h) When the fog has cleared, recall all above actions.

Never pass another ship, land, or any other object less than 1.5 miles distance.

Start maneuvering the ship to avoid a collision, never less than 3 miles distance.

Close all the portholes and headlights during bad weather conditions.

One radar is to always be “ON” if the conditions require so. Relevant entry is to be made in the radar book.

Never leave your position before you are relieved by the Officer of the next watch.

Always be alert during your watch.
This page intentionally left blank
61

APPENDIX D

POSTACCIDENT TESTING OF GPS RECEIVER AND ANTENNA

 The Raytheon RAYSTAR 920 Global Positioning System (GPS) receiver and antenna used for

navigation during the grounding of the Royal Majesty were tested at Raytheon headquarters on July 6,

1995.1

 Present for the tests were representatives from the National Transportation Safety Board, Raytheon Marine, and Majesty Cruise Line. A new Raytheon RAYSTAR 920 GPS receiver and antenna,

randomly removed from Raytheon stock, were first tested to establish a baseline for functionality and

performance. The Raytheon GPS receiver and antenna from the Royal Majesty were then tested for comparison. Speed log and gyro compass inputs from bench test equipment were used to simulate dead reckoning (DR) data inputs when necessary. The test results follow:

• The Raytheon RAYSTAR 920 GPS receiver and antenna from the Royal Majesty functioned

per design and in a like manner to that of a new Raytheon RAYSTAR 920 GPS receiver and

antenna.

• An “open” in the GPS antenna cable shield wire, such as would result if the shield wire

pulled out of any connector leading to the antenna, results in the GPS receiver going into the

SOL and DR modes within 2 to 3 seconds of the “open” being established, regardless of

whether speed/course data are being input to the GPS receiver.

• As few as 1 to 3 strands of GPS antenna cable shield wire permit continued operation of the

antenna pre-amp and, therefore, system functionality.

• As long as the Raytheon 920 GPS receiver’s internal audio alarm function is active (user selectable; “ON” in the case of the Royal Majesty’s unit), going from a satellite fix condition to

the SOL and DR modes results in a brief (<1 second) audio alarm chime (similar to a wristwatch alarm in volume and tone).

• As long as the Raytheon 920 GPS receiver’s external alarm function is active (user selectable), going from a satellite fix condition to the SOL and DR modes results in a continuous

closing of the external alarm contacts (which could be used to wire up external or remote

audio alarms of various forms).

• When satellite data input is removed from the operating Raytheon 920 GPS receiver and

speed/course data (e.g., DR data) are available, a single audio alarm chime is emitted, and the

receiver continues to output NMEA 0183 v1.5 data, with the LAT/LONG portion of the

NMEA 0183 v1.5 data continuing to update based on the DR data and the last GPS position.

• When both satellite data and speed/course data (e.g., DR data) inputs are removed from the

operating Raytheon GPS receiver, two brief and separate audio alarm chimes are emitted,

and the receiver continues to output NMEA 0183 v1.5 data; but the LAT/LONG portion of

the NMEA 0183 v1.5 data stay fixed at the last position.

• An “open” in the antenna cable center conductor results in the GPS receiver going into the

SOL and DR modes within 2 to 3 seconds of the “open” being established, regardless of

whether speed/course data are being input to the GPS receiver.

 1

The Safety Board has maintained possession of the Royal Majesty’s GPS receiver and antenna since June 15, 1995.
62

• Shorting the antenna cable center conductor to the antenna cable shield wire results in the

GPS receiver backlights going off immediately, the SOL and DR modes are immediately displayed, all processor functions stop, and all NMEA 0183 v1.5 data output stops.

Whenever the Raytheon RAYSTAR 920 GPS receiver does not have any satellite data from which to

obtain a position fix, the receiver switches to the SOL and DR modes, and the satellite status information

screen indicates the following: ⇒ no satellites are being tracked ⇒ no signals are present

for any of the satellites ⇒ the degree of precision (DOP) is 0.0

Whenever the Raytheon 920 GPS receiver is in SOL and DR modes, the NMEA 0183 v1.5 data output contains multiple status indications of DR position data. The Royal Majesty’s Raytheon 920 GPS

receiver and antenna functioned properly during all tests and provided temporary aural and continuous

visual and electrical indications of the SOL and DR status. The electrical indications include the receiver’s external alarm contact and NMEA 0183 v1.5 output data, the latter of which contains

valid/invalid position data bits (A = VALID, V = INVALID) within the APA autopilot data sentence and

other data sentences.
63

APPENDIX E

SAFETY BOARD’S URGENT SAFETY RECOMMENDATIONS

ISSUED ON AUGUST 9, 1995

M-95-26 and -27 to the U.S. Coast Guard:

Immediately recommend that the International Maritime Organization urge its administrations to advise maritime vessel operators of the circumstances of the Royal Majesty

grounding and to encourage the operators to review the design of their integrated bridge

systems to identify potential system and operational failure modes that might result in

undetected changes to the autopilot function, and develop modifications as required. (M95-26)

Immediately advise maritime vessel operators of the circumstances of the Royal Majesty

grounding and urge them to review the design of their integrated bridge systems with the

manufacturer to identify potential system and operational failure modes that might result

in undetected changes to the autopilot function, and develop modifications as required.

(M-95-27)

Although Safety Recommendation M-95-26 was not officially entered into IMO’s SUBNAV-42 proceedings because of publication approval and time rules, the Coast Guard did distribute numerous copies

of the recommendation, and it was discussed at several of the technical working group sessions. Consequently, Safety Recommendation M-95-26 was classified “Closed—Acceptable Alternate Action” on

November 14, 1995. In response to Safety Recommendation M-95-27, the Coast Guard published a

safety note in the November/December issue of the proceedings of the Marine Safety Council and also

issued a “Notice to Mariners” advising them to review the operation of their integrated bridge systems to

identify failure modes. As a result, Safety Recommendation M-95-27 was classified “Closed—Acceptable Action” on January 16, 1996.

M-95-28 to the International Council of Cruise Lines, the International Chamber of Shipping,

the American Institute of Merchant Shipping, and the International Association of Independent

Tanker Owners:

Immediately advise members of the circumstances of the Royal Majesty grounding and

urge those members that operate with integrated bridge systems to review the design of

their integrated bridge systems for potential system and operational failure modes that

might result in undetected changes to the autopilot functions.

All recipients of Safety Recommendation M-95-28 responded favorably and advised their members

of the circumstances of the Royal Majesty grounding. For the International Chamber of Shipping, the

recommendation was classified “Closed—Acceptable Action” on October 27, 1995. For the other three

recipients, the recommendation was classified “Closed—Acceptable Action” on December 12, 1995.

M-95-29 to STN Atlas:

Immediately inform customers with the NACOS 25 integrated bridge system or similar

systems of the circumstances of the Royal Majesty grounding and review the design and

implementation of their systems to identify potential system and operational failure

modes that might result in undetected changes to the autopilot function.

STN Atlas acted promptly and informed all customers of the circumstances of the grounding. The

recommendation was classified “Closed—Acceptable Action” on December 21, 1995.
64

M-95-30 to the National Marine Electronics Association:

Immediately advise members of the circumstances of the Royal Majesty grounding and

urge members to review their products to identify potential system and operational failure modes that might result in undetected changes to system functionality, including

changes in NMEA 0183 position data validity.

The recommendation was classified as “Closed—Acceptable Action” on May 6, 1996, following

NMEA’s dissemination of information to all of its member companies.
65

APPENDIX F

PORTIONS OF COAST GUARD TRANSCRIPT OF

VHF-FM RADIO TRANSMISSIONS FROM THE

NANTUCKET SHOAL AREA ON THE EVENING OF JUNE 10, 1995

2042 fishing vessel (f/v) Sao Marcos [in English]: “Fishing vessel, fishing

vessel call cruise boat.”

2043 f/v Rachel E [in Portuguese]: “Are you there Toluis [nickname of

Tony Sao Marcos]?”

f/v Sao Marcos [in Portuguese]: “Yeah, who is this?”

f/v Rachel E [in Portuguese]: “It’s Antonio Pimental. Hey, that guy is

bad where he is. Don’t you think that guy is wrong in that area.”

f/v Sao Marcos [in Portuguese]: “I just tried to call him. He didn’t answer back. He is very wrong.”

f/v Rachel E [in Portuguese]: “I’ve been watching him for the last half

hour. He was a big contact on my radar. I picked him up 8 miles away.

[source unknown] [in English]: “Channel 16 is a distress channel and

this is international, please change your channel, please change your

channel.

[Portions of the remaining conversation were cut off; however, one

salvageable remark in Portuguese was that f/v Rachel E will try to call the

cruise boat.]

2045 f/v Rachel E [in English]: “Calling the cruise boat in the position 41

02N, 69 24W. Over.”

40 sec.

Later

f/v Rachel E [in English]: “Calling the cruise boat 41N, 69 24W.

Over.”

2046 f/v Sao Marcos [in Portuguese]: “Maybe nobody on the bridge is

paying attention.”

f/v Rachel E [in Portuguese]: “I don’t know. He is not going the right

way.”

[Both vessels say goodbye to each other in Portuguese.]
This page intentionally left blank
67

APPENDIX G

ABBREVIATIONS AND ACRONYMS

ARPA: automatic radar plotting aid

Boston traffic lanes: Port of Boston Traffic Separation Scheme

CFR: Code of Federal Regulations

DNV: Det Norske Veritas

DR: dead reckoning

FMEA: failure modes and effects analyses

GPS: global positioning system

HSI: human systems integration

ICCL: International Council of Cruise Lines

IEC: International Electrotechnical Commission

IMO: International Maritime Organization

INTERTANKO: International Association of Independent Tanker Owners

ISO: International Standards Organization

LR: Lloyd’s Register of Shipping

NACOS 25: navigation and command system

NAUT-C: optional classification notation developed by DNV

NAV: navigation (mode)

NAV1: navigation for 1-man bridge

Nav O: class notation for ocean area

Nav OC: class notation for ocean area/coastal waters

NMEA: the National Marine Electronics Association

SOL: solution

STN Atlas: STN Atlas Elektronik

TC8: Technical Committee 8 of the International Standards Organization (ISO/TC8)

TC80: Technical Committee 80 of the International Electrotechnical Commission (IEC/TC80)

W1: Watch 1, highest class notation in NAUT-C

WG9: working group belonging to the IEC/TC80