Factual Informati<strong>on</strong> 54 Marine Accident Reportcompanies have revised <strong>the</strong>ir SMS to include procedures for maintaining <strong>the</strong> ventilati<strong>on</strong>ducts in a fire-safe c<strong>on</strong>diti<strong>on</strong>.Qualitative Failure AnalysisRegulatory requirements. In 1988, <strong>the</strong> Coast Guard issued regulati<strong>on</strong>s(46 CFR 62, “Vital System Automati<strong>on</strong>” 43 ) requiring <strong>the</strong> use of a qualitative failureanalysis of certain automated systems, including propulsi<strong>on</strong> c<strong>on</strong>trol systems. In proposing<strong>the</strong> regulatory requirement that designers, manufacturers, and/or shipyards perform andsubmit system failure analysis, <strong>the</strong> Coast Guard stated that <strong>the</strong> use of advanced automati<strong>on</strong>technologies such as electr<strong>on</strong>ics and microprocessors made it increasingly difficult, “attimes impossible, for <strong>the</strong> Coast Guard, ship owners/operators, and classificati<strong>on</strong> societiesto evaluate safety.” The Coast Guard fur<strong>the</strong>r stated:The Coast Guard has chosen to propose safety performance standards that, to <strong>the</strong>greatest extent practicable, state <strong>the</strong> desired operati<strong>on</strong> or functi<strong>on</strong> withoutaddressing detailed design criteria…As an alternative to detail evaluati<strong>on</strong>, <strong>the</strong>Coast Guard proposes (to require) a failure analysis of <strong>the</strong> design and a selfcertificati<strong>on</strong>of design compliance to certain…standards. [This process]emphasizes <strong>the</strong> resp<strong>on</strong>sibility of <strong>the</strong> parties most familiar with any automati<strong>on</strong>system, i.e., <strong>the</strong> designer and manufacturer, to evaluate and certify <strong>the</strong> safety of<strong>the</strong> system. It also provides an evaluati<strong>on</strong> means that is suited to technologicalchanges. In most cases, <strong>the</strong> failure analysis will identify a preferred fail-safe state.Systems that would be required to be independent, that is, have arrangements thatprovide a level of safety and reliability equivalent to complete duplicati<strong>on</strong>,include:• C<strong>on</strong>trols systems• Alarms and instrumentati<strong>on</strong> (m<strong>on</strong>itoring systems)The IMO subsequently adopted regulati<strong>on</strong>s requiring that a failure modes andeffects analysis (FMEA) 44 be performed for <strong>the</strong> machinery and c<strong>on</strong>trol systems of highspeedvessels. 45 The IMO and classificati<strong>on</strong> societies presently do not require <strong>the</strong> use ofFMEA for passenger vessel propulsi<strong>on</strong> system designs. 4643 Subpart 62.10 defines system as an arrangement of elements that interact to perform a specificfuncti<strong>on</strong> and vital system as that which is essential to <strong>the</strong> safety of <strong>the</strong> vessel, its passengers, and its crew.44 An FMEA is an inductive approach to identifying engineering design deficiencies by examining eachindividual comp<strong>on</strong>ent or process in a system to determine how its failure or deviati<strong>on</strong> from intendedperformance might affect <strong>the</strong> entire system. By c<strong>on</strong>ducting a FMEA, engineers can modify <strong>the</strong> design of asystem before it is built to avoid catastrophic or significant system failures.45 The Internati<strong>on</strong>al Code of Safety for High Speed Craft, adopted in 1994, mandated <strong>the</strong> use of FMEAbecause <strong>the</strong>se craft employed new technologies.46LR’s Propulsi<strong>on</strong> and Steering Machinery Redundancy c<strong>on</strong>tains provisi<strong>on</strong>al rules that are in additi<strong>on</strong>to <strong>the</strong> classificati<strong>on</strong> society’s Rules and Regulati<strong>on</strong>s for <strong>the</strong> Classificati<strong>on</strong> of <strong>Ship</strong>s. LR’s provisi<strong>on</strong>al rules,which are opti<strong>on</strong>al for vessel owners, stipulate <strong>the</strong> use of FMEA in designing propulsi<strong>on</strong> systems, electricalpower supplies, essential services, c<strong>on</strong>trol systems, and steering arrangements. According to LR’sprovisi<strong>on</strong>al rules, <strong>the</strong> FMEA report must show that a single failure in <strong>the</strong> propulsi<strong>on</strong> and related auxiliarysystems will not cause loss of all propulsi<strong>on</strong> or steering capability.
55 Marine Accident ReportAnalysisGeneralThis analysis first identifies factors that can be readily eliminated as causal orc<strong>on</strong>tributory to <strong>the</strong> fire and determines where and how <strong>the</strong> fire started and how it spread.The report <strong>the</strong>n discusses <strong>the</strong> following major safety issues, which were identified during<strong>the</strong> investigati<strong>on</strong>:• Adequacy of management safety oversight;• Adequacy of fire protecti<strong>on</strong> systems;• Adequacy of passenger and crew safety; and• Adequacy of engineering systems design.This report also discusses <strong>the</strong> effectiveness of <strong>the</strong> emergency resp<strong>on</strong>se effort.Exclusi<strong>on</strong>sThe wea<strong>the</strong>r was not a factor in this accident. The vessel’s navigati<strong>on</strong>, propulsi<strong>on</strong>,and steering systems had no bearing <strong>on</strong> <strong>the</strong> cause of <strong>the</strong> fire. No engineering difficultiesoccurred before <strong>the</strong> outbreak of <strong>the</strong> fire. From documents and statements, <strong>the</strong> Safety<strong>Board</strong> determined that all officers were properly licensed and certified by <strong>the</strong> <strong>Liberian</strong>government and were qualified to serve in <strong>the</strong>ir positi<strong>on</strong>s. Postaccident drug and alcoholscreenings of 79 crewmembers were negative for 76 individuals. The first officer testedpositive for marijuana, indicating that he had used <strong>the</strong> drug sometime in <strong>the</strong> weeks before<strong>the</strong> fire occurred. However, based <strong>on</strong> witnesses’ descripti<strong>on</strong>s of <strong>the</strong> first officer’s acti<strong>on</strong>s<strong>on</strong> <strong>the</strong> bridge during <strong>the</strong> emergency, no behavioral evidence indicated that he wasimpaired by drugs at <strong>the</strong> time of <strong>the</strong> fire. Because <strong>the</strong> pers<strong>on</strong>nel who tested positive fordrugs have been dismissed from service and because of <strong>the</strong> improvements that CarnivalCruise Lines has made to its drug-testing program since this accident, <strong>the</strong> use of drugs andpostaccident testing will not be discussed fur<strong>the</strong>r in this report.Accident AnalysisThe <strong>Ecstasy</strong> experienced a major fire at <strong>the</strong> aft end of <strong>the</strong> ship that affected twoMVZs. A combinati<strong>on</strong> of fire, heat, and smoke damaged <strong>the</strong> main laundry room, <strong>the</strong> sternthruster room, an air c<strong>on</strong>diti<strong>on</strong>ing room, an electrical equipment room, <strong>the</strong> aft mooringdeck, and <strong>the</strong> steering gear room. In additi<strong>on</strong>, some passenger staterooms and crew cabins<strong>on</strong> deck Nos. 2, 4, 5, and 6 sustained heat and smoke damage. The cruise ship