Analysis 74 Marine Accident ReportCarnival Cruise Lines owns seven o<strong>the</strong>r Fantasy Class ships that may have similarpropulsi<strong>on</strong> system arrangements as <strong>the</strong> <strong>Ecstasy</strong>. In corresp<strong>on</strong>dence to Safety <strong>Board</strong>investigators, <strong>the</strong> cruise ship company did not indicate whe<strong>the</strong>r it had examined orintended to examine its o<strong>the</strong>r vessels to identify design problems in <strong>the</strong>ir propulsi<strong>on</strong>systems. The Safety <strong>Board</strong>, <strong>the</strong>refore, believes that Carnival should examine <strong>the</strong>propulsi<strong>on</strong> systems <strong>on</strong> <strong>the</strong> ships in its fleet and, if necessary to provide redundancy,modify <strong>the</strong> arrangement of <strong>the</strong> auxiliary voltage circuitry to <strong>the</strong> high-speed breakers wherea single source supplies both port and starboard propulsi<strong>on</strong> systems.The company that designed <strong>the</strong> <strong>Ecstasy</strong>’s propulsi<strong>on</strong> system, ABB, is a majorsupplier of cycloc<strong>on</strong>verter propulsi<strong>on</strong> systems to marine customers. C<strong>on</strong>sequently, o<strong>the</strong>rvessels might be operating with an ABB propulsi<strong>on</strong> system similar in design to that <strong>on</strong> <strong>the</strong><strong>Ecstasy</strong>. The Safety <strong>Board</strong>, <strong>the</strong>refore, believes that ABB should advise its customers withships having <strong>the</strong> same propulsi<strong>on</strong> system design arrangements as <strong>the</strong> <strong>Ecstasy</strong> of <strong>the</strong>potential for system failure from <strong>the</strong> loss of auxiliary voltage to <strong>the</strong> high-speed breakersand recommend design changes to <strong>the</strong> propulsi<strong>on</strong> system that would minimize <strong>the</strong>seeffects.Even though <strong>the</strong> <strong>Ecstasy</strong>’s propulsi<strong>on</strong> system had a number of design features thatwere intended to reduce <strong>the</strong> likelihood that both port and starboard systems would fail as aresult of single fault, <strong>the</strong> importance of isolating <strong>the</strong> auxiliary voltage source to <strong>the</strong> highspeedbreakers was not identified before or during <strong>the</strong> vessel c<strong>on</strong>structi<strong>on</strong>. ABB officialsstated that <strong>the</strong>y did not do a formal failure analysis, such as an FMEA, of <strong>the</strong> propulsi<strong>on</strong>system design because SOLAS, LR, and Carnival did not require <strong>the</strong>m to perform <strong>on</strong>e.A qualitative failure analysis, such as <strong>the</strong> FMEA method, can identify potentialfailures and rank <strong>the</strong>m according to <strong>the</strong> probability of occurrence, <strong>the</strong> severity of effects,and <strong>the</strong> probability of detecti<strong>on</strong>. System failure analyses are widely used in many o<strong>the</strong>rindustries as part of <strong>the</strong> overall movement toward quality improvement in processes andproducts. In additi<strong>on</strong>, IMO now requires that a failure analysis be performed during <strong>the</strong>design of navigati<strong>on</strong> equipment and bridge systems. The Coast Guard has required <strong>the</strong> usequalitative failure analysis techniques in evaluating <strong>the</strong> reliability and safety of vitalsystem automati<strong>on</strong> <strong>on</strong> U.S. flag vessels since 1988. In proposing <strong>the</strong> regulatoryrequirement that designers, manufacturers, and/or shipyards perform and submit systemfailure analysis, <strong>the</strong> Coast Guard stated that <strong>the</strong> use of advanced automati<strong>on</strong> technologiessuch as electr<strong>on</strong>ics and microprocessors made it increasingly difficult, “at timesimpossible, for <strong>the</strong> Coast Guard, ship owners/operators, and classificati<strong>on</strong> societies toevaluate safety.”Classificati<strong>on</strong> societies, however, have not seen <strong>the</strong> need to require failure analyses<strong>on</strong> vital automati<strong>on</strong> systems in spite of <strong>the</strong> fact that <strong>the</strong>se systems are becoming even morecomplex and difficult to evaluate. The LR stated that during its plan approval and surveysof <strong>the</strong> <strong>Ecstasy</strong>’s c<strong>on</strong>structi<strong>on</strong>, it was not provided details of <strong>the</strong> propulsi<strong>on</strong> system’sinternal c<strong>on</strong>necti<strong>on</strong>s. Therefore, LR was not aware, prior to <strong>the</strong> casualty, that <strong>the</strong>propulsi<strong>on</strong> would be lost if <strong>the</strong> cables to <strong>the</strong> high-speed breakers were burned through.
Analysis 75 Marine Accident ReportIf a qualitative failure analysis of <strong>the</strong> <strong>Ecstasy</strong>’s propulsi<strong>on</strong> system had beenperformed during its design phase, <strong>the</strong> failure probability of <strong>the</strong> single power source mayhave been rated low. However, <strong>the</strong> high severity of <strong>the</strong> failure effect, that is, <strong>the</strong> total lossof <strong>the</strong> propulsi<strong>on</strong> system, should have led <strong>the</strong> designers to implement designmodificati<strong>on</strong>s.The Safety <strong>Board</strong> is aware that qualitative failure analysis typically is not appliedto existing systems because analyzing and changing system arrangements afterc<strong>on</strong>structi<strong>on</strong> is often difficult and costly. However, a qualitative failure analysis can be animportant technique to maximize <strong>the</strong> reliability and safety of a system before it is built,when changes can be easily made. The Safety <strong>Board</strong> c<strong>on</strong>cludes that, to ensure <strong>the</strong> highestlevels of safety and reliability, ship owners should use qualitative failure analysistechniques in <strong>the</strong> design and c<strong>on</strong>structi<strong>on</strong> of <strong>the</strong>ir vessels. The Safety <strong>Board</strong>, <strong>the</strong>refore,believes that, in <strong>the</strong> c<strong>on</strong>structi<strong>on</strong> of new passenger ships, owners should use qualitativefailure analysis techniques to identify system comp<strong>on</strong>ents whose failure might cause acomplete loss of propulsive power and take acti<strong>on</strong> to mitigate identified problems. TheSafety <strong>Board</strong> also believes that <strong>the</strong> Internati<strong>on</strong>al Associati<strong>on</strong> of Classificati<strong>on</strong> Societies(IACS) should recommend that its members require systems designers, manufacturers,and/or shipyards to perform and submit qualitative failure analyses to ensure <strong>the</strong> fail-safeoperati<strong>on</strong> of propulsi<strong>on</strong> systems <strong>on</strong> new passenger ships.