Adam Parnell
Confidential Human Factors
Incident Reporting Programme
The Charity
Aviation
Maritime
FEEDBACK
SY 07
Leading by example
Working over the side without PPE is still an issue.
We have previously published many reports about crew members working over the side without the correct PPE, but we again return to this topic in our first report because we have yet, as an industry, to resolve this potentially lethal practice. The report highlights the need for a thorough risk assessment, which is a theme you will note throughout this edition. Whether you are working overside, anchoring close to shore, recovering a tender or engaged in diving operations, it is vital that you conduct a painstaking assessment of the potential risks and speak up if you believe a risk is being ignored.
Design factors also feature several times, in the form of a design fault in a carabiner securing rail, lifting gear which was not capable of handling the loads imposed upon it, and sensors which were unreliable. It is worth noting that these are all issues we have covered before, so please pay particular attention to the design of systems and equipment on your vessel.
Permits to work also feature prominently, in cases involving working at height and working below the vessel. They are a useful tool but must be completed thoroughly. In addition, all crew members must be aware of them and must feel empowered to question their requirements and stop the work if necessary. We should constantly be asking whether a job is safe and whether it is necessary.
If these reports teach us anything, it is that we can never relax our vigilance, even for a moment.
Until next time, stay safe, and may all your voyages bring you safely home.
-
M2263
–
Vessel tender recovery injures crew member
Vessel tender recovery injures crew memberInitial Report
Our reporter told us “I reported to engineers that a bilge pump was not working on the 9m catamaran RIB, but nothing was done. I also reported that the lifting points were slightly deformed, which allowed water to access the bilge. With the bilge pump not working, additional water was added to the tender’s weight. The tender is stowed on the main deck approximately 2.5/3m from the water line.
The RIB is used frequently, and it is recovered from the water with the two crew members inside. Once it reaches the yacht’s main deck, it is pulled alongside the main deck and the two crew members step out of the tender in turn. As the first deckhand got out, one – then all – of the lifting points on the RIB failed and it fell several metres into the sea with the bosun still inside. The bosun suffered a minor back injury and shock.”
CHIRP Comment
Both the securing points and lifting points of a tender must be adequately designed to handle the deadweight and other reasonably foreseeable shock loading that might arise (eg failure of one of the other securing points).
CHIRP could not determine why the previously reported defects had not been addressed by the vessel’s senior officers, but it is good practice for defect-reporting systems to assign responsibility for rectifying a defect to a named officer, who should assess and prioritize resolution, and if necessary, take the equipment out of action until this is done.
Safety is everybody’s responsibility, and CHIRP wonders why crew boarded a tender with known lifting point issues? It is only by sheer good fortune, the bosun was not killed or permanently incapacitated for life.
Finally: we have previously reported on lifting point failures before, so it is encouraging to hear that Flag State inspectors are now checking the SWL of the lifting points during annual inspections.
Key Issues relating to this report
Design—The tender’s lifting arrangement was insufficient for its weight. Deformed lifting points allowed water to enter the boat, a clear sign that they were operating at their limits. The defect is serious and must be reported to management and the manufacturers.
Culture— These known faults were reported but not acted on, highlighting a weak safety culture at a management level. Would you refuse to operate the tender if you found a similar situation on your boat? Would you take the boat out of service?
Alerting—Inform the manufacturers of the issues encountered on the tender and seek clarification of the SWL of the lifting points.
Overconfidence– All lifting equipment has a failure point, mainly when operating at its limits. Take early action to prevent severe injury and loss of life. Never assume all is OK!
-
M2271
–
Fouled anchorsFouled anchorsInitial Report
A 70-meter superyacht was anchored in a very ‘tight’ anchorage with limited swing circle and depth. There was around 3 meters of depth under the keel, and the swing radius was 130m (160m would have put the vessel aground)
With some bad weather expected, the master decided to put two anchors down. Once the weather cleared, both anchors remained deployed.
When the anchors were retrieved a few days later, both anchor chains were severely twisted and the crew had spent more than 12 hours trying to free them – all the while slowly dragging towards the shallows nearby.
More bad weather was forecast so a decision was taken to release both anchors from their bitter ends to prevent the vessel from grounding. Once both anchors were released, the vessel made its way to port before the weather closed in and a salvage company later recovered the anchors and returned them to us a few days later.
CHIRP Comment
Anchorage locations should continuously be assessed for proximity to known hazards, including under-keel clearance and potential grounding, safe swinging distance from other nearby vessels, and holding ground capability in inclement weather.
Although vessels will generally anchor close to the shore for their passengers’ convenience, vessels should be ready to move to a deeper anchorage if the vessel’s safety cannot be assured. In this incident the vessel was anchored only 30 meters from a lee shore. Given the expected weather forecast, this was an unacceptable and unnecessary risk.
Using two anchors when expecting bad weather can help to control the vessel’s yaw but should be considered a temporary measure only, because of the heightened risk of them being fouled. As soon as the reason for deploying the second anchor has passed, it should be weighed and brought home. An anchor home ready for an emergency is good contingency planning.
Key Issues relating to this report
Capability—Does your bridge team have the necessary knowledge and training to understand and appreciate the use of the ship’s anchors? Given the proximity to the shore and other vessels in the anchorage, a vigilant bridge anchor watch is required. What does your SMS advise on anchoring operations?
Teamwork– Continually review whether the second anchor is required, and weigh the second anchor when the original reason for using two anchors is no longer required.
Situational Awareness– While at anchor, a member of the bridge team should periodically visit the fo’c’stle to monitor the growth and stay of the anchor chain (or chains) so that issues can be identified early – ie before the chains become twisted.
Alerting—If you were in a similar situation, would you alert the master that the other anchor should be brought home so it can be used in an emergency?
-
M2284
–
Breach of watertight integrityBreach of watertight integrityInitial Report
Shortly after a 50+ meter sailing vessel set sail, an unusual amount of spray was noticed on one side of the deck. It was discovered that a shell door had been left open. This door, used as a boarding platform, had a cavity for a guest shower and storage. While it did not open directly to the yacht’s interior, it could have caused significant damage, including rupturing hydraulic hoses, if not caught in time.
Pre-departure checks (PDCs) included securing all hull openings. However, due to the hull and door shape, this opening could only be seen by leaning over the side. The shell door sensor was also sometimes faulty, giving inaccurate alarm and monitoring system readings.
Closing the shell door was a two-stage process: first, the ladder section, then the door, and these operations were often done by two crew members at different times. This contributed to the incident, as each crew member assumed the other had completed the task. The desire to be ready quickly led to shortcuts and assumptions without confirming each PDC.
CHIRP Comment
This report involves several critical factors contributing to the safety issue. Firstly, a design flaw meant that it was difficult to see if the shell door was securely closed and sealed. This was worsened by a faulty sensor for door closure status, known for unreliability yet not maintained and thus compromising safety alarms. CHIRP has frequently highlighted sensor issues, especially in exposed areas.
Additionally, time pressure to complete tasks quickly led to shortcuts and assumptions, with crew members prioritising speed over thoroughness. Each assumed the other had completed their part, resulting in communication breakdowns. The two-stage closing process involved different crew members and needed clear communication and confirmation. CHIRP emphasises that positive confirmation of PDC requires a cross-check, like how airlines do when placing doors to manual and cross-checking.
The issue was ultimately alerted not by the faulty sensor but by a crew member’s visual observation of unusual spray patterns, indicating a problem missed due to the sensor and poor communication.
In summary, the incident stemmed from a combination of factors: problematic door design, an unreliable sensor, and a fragmented closing process with inadequate communication among crew members. This underscores the need for reliable equipment, thorough checks, and clear communication to ensure vessel safety and watertight integrity.
Key Issues relating to this report
Communication— Closed-loop communications did not work in this incident during the pre-departure inspections due to pressure to depart on time. Do your pre-departure checklists work effectively when under pressure? Is there a chance that cross-checks on shell doors can be overlooked?
Alerting- If you know of an equipment malfunction, how easy is reporting it on your vessel? Is the reporting process thorough enough to prioritise critical alarm systems for repair?
Design—The alarm and monitoring system’s design appears temperamental and needs regular maintenance. Its unreliability created a single point of failure. This should have been addressed as a priority; otherwise, its effectiveness is rendered useless. Have you had alarm systems on your vessel that sometimes did not work? Would a camera provide the additional backup required?
Situational Awareness– The crew performed excellent visual monitoring to note an unusual spray pattern.
-
M2282
–
Lack of safety assessment by the MasterLack of safety assessment by the MasterInitial Report
Onboard a small motor yacht alongside the dock, someone dropped their radio into the water by the stern, directly under the propellors. The captain directed that it be retrieved by sending someone down with scuba gear. When informed that this would require a permit to work, the captain insisted it was not required. Despite concerns about the need for a permit or some formal procedure, the captain dismissed the idea and requested proof of legislation that mandated a permit to work for diving under the boat. When the suggestion to consult the Code of Safe Working Practices (COSWP) was made, the captain insisted on quickly retrieving it without any permit.
CHIRP Comment
In this situation, the appropriate steps involve consulting the Code of Safe Working Practices for Merchant Seafarers, which provides guidelines for safe practices, including diving operations. If unsure, calling the Designated Person Ashore
(DPA) to seek advice on the diving risk would be appropriate.A stop-work authority would be the ideal tool for evaluating the risks. However, the company’s safety culture must be proactive enough to implement this process.
According to the latest Diving at Work Regulations, diving operations conducted as part of work activities require a risk assessment and proper procedural adherence. The COSWP chapter on diving operations outlines the need for permits and safety procedures for diving. The relevant excerpts indicate that before any diving operation is undertaken, a risk assessment must be carried out, and a diving permit must be issued to ensure all safety measures are implemented. This aligns with the requirement that only a person shall dive in connection with a work activity if a suitable and sufficient assessment of the risks to health and safety has been made.Most divers on board superyachts have a Professional Association of Diving Instructors (PADI) certification. This is for recreational diving only and is NOT sufficient to undertake commercial diving; that needs a professional commercial diving certification, which requires a higher standard of training and an equally well-trained diving support team.
CHIRP recognises that standing firm can be daunting when an authoritative figure pressures a crew member.Safety protocols, such as contacting the Designated Person Ashore (DPA) or a stop-work policy, are crucial for justifying the issuance of permits. The master’s conduct was unacceptable, and the company’s lack of written guidelines for diving operations reflects a tolerance for risk.
Key Issues relating to this report
Culture—The crew’s attempt to influence the master’s decision to retrieve the radio using a diver was blocked, and there was no safety, highlighting a poor safety culture. Thinking about your experiences on your vessel and past vessels, have you encountered this type of behaviour? What would you have done?
Alerting—How would your DPA respond if you contacted them to seek advice on this matter? You can also contact the Flag State to seek advice. The master should have made this call.
Teamwork- A shared mental model of the safety risks and the usefulness of retrieving the radio was not shared by everyone. How good would you be at creating a shared mental model where the risks for carrying out a dive to retrieve the radio could be persuasive enough to stop the operation?
-
M2248
–
Fall while working aloftFall while working aloftInitial Report
The reporter was tasked with cleaning the outboard windows and donned a safety harness which was secured by a single line to the carabiner on the rail. See the picture showing a typical arrangement below.
A typical rail arrangement- not the one in the report.
As they traversed the rail track from forward to aft, a gap in the track system caused the safety line to detach from the rail, and the reporter fell into the water as the carabiner slipped off the end of the track. Our reporter stated that they had received no training; that no permit to work was carried out; the track and carabiner system had not been inspected or tested, and that only a single securing point was available.
CHIRP Comment
Working at height is a high-risk activity that requires an industry-standard permit. The number of incidents involving working at height is not decreasing, and Flag States and management companies are strongly encouraged to focus on this aspect of superyacht safety.
The requirements are straightforward: working at height is only allowed if a risk assessment has been carried out and a permit to work is thoroughly completed.
A permit to work at height requires that safety equipment, including PPE, be thoroughly checked. It also requires the crew to be adequately trained and supervised. Completing it is not a tick-box exercise and requires considered thought. All stages of the permit need to be answered, especially by the crew carrying out the work. The crew must be empowered to stop the work if the permit has not been completed properly.
The carabiner rail to which the line from the harness was attached must be inspected and form part of regular maintenance inspections. The gap in the track system would be apparent to see if it was properly inspected. Inspections of the carabiner rail must form part of regular maintenance checks. In this case, the rail should have been taken out of service until it was repaired.
CHIRP highlights the design of these frequently used safety rails, which require extensive maintenance due to their many moving parts. Retrofitted rail connections may not be as strongly connected to the superstructure as those fitted the new building stage. CHIRP recommends that the class attend to advise on superstructure connections for retrofitted rails.
All parts of the safety harness must be secured entirely; no buckles or straps must be left undone, as all parts of the harness play a part in absorbing the body weight in the event of a fall. The safety line or lanyard must be connected to the safety ring at the back of the harness and not on the front due to the possibility of severe spinal injury in the event of a fall.
Crucially, there must always be a rescue plan to retrieve anyone who has fallen while wearing a safety harness. The time to recover a fallen crew member suspended in a harness should be at most 15 minutes, as blood circulation will be seriously affected and could be lethal.
Key Issues relating to this report
Alerting- No-one had reported the defective safety rail, so no action was taken. Does your PMS system require that the safety rails be regularly checked? How do you report a safety failure? Has this been explained to you as part of your familiarisation process?
Teamwork—If you have not received training or are uncertain about using the safety equipment, seek help from others. Never assume that everything is okay. Falling into the water versus falling to the jetty has two different outcomes!
Pressure—Never be pressured into doing something you have not been trained to do. In this case, insist on being supervised and demand that a working-at-height permit be completed. When you sign the permit to work, do you check that everything has been completed, including the risk assessment?
Capability—Have you received training in conducting a risk assessment and completing a permit to work?
-
M2283
–
Diving SOPs not followedDiving SOPs not followedInitial Report
A near-miss incident during a routine maintenance operation on a 60-meter commercial sailing vessel could have had severe consequences. The task involved cleaning the generator sea chest inlet, which had become clogged with weeds. An Alpha flag was hoisted, indicating a diver was in the water, and a permit to work was signed and issued. The first mate oversaw the operation from the deck, using a tagline tied to the diver and timing the manoeuvre. Meanwhile, the engineer was ashore.
While the master was also ashore, he called the first mate, and a long conversation ensued, distracting the mate from his duties. Unbeknownst to the first mate, the engineer returned to the vessel and, failing to notice the Alpha flag, proceeded to start the engines and test forward and aft propulsion as previously instructed by the master. This action was totally at odds with the current diving operation and indicated a severe lapse in communication and procedures.
Several critical errors contributed to this dangerous situation. The permit to work was not issued to the engineer, leaving them unaware of the ongoing diving operations. Additionally, no measures were taken to prevent the engine from being activated during this high-risk task. Consequently, the propeller began turning approximately 25 meters from where the diver was working underwater. Tied to the deck by the tagline, the diver could not swim away from the turning propeller, which could have resulted in a severe accident or even a fatality. The first mate’s distraction during the telephone call with the master allowed this hazardous situation to develop unchecked.
CHIRP Comment
This incident underscores the importance of rigorous communication, adherence to safety protocols, and the need for all crew members to be fully informed of ongoing operations to prevent similar near-miss events in the future.
The hoisting of the Alpha flag is a requirement when a diver is down but ineffective on board the vessel when key crew members are omitted from the work planning meetings. In this case, the lock-out tag-out try-out (LOTOTO) barrier control is required, to ensure all ship’s staff are alerted to the work activity that is planned for this time.
CHIRP wonders who ‘owned’ the permit to work in this incident. The permit needed to be completed fully. It is also clear that this work was communicated to only some crew members, and there was a communication breakdown.
Consider this work activity from the point of view of the diver tasked with carrying it out. How confident would you be that your safety is being adequately managed?
The officer assigned to look after the diver spoke with the master on the telephone, an apparently dangerous distraction. At the same time, the master had requested that the engineer, unaware of the diving operation, conduct tests of the vessel’s propulsion systems, a conflicting work activity given the diving operation being carried out.
We repeat our emphasis on the level of education and qualifications of the diving crews that sail on super yachts concerning their levels of qualification and reiterate that if you do not possess the necessary diving qualifications for the work activity, you must not carry out the work. If you have the required qualifications, you must take ownership of the permit to work and insist that its requirements have been thoroughly implemented and resourced. Otherwise, no diving operation takes place.
Key Issues relating to this report
Alerting—Alerting with signal hoists is correct but can only be effective if it is part of a permit-to-work system made known to everyone on board.
Situational Awareness— Diving operations are high-risk and must be prioritised by everyone. Knowledge that a diver is below the hull must be shared with everyone. It is not an isolated work activity. If you are trained to carry out diving work on your vessel, do you insist this work is prioritised over everything else? Do you check and sign off the permit to work?
Distractions—Clearly, the diving supervisor was distracted by a call from the master, who was ashore. How would you react if you received a call while supervising a diving operation? There were also conflicting work activities planned for this day, such as testing the engines as agreed by the master.
Communications—Work planning meetings did not appear to address conflicting work activities simultaneously with the diving operation. Do you have a section on conflicting work activities at your work planning meetings?
Culture—Is your safety culture strong enough to inform the master that the call cannot be taken now because you are attending to the diver?