Although each finding was recorded as a “Medium Risk” observation, their number and consistency point to a broader breakdown in anchoring watch discipline. No incident occurred, but several key defences were absent or unverifiable. We consider some of the findings to be well above “Medium Risk”, and our analysis is as follows:

The findings are accurate, but there are too many passive phrases, such as “no objective evidence”, which softens the operational reality. In safety-critical operations, if something cannot be demonstrated, it cannot be relied upon.

The use of mixed time standards (UTC and local time) undermines shared situational awareness and complicates decision-making during anchoring, emergencies, and incident review. The use of correct times is a fundamental requirement in bridge management, not an administrative detail.

Failure to amend the anchoring plan suggests the operation was treated as routine rather than as planned navigation. This often leads to informal watchkeeping and reduced vigilance once the anchor is down.

Across several observations, there was no verifiable evidence of effective monitoring – no visual bearings, no plotted positions, limited radar use, and one radar switched off. In effect, the vessel was anchored without reliable position awareness. An anchor watch without monitoring is not a watch – it is an assumption.

Radar redundancy is a deliberate safety feature. Switching off a radar removes or reduces early warning of anchor dragging, traffic, or unexpected movement. Radar use at anchor should be considered essential.

While each issue was assessed as medium risk in isolation, their combined effect significantly increased the likelihood of an undetected dragging anchor or a close-quarters situation. No accident occurred, but normal defences had eroded. Monitoring, documentation, and radar use are core safety controls, not optional tasks. CHIRP members expressed concerns that there was an excessive emphasis on documentation requirements rather than on real navigational performance. The advisory board wants to highlight the need for auditors to receive training in bridge behaviour, situational awareness, and anchoring practices.

For a ship’s crew member to feel ignored when raising a safety concern is unacceptable. In this case, the reporter correctly raised concerns about the improper use of twin-lanyard fall-arrest equipment. When a safety concern is raised, work should stop immediately. The Master should be consulted without delay, and the contractor’s supervisor informed of the vessel’s safety expectations and company policy. Unsafe conditions should always result in a clear, well-supported Stop Work decision.

Members commenting on this report highlighted a broader issue of poor safety culture, including gaps in leadership and accountability. Training alone is not enough unless it is supported by clear expectations and visible leadership. Improved training of both crew and contractors, combined with a shared understanding of accountability, would help prevent similar situations.

Falls from height continue to occur because people become briefly disconnected while moving. In maritime environments, twin-tail fall-arrest lanyards should always be used to ensure continuous attachment. The principle is simple: one connection must always remain attached. Before moving or passing an obstruction, the second lanyard leg should be secured to a suitable anchor point, and only then should the first leg be disconnected. This avoids any moment when the person is unprotected.

Anchor points must be structural, correctly rated, and positioned to provide sufficient clear space below for the lanyard and energy absorber to deploy fully. The lanyard stem, including the energy absorber, must be connected to the approved fall-arrest point on the harness, normally the dorsal D-ring. Lanyard legs should not be clipped back onto the harness or belt except at approved parking points, as this can prevent proper operation of the energy absorber and significantly increase the risk of injury.

All fall-arrest equipment should be checked before use and protected from damage caused by sharp edges and the harsh marine environment. Only trained and medically fit personnel should use the equipment, and a clear rescue plan must be in place before starting.

Finally, it is worth reflecting on the contrast between the strong safety culture expected at sea and the practices sometimes introduced on board by contractors. The vessel’s expectations must be clearly set out during pre-work planning meetings, reinforced through supervision, and applied consistently. Continuous protection, open reporting, and the confidence to stop work are essential to preventing falls from height. This challenge is often compounded when dealing with contractors, as some crew members may feel uncomfortable challenging individuals perceived as external experts or commercially influential, particularly when the crew lack confidence in confrontational situations.

Bilges are enclosed spaces as defined in the Code of Safe Working Practices Section 15, MGN 659, and MSC A.1050(27). Vessels should clearly identify and record which compartments onboard are considered enclosed spaces (ES), or confined spaces (CS) and ensure this information is reflected in the SMS and risk assessments. While the reporter was following the vessel’s SMS, the VOC mask used was not suitable for the hazard encountered.

This report highlights an important and often under-appreciated chemical hazard associated with routine tasks such as bilge cleaning. The reporter was working during a refit period, when ventilation arrangements and system configurations may differ from normal operations. The use of acetone in the confined geometry of a bilge sump, combined with poor ventilation and no atmospheric monitoring, created a potentially life-threatening situation. A personal oxygen meter should be worn. It is commendable that the reporter recognised the symptoms early and exited the space promptly, thereby preventing a more serious outcome.

A key learning point is that many common solvents produce vapours that can rapidly displace oxygen because they have higher vapour densities, particularly in enclosed, confined, and poorly ventilated spaces. VOC masks protect against the inhalation of certain substances but do not provide notification that oxygen depletion is occurring. Carrying gas-detection equipment is essential, not only for formally designated enclosed spaces or confined spaces but also when using oxygen-displacing chemicals in any restricted area.

Task risk assessments should explicitly consider the chemical properties of substances used, as documented in their safety data sheets, including their vapour behaviour, ventilation arrangements, and the need for atmospheric monitoring. Standard enclosed-space precautions, including portable gas detectors, effective mechanical ventilation, and a designated standby person, should always be applied. This is particularly important during refit or maintenance periods, when resources can be reduced due to additional workload.

This report also underlines the importance of crews having access to and understanding Safety Data Sheets (SDS) in the correct working language. Pre-task planning should ensure that all personnel are aware of the risks of vapour expansion and oxygen displacement, as well as the limitations of PPE.

CHIRP strongly recommends that solvent-based cleaners, such as acetone, should not be used for bilge cleaning.

This incident highlights the risks associated with remote software updates being carried out on vessels without prior notification to the crew. In this case, a very large superyacht lost power during a manoeuvre after a software upgrade to a non-essential system (galley refrigeration). Through its connection to the integrated power management system, the update indirectly affected essential navigation and monitoring systems, causing critical equipment to go offline at a high-risk moment during manoeuvring in port.

Updating machinery controls or power-connected systems while a vessel is underway and entering harbour poses an unacceptable risk. Systems of this nature should be isolated using breakers or equivalent safeguards to ensure that non-critical equipment cannot trigger cascading failures affecting essential services.

The incident also raises cybersecurity concerns. Although the event appears to have been accidental, similar outcomes could result from a malicious cyberattack. Remote access to onboard systems, particularly non-essential ones, introduces potential vulnerabilities if cyber-defences and network monitoring are not robust. Crews should be aware of these risks and ensure appropriate protective measures are in place.

The crew’s response further illustrates the challenges of managing unanticipated system failures. While partial emergency power was restored, the order in which systems were shed was not fully understood, highlighting the need for improved familiarisation and training on how the power management system responds to abnormal electrical loads and unexpected system behaviour.

This event also points to a wider concern regarding the management of change. Software updates and system modifications should be treated as formal changes, with clear procedures in place, including risk assessment, crew notification, and operational restrictions where necessary.

CHIRP is also concerned that downsizing of crews and the transfer of technical control and decision-making ashore can have unintended consequences. Removing responsibility from those onboard may reduce situational awareness and the crew’s ability to anticipate or manage developing risks in real time.

Suppliers should communicate all software updates in advance, allowing vessels to assess potential operational impacts and decide when it is safe to proceed. Operators should also review the integration of non-critical systems with essential systems to prevent single-point or cascading failures. Strengthening cyber-defences and monitoring networked access points, even for apparently minor systems, will help reduce the risk of both accidental disruption and deliberate attack.

The master’s reaction appeared to be driven by concern about the impact on ETA and by the belief that night orders had been breached. This highlights a common tension on board: commercial pressure and schedule adherence, versus the realities of dynamic traffic management at night.

From a navigational perspective, the officer’s actions were both reasonable and compliant with COLREGs. Officers of the watch are not only permitted but required to take early and positive action to avoid close-quarters situations. This authority exists regardless of whether night orders specifically mention speed adjustments. If officers feel constrained from acting decisively out of fear of criticism, safety margins erode quickly.

Calling the master to explain the developing situation may have been an option. However, this raises an important question: did the officer feel sufficiently supported and confident to do so? A bridge culture in which officers hesitate to call the master for fear of a negative reaction is itself a risk factor. The master’s standing and night orders should make it clear that safety-driven decisions are expected, supported, and open to discussion.

Night orders did not adequately cover speed management in heavy traffic; the balance between schedule adherence and navigational safety; and the explicit authority of the OOW under COLREG Rule 2 and, in particular, the principles of Rule 8. The master’s standing orders should, however, make very specific reference to these aspects so that officers are not in doubt about what actions to take.

A culture that questions compliant safety decisions risks normalising hesitation or delay in future high-risk situations. ETA sensitivity reflects broader industry pressures that can indirectly shape onboard leadership behaviours and expectations.

This report underscores the importance of trust, clarity, and shared priorities on the bridge. Compliance with COLREGs and good seamanship must always take precedence over ETA. Masters play a key role in reinforcing this message before, during, and after the watch.

This report highlights a maintenance situation in which established safety barriers functioned as intended. The outcome was achieved, not by chance, but through the exemplary actions of the vessel’s Safety Officer, who correctly applied the safety management system and upheld the permit-to-work (PTW) process in the face of pressure.

The proposed work involved entry into a fuel tank while the vessel was at sea. The Safety Officer correctly identified that the tank could not be fully drained or adequately ventilated, and that the conditions did not meet the requirements of COSWP or accepted enclosed-space entry guidance. On this basis, the Permit to Work was refused, and the task did not proceed. CHIRP considers this to be an appropriate, proportionate, and professionally sound safety decision.

Of concern, however, is the apparent challenge to both the PTW process and the Safety Officer’s authority. The PTW system is intended to serve as a formal safety barrier, particularly for high-risk activities such as entering enclosed spaces. Its effectiveness relies on a shared understanding that permits may be refused when risks cannot be adequately controlled, regardless of operational or commercial pressures.

CHIRP notes that entry into enclosed spaces within fuel tanks remains a significant cause of serious maritime accidents and fatalities. Industry guidance is clear that such entries must not be undertaken unless the space has been properly prepared, tested, and confirmed safe. Attempts to override these controls undermine the purpose of the safety management system and increase the risk of serious outcomes. A valid question for the naval architects is why a light fitting should be accessed via a fuel tank?

This case also reinforces the importance of clearly defined roles and authority on board. When the Safety Officer’s responsibilities are not fully understood or supported at the command level, safety decisions risk becoming negotiable rather than mandatory.

CHIRP 100% strongly endorses the Safety Officer’s professionalism in upholding their decision and submitting a confidential report. Operators may wish to use this case to review their understanding of enclosed space entry requirements, the authority and responsibilities associated with the Permit to Work system, and how differences of opinion on safety matters are resolved within the vessel’s command structure.

Maintaining an environment where safety concerns can be raised, supported, and respected without challenge is fundamental to effective safety management, and CHIRP will work to provide support for those who find themselves in a similar situation.