Abstract:On June 10, 1995, the Panamanian passenger ship Royal Majesty grounded on Rose and

Crown Shoal about 10 miles east of Nantucket Island, Massachusetts, and about 17 miles from where the

watch officers thought the vessel was. The vessel, with 1,509 persons on board, was en route from St.

George’s, Bermuda, to Boston, Massachusetts. There were no deaths or injuries as a result of this

accident. Damage to the vessel and lost revenue, however, were estimated at about $7 million.

This report examines the following major safety issues: performance of the Royal Majesty’s integrated

bridge system and the global positioning system, performance of the Royal Majesty’s watch officers,

effects of automation on watch officers’ performance, training standards for watch officers aboard

vessels equipped with electronic navigation systems and integrated bridge systems, and design,

installation, and testing standards for integrated bridge systems.

As a result of its investigation, the National Transportation Safety Board issued safety recommendations

to Majesty Cruise Line, the U.S. Coast Guard, STN Atlas Elektronik GmbH, Raytheon Marine, the

National Marine Electronics Association, the International Electrotechnical Commission, the

International Council of Cruise Lines, the International Chamber of Shipping, and the International

Association of Independent Tanker Owners.

The National Transportation Safety Board is an independent Federal agency dedicated to promoting

aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the

agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate

transportation accidents, determine the probable causes of the accidents, issue safety recommendations,

study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in

transportation. The Safety Board makes public its actions and decisions through accident reports, safety

studies, special investigation reports, safety recommendations, and statistical reviews.

IntroductionAbout 2225 on June 10, 1995, the Panamanianpassenger ship Royal Majesty grounded onRose and Crown Shoal about 10 miles east ofNantucket Island, Massachusetts. The vessel,with 1,509 persons on board, was en route fromSt. George’s, Bermuda, to Boston, Massachusetts.Initial attempts to free the vessel were unsuccessful.Deteriorating weather and sea conditionsprevented the evacuation of passengersand crewmembers from the vessel.On June 11, the Royal Majesty, with the aidof five tugboats, was freed from its strand. Initialdamage surveys revealed deformation of the

vessel’s double bottom hull. However, no penetrationor cracking of the hull was detected, andno fuel oil had been spilled. The U.S. CoastGuard gave the vessel permission to proceed toBoston. On June 12, the vessel arrived in Bostonand disembarked its passengers.There were no deaths or injuries as a resultof this accident. Damage to the vessel and lostrevenue, however, were estimated at about $7million.The National Transportation Safety Boarddetermines that the probable cause of thegrounding of the Royal Majesty was the watchofficers’ overreliance on the automated featuresof the integrated bridge system, Majesty CruiseLine’s failure to ensure that its officers wereadequately trained in the automated features ofthe integrated bridge system and in the implicationsof this automation for bridge resourcemanagement, the deficiencies in the design andimplementation of the integrated bridge systemand in the procedures for its operation, and thesecond officer’s failure to take corrective actionafter several cues indicated the vessel was offcourse.

Contributing factors were the inadequacy ofinternational training standards for watchstandersaboard vessels equipped with electronicnavigation systems and integrated bridge systemsand the inadequacy of international standardsfor the design, installation, and testing ofintegrated bridge systems aboard vessels.This report examines the following majorsafety issues:Performance of the Royal Majesty’sintegrated bridge system and theglobal positioning system.Performance of the Royal Majesty’swatch officers.Effects of automation on watch officers’performance.Training standards for watch officersaboard vessels equipped withelectronic navigation systems andintegrated bridge systems.Design, installation, and testingstandards for integrated bridge systems.As a result of its investigation of this accident,the Safety Board issued safety recommendationsto Majesty Cruise Line, the U.S. CoastGuard, STN Atlas Elektronik GmbH, Raytheon

Marine, the National Marine Electronics Association,the International Electrotechnical Commission,the International Council of CruiseLines, the International Chamber of Shipping,and the International Association of IndependentTanker Owners.

INVESTIGATION

The AccidentAbout 22251 on June 10, 1995, the Panamanianpassenger ship Royal Majesty (see figure 1)grounded on Rose and Crown Shoal near NantucketIsland, Massachusetts. The Royal Majesty,carrying 1,509 passengers and crewmembers,was en route from St. George’s, Bermuda,to Boston, Massachusetts. No injuries or deathsresulted from the grounding.On the night of the accident, the Royal Majestywas on the last day of a 7-day voyage. Theship had left Boston for Bermuda on June 5. Thevessel had arrived in St. George’s on June 7,where it was berthed until it departed Bermudaon June 9 for the return trip to Boston. The vesselwas scheduled to arrive in Boston about0530 on June 11.The return trip to Boston was divided intotwo legs. The first leg normally extended fromSt. George’s to the entrance of the approach tothe Port of Boston Traffic Separation Scheme(Boston traffic lanes)—a distance of more than500 miles over open ocean. The second legnormally took the vessel in a northerly directionthrough the traffic lanes along the eastern edgeof Nantucket Shoals and around the easternshores of Cape Cod. The entire voyage to Boston(a distance of about 677 miles—see figure2) normally took about 41 hours.The navigator testified that on June 9, hewent on duty about an hour before the scheduleddeparture time of 1200. He said that he customarilytested the vessel’s navigational equipmentbefore getting underway. He stated that when hetested the navigation equipment, including“compasses, repeaters, radars, NACOS 25, GPS,Loran-C, and the communications systems”during the half hour before the vessel departedSt. George’s, he found the equipment to be in“perfect” operating condition. He said thatshortly after departure, he set the navigation andcommand system (NACOS) 25 autopilot on thenavigation (NAV) mode.2 He further stated thatlater when the vessel dropped off the harbor pilot(about 1230), he compared the position data

displayed by the global positioning system(GPS)3 and by the Loran-C4 and found that thetwo sets of position data indicated positionswithin about a mile5 of each other.According to the watch officers on duty, thenorthbound trip was uneventful during the first24 hours. The watch officers stated that theRoyal Majesty followed its programmed track,as indicated on the display of the automatic radarplotting aid (ARPA) maintaining a course ofabout 336°.62A description of the vessel’s radar and navigationalequipment is contained in a section on vessel informationlater in the report. When set on the NAV mode, theNACOS 25 autopilot automatically corrected for the effectof set and drift caused by the wind, sea, and current to keepthe vessel within a preset distance of its programmed track.3The GPS is a satellite-based radio navigation system designedto provide continuous and accurate position dataunder all weather and sea conditions. The accuracy of thesystem is based on the GPS unit’s ability to receive, identify,and measure radio signals from orbiting satellites. TheGPS receiver on the Royal Majesty, when fully operational,was capable of providing position data accurate to within100 meters to the NACOS 25 autopilot (see discussion laterin this section).4The Loran-C is a radio-based navigation system designedto provide position data along the coasts of theUnited States. The system is based on the Loran-C unit’sability to receive, identify, and measure time-differenceradio signals from a series of land-based Loran stations.The accuracy of the system is largely dependent on theuser’s location in relation to the transmitting stations. Forexample, the Loran lines of position in the Bermuda areacross at oblique angles, whereas along the U. S. coast, numerous

lines of position cross at much sharper angles toprovide greater accuracy.

Figure 2—Map of route between Bermuda and Boston.At 1200 on June 10, the navigator was againon watch, assisted by a quartermaster. Accordingto the navigator, the Royal Majesty maintainedits course of 336°, and its speed was 14.1knots (over ground). Entries in the vessel’sbridge log indicated cloudy skies, winds out ofthe east-northeast at 8 knots, and seas between 1and 3 feet. Meteorological visibility was reportedlyat least 10 miles.The navigator stated that during his watch,he was using the port ARPA on the 12-milerangescale. (See figure 3.) He also stated that

he was plotting hourly fixes on the chart of thearea using position data from the GPS. He statedthat although he frequently checked the positiondata displayed by the Loran-C, all of the fixesthat he plotted during the voyage from Bermudawere derived from position data taken from theGPS and not the Loran-C. (See figure 4. In thelower photograph, the lower receiver was installedafter the accident.) The navigator furtherstated that in the open sea near Bermuda, thepositions indicated by the GPS and Loran-Cwould have been expected to be within ½ to 1mile of each other. As the vessel approachedcloser to the United States, the positions wouldhave been expected to be within about 500 metersof each other.At 1600, the watch changed, and the vessel’schief officer relieved the navigator. Thechief officer was assisted by a quartermaster,who acted as either a helmsman or a lookout onan as-needed basis. The chief officer stated thathe used the port radar set on the 12-mile range.He further stated that no procedure specified thenumber of radars to use, but that usually twowere used in bad weather. He stated that becausethe weather was good and visibility wasclear, he used one radar. The chief officer alsoindicated that he relied on the position data fromthe GPS to plot hourly fixes during his watchesand that the Loran-C was used as a backup systemin case the GPS malfunctioned. He stated,however, that for the 1700 and 1800 hourlyfixes he compared the data from the GPS withthe data from the Loran-C and that in both instancesthe Loran-C indicated a position about 1mile to the southeast of the GPS position.The chief officer testified that before the1700 hourly fix, at about 1645, the master telephonedthe bridge and asked him when he expectedto see the BA buoy, the buoy that markedthe southern entrance to the Boston traffic lanes(see figure 5). The chief officer responded thatthe vessel was about 2½ hours away (35.25miles at 14.1 knots) from the buoy. The mastertestified that he asked the chief officer to callhim when he saw the buoy. According to thechief officer, about 45 minutes later (1730), themaster visited the bridge, checked the vessel’sprogress by looking at the positions plotted onthe chart and at the map overlay exhibited on the

ARPA display, and asked a second time whetherthe chief officer had seen the BA buoy.7 Thechief officer responded that he had not. Shortlythereafter, the master left the bridge.According to the chief officer, about 1845,he detected on radar a target off his port bow ata range of about 7 miles and concluded that thetarget was the BA buoy. He stated that his conclusionhad been based on the GPS positiondata, which indicated that the Royal Majestywas following its intended track, and on the factthat the target had been detected about the time,bearing, and distance that he had anticipateddetecting the BA buoy. He further testified thaton radar the location of the target coincided withthe plotted position of the buoy on the ARPAdisplay. He said that about 1920, the radar targetthat he believed to be the BA buoy passed downthe Royal Majesty’s port side at a distance of 1.5miles. He stated that he could not visually confirmthe target’s identity because of the glare onthe ocean surface caused by the rays of the settingsun.He testified that about 1930, the mastertelephoned the bridge and asked him for thethird time whether he had seen the BA buoy.According to the chief officer, he responded that

Figure 5-Intended track and approximately actual track.

the ship had passed the BA buoy about 10 minutesearlier (about 1920). The master then askedwhether the chief officer had detected the buoyon radar; the chief officer replied that he had.According to the testimony of the chief officerand the master, the chief officer did not tell themaster that he had been unable to visually confirmthe identify of the BA buoy, and the masterdid not ask whether the buoy had been visuallyconfirmed.The second safety officer (second officer)testified that he arrived on the bridge about 1955and prepared to assume the watch from the chiefofficer. According to the testimony of both officers,during the subsequent change-of-the-watchbriefing (2000), they discussed the traffic conditionsand the vessel’s course, speed, and position.According to the testimony, the chief officerdid not discuss with his relief the circumstancessurrounding his identification of the BAbuoy. The second officer testified that at 2000,he assumed the watch, assisted by two quartermasters,8 and that the chief officer left thebridge. The second officer stated that shortlyafter assuming the watch, he reduced the rangesetting on the port radar from the 12-mile rangeto the 6-mile range. He testified that he relied onthe position data from the GPS in plottinghourly fixes during his watches and that he consideredthe Loran-C to be a backup system. Healso stated that it was not his practice to use theLoran-C to verify the accuracy of the GPS.The quartermaster standing lookout on theport bridge wing (port lookout) stated that about2030 he saw a yellow light off the vessel’s portside and reported the sighting to the second officer.According to the quartermaster, the secondofficer acknowledged the report, but took nofurther action. At the time of the sighting, theNACOS 25 was showing the Royal Majesty’sposition to be about halfway between the BAand BB buoys. (The BB buoy is the second buoyencountered when traveling northbound in theBoston traffic lanes.) Shortly after the sightingof the yellow light, both the starboard and portlookouts reported the sighting of several highred lights off the vessel’s port side.9 Accordingto the lookouts, the second officer acknowledgedthe report, but took no further action.The port lookout stated that shortly after thesightings of the yellow and red lights, the mastercame to the bridge. The master testified that hespent several minutes talking with the secondofficer and checking the vessel’s progress bylooking at the plotted fixes on the chart and the

map overlay on the ARPA display. According tothe master, the GPS and ARPA displays wereshowing that the vessel was within 200 metersof its intended track. The master then left thebridge. According to the testimony of both themaster and the second officer, no one told themaster about the yellow and red lights that thelookouts had sighted earlier.The master testified that about 2145, hetelephoned the bridge and asked the second officerwhether he had seen the BB buoy. The masterstated that the second officer told him that hehad seen it.According to the master, about 2200 he arrivedon the bridge for the second time duringthat watch. He testified that after talking withthe second officer for several minutes, hechecked the vessel’s progress by looking at thepositions plotted on the chart and at the mapoverlay on the ARPA display. He stated that heagain asked the second officer whether he hadseen the BB buoy and the second officer repliedthat he had. Satisfied that the positions plottedon the chart and that the map displayed on theradar continued to show the vessel to be followingits intended track, the master left thebridge about 2210. He stated that he did notverify the vessel’s position using either the GPSor the Loran-C for two reasons: (1) his officershad reported that the BA and BB buoys hadbeen sighted, and (2) he had observed that themap overlay on the ARPA display showed thatthe vessel was following its intended track.

The second officer testified that he had notseen the BB buoy but had informed the masterotherwise because he had “checked the GPS andwas on track” and because “perhaps the radardid not reflect the buoy.” He also testified thaton the previous transits of the traffic lanes, hehad sighted buoys both visually and by radar.According to the testimony of the lookouts,a few minutes after the master left the bridge,the port lookout reported to the second officerthe sighting of blue and white water dead ahead.According to this lookout, the second officeracknowledged receiving the information, but didnot discuss it or take action. The port lookoutstated that the vessel later passed through thearea where the blue and white water had beensighted.The second officer testified that about 2220,the Royal Majesty unexpectedly veered to portand then sharply to starboard and heeled to port.The second officer stated that because he was

alarmed and did not know why the vessel wassheering off course, he immediately switchedfrom autopilot to manual steering. The master,who was working at his desk in his office, feltthe vessel heel to port and ran to the bridge. Hestated that when he arrived on the bridge, hesaw the second officer steering the ship manuallyand instructed one of the lookouts to takeover the helm. The master then turned on thestarboard radar, set it on the 12-mile range,10

and observed that Nantucket was less than 10miles away. According to the master, he immediatelywent into the chart room to verify hisposition. He stated that he then immediately orderedthe helmsman to apply hard right rudder.However, before the helmsman could respond,the vessel grounded, at 2225. The master statedthat he then had the vessel’s GPS and Loran-Cchecked and realized for the first time that theGPS position data was in error by at least 15miles. The Loran-C position data showed thevessel where it had grounded, about 1 milesouth of Rose and Crown Shoal.11 (See figure6.) Charts of the area indicate that the shoal,which is about 10 miles east of Nantucket’sSankaty Head Light, has a hard sandy bottom.Postaccident EventsThe master testified that immediately afterthe grounding, he called the engineroom andtold the engineering officer on duty that the vesselhad grounded and that he should immediatelyinspect the vessel’s double bottom hull andfuel tanks for signs of leakage. According to themaster, several minutes later, the engineroomcalled the bridge and reported that there was noevidence that the vessel was taking on any water.The master responded by asking the engineroompersonnel to repeat the inspection, whichthey did. The master stated that about 2245 theengineroom again reported to him that no evidenceof leakage had been found. Shortly thereafter,the master instructed the vessel’s cruisedirector to inform the passengers and crewmembersthat the vessel had run aground, that it wasnot in any danger, and that the crew was tryingto free the vessel by using its engines. At 2310,the U.S. Coast Guard, after receiving a messagefrom a passenger via cellular telephone, calledthe Royal Majesty, at which point the RoyalMajesty requested Coast Guard assistance. Accordingto the testimony of the master, he hadbeen about to notify the Coast Guard when theCoast Guard called him.12

Several unsuccessful attempts were madebetween 2245 and 0015 to free the vessel using

the main engines. Shortly thereafter, MajestyCruise Line, the owner of the vessel, made

arrangements to hire tugboats to pull the vesseloff the shoal.At 0024 on June 11, the passengers weretold that the efforts to free the vessel had beenunsuccessful and that the vessel was awaitingthe arrival of tugboats. Later that morning, thepassengers were told that they and their luggagewould be transferred to ferries for transport toHyannis, Massachusetts, and then to Boston.At 1330 on June 11, the ferries M/V BrantPoint and Point Gammon arrived on scene.13

The Brant Point and Point Gammon togethercould hold about 1,200 persons.At 1550, the tugboats Vincent Tibbets, HaroldRheinhauer, Resolute, Reliance, and Venusarrived on scene. Meanwhile, sea conditionscontinued to deteriorate. About 1600, plans tooffload passengers to the ferries were canceledbecause sea conditions had become too hazardous.Shortly thereafter, the Brant Point and thePoint Gammon returned to Hyannis.At 2154, the Royal Majesty, with the aid offive tugboats, was refloated and escorted to asafe anchorage near Chatham, Massachusetts,where the damage was surveyed. At 0742 on themorning of June 12, the Coast Guard gave thevessel permission to begin the 6-hour trip toBoston. At 1535, the vessel was safely mooredwith its port side to the Black Falcon PassengerTerminal in Boston. Passengers began disembarkingthe vessel at 1710.The Coast Guard/Safety Board hearing intothe grounding of the Royal Majesty was heldJune 14 through June 16 in Boston. After thehearing, the Safety Board learned that two fishingvessels were just east of Fishing Rip Shoalon the evening of June 10. They observed acruise ship pass about ¾ mile west of the fishingvessels’ position heading in a northerly direction.About 2042, one of the fishing vessels radioeda cruise ship at “41 02N, 69 24W” viaVHF-FM channel 16. They later stated it wastheir intent to inform the vessel that it was in anarea not frequented by large cruise ships. Thecalls to the cruise ship were in English; however,all the transmissions between the fishingvessels, including the transmission regarding theship being in the wrong location, were in Portuguese.An unknown person interrupted the Portugueseconversation and requested that thefishermen change channels. (See appendix F.)According to international regulations(SOLAS-Regulation 8), when ships such as theRoyal Majesty are at sea they are required tomaintain a continuous listening watch on the

navigating bridge on 156.8 MHz (channel 16).During the Coast Guard Marine Board of Inquiry,the second officer was not asked whetherhe was monitoring channel 16 on the night ofthe accident.14 Since that time, a spokespersonfor Majesty Cruise Line has identified the personwho interrupted as possibly the second officer.The Safety Board could not confirm this.According to the Coast Guard, the call to thecruise ship from the fishing vessel did not conveyany urgency and would not have alerted thesecond officer aboard the Royal Majesty or theradio operator at U.S. Coast Guard GroupWoods Hole, where the transmissions were recorded,that the Royal Majesty or any othercruise ship was in danger.InjuriesThe accident did not cause any deaths orinjuries.Vessel DamageOn June 16, the Royal Majesty left Bostonfor the Sparrows Point Shipyard in Baltimore,Maryland, where it was drydocked and repaired.The grounding of the Royal Majesty had damagedits outer hull extensively. According to thefield survey conducted by Lloyds Register onJune 19, a portion of the vessel’s outer shellplating, which was about 51 feet wide and 41feet long, needed to be cropped and renewed.The report also indicated that the bottom fuel oiltanks and the internal steel structure between thevessel’s internal tank tops and hull plating hadbeen substantially damaged. No oil spilled as aresult of the accident.On June 22, the vessel was refloated andreturned to Boston. On June 24, the vessel resumedpassenger service. Total structural damagewas estimated at about $2 million. Lostrevenue for the period the vessel was out ofservice was estimated at about $5 million.Crew InformationMaster.—The master, age 53, held a master’scertificate for seagoing vessels that hadbeen issued by Panama on June 7, 1991. He alsoheld a master’s certificate from the Greek governmentthat was originally issued in 1974. Hehad been going to sea for 32 years. During hiscareer, he had served in a variety of licenseddeck officer positions on tankships and passengerships. Between 1968 and 1992, he had sailedas chief officer and master on several passengervessels built in the 1950s. Majesty Cruise Lineassigned him as master of the Royal Majesty inNovember 1992. He stated that the Royal Majestywas the first vessel that he had served on

that had an integrated bridge system.15

The master testified that he had not consumedany alcohol before the grounding, that hehad not taken any prescription medicine, andthat he was not required to wear eyeglasses. Hestated that he typically slept about 7 hours eachnight, from 2400 to 0700, and then took a 1-houror 1½-hour nap in the afternoon, schedule permitting.Chief Officer.—The chief officer, age 43,held a master’s certificate for seagoing vesselsthat had been issued by Panama on May 20,1994. He also held a chief officer’s certificateissued by the Greek government in 1982. He hadbeen going to sea since 1971. During his career,he had served in a variety of licensed deck officerpositions on cargo ships, tankships, and passengerships. Between 1981 and 1992, he hadbeen chief officer on four passenger vesselsbuilt in the 1950s. Majesty Cruise Line hiredhim as chief officer on the Royal Majesty in1992. The Royal Majesty was the first vessel hehad served on that had an integrated bridge system.At the time of the grounding, he had spent30 of the previous 36 months as a bridge watchofficer aboard the Royal Majesty.The chief officer stated that routinely afterfinishing his 1600-to-2000 watch, he would jogon deck (weather permitting) for about 45 minutes,work out in the vessel’s gym for about 15minutes, and retire around 2200. He normallyslept until about 0330. He stated that typicallyhe also slept about 2½ hours before starting his1600 watch.Navigator.—The navigator, age 30, held asecond officer’s certificate for seagoing vesselsthat had been issued by the Greek governmenton May 18, 1994. He also held a second officer’slicense from Panama. He had been goingto sea in a licensed capacity since March 20,1987. During his career, he had served 8 monthsas second officer on a tankship and 7 months assecond officer on two passenger ships that hadbeen built in the 1950s. Majesty Cruise Linehired him as a second officer on the S/S Seabreezeon July 18, 1994. He was assigned asnavigator aboard the Royal Majesty on August1, 1994. The Royal Majesty was the first vesselthat he had served on that had an integratedbridge system.The navigator testified that he had not consumedalcohol in the 24 hours before his lastwatch, that he was not taking any prescriptiondrugs, and that he was not required to wear eyeglasses.16

Second Officer.—The second officer, age

33, held a chief officer’s certificate for seagoingvessels that had been issued by the Greek governmenton January 4, 1991. He also held achief officer’s license from Panama. He hadbeen going to sea in a licensed capacity sinceMay 1984. During his career, he had served in avariety of licensed deck officer positions onbulk carriers and passenger ships. He had sailedas second officer and chief officer on five passengervessels between 1987 and 1994. MajestyCruise Line hired him as a second officer onMay 1, 1995. After 3 weeks of on-the-job training,the master allowed him to stand a navigationwatch alone. On May 21, 1995, he assumedhis duties as watch officer for the 0800-to-1200watch. The Royal Majesty was the first vesselthat he had served on that had an integratedbridge system.The second officer testified that he had notconsumed alcohol or taken any prescriptionmedicine in the 24 hours before his last watch.He stated that he slept about 7 hours after finishinghis previous 2000-to-2400 watch and thathe had also taken a 2-hour nap before beginninghis 2000 watch on June 10.Vessel InformationGeneral.—The Royal Majesty was a conventionalsteel-hull, bulbous-bow, passengerliner designed for unrestricted internationalvoyages. The vessel was constructed in 1992 atKvaener Masa Yard in Turku, Finland. Panamahad certified the vessel to carry 1,256 passengersand 490 crewmembers, a total of 1,746 persons.The vessel held the highest vessel classificationfor construction issued by Det NorskeVeritas (DNV). The vessel’s principal characteristicsfollow:Length overall: 568 feet (173.16 meters)Breadth: 91 feet (27.60 meters)Draft (departureBermuda): forward: 18 feet, 0.5 inches(5.5 meters); aft: 19 feet, 6inches (5.95 meters)Gross registeredtonnage: 32,396Displacement: 17,214 tonsService speed: 19 knotsPropellers: two controllable pitchThe Royal Majesty was fitted with the followingnavigation, communications, shiphandling,and collision-avoidance equipment:Radar: Two Krupp Atlas17 Model 8600A/CAS with ARPARadar: One Krupp Atlas slave radarwith ARPA

Autopilot: STN Atlas ElektronikGPS: Raytheon RAYSTAR 920 withdead-reckoning backup mode optioninstalled (NNE-205 DR interface)Loran-C: Raytheon RAYNAV 780VHF radios: Two Sailor radios (with dualmonitoring capabilities)Speed log: Atlas Dolog 23Gyrocompass: AnschutzCourserecorder: AnschutzIntegrated Bridge System.—The RoyalMajesty had an integrated bridge system. Accordingto the definition of the InternationalElectrotechnical Commission (IEC),18 issuedafter the vessel was built, an integrated bridgesystem is a combination of systems that are integratedin order to allow centralized access tosensor information and command/control fromworkstations. One of the main components ofthe vessel’s integrated bridge system was STNAtlas Elektronik (STN Atlas) NACOS 25.19 TheNACOS 25 was a special upgrade of the firstgeneration NACOS 20 integrated navigationsystem, of which approximately 130 have beensold and installed on vessels of various typesand service. The NACOS 25 was specificallydesigned for service on six Baltic Sea ferriesconstructed at Kvaener Masa Yard. Some weresold to Italian vessel owners. According to STNAtlas, 14 NACOS 25 units were sold to ownersof passenger ships. The last unit was sold inMay 1988 to the shipyard constructing the RoyalMajesty. However, because of construction delays,the Royal Majesty’s NACOS 25 equipment

was held in stock until installation in the springof 1992.The Royal Majesty’s NACOS 25 was capable ofcreating radar maps and exhibiting them on theARPA display (see figure 7). The radar mapscould be tailored to include reference pointsalong the vessel’s intended track (aids to navigation,navigation marks, waypoints, turningpoints, etc.). Navigation lines could also beadded to these maps for the purpose of outliningthe perimeter of traffic lanes, channels, and areascontaining hazards to safe navigation.The navigator testified that a radar map hadbeen created for the voyage between St.George’s and Boston. He also testified that themap, showing the vessel’s preprogrammedtrack, waypoints, and the location of the buoysnear the intended track, was exhibited on the

ARPA display before the accident.The autopilot portion of the NACOS 25,using programmed information (latitude andlongitude of waypoints and the vessel’s maneuveringcharacteristics), gyro and speed data, andposition data from the GPS or the Loran-C, wascapable of automatically steering the vesselalong a preprogrammed track. When engagedand operating in the NAV mode, the autopilotsteered the ship in accordance with the programmedtrack while automatically compensatingfor the effect of gyro error, wind, current,and sea. According to the Royal Majesty’sbridge officers, the NACOS 25 autopilot wasengaged and operating in the NAV mode fromthe time the vessel departed St. George’s (1400on June 9) to before the grounding.The Raytheon GPS unit installed on theRoyal Majesty had been designed as a standalonenavigation device in the mid- to late1980s, when navigating by dead reckoning(DR)20 was common and before the GPS satellitesystem was fully operational. The GPS unitwas designed to default to either a DR mode ora hybrid navigation mode (accepting positiondata from a Loran-C, Omega, or Transit satellitenavigation receiver). The Royal Majesty’s GPSwas configured by Majesty Cruise Line toautomatically default to the DR mode when satellitedata were not available.21 When theRAYSTAR 920 GPS unit switches to DR mode,itissues a series of aural chirps similarto those of a wristwatch alarm(the total duration of the series is 1second);continuously displays SOL (solution)22 and DR on a liquid crystaldisplay; the display measures 3inches high by 3.5 inches wide (seefigure 8);changes the state of National MarineElectronics Association(NMEA)23 0183 status field bitsfrom valid to invalid, indicating thatvalid position data are no longerbeing transmitted; andcloses an electronic switch that isprovided as a means of activating anexternal alarm or other device of theinstaller’s choice (such as an externalflashing light, audio alarm,etc.).24

Figure 7 – Sample map on ARPA display

Figure 8—GPS display showing SOL and DR.

All the watch officers testified that they didnot see SOL and DR displayed on the GPS unitduring their watches before the grounding. Theirtestimony indicated that they understood themeaning of these symbols and had seen them onprevious occasions.The Raytheon RAYSTAR 920 GPS and theRaytheon RAYNAV 780 Loran-C were designedto output position and other navigationdata in NMEA 0183 v1.5 format.25 The outputincluded the recommended minimum GPS datasentence, RMC, which contained, among otherdata, latitude/longitude position coordinates.26

A position receiver that transmits data is a“talker” device in NMEA nomenclature; theRaytheon 920 GPS identified itself as a GPtalker, which signified a GPS position receiversending GPS position data. A position receiversuch as the Raytheon 920 GPS, while operatingin different position modes, could identify itselfas an integrated instrument (II) talker. At thetime the system was designed, the NMEA specifieda SYS sentence to identify the operationalmode of a hybrid system. The SYS sentence definesthe mode in which the receiver is operating:GPS (G), Loran (L), Omega (O), Transit(T), or Decca (D). However, DR is not a specifiedsystem mode in the NMEA 0183 SYS sentence.Thus, Raytheon designed the 920 GPS toidentify itself as a “GP” talker regardless ofGPS or DR mode and used the NMEA 0183valid/invalid data bits as the means of notifying“listeners” that its data were invalid when in DRmode. However, the sentence formatter GDPwas available in NMEA 0183 v1.5 to indicatedead reckoned geographic position fixes.Although both the GPS and Loran-C simultaneouslysent position data to the NACOS 25,the NACOS 25 was designed to use positiondata from only one external position receiver at a time, as selected by the crew. That is, theNACOS 25 was not designed to compare theGPS and the Loran-C position inputs, nor was itdesigned to display both sets of position data tothe bridge officers simultaneously so that theycould compare the data. On June 9 and throughoutthe voyage, the autopilot was set by the crewto accept and display position data from theGPS receiver, which was the position receivernormally selected by the crew during the 3 yearsthe vessel had been in service.Once the position receiver is selected, theNACOS 25 recognizes the chosen position receiverbased on the talker identifier codes in theNMEA 0183 data stream; for example, GP in

the data stream from the Raytheon 920 GPS.According to STN Atlas, its designers did notexpect a device identifying itself as GP to sendposition data based on anything other than GPSsatellite data, particularly not DR-derived positiondata. Further, STN Atlas expected invalidGPS position data to be recognizable by nulledposition data fields, by halted data transmission,by a separate proprietary SLL sentence,27 or byno changes in the position latitude/longitude.The latter case would trigger the NACOS position-fix alarm; the other cases would cause theNACOS to switch its position input to estimated(its own DR mode) and to highlight this informationat all NACOS and radar displays untilthe transmission is resumed and/or the SLL sentencecontains the valid data bit.According to the NMEA, NMEA 0183 providesthree methods to indicate whether thetransmitted data are inaccurate or unavailable:(1) null fields where the sentence is transmittedbut no data are inserted in the fields in question;(2) by using system-specific status sentences(available only for Loran-C; and (3) by the useof “status” or “quality indicator” characters inspecific sentences. There are no other provisionswithin NMEA 0183 to indicate invalid data intransmitted sentences. In version 1.5, the use of null fields is the most common method, as mostsentences do not have status fields. According toSTN Atlas’s interpretation of this specification,when a position receiver with a GPS talkeridentifier has no GPS position data available, itmust transmit null fields instead.The NACOS 25 autopilot was programmedto continuously calculate its own independentDR position in order to provide a comparisonwith the position data provided by the externalposition receiver (GPS or the Loran-C in thecase of the Royal Majesty). If the autopilot’s DRposition and the external position-receiver’s position(GPS or Loran-C positions in the case ofthe Royal Majesty) are within a specified distanceof each other,28 the autopilot considers theposition data from the external position receiverto be valid, makes any necessary course corrections,and uses the new external position receiver’sposition to continue its own independentDR calculations. If, however, the two positionsare more than the specified distance apart,the autopilot sounds a loud alarm29 and presentsa visual indication (warning position fix) on allthe NACOS displays, including the radars,meaning that a position discrepancy has beendetected that requires the watch officers’ immediateattention. If the lateral distance between

the GPS position and the preprogrammed trackline exceeds the specified distance, the autopilotsounds a loud alarm and presents a visual indication(warning track limit exceeded) on theNACOS display, meaning that the vessel is offthe intended track.The navigator stated that during the 11months he had been aboard the vessel, he hadobserved a phenomenon he called “chopping.”Other deck officers stated that they too had witnessedthis phenomenon. According to the navigator,chopping occurred when, for whatever reason, the position data displayed by the GPSwere unreliable. Majesty Cruise Line’s electronicstechnician and the Raytheon staff indicatedthat chopping could have been the resultof atmospheric interference with GPS signals orthe obstruction of the GPS antenna’s view of thesatellites by the vessel’s superstructure and/ortall buildings or other structures while the vesselwas in port. These circumstances degraded theGPS signal, changing the calculated position,and consequently caused the radar map displayto jump erratically, which the crew referred toas chopping.According to the navigator’s testimony,when chopping occurred, the 1-second series ofaural chirps sounded and SOL and DR appearedon the GPS display. The master testified thatchopping also usually set off the NACOS 25position-fix alarm, indicating that the differencebetween the NACOS 25 DR position and theGPS position was greater than 200 meters. Hestated that watchstanders had found, throughtrial and error, that if they acknowledged thealarm before switching to the COURSE mode,30

the autopilot automatically accepted the erroneousposition data and the radar map movedabout the ARPA display. To avoid this, watchstandersswitched the autopilot from the NAVmode to the COURSE mode before acknowledgingthe alarm. Thus, they could use the mapuntil the GPS returned to normal. According tothe master, chopping generally lasted a fewminutes. Nothing in the testimony of the watchofficers suggested that chopping had occurredduring the trip from Bermuda to Boston.According to Majesty Cruise Line, the GPSantenna, originally installed on the radar mast,had been moved in February 1995, severalmonths before the grounding, as part of an effortto eliminate the chopping. Majesty CruiseLine’s electronics technician indicated that as aresult of the move, the antenna’s view of thesatellites was less obstructed and the crew complainedmuch less about chopping.

The Royal Majesty’s integrated bridge systemwas also fitted with an automatic bell logger(bell log), which was located against the afterbridge bulkhead. At regular intervals, the belllog recorded the propeller pitch settings, enginerevolutions per minute, true course, and speed.It also recorded the time of each entry inGreenwich mean time.31 The course and speeddata that were recorded by the bell log camefrom the vessel’s GPS.The bell log showed that it was turned on at1131:54 on June 9. Between 1131:55 and1133:17, the bell log recorded a course of 197°,000°, and 197°, indicating that the GPS datawere invalid. This could be the result of the GPSreceiver being turned on and going through itssatellite acquisition process, chopping, antennaconnection problems, or other problems. Therecord also showed that between 1133:18 and1202, the Royal Majesty was steering variouscourses. Between 1130 and 1202, the vessel wasstill moored alongside the pier.32 Such coursevariation while the vessel is stationary is consistentwith normal GPS position variation andthe resulting calculation of courses betweenthose slightly different positions. The bell logrecorded various courses between 1203, whenthe ship left the pier, and 1252, consistent withport departure. At 1252:02, the bell log onceagain began recording consecutive courses of197° and 000°, when, in fact, the vessel wassteering a course of 333°, as shown by the ship’scourse recorder. At 1309:06, the bell log recordeda course of 336°. After that recording,the bell log recorded 197°/000° headings continuouslyuntil after the vessel’s arrival in Boston.33 (See table 1.) After the accident, MajestyCruise Line advised the Safety Board that the anomalous 197°/000° courses recorded by thebell log were the result of the GPS receiver beingin the SOL and DR modes.The bell log also recorded speed calculationsbased on information provided by the GPS.The bell log recorded 18 speed calculationsbetween 1200 on June 9 (departure time fromthe pier) and 2000 on June 10. These speed calculationsand the time at which they were recordedare listed in table 2. The Royal Majesty’swatch officers also maintained written recordsof the vessel’s speed during the voyage in thebridge log and in the speed record. According toentries made in the bridge log between 1400 onJune 9 and 1200 on June 10, the vessel’s averagespeed was 19.06 knots. The bridge-logspeed data, however, were calculated using positiondata from the GPS. If the GPS was in DR

mode, the bridge-log speed data would not accountfor wind, seas, and current. The speeddata recorded by watchstanders in the speed recordwere based on distances between DR positionsshown on the GPS. The distances betweenDR positions depended on the speed supplied bythe Doppler speed log.34 The speed data, whichwere recorded at hourly intervals between 1500on June 9 and 2200 on June 10, indicated thatbetween 1400 on June 9 and 2200 on June 10the vessel’s average speed was 18.79 knots. Thespeed record also showed that between 1200 and2200 on the day of the accident, the vessel’saverage speed was 13.87 knots.

The Royal Majesty was also fitted with anAtlas 481 echo sounder (fathometer)35 withdigital readout. The fathometer data could bedisplayed on the NACOS screen by pressing abutton. The fathometer had a recorder, whichwas in the chart room. Postaccident examinationof the fathometer recorder indicated that it wasnot turned on at the time of the accident.36 The fathometer was also fitted with alarmsthat were activated whenever the vessel transitedwaters shallower than the water for whichthe alarms were set. In addition to an auralalarm, a flashing message appeared on theNACOS display. Both the aural alarm and theflashing message could be overridden by watchstanders.The chief officer andthe navigator testified thatthe fathometer alarm wasnormally set to go offwhen the water beneaththe keel was less than 3meters (9.75 feet) deep.On the night of thegrounding, the Royal Majesty’sdeep draft was 19feet 6 inches. Based onstatements from the chiefofficer and the navigator,the alarm should have activatedwhen the RoyalMajesty entered waterwith a depth of 29 feet 4inches or less. During thehour preceding thegrounding, the Royal Majestypassed over Great Rip and Davis Shoals,where in some areas the depth of the water wasless than 29 feet 4 inches. The master, chief officer,and second officer did not recall seeing orhearing the fathometer alarm before thegrounding. Postaccident examination revealedthat the fathometer alarm was set at 0 meters.According to the navigator, the alarm was normallyset at 0 when the vessel was in port or in aharbor to prevent the alarm from being continuouslyactivated.Crew Training on Integrated Bridge System.—The Royal Majesty entered service inJune 1992. The master, who joined the vessel inNovember of that year, stated that before joiningthe vessel, he had read all the manuals and technicaldocuments related to the integrated bridgesystem (see next section). He stayed aboard theship for 1 month with the master he was relievingand received on-the-job training related tothe integrated bridge system from that master

and the navigator who was aboard the vesselwhen it entered service.The chief officer of the Royal Majesty hadjoined the ship in 1992. He stated that he hadalso received on-the-job training (3 weeks) fromthe same navigator as the master had.The navigator who was aboard the RoyalMajesty at the time of the accident had joinedthe ship in August 1994. According to him, hewas responsible for the orientation and trainingof new officers in the operation of the NACOS25, GPS, Loran-C, Decca, fathometer, gyro(s),speed log, ARPA radars, and engine controls.He stated that he was solely responsible for programmingthe radar maps onto the ARPA display.He stated that it was his responsibility toensure that watch officers fully understood howthe different systems worked and interacted witheach other. He further stated that one of his responsibilitieswas to tell the master when anewly assigned watch officer was fully preparedto stand a bridge watch alone. The navigatorstated that the master made the final decisionabout whether an individual was sufficientlyqualified to operate the bridge equipment andwas fully conversant in the ship’s watchstandingprocedures.The second officer joined the Royal Majestyon May 1, 1995. He received 3 weeks of on-thejobtraining—2 weeks with the navigator and 1week with the chief officer. According to histestimony, the 3 weeks of on-the-job trainingincluded his being familiarized with the componentsof the integrated bridge system but alsowith other bridge watchstanding duties and re- sponsibilities, fire and boat drills, vessel maintenance,and various other officer duties andresponsibilities.According to the testimony of the watch officers,there was no formal classroom or simulator-based training on the integrated bridgesystem, nor was any curriculum, checklist, orexam used during the 3 weeks of on-the-jobtraining to measure the extent of the trainee’sknowledge of the system or its components.According to STN Atlas, the manufacturerof the NACOS 25, STN Atlas offers classroomand simulator training in the operation of itsequipment at an additional cost to the purchaser.STN Atlas also indicated that several companiesand organizations in Europe were qualified toprovide formal classroom and simulator-basedtraining in the operation of the STN AtlasNACOS 25. Majesty Cruise Line did not obtainsuch training from STN Atlas or any other organization,nor was it required to by any international

regulations or standards.Written Guidance on Use of the NACOS25.—STN Atlas supplied several supportingmanuals with the NACOS 25 on the Royal Majesty.Manuals for the Atlas NACOS 25 systemincluded Specifications, Navigation Instructions,“Brief Navigation Instructions,” OperatingInstructions, and “Brief Operating Instructions.”37 In addition, STN Atlas provided manualsfor the Atlas 8600 ARPA radar and the programmingof maps using the ARPA radar. STNAtlas notes the following in its concluding remarksin the Navigation Instructions:The navigator’s role is that of overseerof the ship’s progress and proper functioningof the automatic equipment. Ifthe system performs faultlessly, it couldhappen that the navigator loses interestin overseeing a faultlessly functioningsystem. Before entering into this situationone must set about planning thenext stage of development. In the next stage of development, onemust consider changing the automationso that the supervising of the navigationwill be done automatically instead of bythe navigator.Waterway InformationThe Royal Majesty grounded on Rose andCrown Shoal about 10 miles east of SankatyHead Light, which is on the eastern shore ofNantucket Island and about 17.0 miles west ofthe vessel’s intended track (the northboundBoston traffic lane). The shoal extends approximately5 miles in a north-south directionand about 3 miles in an east-west direction. Theminimum depth of the water in this area rangesbetween 3 and 7 feet at mean low water. Thearea is also known to contain breakers. Theshoal is marked by a lighted whistle buoy(2RC). The buoy’s red light flashes at 2.5-second intervals and is visible at a distance of atleast 6 miles when visibility is clear.Rose and Crown Shoal is one of severalbroken shoals that compose Nantucket Shoals—the general name of the shoals that extend 23miles east and 40 miles south of Nantucket Island.The currents in this area are strong anderratic, reaching a velocity of 3 to 5 knotsaround the edges of the shoals. According toVolume 2 of U.S. Coast Pilots (Atlantic Coast:Cape Cod to Sandy Hook), Nantucket Shoals is“one of the most dangerous parts of the coast ofthe United States.” It also states that “this areashould be entirely avoided by deep draft vesselswhen possible and by light draft vessels without

local knowledge.”The shoals, which are shifting in nature, arebordered to the south and east by several aids tonavigation. The southwest corner of NantucketShoals is marked by the Davis South Shoallighted whistle buoy. The buoy has a red lightthat flashes at 4-second intervals and is visibleat a distance of about 4 miles when visibility isclear. Marking the southeast corner of NantucketShoals is the Asia Rip (AR) lighted bellbuoy. This buoy, which is about 17 miles westof the Royal Majesty’s intended track and15 miles (on a bearing of 248°) away from theBA buoy, has a yellow light that flashes at 2.5- second intervals. Fifteen miles to the southsouthwestof the AR buoy and 30 miles west ofthe Royal Majesty’s intended track is the NantucketShoals lighted horn buoy. This buoy,which replaced the original Nantucket Lightship,is a large navigational buoy38 that has ayellow light that is 40 feet above the water andflashes at 6-second intervals.Large deep-draft vessels operating betweenBermuda and Boston generally use the Bostontraffic lanes east of Nantucket and Cape Cod.The purpose of the traffic lanes is to separatenorthbound and southbound vessels and to providea deep-water route for vessels en route toand from Boston that keeps them clear of NantucketShoals. A traffic separation zone separatesthe northbound and southbound lanes.Marking the separation zone are a series oflighted buoys (BA, BB, BC, BD, BE, and BF).Each buoy has a flashing yellow light and a radarreflector and has a distinctive flashing characteristic.For example, the yellow light on theBA buoy, which marks the southeast entrance tothe traffic lanes, flashes four times at 20-secondintervals. The BA buoy also sounds a whistle at10-second intervals when certain rough sea conditionsexist.Meteorological InformationThe weather and sea conditions recorded bythe Royal Majesty crew between 1800 and 2230on June 10 generally indicated cloudy skies,force 4 winds39 (between 11 and 16 knots) outof the east, and seas between 2 and 4 feet. Visibilityat sea level was reported to be at least 10miles.A review of the bridge log for the 24-hourperiod beginning at 2100 on June 9 indicatedthat the Royal Majesty encountered winds averaging15.9 knots out of the east-northeast. Basedon the Beaufort scale, a 16-knot wind could generate a wind-driven current capable of settingthe Royal Majesty toward the westsouthwestat a rate of 0.32 knots, or a distance

of about 8 miles over a 24-hour period. The effectof the wind on the vessel’s vast superstructurewould have also contributed to the vessel’swesterly drift.Toxicological InformationThe Coast Guard does not have the authorityto order postaccident toxicological testing inaccidents on foreign vessels that occur in internationalwaters.40 However, Majesty CruiseLine requested that all watchstanders on thebridge at the time of the grounding and themaster provide specimens for toxicologicaltesting. The company tried to obtain the servicesof a testing firm that could travel to the site ofthe grounding. On the following day, June 11,the company found a contractor in New Hampshirewho agreed to collect the specimens. Hearrived on scene in a chartered fishing vesseland was transported to the Royal Majesty on aCoast Guard vessel about midnight. The CoastGuard requested that the contractor wait until itwas safe to board, as the Coast Guard was stillin the process of freeing the vessel. Afterboarding, he was directed to the office of theship’s doctor and began collecting the specimenssoon thereafter.Twenty-five to 28 hours after the grounding,the master, the second officer, and the two lookoutson duty at the time of the grounding gaveblood and urine specimens for alcohol and drugtesting specified in 46 Code of Federal Regulations(CFR) Part 4 and in 49 CFR Part 40. Thespecimens were shipped for testing to the MethodistMedical Center in Peoria, Illinois. The resultsof the tests were negative.Watchstanding Policies and PracticesThree licensed deck officers and six unlicensedcrewmen were assigned to the watchstandingduties aboard the Royal Majesty. Eachstood a 4-hour-on/8-hour-off watch rotation.The watches for the three licensed deck officerswere as follows: 0000-0400/1200-1600 Navigator0400-0800/1600-2000 Chief Officer0800-1200/2000-2400 Second OfficerThe master of the Royal Majesty, who didnot stand a regular watch, oversaw the performanceof the watch officers. According to themaster, in good weather he typically visited thebridge two to three times during the course of awatch and frequently telephoned the officer ofthe watch for navigation and traffic updates. Hestated that he visited the bridge more frequentlywhen the weather or sea conditions were bad orwhen visibility was poor.Company policy governing the activities of

the bridge watchstanders aboard the Royal Majestyare contained in its “Bridge ProceduresGuide” and the Majesty Cruise Line’s OperationsManual. The two-page “Bridge ProceduresGuide” (see appendix B) was posted on thebridge of the Royal Majesty before the accident.According to Majesty Cruise Line, the purposeof the “Bridge Procedures Guide” is to providewatchstanders “with a description of the day-todaybridge procedures that are recognized asgood practice and to promote through them thesafety of the M/V Royal Majesty, her passengers,and crew.”The Operations Manual contains a collectionof policies, letters, and circulars coveringsuch topics as checking the vessel’s position,fire and boat drills, and payroll and accountingprocedures. Duties of the officer on watch arelisted on page 3 of Majesty Cruise Line’s CircularNo. 9, dated July 9, 1992 (see appendixC). The circular states that deck watch officersare to “check the ship’s position as often asconditions and circumstances allow, but neverlonger than 30-minute intervals.” The circulardoes not state how the ship’s position is to bechecked, nor does it require that GPS and Loran-C position data be compared. The circularalso does not require that a written record bemaintained of GPS or Loran-C observations orof radar ranges and bearings of nearby floatingaids to navigation and/or landmarks.The master testified that he required hiswatch officers to plot the vessel’s position on anhourly basis. A postaccident examination of National Oceanic and Atmospheric Administrationchart No. 13200 (Georges Bank and NantucketShoals) indicated that hourly fixes hadbeen plotted on the chart of the area startingabout 100 miles to the south of the accident siteand continuing up into the Boston traffic lanes.Circular No. 9 and the “Bridge ProceduresGuide” discuss when the master should besummoned to the bridge. Among the circumstancesthat should prompt a call to the master isthe failure of watch officers to sight land or anavigation mark or to obtain a sounding by theexpected time.Postaccident Testing of GPSAfter the accident, representatives fromMajesty Cruise Line and the Coast Guard examinedthe Royal Majesty’s GPS antenna andreceiver. They found that the GPS antenna cablehad separated from the factory connection at theantenna. The antenna cable, which was factoryassembled,showed no sign of physical damage,other than having been separated from the connection.

The Safety Board examination also revealedthat the cable was openly routed on theroof of the bridge and that it had been paintedwith a brush or roller at least twice when thebridge was being painted (see figure 9). Trafficon the roof of the bridge was limited to MajestyCruise Line employees. However, the GPS cablewas not secured to the roof or protected fromsomeone tripping over it, kicking it, or otherwisedamaging it and the nearby antenna connector.Postaccident testing at Raytheon41 indicatedthat because the GPS antenna cable was separatedfrom the connection, the GPS receivertransmitted DR-derived position data instead ofsatellite-derived position data to the NACOS 25autopilot.Safety Board’s Urgent Safety RecommendationsThe Safety Board’s postaccident testing andinspection of the integrated bridge system on the

Figure 9—GPS antenna assembly (photograph shows antenna and cabling as installedon deck of fly bridge). .

Royal Majesty raised concerns about the safetyof the world’s maritime fleet and the safety ofpassengers and crews on vessels with similarintegrated bridge systems, as well as the potentialdamage to the environment that could resultfrom a release of hazardous cargo. Consequently,on August 9, 1995, the Safety Boardissued five urgent safety recommendations tothe Coast Guard, the International Council ofCruise Lines (ICCL), the International Chamberof Shipping, the American Institute of MerchantShipping, the International Association of IndependentTanker Owners (INTERTANKO), STN

Atlas, and the NMEA. The recommendationsurged the organizations to immediately advisemaritime vessel operators of the circumstancesof the Royal Majesty’s grounding and to encouragethe operators to review the design oftheir integrated bridge systems to identify potentialsystem and operational failure modes. Allfive recommendations were acted upon and,consequently, have been classified either“Closed—Acceptable Action” or “Closed—AcceptableAlternate Action.”42Safety Board’s Public ForumThe grounding of the Royal Majesty suggestedto the Safety Board a need to assess thecurrent state of the art in integrated bridge systems.As a first step, the Safety Board held apublic forum on integrated bridge systems onMarch 6-7, 1996, to examine data-transmissionstandards, design standards for integrated bridgesystems, human-factors considerations in thedesign of integrated bridge systems, training andcertification of mariners responsible for operatingintegrated bridge systems, and the impact ofintegrated bridge systems on safety, workload,and watchkeeping. Participating in the publicforum were representatives of the vessel operators,standards organizations, manufacturers ofintegrated bridge systems, and classificationsocieties. Government representatives and marineeducators from the major maritime schools,colleges, and universities also participated. The following sections highlight some ofthe comments from the various participants.Manufacturers.—The public forum showedthat manufacturers of integrated bridge systemsare designing and building the components oftheir systems in accordance with internationallyrecognized standards, proprietary standards, andthe standards of the classification societies.Manufacturers stated that problems were occasionallyencountered in matching subsystems,such as Loran-C and GPS, speed logs, and gyrocompasses, with the integrated bridge systemthat they manufacture. They expressed concernabout the maintenance of system integritythroughout the life of the integrated system assubcomponents are added or replaced. They expressedthe belief that an independent authorityis needed to ensure system integrity.Standards Organizations.—The InternationalMaritime Organization (IMO), a UnitedNations organization, produces performancestandards for navigation equipment required oncommercial vessels. Such standards are normallycast in general terms. Once adopted, eachof the IMO performance standards is reviewed

by either Technical Committee 8 (TC8) of theInternational Standards Organization (ISO) or,more often, by Technical Committee 80 (TC80)of the IEC, depending upon whether the equipmentis mechanical or electric/electronic. Normally,one of the two organizations will developspecifications (called standards) that enablemanufacturers to design and build navigationequipment that will meet the appropriate IMOperformance standard. It is not unusual for theISO and the IEC to work jointly to producestandards.The ISO and the IEC are parallel internationalorganizations, working in close cooperationto form a world system of standardizedworking procedures, terminology, and documentationpresentation. The TC8 has 10 subcommitteesworking on various areas, including ship bridge layout43 for one-person watchkeeping.44

The work of the IEC is managed throughmore than 200 technical committees, and theTC80, formed in 1979, is the technical committeeconcerned with marine navigation and radiocommunicationequipment and systems. TheTC80 has 10 working groups.In 1990, the TC80 notified the IMO that itwas forming a working group (WG9) to developa draft IMO performance standard for integratedbridge systems. The proposed standard wascompleted and submitted to the IMO in July1996. The proposed standard is expected to becomean IMO performance standard by about1999.In the absence of an ISO or IEC standard,manufacturers use other internationally recognizedstandards, such as those of the NMEA.The NMEA, a U.S. organization of manufacturers,dealers, and installers of marine electronicequipment, actively encourages internationalmembership and participation. The NMEA InterfaceStandards Committee, for example, hasrepresentatives from nearly all the companies inthe world that manufacture marine electronicequipment.The NMEA and the IEC have members oneach other’s working groups and in 1995 collaboratedto produce a harmonized standard fordata transmission (NMEA 0183 and IEC 1162-1), which will facilitate matching subsystemslike GPS with integrated bridge systems and theGlobal Maritime Distress and Safety System.45

The NMEA and the IEC have agreed to worktogether on future transmission standards and tokeep both standards in harmony.The NMEA representative stated that manufacturers

have sometimes made different interpretationsof the NMEA standards and thatelectronic equipment has been mismatched. TheNMEA representative further stated that the0183 standard by itself does not regulate the useof the data in NMEA-provided sentences. TheNMEA counts on the knowledgeable input to,and sensible implementation of, the NMEAstandard by equipment designers. This processhas improved vastly over the past few years andmany of the early problems with implementationno longer exist. Helping in this regard is thetrend in international performance standards formarine electronic equipment to specify the useof specific NMEA 0183/IEC 1162-1 sentences.The representative stated that he believes thatthe new improved standards have reduced thepossibility of mismatching.Classification Societies.—The DNV hasbeen involved in bridge navigation issues sincethe early 1970s; the classification society wasmotivated to enter this nontraditional area by thehigh number of groundings and collisions attributableto human error. The DNV studied thebridge environment, including design of workstations, organizational matters, range and qualityof instrumentation, and man/machine interface.The DNV then developed some standardsfor bridge design and equipment that might reducesituation-induced errors. These standardswere offered as an optional classification notation,46 NAUT-C.Currently, the highest class notation offeredby the DNV is Watch 1 (W1), which addressesequipment requirements, qualifications of theintegrated bridge system operator, operatingprocedures, documentation on maneuvering performance,and a contingency plan. The DNVrequires that vessel officers attend classes providedby the integrated bridge system manufacturer.An officer who has been trained by themanufacturer and has operated an integratedbridge system at sea may instruct other officers.All operators of an integrated bridge systemmust be certified by the DNV.Germanischer Lloyd was the coordinator forthe German Ship of the Future program, whichinvolved various elements of the German maritimeindustry. The intention of this researchprogram was to employ automatic navigationsystems to do routine functions; as a result,watchkeeping at any time, day or night, could behandled by one person. The culmination of theShip of the Future program was marked in 1985by the commissioning of a prototype vessel with

an integrated bridge system. In 1991, GermanischerLloyd published its Rules for Bridge Designon Sea-Going Ships - One-man ControlConsole. The rules were based on 5 years ofoperational experience with advanced navigationsystems. A ship complying with the rulesreceives the optional class notation Nav O(ocean area) or Nav OC (ocean area/coastalwaters).Lloyd’s Register of Shipping (LR) publishedrules for navigation bridge arrangementsin 1988 and in January 1996, after completingfurther research, replaced those rules with amore comprehensive notation (NAV-1).47 TheLR is planning to offer an integrated bridgesystem notation, IBS, which will be an enhancementof NAV-1. The notation also willaddress software, and will require that the “development,modification, replication and installationof the software be subject to quality planswhich meet the requirements of acceptable standards,e.g. the ISO 9000 series.” The LR willaccept certification of the software quality proceduresby a recognized authority as evidence ofcompliance. Also, the LR can now providecomprehensive software assessment to manufacturers.(The DNV tests software at the manufacturer’splant for each model of an integratedbridge system and whenever there are changesin software.)Nippon Kaiji Kyoukai published rules fornavigation bridge systems in February 1995. Inpreparing the rules, the organization consideredcurrent Japanese technology, other technicaldevelopments, vessel-owner desires, and internationalstandards, including those of the IMO,the ISO, and the IEC.The Nippon Kaiji Kyoukai notation BRS1covers “functionality of the bridge design layout,configuration, bridge environment, and essentialnavigational equipment to be installedand work stations for one officer bridge operationon the open sea.”The Korean Registry of Shipping has introducedrequirements for one-man bridge operatedships. In developing its rules, the organizationgave a high priority to the safety and reliabilityof systems. The organization also focused on thehuman element, including ergonomic criteriaand bridge design and installation, as well as ontechnical performance standards, system redundancy,and reliability.The American Bureau of Shipping publishedguidelines for one-man bridge operationin 1992.

ANALYSISGeneralThe weather at the time of the accident wasclear, visibility was at least 10 miles, seas werecalm, and winds were light. Except for the GPSantenna cable connection, all other navigationequipment and the main propulsion, steering,and auxiliary systems were fully operationalbefore and after the accident. The investigationindicated that the certifications of the masterand the deck officers were in accordance withcurrent international requirements. Accordingly,the Safety Board concludes that the weather, themechanical condition of the Royal Majesty, exceptfor the GPS antenna cable, and the officers’certifications were not factors in the accident.Because the accident happened in internationalwaters, the Coast Guard did not have theauthority to order toxicological testing. However,the master, the second officer, and the twolookouts on duty at the time of the accident providedblood and urine specimens for alcohol anddrug testing, as requested by Majesty CruiseLine. On the basis of test results, the SafetyBoard concludes that drugs were not a factor inthe accident. However, because the specimenswere obtained more than 24 hours after the accident,the alcohol tests were of little value; hadthere been any alcohol, it probably would havebeen metabolized and eliminated. Although investigatingCoast Guard personnel observed noindications that the officers had been under theinfluence of alcohol, the Safety Board could notdetermine conclusively that alcohol was not afactor in the accident.The master and two of the deck officers, includingthe second officer, who was on duty atthe time of the accident, testified that theirwork/rest routines during the days preceding theaccident were normal. In particular, the secondofficer slept about 7 hours after finishing his2000-to-2400 watch and had also taken a 2-hournap before beginning his 2000 watch onJune 10, the day of the accident. In short, theSafety Board concludes that fatigue was not afactor in the grounding of the Royal Majesty.The Safety Board assessed the fishing vessel’sattempts to call a cruise ship shortly beforethe grounding of the Royal Majesty. Althoughthe Safety Board could not conclusively determinewhether the second officer was in factmonitoring channel 16, international requirementsand company procedures required him todo so. Because the position transmitted by thefishing vessel was approximately 17 miles away

from where the second officer believed the vesselto be and because the English transmissionsmade by the fishing vessel to the cruise ship didnot convey any urgency or immediacy and wereinterspersed with Portuguese conversation, theSafety Board believes it was reasonable that thesecond officer did not respond to these transmissions.The transmissions do, however, provideevidence of the location of the Royal Majestyalmost 2 hours before the grounding.The grounding occurred near Nantucket Islandin an area known as Rose and CrownShoal—a location more than 17 miles west ofthe vessel’s intended track. The investigation,therefore, focused on determining how a largepassenger vessel with a sophisticated integratedbridge system, manned by experienced watchofficers, and operated in clear weather throughcalm seas could travel, unknown to the crew,more than 17 miles off course.The AccidentShortly after the vessel left St. George’s, thenavigator set the NACOS 25 autopilot on theNAV mode. When engaged and operating in theNAV mode, the autopilot could steer the vesselalong a predetermined route using programmedinformation (latitude and longitude of waypointsand the vessel’s maneuvering characteristics),gyro and speed data, and position data from eitherthe GPS or the Loran-C while automaticallycompensating for the effect of gyro error, wind,current, and sea. On the day of the accident, thecrew had selected, as it normally had done sincethe vessel entered service, the GPS as the sourceof position data for the NACOS 25.To compensate for the possible lack of satellitedata, the GPS unit on the Royal Majestyhad been designed to receive speed and gyroheading data so that when GPS satellite datawere not available, the unit would automaticallydefault to a DR mode, in which the latitude/longitude data transmitted to the autopilotwere derived from DR calculations rather thansatellite-based position data. When the GPS unitdefaulted to the DR mode after the vessel leftBermuda, the autopilot was unable to recognizethe status change; and, thus, its subsequentnavigation did not correct for the effect of wind,current, or sea.The bell-log record provided evidence thatcomplete interruption of valid satellite-basedposition data occurred about 1311:46, whichwas about an hour after the vessel left St.George’s. From that point on, the bell log continuedto record alternate courses of 197° and

000° until after the vessel’s arrival in Boston,although, in fact, the vessel was maintaining acourse of about 336° during that time. It appearedthat a temporary interruption of validsatellite-based data occurred at 1252:02, about52 minutes after the vessel left Bermuda, as thecourse and speed recorded were 197° and 12.7knots, respectively—the same readings thatwere later recorded. The course of 336° recordedat 1309:06 was consistent with the vessel’scourse at that time. Similarly, the bell-logrecord of speed calculations based on the dataprovided by the GPS unit indicated that the lastaccurate recording occurred at 1309:05 whenthe bell log recorded a speed of 21.3 knots.However, from that point on until the vessel’sarrival in Boston on June 12, the bell log continuedto record a speed of 12.7 knots, a speednot consistent with the speeds recorded in thebridge log and speed record. In summary, theSafety Board concludes that starting about 52minutes after the Royal Majesty left St.George’s, the GPS receiver antenna cable connectionhad separated enough that the GPSswitched to DR mode, and the autopilot, notprogrammed to detect the mode change and invalidstatus bits, no longer corrected for the effectsof wind, current, or sea. Over time, theeffects of the east-northeasterly wind and sea setthe Royal Majesty in a west-southwesterly directionand away from its intended track, resultingin the 17-mile error. Further evidencecame from a Coast Guard transcript of radiotransmissions from two fishing vessels that werein the vicinity of Fishing Rip Shoal on the eveningof June 10 and had seen a large passengercruise ship about 16 miles west of the Bostontraffic lanes.The investigation determined that the GPSantenna, which was originally installed on theradar mast, had been moved in February 1995,several months before the grounding, as part ofan effort to eliminate chopping. An examinationof the GPS antenna cable indicated that it wasrouted in such a way that it could be kicked ortripped over, which could induce separatingstress at the antenna cable connection, and thatit had been painted on at least two occasions.However, precisely when the painting was donewas not known. In short, it could not be determinedwhether the GPS antenna failed as a resultof crewmembers’ inadvertently damaging itwhile they were doing routine maintenance, as aresult of crewmembers’ tripping over the cable,or as a result of other unknown factors. Nevertheless,

the Safety Board concludes that openlyrouting the GPS antenna cable in an area wheresomeone occasionally walked increased the riskof damage to the cable and related connectors.The Safety Board believes, therefore, that todecrease the risk of damage, Majesty CruiseLine should eliminate the practice of openlyrouting navigation equipment cable to decreasethe risk of damage and that the ICCL shouldencourage its members to do the same.Watch Officers’ PerformanceThe crew’s failure to detect the ship’s errantnavigation for more than 34 hours raises seriousconcerns about the performance of the watchofficers and the master. None of the three watchofficers or the master determined that the GPShad switched to DR mode or that the RoyalMajesty had been on an errant course throughoutthe trip from St. George’s. Further, the chiefofficer and the second officer, who stood thelast two watches before the grounding, failed torecognize that the Royal Majesty was on an errantcourse despite several indications that thevessel was not on its intended track. The investigation,therefore, examined the events leadingup to the accident from the time the Royal Majestydeparted St. George’s, including the inspectingof equipment and the setting of thefathometer alarm. The investigation also examinedthe watchstanding practices of the watchofficers and their lack of response to severalindications that the vessel was not following itsintended track, including the sighting of redlights, the failure to sight the BB buoy, and thesighting of blue and white water.Equipment Inspection.—The navigator saidthat he had tested the navigational equipmentbefore the vessel left St. George’s and found theequipment to be in “perfect” operating condition.Because the evidence from the bell log indicatedthat interruption of GPS data did notoccur until about 1252, about an hour after thevessel had left port, the GPS receiver wouldprobably not have shown the SOL and DR messagesbefore that time. Consequently, the navigatormay indeed have inspected the GPS receiverbefore the departure when the other navigationequipment was inspected and found noanomalies.Fathometer Alarm.—Although the testimonyindicated that the fathometer alarm wasusually set at 3 meters, the postacccident investigationdetermined that the fathometer alarmwas set at 0 meters—the setting used when thevessel was in port or in harbor so that the alarm

would not be continuously activated. During thevoyage, no one detected that the fathometer settingwas improper, and the fathometer recorderwas not turned on. Because the fathometeralarm was set at 0 meters, the aural fathometeralarm would not have activated; thus, the settingeffectively rendered the alarm useless.Before it grounded, the Royal Majestypassed over several areas in which the depth ofwater beneath the keel was significantly lessthan 3 meters. Had the alarm been set as usual to3 meters, it would have activated several timesbefore the vessel grounded. The Safety Boardconcludes that had the fathometer alarm been setto 3 meters, as was the stated practice, or hadthe second officer chosen to display thefathometer data on the control console, hewould have been alerted in time for him to takecorrective action that the Royal Majesty was infar shallower water than expected and, thus, wasoff course. Because of the proximity of DavisBank (a shoal about 8 miles southeast of thegrounding site; the water is between 15 and 40feet deep) it is possible that he would have beenalerted perhaps as long as 40 minutes before thegrounding.GPS Status.—Once the ship had beenplaced under the control of the automated navigationsystem, the watch officers’ operatingtasks were to ensure that the automated navigationsystem equipment was operating properlyand to verify that the Royal Majesty was followingthe intended track. The testimony of thewatch officers and the charts used by these officersindicated that hourly fixes were beingplotted during the voyage, as instructed by themaster. The navigator and the second officerboth testified that the hourly fixes they plottedwere based on position data from the vessel’sGPS. However, according to testimony, no officer,including the master, recognized the SOLand DR messages, indicating that the GPS positiondata were not reliable, until after thegrounding. Because the crew noticed the SOLand DR messages immediately after thegrounding and because postaccident testing confirmedthat the SOL and DR messages werefunctioning properly and should have been displayed,the watch officers apparently read theposition coordinates on the GPS unit to accomplishtheir manual plotting task, without attendingto the SOL and DR messages. The SafetyBoard concludes that the watch officers’ monitoringof the status of the vessel’s GPS was deficientthroughout the voyage from St. George’s.

Cross-checking of Position Data.—Despitefailing to recognize the SOL and DR indicators,the officers could have discovered that the GPShad defaulted to DR mode by using an independentsource of information, such as the Loran-C. According to the chief officer and thenavigator, they periodically compared the GPSdata with the Loran-C data during the voyage.The second officer, however, stated that he didnot check the Loran-C because it was used as abackup only if the GPS failed. At the site of thegrounding, the Loran-C indicated the correctposition of the Royal Majesty, and there was noevidence that the Loran-C was malfunctioningduring the voyage. Thus, had the officers regularlycompared position information from theGPS and the Loran-C, they should not havemissed the discrepant coordinates, particularlyas the vessel progressed farther from its intendedtrack. The Safety Board concludes thatdeliberate cross checking between the GPS andthe Loran-C to verify the vessel’s position wasnot being performed and should have been onthe voyage from St. George’s.Use of Position-fix Alarm.—Evidence suggestedthat instead of monitoring the positioninstrumentation, the watch officers relied on theposition-fix alarm, a feature of the autopilot designedto alert watchstanders to any degradationof position data from the position sensor in use.According to the officers, the only times theGPS positions could not be depended on for accuracywere during chopping episodes, whichcould usually be recognized because they wereaccompanied by an erratic movement of the radarmap and the sounding of the position-fixalarm. Because chopping did not occur on theaccident voyage and because the position-fixalarm never activated, the crew probably believedthere was no need to suspect that the GPSwas not providing satellite-derived positiondata. On this voyage, the position-fix alarm wasset to activate only when the position data generatedby the GPS and the DR position datagenerated by the autopilot differed by more than200 meters. Because the GPS and autopilotshared common gyro and speed inputs, the DRposition data transmitted by the GPS when itdefaulted to the DR mode was essentially identicalto the DR position data calculated by theautopilot. Consequently, the position-fix alarmwould not have activated after the GPS defaultedto the DR mode. The Safety Board concludesthat even though it is likely that thewatch officers were not aware of the inherent

limitation in using the position-fix alarm tomonitor the accuracy of GPS position data, itwas inappropriate for them to rely solely on thealarm to warn them of any problems with theGPS data.Identification of Navigation Aids.—Althoughthe officers’ inadequate monitoring ledto the errant track and was a serious deviationfrom acceptable methods of operating automatedequipment, the grounding itself couldhave been avoided had the chief officer and thesecond officer followed longstanding goodwatchkeeping practices when approaching land.During the 1600-to-2000 watch preceding theaccident, the chief officer did not visually identifythe buoy he saw on the radar about 1900and apparently assumed that it was the BAbuoy, which marked the entrance to the trafficlanes. The target that he probably observed wasthe AR buoy, which marked a wreck about 17miles west of the traffic lanes, and it was probablycoincidental that he detected it when andwhere he anticipated seeing the BA buoy. Helater explained that he was not concerned aboutconfirming that the target was the BA buoy becausethe information displayed at the time onthe GPS and ARPA displays indicated to himthat confirmation was not necessary.When the second officer assumed the followingwatch, he did not detect, either visuallyor by radar, the next buoy in the traffic lanes,the BB buoy, when it was expected. Contrary tostanding orders from the master, he failed toreport that he had not seen the BB buoy; andwhen the master called the bridge anticipatingpassing the buoy, the second officer stated thathe had observed it.The second officer continued to miss opportunitiesto avoid the grounding when thelookouts reported sighting several high redlights (later determined to be on Nantucket Island),sighting a flashing red light on the portbow, and sighting blue and white water ahead ofthe Royal Majesty. He acknowledged these observations,but he failed to take any action.The second officer’s response to thesesightings should have been deliberate andstraightforward. He should have been concerned as soon as the BB buoy was not sighted and thenagain when the lookouts sighted the red lights.Had he then increased the radar range from 6miles to 12 miles on the port radar, the one radarin use, or turned on the starboard radar and set itto the 12-mile range, he would have detectedNantucket Island. He would also have seen thatthe radar pictures did not conform to the radar

maps exhibited on the ARPA display. In addition,had he checked a chart of the area for thesource of the flashing red light, he would havelearned that the nearest flashing red light wasthe Rose and Crown Shoal buoy and, thus,would have been warned that the ship was not inthe traffic lanes, as he believed it was.Additionally, the second officer should havechecked the Loran-C to cross check his position,as he knew the Loran-C to be accurate in thisarea. Had he still been uncertain about the positionof the Royal Majesty after checking the Loran-C, he should have called the master and thenavigator to the bridge for assistance. TheSafety Board concludes that the sighting oflights not normally observed in this area and thesecond officer’s inability to confirm the presenceof the BB buoy should have taken precedenceover the automation display on the centralconsole and compelled the second officer topromptly use all available means to verify hisposition.Fundamental seamanship practices cautionagainst exclusive reliance on any one source ofposition information for navigation. When awatch officer finds visually sighted navigationaids that conflict with a position determined byautomated instrumentation, he should promptlyverify the vessel’s position by using proper procedures.The Safety Board concludes that thechief officer and the second officer did not observegood watchkeeping practices or act withheightened awareness of the precautions that areneeded when a vessel approaches the Bostontraffic lanes and landfall. Consequently, in viewof the actions of the watch officers on the RoyalMajesty, the Safety Board believes that MajestyCruise Line should review and revise as necessarythe bridge watchstanding practices on all itsvessels to ensure that all watch officers adhereto sound watchstanding practices and procedures,including using landmarks, soundings,and navigational aids to verify a vessel’s position,relying on more than one source for positioninformation, and reporting to the master anyfailure to detect important navigational aids.The Safety Board believes that the ICCL shouldencourage its members to take the same steps.The Safety Board further believes that MajestyCruise Line and the members of the ICCLshould periodically review the performance ofall officers on board their vessels.Master’s Monitoring of the Vessel’s Progress.—The investigation determined that themaster of the Royal Majesty frequently visited

the bridge to keep himself informed aboutbridge operations and to confirm that the passagewas progressing satisfactorily. By requestingthat the chief officer and the second officerreport their sightings of the BA and BB buoys,the master made a reasonable effort to assurehimself that the Royal Majesty was following itsintended track. It is likely that the chief officerwas not aware that he had misidentified the BAbuoy, which marked the entrance to the trafficlanes, and unknowingly passed on erroneousinformation about the buoy to the master and thesecond officer. The second officer, however,deliberately misinformed the master when askedwhether he had seen the BB buoy. Thus, themaster was grossly misled by the second officerand was denied the opportunity to investigateclues indicating that the ship was not followingthe intended track.The evidence suggests, however, that themaster did not have any better understanding ofthe automated navigation system and the functioningof the GPS than the watch officers. Hisrequirement that the officers plot courses manuallydid not result in anyone monitoring the vesselposition by using an independent source ofposition information. Because the officers usedthe GPS data to get the coordinates for the manualplotting, the fixes on the chart correspondedwith the map and positions displayed on thecentral console; thus the manual plotting in noway verified the validity of the GPS data. Themaster appeared to share the deck officers’ relianceon the automated navigation system, sincehe did not ask for deliberate cross checks between the GPS and the Loran-C or make anycomparisons himself. The Safety Board concludesthat the master’s methods for monitoringthe progress of the voyage did not account forthe technical capabilities and limitations of theautomated equipment.Effects of Automation on Watch Officers’PerformanceInnovations in technology have led to theuse of advanced automated systems on modernmaritime vessels. However, bridge automationhas also changed the role of the watch officer onthe ship. The watch officer, who previously wasactive in obtaining information about the environmentand used this information for controllingthe ship, is now “out of the control loop.”The watch officer is relegated to passivelymonitoring the status and performance of theautomated systems. As a result of passivemonitoring, the crewmembers of the Royal Majesty

missed numerous opportunities to recognizethat the GPS was transmitting in DR mode andthat the ship had deviated from its intendedtrack. The Safety Board examined why thewatch officers missed the opportunities.When the GPS unit defaulted to its DRmode, it displayed both SOL and DR, indicatingthat the GPS solution was no longer valid andthat the unit had switched to a DR mode. Althoughthe watch officers testified they used theGPS data for plotting, each officer also testifiedthat he did not see SOL displayed on the GPSunit. Ineffective monitoring of sophisticatedautomated equipment is not new. The SafetyBoard has investigated several aviation accidentsin which pilots failed to monitor flightinstruments during automated flight.48 Likewise,empirical research on the monitoring of auto- mation has shown that humans are poor monitorsof automated systems.49 The problem ofpoor monitoring of automated systems was alsoknown to STN Atlas, the manufacturer of theNACOS 25 system. STN Atlas warns in its operatingmanual for the NACOS 25 that operators,with little to do, may fail to monitor theautomated NACOS 25 system.The watch officers’ failure to recognize theSOL or DR messages may also have been relatedto the absence of any loud alarm signifying poorGPS data. Before the separation of the antennacable connection, failures of the GPS systemtriggered the NACOS 25 position-fix alarm.This could have led to what Wiener and Curry(1980) referred to as a primary/backup inversion.50 The primary indicators of the status ofthe GPS unit are SOL and DR. As a backup tothese primary indicators, the watch officerscould use the position-fix alarm to signal inaccurateGPS data. As Wiener and Curry warned,the watch officers and the master of the RoyalMajesty relied exclusively on the position-fixalarm instead of monitoring for SOL or DR. In1988, the Safety Board investigated another caseof primary/backup inversion in the crash of aNorthwest Airlines Boeing 737 in Romulus,Michigan.51 The plane crashed while the crewwas attempting to take off in the wrong flightconfiguration. The crew apparently relied on anonboard configuration warning system insteadof manually checking the position of the flapsand slats.The Board’s investigation also found thatthe watch officers failed to use independent alternativemeans to verify the Royal Majesty's 35position. Research on operator monitoring performancesuggests that the reliability or trustworthiness

of an automated system52 could haveaffected the officers’ verification of the GPSposition data. The complete automated navigationsystem, including the GPS, on the RoyalMajesty had proven to be a highly reliable andaccurate system, and the watch officers’ testimonysuggested that they believed the GPS wassuperior to other onboard position instrumentation.Also, the watchkeeping procedures of themaster and the watch officers did not include aneffective mechanism for comparing the GPSwith other position instrumentation. Althoughthe master required the watch officers to plotfixes manually as an apparent check on the system,this procedure did not provide an independentverification of the GPS information.The Safety Board concludes that the watch officerson the Royal Majesty may have believedthat because the GPS had demonstrated sufficientreliability over 3 ½ years, the traditionalpractice of using at least two independentsources of position information was not necessary.After failing to recognize the mode changeon the GPS system, the watch officers had numerousopportunities to detect that the vesselhad drifted away from its intended track. Thefailure of the chief officer and the second officerto recognize that the Royal Majesty was offcourse may be explained by how convincing thedisplay of position information was. TheNACOS 25 presented the watch officers with adetailed map view (on the ARPA display) thatindicated the position of the ship. The map displayprovided a very salient and seemingly accuratepicture of the Royal Majesty's course. Researchon decisionmaking indicates that cuesthat are most salient, such as the map display,tend to bias operators when they make diagnosticdecisions.53 Further, research on decisionmakingin the presence of automation has indi cated that automation can bias an operator’s decisions.54

Both the chief officer and the second officerexhibited decisionmaking bias toward the automatedmap display. Based on information fromthe map display, the chief officer felt no need tovisually verify his identification of the BA buoy.The second officer was overly reliant on themap display when he failed to cross check thevessel’s position despite repeated indications ofthe Royal Majesty's deviation from its intendedtrack. The Safety Board concludes that all thewatchstanding officers were overly reliant onthe automated position display of the NACOS25 and were, for all intents and purposes, sailingthe map display instead of using navigation aids

or lookout information.Notwithstanding the merits of advancedsystems for high-technology navigation, theSafety Board does not consider the automationof a bridge navigation system as the exclusivemeans of navigating a ship, nor does the Boardbelieve that electronic displays should replacevisually verifiable navigation aids and landmarks.The human operator must have the primaryresponsibility for the navigation; he mustoversee the automation and exercise his informedjudgment about when to intervenemanually.As the grounding of the Royal Majestyshows, shipboard automated systems, such asthe integrated bridge system and the GPS, canhave a profound influence on a watchstander’sperformance. However, the full impact of automatedsystems on watchstanding performancehas yet to be examined in detail. The CoastGuard has begun this effort by examining howautomation affects watch officers’ tasks andworkload. The Safety Board believes furtherresearch is necessary. Therefore, the SafetyBoard recommends that the Coast Guard continueits research on shipboard automation, focusingon watch officers’ monitoring and deci sionmaking aboard ships with automated integratedbridge systems.Integrated Bridge System Design andLocationThe performance of the watch officers duringthe voyage and the circumstances leading tothe grounding were linked to several errorinducingdeficiencies in the design of theequipment and to an inefficient layout of systemdisplays on the bridge.Although the Raytheon 920 GPS receiver’sNMEA 0183 output data should have been programmedto identify the receiver as an integratedinstrument (II) talker with a system mode(SYS) sentence to indicate GPS or DR mode, theindustry standard NMEA 0183 data protocol didnot provide a SYS identifier for DR mode. Inshort, the NMEA did not consider that hybridmode receivers could use DR as one of theirmodes of determining position. Consequently,the Raytheon designers chose to use the GPSGP identifier in the NMEA 0183 output, regardlessof whether the Raytheon 920 GPS devicewas transmitting valid GPS data or DRderivedposition data.To account for this, however, Raytheon alsoprogrammed the Raytheon 920 GPS to automaticallyset the NMEA 0183 valid/invalid positiondata bits to the invalid state when the GPS

was operating in the SOL and/or DR mode. Indoing so, Raytheon assumed that a listener device,such as the NACOS 25, using position datafrom a GP talker would recognize when the datawere flagged invalid.Once the desired position receiver is selectedby the crew, the NACOS 25 takes positiondata from the chosen position receiverbased on the “talker” identifier code in theNMEA 0183 data stream; in this case, GP in thedata stream from the Royal Majesty’s Raytheon920 GPS. STN Atlas designers did not expect adevice identifying itself as GP to send positiondata based on anything other than GPS data,particularly not on DR-derived position data.Further, STN Atlas expected inaccurate or failedGPS position data to be recognizable by nulledposition data fields or by no change in the positionlatitude/longitude, the latter of which wouldtrigger the NACOS 25 position-fix alarm. STNAtlas therefore chose not to program theNACOS 25 to check the valid/invalid bits in theNMEA 0183 data stream as a means of detectinginvalid GPS data. Consequently, when theGPS defaulted to the DR mode, the NACOS 25autopilot was unable to recognize the statuschange; and thus its subsequent navigation didnot correct for the effect of wind, current, orsea. The Safety Board concludes that becausethe industry standard NMEA 0183 data protocoldid not provide a documented or standardizedmeans of communicating or recognizing that aDR positioning mode was in use by a hybrid,DR-capable position receiver, Raytheon andSTN Atlas adopted different design philosophiesabout the communication of positionreceivermode changes for the Raytheon 920GPS and the NACOS 25.Nevertheless, STN Atlas was aware of andclaimed compatibility with the NMEA 0183protocol containing the valid/invalid status bitsused by Raytheon and was capable of makingthe NACOS 25 NMEA 0183 interface fullycompatible with those specifications if it wantedto do so (including the recommended minimumGPS data sentence RMC). Therefore, the SafetyBoard further concludes that STN Atlas shouldhave, in order to help ensure safety and compatibilitywith different NMEA 0183 positionreceivers, programmed the Royal Majesty’sNACOS 25 to recognize the valid/invalid statusbits in the NMEA 0183 data, including thosespecified in the NMEA 0183 v1.5 RMC recommendedminimum GPS data sentence. TheSafety Board is aware that since the accident,

STN Atlas has taken steps to program its integratednavigation system NMEA 0183 interfacesto meet a newer, more comprehensiveNMEA 0183 version and to ensure that no DRcapableposition receivers are used with itsNACOS-integrated navigation system. TheSafety Board believes that Raytheon should designits hybrid positioning systems to identifythemselves as integrated instruments (II) with anappropriate system mode identifier (SYS) in coordinationwith the NMEA. Further, the Boardbelieves that the NMEA and the IEC should re vise their electronic interface standards to providean explicit means of indicating when hybridposition receivers are transmitting DRderivedposition data. Finally, the Board believesthat the NMEA and the IEC should advisetheir members to (1) immediately inform theNMEA and the IEC of perceived inadequaciesin electronic interface standards and (2), if applicable,design their hybrid positioning systemsto identify themselves (“talk”) as integrated instruments(II) with an appropriate system modeidentifier (SYS).Although the Royal Majesty was equippedwith multiple position receivers, the NACOS 25autopilot was not configured to compare positiondata from multiple independent positionreceivers, such as the Raytheon 920 GPS andthe 780 Loran-C receivers. Given the RoyalMajesty’s frequent proximity to land and theexpected reasonable accuracy of the Loran-C inthat area, the NACOS 25 could have recognizedthe large discrepancy between the GPS and theLoran-C positions as the vessel approachedNantucket Shoals had it been able to comparethem. The Safety Board concludes that had theautopilot been configured to compare positiondata from multiple independent position receiversand had a corresponding alarm been installedthat activated when discrepancies were detected,the accident may have been avoided. The safetybenefits associated with the redundancy of suchcritical systems as position receivers would helpprevent such single-point catastrophic failuresas occurred on the Royal Majesty. The SafetyBoard believes, therefore, that STN Atlas shoulddesign its integrated bridge systems to incorporatemultiple independent position receivers,comparison of position data from those receivers,and related crew alerts regarding changes inposition-receiver accuracy, selection, and mode.The NACOS 25 central console provided efficientaccess to and display of most informationneeded to conduct a passage when the GPS wasfully operational. However, where various

sources of position information were possible(i.e., GPS, Loran-C, or DR), as with the NACOS25 autopilot, it was important to delineateclearly which mode was in use. On the RoyalMajesty, because the NACOS 25 could not detectthe GPS’s change to DR mode, the centralconsole display switched from GPS to DRderivedpositions without changing its display inany perceivable way or notifying the crew. Theintegrated bridge system, as configured, did notindicate to the officers at the central console thatthe navigation system had defaulted to the DRmode.The design of the integrated bridge systemconsolidated most of the officers’ watchstandingnavigation activities at the central console whenthe Royal Majesty was underway. The officer onwatch could remain in the console seat for mostof his watch and execute maneuvers along withmost of the essential navigation tasks. However,key components of the system were installedelsewhere so that the officers needed to leavethe console area to do monitoring tasks. In orderto cross check the position instrumentation andto verify that the navigation system was not inthe DR mode, officers needed to see equipmentdisplays in the chart room behind the consolearea on the bridge. The GPS and the Loran-Creceivers were convenient only when manualchart work was being performed. The SafetyBoard concludes that because watch officersmust verify proper equipment operation frequently,alternative sources of critical equipmentstatus should have been displayed directlyon the console or on repeaters located wherethey could be seen from the central console.Of particular concern was the alarm systemfor the GPS. The internal aural alarm for theGPS lasted 1 second, despite its critical function.Neither the brief aural alarm nor the visualalarm, in the form of very small DR and SOLcharacters on the GPS receiver’s screen, couldbe easily seen or heard at the command console.Rather, the GPS receiver was in the chart room.The remoteness of the location probably precludedthe watch officers’ hearing the alarm orinitially noticing the DR and SOL indicationswhen the GPS defaulted to the DR mode. Further,the installer of the integrated bridge systemdid not connect the GPS receiver’s externalalarm switch to a loud and continuous externalalarm, even though one was available. Had theGPS external alarm been installed or had its internalaural alarm required the user to take action to silence it, the officers would have been

alerted to the GPS antenna problem shortly afterleaving St. George’s. Consequently, the SafetyBoard concludes that the Raytheon 920 GPSreceiver’s brief aural alarm, the remoteness ofthe receiver’s location, and the failure of theinstaller to connect the GPS external alarm resultedin the inadequacy of the aural warningsent to the crew when the GPS defaulted to theDR mode. In view of the foregoing, the SafetyBoard believes that Raytheon should design itsposition receivers to provide continuous auralalarms that require the user to take action to silencethem. The Board further believes that theNMEA should recommend that its members designand install critical aural alarms that arecontinuous and require the user to take action tosilence them. Finally, the Safety Board believesthat the ICCL, the International Chamber ofShipping, and INTERTANKO should recommendto their members that they ensure that integratedbridge systems installed on their vesselsprovide critical aural alarms that are continuousand require the user to take action to silencethem.The failure of the GPS antenna connectionand the subsequent failure of the NACOS 25autopilot to recognize the GPS data as invalidand to sound an alarm resulted in a single-point,“silent” failure mode on the Royal Majesty.Aeronautical and aerospace design safety practicestypically require the analysis of potentialfailure modes via failure modes and effectsanalyses (FMEAs). FMEAs of the Royal Majesty’sintegrated bridge system could have highlightedthe need for multiple independent comparisonsof positioning systems to detect discrepanciesbetween systems, the need for removalof the DR input to the Raytheon 920 GPSreceiver, and the need for the NACOS 25 to interrogatethe NMEA 0183 valid/invalid positiondata bits. The Safety Board concludes thatFMEAs of the Royal Majesty’s integrated bridgesystem would probably have disclosed theshortcomings of the system’s components.Therefore, the Safety Board believes that theCoast Guard should propose to the IMO that itdevelop standards for integrated bridge systemdesign that will require:multiple independent positionreceiverinputs;monitoring position-receiver datafor failures/invalid data and subsequentpositive annunciation to thecrew;comparing position-receiver data for

significant discrepancies betweenposition receivers, and subsequentpositive annunciation to the crew;andFMEAs during the design processand once again when all peripheraldevices and equip-ment details havebeen “frozen” if the FMEA duringthe design process does not accountfor all peripheral device/equipmentvariations.The Safety Board also believes that STNAtlas should recommend that all of its customershave final FMEAs for their installations,because overall integrated bridge system andperipheral device installation details frequentlyvary from installation to installation.Further, the Safety Board believes that, inthe interim, the ICCL, the International Chamberof Shipping, and INTERTANKO shouldrecommend that each of their members ensurethat their existing and new integrated bridgesystems incorporate the following:multiple independent positionreceiverinputs;monitoring position-receiver datafor failures/invalid data and subsequentpositive annunciation to thecrew;comparing position-receiver data forsignificant discrepancies betweenposition receivers, and subsequentpositive annunciation to the crew;andFMEAs on existing systems, duringthe design process for new systems, and whenever peripheral devices orequipment details change.Human Systems IntegrationIt is apparent that the marine industry is undergoingthe same evolution in automation thatthe aviation and other transportation industriesare. Accidents involving automated systems,like the grounding of the Royal Majesty, highlightthe importance of considering the abilitiesof the human operator in automated systems.Rothblum et al. concluded:Automation is becoming more prevalenton commercial ships, affecting such areasas engineering, bridge, and cargooperations. When designed properly andused by trained personnel, such automationcan be helpful in improving operationalefficiency and safety. However,when designed poorly or misusedby undertrained or untrained personnel,

automated equipment can be a contributingcause to accidents. In one study of100 marine casualties, inadequateknowledge about equipment was foundto be a contributing cause in 35 percentof the casualties. The most frequentlycited problem was the misuse or nonuseof radar. Lack of training is not the onlyproblem. Poor equipment design can inducethe mariner to make mistakes. Inthe same study, one-third of the accidentswere found to be caused partly bypoor human-factors design of theequipment.55

Inadequate training and poor human-factorsdesign are often the result of applying a technology-centered philosophy to automated systems.56 This approach seeks to replace marinerfunctions with machine functions without consideringthe mariners’ capabilities and limita tions. As a result, the approach has the effect ofleaving the mariner out of meaningful control oractive participation in the operation of the ship.A human-centered philosophy towards automationrecognizes that the mariner is the centralelement in the operation of the ship. Consequently,the philosophy emphasizes designs thatfully utilize human capabilities and protectagainst human limitations, such as unreliablemonitoring and bias in decisionmaking.Human systems integration (HSI), part ofthe systems engineering57 process addressingthe psycho-social aspects of system design, representsa method by which automation can bedesigned with a human-centered philosophy.HSI addresses such areas as human-factors engineering,58 training, manpower, and personnel.The types of human engineering analyses associatedwith HSI (i.e., task analysis, and erroranalysis) help us to understand the impact ofautomation on human tasks and on the entiresystem’s performance.Several standards and guidelines have beenproduced to ensure that human factors are addressedin system designs, thus reducing thepotential for human error. These standards addressbehaviors related to automation and specifydesign parameters that keep the systems’operating characteristics within the physical andcognitive capabilities of humans. The U.S. Departmentof Defense and the National Aeronauticsand Space Administration have long recognizedthe importance of addressing human factorsearly in the system design, development,and overall acquisition processes and have publishedrelevant human engineering standards and

guidelines.59

Other sectors of the maritime industry haveincorporated human-factors engineering routinely.For example, the American Society ofTesting and Materials has adopted much of theDepartment of Defense human engineeringstandards in designing off-shore oil platforms.60

Thus, while human engineering is a known conceptin the marine industry, there have not beenany unifying efforts to integrate this conceptinto the marine engineering and manufacturingsector. Additionally, human engineering in thebroader context of HSI has been given little orno consideration. Consequently, the potentialfor error causing behavior related to these systemshas not been adequately addressed by themarine industry.To assess the HSI involved in the automatedsystems on the Royal Majesty, the Safety Boardexamined the training the officers received andthe design of the automated systems in the contextof human-factors engineering.Watch Officers’ Training in Using the IntegratedBridge System.—The investigationdetermined that although the manufacturer ofthe NACOS autopilot, STN Atlas, had classroomand simulator training available to purchasersof the system, the owner of the RoyalMajesty had not purchased any training. Whenthe vessel was placed in service, the manufacturerprovided an orientation during sea trials tothe first complement of officers assigned to theship; however, of the officers on the Royal Majestyat the time of the grounding, only the chiefofficer had been a part of that complement.The investigation determined that the watchofficers on the Royal Majesty during thegrounding were familiar with the basic operationof the automated navigation equipment, butthat no one, with the possible exception of thenavigator, appeared to be fully proficient withthe system, as evidenced by the lack of knowl edge about the GPS receiver’s DR mode capability.The crew’s automated navigation equipmenttraining consisted primarily of on-the-jobtraining, the type of training on which the marineindustry has historically relied. For example,the second officer’s preparation to operatethe automated navigation system was describedas him reading the equipment manuals acquiredwith the system installation, observing bridgeoperations by the other officers, and using theequipment under their supervision. Because thesecond officer’s introduction to the system consistedof watching others or operating the systemhimself during routine conditions, he

probably had very little experience in recognizingand coping with system malfunctions.The Safety Board has long supported onthe-job training as an important aspect of an operator’straining. However, with the implementationof sophisticated, automated navigationalequipment, the Safety Board believes that onthe-job training alone may not be sufficient. TheSafety Board is particularly concerned that therewere no procedures to determine the proficiencyof the officers in operating the automated navigationsystem, including the navigator who, accordingto his testimony, was responsible for allinstruments on the bridge and the orientationand training of new officers. The Safety Boardconcludes that the on-the-job training programemployed by Majesty Cruise Line to train theRoyal Majesty’s watch officers in the operationof the integrated bridge system did not adequatelyprepare the officers to identify and respondto system malfunctions. Therefore, theSafety Board believes that Majesty Cruise Lineshould provide initial and recurrent formaltraining on essential technical information,equipment functions, and system operating proceduresto all bridge watchstanding personnelon all of its ships that are equipped with integratedbridge systems. The Safety Board alsobelieves that the ICCL should encourage itsmembers to take the same steps.As discussed earlier, the watch officers, inparticular the second officer and the chief officer,abandoned the good watchstanding practicesof properly monitoring and cross checkingthe progress of their vessel and instead reliedalmost solely on the GPS and the ARPA displayto provide them with information about the vessel’smovements. The circumstances of thegrounding of the Royal Majesty and the discussionsat the Safety Board’s public forum suggestthat there is a need for the international maritimecommunity to address the issue of improvingtraining for deck officers assigned to vesselsequipped with electronic navigation equipmentand integrated bridge systems. The Safety Boardis concerned that the inadequacy of traininggiven to the crew of the Royal Majesty in theuse of sophisticated electronic navigationequipment and integrated bridge systems may betypical of the industry. Therefore, the SafetyBoard believes that the Coast Guard should proposeto the IMO that it develop appropriate performancestandards for the training of watchofficers assigned to vessels equipped with sophisticatedelectronic navigation equipment and

integrated bridge systems and then require thistraining.The deficient monitoring of the integratednavigation system by the deck officers and thesecond officer’s failure to recognize the dangerto the Royal Majesty before the grounding pointto the usefulness of training in bridge resourcemanagement. As shown by its issuance of SafetyRecommendations M-93-18, and -19, the SafetyBoard has advocated such training for deck officerswho operate conventional navigationbridges. The grounding of the Royal Majesty,however, shows the need to address proceduresfor and training in effective monitoring of automatednavigation equipment.Bridge resource management trainingadapted for watch officers working with fullyautomated navigation systems or integratedbridge systems could improve the officers’ performance.The training would help them makedecisions that are not biased by their use ofautomated equipment. It would improve theirsituational awareness,61 which, research shows,62 declines when operations are automated.On June 25, 1993, as a result of its investigationof the grounding of the United Kingdompassenger vessel RMS Queen Elizabeth 2 (nearCuttyhunk Island, Vineyard Sound, Massachusetts,on August 7, 1992, the Safety Board issuedSafety Recommendations M-93-18 and -19to the Coast Guard. The Safety Board requestedthat the Coast Guard:Propose to the IMO that standards andcurricula be developed for bridge resourcemanagement training for themasters, deck officers, and pilots ofocean-going ships. (M-93-18)Propose to the IMO that the masters,deck officers, and pilots of ocean-goingships be required to successfully completeinitial and recurrent training inbridge resource management. (M-93-19)On September 27, 1993, responding toSafety Recommendation M-93-18, the CoastGuard Commandant wrote:I partially concur with this recommendation.The U.S. will propose at the25th Session of the IMO Subcommitteeon STW that standards and curricula bedeveloped for bridge resource managementtraining for masters and deck officersof seagoing ships. However, theCoast Guard views pilot qualificationsas a matter for port State regulation. Iwill keep the Board informed of ourprogress regarding this recommendation.

On January 7, 1994, the Safety Board responded:

The Safety Board agrees that, in theend, pilot qualifications are a matter forthe port State to enforce. The intent ofthe recommendation is for the IMO todevelop a specified standard that wouldserve as a model that the port Statescould adopt. The United States has recentlybeen more receptive to the ideaof developing a unilateral standard if itis included in the Standards of Trainingand Watchkeeping. Consequently, theBoard encourages the Coast Guard topursue this issue at the IMO. Becausethe Coast Guard states it will proposethe recommendation to the IMO, SafetyRecommendation M-93-18 has beenclassified “Open--Acceptable Response,”pending implementation by theIMO.On September 27, 1993, responding toSafety Recommendation M-93-19, the CoastGuard Commandant wrote:I partially concur with this recommendation.The United States will proposethat IMO agree in principle to requiringmasters and deck officers on seagoingships to complete initial and recurrenttraining in bridge resource management.However, the Coast Guard views pilotqualifications as a matter for port Stateregulation. I will keep the Board informedof our progress regarding thisrecommendation.On January 7, 1994, the Safety Board respondedthat for the reasons stated in the discussionof Safety Recommendation M-93-18, theSafety Board encouraged the Coast Guard toactively promote the IMO’s acceptance ofSafety Recommendation M-93-19. Because theCoast Guard had agreed to “proposing in principle”the recommendation, the Board classifiedSafety Recommendation M-93-19 “Open--Acceptable Alternate Response,” pending theoutcome of the Coast Guard’s efforts.Therefore, the Safety Board reiteratesSafety Recommendations M-93-18 and -19 andurges the Coast Guard to work closely with theIMO in order to expedite the intended outcomeof these recommendations.The Safety Board also believes that theCoast Guard, as part of the foreign flag passengership control verification examination program,

should assess the adequacy of installedintegrated bridge systems and verify that theships’ officers are properly trained in their operationand possible failure modes. Furthermore,as part of the same program, the Coast Guardshould verify that the watchstanding proceduresof ships’ officers include the use of multipleindependent means of position verification.Human-factors Engineering.—Where multiplemodes of operation are possible on a system,an important human-factors engineeringprinciple is the clear delineation to the operatorof what mode is in use and of when a change inmode occurs. Because different operating proceduresmay be required for the different modesin use, the operator must be aware of the modeto remain in the decisionmaking process. Thus,the display of which modes and functions are inuse should be clearly evident to the operator.A good example of automation mode confusionoccurred on January 20, 1992, when an AirInter Airbus A320 crashed on a mountainsidewhile on approach to the Strasbourg-EntzheimAirport. The French Transport Ministry’s investigationdetermined that the pilots had becomeconfused with the vertical speed/flightpath angle display mode on the A320’s flightcontrol unit and had entered a 3,300 foot/minuteautomatic rate of descent instead of an intended3.3 angle of descent to the airport. The displaysof the vertical speed and the flight path anglewere almost identical and thus easily confused.Not only did the GPS receiver on the RoyalMajesty display the DR coordinates in the samecharacter size and format as the coordinates derivedfrom satellite data, it switched to the DRmode automatically, without requiring a humanto acknowledge that the mode was acceptable.However, as previously discussed, deficienciesin the alarm, the distance of the receiver fromthe operator, and the inadequacy of the crew’sprocedures also contributed to the crew’s failureto recognize the change to DR mode. The size of characters, the viewing distance,and the use of contrasting colors are a few of thefactors that should be considered in designingcharacter displays for alerts and warnings. Alertmessages and status indicators about criticalinformation, such as the GPS defaulting to theDR mode, should be distinctively displayed. Inthis case, the SOL and DR alert messages weremuch smaller than the normal status information.An operator may also become desensitizedwhen an alert appears frequently with normalstatus information. In this case, whenever choppingoccurred, SOL and DR were displayed. The

watch officers had noticed these messages manytimes before and perhaps had learned to pay littleattention to them.The Safety Board concludes that the RoyalMajesty’s integrated bridge system had severalshortcomings with respect to human-factors engineering.First, mode information was notavailable to the crew at the central console (thenormal position). Second, the GPS/DR alarmand status indicators, which could have alertedthe crew to the mode change, were either notinstalled (external alarm) or not salient enough(internal alarm) to attract the watchstanders’attention. Finally, the integrated bridge systemas implemented on the Royal Majesty failed toadequately define the watch officers’ tasks andprocedures. If the automation on board theRoyal Majesty had been appropriately implementedand integrated with the human operator,the vessel probably would not have grounded.Because of the Safety Board’s concern thatautomation on other vessels has not been appropriatelyimplemented and integrated with thehuman operator, the Board believes that theCoast Guard should propose to the IMO that itapply existing human-factors engineering standardsin the design of integrated bridge systemson vessels.Certification of Integrated Bridge SystemsA draft IMO performance standard for integratedbridge systems is currently under reviewand is expected to be adopted and implementedby 1999. At the Safety Board’s public forum onintegrated bridge systems, manufacturers of integratedbridge systems pointed out that integratingthe various components like ARPA,autopilot, electronic chart system (or radarmap), and monitoring systems involves carefulmatching and FMEAs to eliminate any potentialinterface problems. The recently developed interfacestandards from the IEC and the NMEA(IEC 1162-2 and NMEA 0183) should facilitatethe matching of subsystems manufactured byone manufacturer to an integrated bridge systemmanufactured by another. These standards andan IMO performance standard should eliminatemany of the potential interface problems. TheSafety Board concludes that there is a need tohave performance standards for integratedbridge systems, and to require that the systemsbe inspected and certified.The proposed IMO performance standardfor integrated bridge systems includes a requirementthat the manufacturers of integratedbridge systems be certified by the ISO. Thus, it

would appear that the safeguards for guaranteeingthe quality of software during manufacturinglikely will become an IMO requirement. Such arequirement could ensure that the people responsiblefor developing the software are wellqualified and that the manufacturer has proceduresfor verifying the quality of the software.Developments in electronic equipment,however, are very rapid, and it is sometimespossible for developments to occur more quicklythan standards can be produced. Further, thepossibility exists that software may be changed,possibly inappropriately, during the life of anintegrated bridge system. Therefore, the selectionand matching of electronic equipment willstill require highly qualified personnel who arefamiliar with the equipment, the data to betransmitted, the format of the data, and the applicablestandards. The Safety Board believesthat there is a need for some competent authorityto conduct continuing oversight to ensurethat future changes in subsystems or software onintegrated bridge systems are compatible andthat system integrity is maintained. Also, theSafety Board believes that certifying navigationbridges equipped with integrated bridge systemsshould be done by a qualified, independentauthority. In summary, the Safety Board believesthat the Coast Guard should propose tothe IMO that a provision be included in the performancestandard for integrated bridge systemsthat would require that a competent independentauthority inspect and certify the navigationbridge of each commercial vessel equipped withan integrated bridge system when the system isinstalled and periodically throughout its life.

CONCLUSIONS1. The weather, the mechanical condition ofthe Royal Majesty, except for the global positioningsystem receiver, the officers’ certifications,drugs, and fatigue were not factorsin the accident.2. Although Coast Guard personnel observedno indications that the officers had been underthe influence of alcohol, alcohol couldnot be conclusively ruled out as a factor inthe accident because of the delay in collectingthe blood and urine specimens.3. About 52 minutes after the Royal Majestyleft St. George’s, Bermuda, the global positioningsystem receiver antenna cable connectionhad separated enough that the globalpositioning system switched to deadreckoningmode, and the autopilot, not programmedto detect the mode change and invalidstatus bits, no longer corrected for theeffects of wind, current, or sea.4. Openly routing the global positioning systemantenna cable in an area where someoneoccasionally walked increased the risk ofdamage to the cable and related connectors.5. Had the fathometer alarm been set to 3 meters,as was the stated practice, or had thesecond officer chosen to display thefathometer data on the control console, hewould have been alerted that the Royal Majestywas in far shallower water than expectedand, thus, was off course. He wouldhave been alerted perhaps as long as 40minutes before the grounding, and thesituation could have been corrected.6. The watch officers’ monitoring of the statusof the vessel’s global positioning systemwas deficient throughout the voyage fromSt. George’s.7. Deliberate cross checking between theglobal positioning system and the Loran-Cto verify the Royal Majesty’s position wasnot being performed and should have beenon the voyage from St. George’s.8. Even though it is likely that the watch officerswere not aware of the limitation inherentin using the position-fix alarm to monitorthe accuracy of GPS position data, it wasinappropriate for them to rely solely on thealarm to warn them of any problems withthe GPS data.9. The sighting of lights not normally observedin the traffic lanes, the second officer’s inabilityto confirm the presence of the BBbuoy, and the sighting of blue and white

water should have taken precedence overthe automation display on the central consoleand compelled the second officer topromptly use all available means to verifyhis position.10. The chief officer and the second officer didnot observe good watchkeeping practices oract with heightened awareness of the precautionsthat are needed when a vessel approachesthe Boston traffic lanes and landfall.11. The master’s methods for monitoring theprogress of the voyage did not account forthe technical capabilities and limitations ofthe automated equipment.12. The watch officers on the Royal Majestymay have believed that because the globalpositioning system had demonstrated sufficientreliability over 3 1/2 years, the traditionalpractice of using at least two independentsources of position information wasnot necessary.13. All the watchstanding officers were overlyreliant on the automated position display ofthe navigation and command system 25 andwere, for all intents and purposes, sailingthe map display instead of using navigationaids or lookout information.

14. Because the industry standard 0183 dataprotocol did not provide a documented orstandardized means of communicating orrecognizing that a dead-reckoning positioningmode was in use by a hybrid, dead reckoningcapable position receiver, Raytheonand STN Atlas adopted different designphilosophies about the communication ofposition-receiver mode changes for theRaytheon 920 global positioning system andthe navigation and command system 25.15. STN Atlas should have, in order to help ensuresafety and compatibility with differentNational Marine Electronics Association(NMEA) 0183 position receivers, programmedthe Royal Majesty’s navigationand command system 25 to recognize thevalid/invalid status bits in the NMEA 0183data, including those specified in the NMEA0183 v1.5 RMC recommended minimumglobal positioning system data sentence.16. Had the navigation and command system 25autopilot been configured to compare positiondata from multiple independent positionreceivers and had a corresponding alarmbeen installed that activated when discrepancieswere detected, the grounding of the

Royal Majesty may have been avoided.17. Because watch officers must verify properequipment operation frequently, alternativesources of critical equipment status shouldhave been displayed directly on the consoleor on repeaters located where they could beseen from the central console.18. The brief aural alarm of the Raytheon 920global positioning system receiver, the remotenessof the receiver’s location, and thefailure of the installer to connect the globalpositioning system external alarm resultedin the inadequacy of the aural warning sentto the crew when the global positioningsystem defaulted to the dead-reckoningmode.19. Failure modes and effects analyses of theRoyal Majesty’s integrated bridge systemwould probably have disclosed the shortcomingsof the system’s components.20. The on-the-job training program employedby Majesty Cruise Line to train the RoyalMajesty’s watch officers in the operation ofthe integrated bridge system did not adequatelyprepare these officers to identifyand respond to system malfunctions.21. The Royal Majesty’s integrated bridge systemdid not adequately incorporate humanfactorsengineering.22. There is a need to have performance standardsfor integrated bridge systems, and torequire that the systems be inspected andcertified.

PROBABLE CAUSEThe National Transportation Safety Boarddetermines that the probable cause of thegrounding of the Royal Majesty was the watchofficers’ overreliance on the automated featuresof the integrated bridge system, Majesty CruiseLine’s failure to ensure that its officers wereadequately trained in the automated features ofthe integrated bridge system and in the implicationsof this automation for bridge resourcemanagement, the deficiencies in the design andimplementation of the integrated bridge systemand in the procedures for its operation, and thesecond officer’s failure to take corrective actionafter several cues indicated the vessel was offcourse.Contributing factors were the inadequacy ofinternational training standards for watchstandersaboard vessels equipped with electronicnavigation systems and integrated bridge systemsand the inadequacy of international standardsfor the design, installation, and testing ofintegrated bridge systems aboard vessels.

RECOMMENDATIONSAs a result of its investigation of this accident,the National Transportation Safety Boardreiterates the following recommendations:To the U.S. Coast Guard:Propose to the International MaritimeOrganization that standards and curriculabe developed for bridge resourcemanagement training for the masters,deck officers, and pilots of ocean-goingships. (M-93-18)Propose to the International MaritimeOrganization that the masters, deck officers,and pilots of ocean-going ships berequired to successfully complete initialand recurrent training in bridge resourcemanagement. (M-93-19)Also as a result of the investigation, the NationalTransportation Safety Board makes thefollowing recommendations:To Majesty Cruise Line:Provide initial and recurrent formaltraining on essential technical information,equipment functions, and systemoperating procedures to all bridgewatchstanding personnel on all its shipsthat are equipped with integrated bridgesystems. (M-97-1)Review the bridge watchstanding practiceson all its vessels, and revise, asnecessary, to ensure that all watch officersadhere to sound watchstandingpractices and procedures, including usinglandmarks, soundings, and navigationalaids to verify a vessel’s position,relying on more than one source for positioninformation, and reporting to themaster any failure to detect importantnavigational aids. (M-97-2)Periodically review the performance ofall officers on board its vessels.(M-97-3)Eliminate the practice of openly routingnavigation equipment cable to decreasethe risk of damage. (M-97-4)To the U.S. Coast Guard:Propose to the International MaritimeOrganization that it develop appropriateperformance standards for the trainingof watch officers assigned to vesselsequipped with sophisticated electronicnavigation equipment and integratedbridge systems and then require thistraining. (M-97-5)Propose to the International Maritime

Organization that it develop standardsfor integrated bridge system design thatwill requiremultiple independent positionreceiverinputs;monitoring position-receiver datafor failures/invalid data and subsequentpositive annunciation to thecrew;comparing position-receiver data forsignificant discrepancies betweenposition receivers, and subsequentpositive annunciation to the crew;andfailure modes and effects analyses(FMEAs) during the design processand once again when all peripheraldevices and equipment details havebeen “frozen” if the FMEA duringthe design process does not accountfor all peripheral device/equipmentvariations. (M-97-6)Propose to the International MaritimeOrganization that it apply existing human-factors engineering standards in thedesign of integrated bridge systems onvessels. (M-97-7) Propose to the International MaritimeOrganization that a provision be includedin the performance standard forintegrated bridge systems that would requirethat a competent independentauthority inspect and certify the navigationbridge of each commercial vesselequipped with an integrated bridge systemwhen the system is installed andthroughout its life. (M-97-8)Continue its research on shipboardautomation, focusing on watch officers’monitoring and decisionmaking aboardships with automated integrated bridgesystems. (M-97-9)As part of the foreign flag passengership control verification examinationprogram, assess the adequacy of installedintegrated bridge systems andverify that the ships’ officers are properlytrained in their operation and possiblefailure modes. (M-97-10)As part of the foreign flag passengership control verification examinationprogram, verify that the watchstandingprocedures of ships’ officers include theuse of multiple independent means ofposition verification. (M-97-11)To STN Atlas Elektronik GmbH:

Design its integrated bridge systems toincorporate multiple independent positionreceivers, comparison of positiondata from those receivers, and relatedcrew alerts regarding changes in position-receiver accuracy, selection, andmode. (M-97-12)Recommend that all its customers havefinal failure modes and effects analysesfor their integrated bridge system installations.(M-97-13)To Raytheon Marine:Design its hybrid positioning systems toidentify themselves as integrated instruments(II) with an appropriate systemmode identifier (SYS) in coordinationwith the National Marine ElectronicsAssociation. (M-97-14)Design its position receivers to providecontinuous aural alarms that require theuser to take action to silence them.(M-97-15)To the National Marine Electronics Association:Revise the 0183 electronic interfacestandard to provide an explicit means ofindicating when hybrid position receiversare transmitting dead reckoningderivedposition data. (M-97-16)Advise its members to (1) immediatelyinform the National Marine ElectronicsAssociation and the International ElectrotechnicalCommission of perceivedinadequacies in electronic interfacestandards and (2), if applicable, designtheir hybrid positioning systems toidentify themselves (“talk”) as integratedinstruments (II) with an appropriatesystem mode identifier (SYS).(M-97-17)Recommend to its members that theydesign and install critical aural alarmsthat are continuous and require the userto take action to silence them.(M-97-18)To the International Electrotechnical Commission:Advise its members to (1) immediatelyinform the National Marine ElectronicsAssociation and the International ElectrotechnicalCommission of perceivedinadequacies in electronic interfacestandards and (2) if applicable, designtheir hybrid positioning systems toidentify themselves (“talk”) as integratedinstruments (II) with an appropriatesystem mode identifier (SYS).

(M-97-19)Revise the 1162 electronic interfacestandard to provide an explicit means ofindicating when hybrid position receiv ers are transmitting dead reckoningderivedposition data. (M-97-20)To the International Council of Cruise Lines:Recommend that its members provideinitial and recurrent formal training onessential technical information, equipmentfunctions, and system operatingprocedures to all bridge watchstandingpersonnel on their ships that areequipped with integrated bridge systems.(M-97-21)Recommend that its members reviewthe bridge watchstanding practices onall their vessels, and revise as necessaryto ensure that all watch officers adhereto sound watchstanding practices andprocedures, including using landmarks,soundings, and navigational aids to verifya vessel’s position, relying on morethan one source for position information,and reporting to the master anyfailure to detect important navigationalaids. (M-97-22)Recommend that its members periodicallyreview the performance of all officerson board their vessels. (M-97-23)Recommend that its members eliminatethe practice of openly routing navigationequipment cable to decrease therisk of damage. (M-97-24)Recommend to its members that theyensure that integrated bridge systems installedon their vessels provide criticalaural alarms that are continuous and requirethe user to take action to silencethem. (M-97-25)Recommend that its members ensurethat their existing and new integratedbridge systems incorporate the following:multiple independent positionreceiverinputs;monitoring position-receiver datafor failures/invalid data and subsequentpositive annunciation to thecrew;comparing position-receiver data forsignificant discrepancies betweenposition receivers, and subsequentpositive annunciation to the crew;andfailure modes and effects analyseson existing systems, during the design

process for new systems andwhenever peripheral devices orequipment details change.(M-97-26)To the International Chamber of Shippingand to the International Association of IndependentTanker Owners:Recommend to its members that theyensure that integrated bridge systems installedon their vessels provide criticalaural alarms that are continuous and requirethe user to take action to silencethem. (M-97-27)Recommend that its members ensurethat their existing and new integratedbridge systems incorporate the following:multiple independent positionreceiverinputs;monitoring position-receiver datafor failures/invalid data and subsequentpositive annunciation to thecrew;comparing position-receiver data forsignificant discrepancies betweenposition receivers, and subsequentpositive annunciation to the crew;and failure modes and effects analyseson existing systems, during the designprocess for new systems andwhenever peripheral devices orequipment details change.(M-97-28)

APPENDIX AINVESTIGATIONAbout 2225 on June 10, 1995, the Panamanian passenger ship Royal Majesty, carrying 1,509 passengersand crewmembers, grounded on Rose and Crown Shoal about 10 miles east of Nantucket Island,Massachusetts.The Safety Board was notified of the grounding early on June 11, 1995. On Monday morning (June12th), a Go-Team (an investigator-in-charge, an operations specialist, and, later, an aerospace engineer)were dispatched to the scene. When the team arrived on board the vessel, it had already proceeded toBoston. However, because the accident occurred in international waters, beyond the 3-mile limit, theSafety Board lacked jurisdiction to investigate. The Board then requested and was given permission bythe Coast Guard to participate as a party in interest at the Coast Guard Marine Board of Inquiry.Sworn testimony was taken in Boston, Massachusetts, from June 13 through June 16, 1995. Becausethe Safety Board was participating as a party in interest, the scope of its investigation into the accidentwas limited to the information obtained from the Coast Guard Marine Board. The Board did not have theauthority to depose individuals and subpoena important records.The Safety Board has considered all facts in the investigative record that are pertinent to the Board’sstatutory responsibility to determine the probable cause of this accident and to make recommendations.This report is based on the information collected and the analyses made during the Safety Board’s investigation

55APPENDIX BMAJESTY CRUISE LINE’SROYAL MAJESTY’S “BRIDGE PROCEDURES GUIDE”The purpose of this guide is to provide you with a description of day-to-day Bridge procedures thatare recognized as good practice and to promote through them safety of the Royal Majesty, her passengersand crew. This guide is posted on the Bridge so that you may keep yourselves thoroughly familiar withits content which is not written in an arbitrary manner but with sincere wish that you will understandyour responsibilities and perform your duties in a professional manner.The officer on watch is my representative, and your primary responsibility at all times is the safenavigation of the vessel. You must at all times comply with the 1972 International Regulations for PreventingCollisions At Sea.You should keep your watch on the Bridge, which you should in no circumstances leave until properlyrelieved. A prime responsibility of the Officer on Watch is to ensure the effectiveness of the navigatingwatch. It is of essential importance that all times you ensure that an efficient lookout is maintained.You may visit the chart room, when essential, for short periods for the necessary performance ofyour navigational duties, but you should previously satisfy yourself that it is safe to do so and ensure thata good lookout is kept.You continue to be responsible for the safe navigation of the vessel despite my presence on theBridge until I inform you specifically that I have assumed responsibility.You should not hesitate to use the sound signaling apparatus at your disposal in accordance with the1972 International Regulations for Preventing Collisions At Sea.You are responsible for the maintenance of a continuous and alert lookout. This is the most importantconsideration in the avoidance of casualties. The keeping of an efficient lookout requires to be interpretedin its fullest sense which includes the following: A) An alert all round visual and aural lookout toensure a full grasp of the current situation including the presence of ships and landmarks in the vicinity.B) Close observation of the movements and compass bearing of approaching vessels. C) Identification ofships and shore lights. D) The need to ensure that the course is steered accurately and that wheel ordersare correctly executed. E) Observation of the radar and echo sounder displays. F) Observation of changesin the weather, especially the visibility.You should bear in mind that the engines are at your disposal. You should not hesitate to usethem in case of need. However, timely notice of engine movements should be given when possible. Youshould also keep prominently in mind the maneuvering capabilities of this ship, including its stoppingdistances.CONTROL OF MAIN ENGINES: There are two aspects with which you are mainly concerned:(A) Control of revolutions and pitch ahead and astern. You should be familiar with the operation of theengine/propellers control mechanism, bow thrusters, and rudders.CHANGING OVER THE WATCH: The relieving officer on watch should ensure that members ofhis watch are fully capable of performing their duties and, in particular, that they are adjusted to nightvision. You should not take over the watch until your vision is fully adjusted to the light conditions andyou have personally satisfied yourself regarding: A) Standing orders and other special instructions relatingto the navigation of the vessel. B) The position, course, speed, and draught of the vessel. C) Prevailing

and predicted tides, currents, weather, visibility, and the effect of these factors upon course and speed. D) The navigational situation including: i) The operational condition of all navigation and safetyequipment. ii) Errors of gyro and magnetic compasses. iii) The movement of vessels in the vicinity. iv)Conditions and hazards likely to be encountered during the watch. v) The possible effects of heel, trim,water density, and squat on under keel clearances. If at any time you are to be relieved, a maneuver orother action to avoid any hazard is taking place, your relief should be deferred until such action is completed.You should not hand over the watch to the relieving officer if you have any reason to believe thatthe latter is under any disability which would preclude him from carrying out his duties effectively. If indoubt, you should inform me at once.You should make regular checks to ensure that: A) The helmsman or the autopilot is steering the correctcourse. B) The standard compass error is established at least once a watch and, when possible, afterany major alteration of course. C) The standard and gyro compasses are compared frequently and repeaterssynchronized. D) The automatic pilot is tested in the manual position at least once a watch. E) Thenavigation and signal lights and other navigation equipment are functioning properly.HELMSMAN/AUTOMATIC PILOT: You should bear in mind the need to station the helmsmanand change over the steering to manual control in good time to allow any potentially hazardous situationto be dealt within a safe manner. With a vessel under automatic steering, it is highly dangerous to allow asituation to develop to the point where you are without assistance and have to break the continuity of thelookout in order to take emergency action. The change-over from automatic to manual steering and visaversa should be made by or under the supervision of a responsible officer.NAVIGATION IN COASTAL WATERS: The largest scale chart on board, suitable for the areaand corrected with the latest information, should be used. You should identify positively all relevantnavigation marks. Fixes should be taken at intervals whose frequency must depend upon factors such asdistance from nearest hazard, speed of ship, set experienced, etc. In cases such as a planned approach toan anchor berth or harbor entrance, fixing may be virtually continuous.RESTRICTED VISIBILITY: When restricted visibility is encountered or suspected, your first responsibilityis to comply with 1972 International Regulations for Preventing Collisions At Sea with particularregard to the sounding of fog signals, use of safe speed and availability of engines for immediatemaneuver. In addition you should A) Inform me. B) Post lookout(s), helmsman and in congested areas,revert to hand-steering immediately, C) Exhibit navigation lights. D) Operate and use the radar. All of theabove actions should, if possible, be taken in good time before visibility deteriorates.CALLING THE MASTER: You should notify me immediately under the following circumstances:A) If visibility is deteriorating. B) If the movements of other vessels are causing concern. C) If difficultyis experienced in maintaining course. D) On failure to sight land or a navigation mark or to obtain asounding by the expected time. E) If either land or a navigation mark is sighted or a marked change in thesoundings occurs unexpectedly. F) On the breakdown of the engines, steering gear, or any other essentialnavigational equipment. G) If any doubt about the possibility of weather damage. H) In any other situation

in which you are in doubt. Despite the requirement to notify me immediately in the foregone circumstances,you should not hesitate to take immediate action for the safety of the ship, where circumstancesso require.NAVIGATION WITH PILOT EMBARKED: The presence of a pilot does not relieve you fromyour duties and obligations. You should cooperate closely with the pilot and maintain an accurate checkon the vessel’s position and movements. Alterations of course and/or changes in wheel and/or engineorders should be transmitted through you. If you are in any doubt as to the pilot’s actions or intentions,you should seek clarification from the pilot and, if still in doubt, notify me immediately and take whateveraction is necessary before I arrive.THE WATCHKEEPING PERSONNEL: You should give watchkeeping personnel all appropriateinstructions and information which will remove the keeping of a safe watch, including a proper lookout.SHIP AT ANCHOR: If I consider it necessary, a continuous navigational watch should be maintainedin such circumstances, you should: A) Determine and plot the vessel’s position on the appropriatechart as soon as possible and, at sufficiently frequent intervals, check by taking bearings of fixed navigationalmarks, or readily identifiable shore objects, whether the anchor is holding. B) Ensure that an effectivelookout is maintained. C) Ensure that an inspection of the vessel is made periodically. D) Observeweather, tidal, and sea conditions. E) Notify me and undertake all necessary measures if the vessel drags.F) Ensure that the state of readiness of the main engines and other machinery is in accordance with myinstructions. G) Notify me if visibility deteriorates and comply with the 1972 International Regulationsfor Preventing Collisions at Sea. H) Ensure that the vessel exhibits the appropriate lights and shapes andthat appropriate sound signals are made at all times.In conclusion, I will always be available to you for advice you may need and I hope that you will atall times endeavor to do your utmost for the benefit of all on board.STRICT ATTENTION TO DUTY HAS ITS AWARDS.MASTERM/V Royal Majesty

APPENDIX CMAJESTY CRUISE LINE’S CIRCULAR NO. 9

APPENDIX DPOSTACCIDENT TESTING OF GPS RECEIVER AND ANTENNAThe Raytheon RAYSTAR 920 Global Positioning System (GPS) receiver and antenna used fornavigation during the grounding of the Royal Majesty were tested at Raytheon headquarters on July 6,1995.1 Present for the tests were representatives from the National Transportation Safety Board, RaytheonMarine, and Majesty Cruise Line. A new Raytheon RAYSTAR 920 GPS receiver and antenna,randomly removed from Raytheon stock, were first tested to establish a baseline for functionality andperformance. The Raytheon GPS receiver and antenna from the Royal Majesty were then tested for comparison.Speed log and gyro compass inputs from bench test equipment were used to simulate dead reckoning(DR) data inputs when necessary. The test results follow:The Raytheon RAYSTAR 920 GPS receiver and antenna from the Royal Majesty functionedper design and in a like manner to that of a new Raytheon RAYSTAR 920 GPS receiver andantenna.An “open” in the GPS antenna cable shield wire, such as would result if the shield wirepulled out of any connector leading to the antenna, results in the GPS receiver going into theSOL and DR modes within 2 to 3 seconds of the “open” being established, regardless ofwhether speed/course data are being input to the GPS receiver.As few as 1 to 3 strands of GPS antenna cable shield wire permit continued operation of theantenna pre-amp and, therefore, system functionality.As long as the Raytheon 920 GPS receiver’s internal audio alarm function is active (user selectable;“ON” in the case of the Royal Majesty’s unit), going from a satellite fix condition tothe SOL and DR modes results in a brief (<1 second) audio alarm chime (similar to a wristwatchalarm in volume and tone).As long as the Raytheon 920 GPS receiver’s external alarm function is active (user selectable),going from a satellite fix condition to the SOL and DR modes results in a continuousclosing of the external alarm contacts (which could be used to wire up external or remoteaudio alarms of various forms).When satellite data input is removed from the operating Raytheon 920 GPS receiver andspeed/course data (e.g., DR data) are available, a single audio alarm chime is emitted, and thereceiver continues to output NMEA 0183 v1.5 data, with the LAT/LONG portion of theNMEA 0183 v1.5 data continuing to update based on the DR data and the last GPS position.When both satellite data and speed/course data (e.g., DR data) inputs are removed from theoperating Raytheon GPS receiver, two brief and separate audio alarm chimes are emitted,and the receiver continues to output NMEA 0183 v1.5 data; but the LAT/LONG portion ofthe NMEA 0183 v1.5 data stay fixed at the last position.An “open” in the antenna cable center conductor results in the GPS receiver going into theSOL and DR modes within 2 to 3 seconds of the “open” being established, regardless ofwhether speed/course data are being input to the GPS receiver.Shorting the antenna cable center conductor to the antenna cable shield wire results in theGPS receiver backlights going off immediately, the SOL and DR modes are immediately displayed,all processor functions stop, and all NMEA 0183 v1.5 data output stops.Whenever the Raytheon RAYSTAR 920 GPS receiver does not have any satellite data from which toobtain a position fix, the receiver switches to the SOL and DR modes, and the satellite status informationscreen indicates the following: no satellites are being tracked no signals are presentfor any of the satellites the degree of precision (DOP) is 0.0Whenever the Raytheon 920 GPS receiver is in SOL and DR modes, the NMEA 0183 v1.5 data outputcontains multiple status indications of DR position data. The Royal Majesty’s Raytheon 920 GPSreceiver and antenna functioned properly during all tests and provided temporary aural and continuousvisual and electrical indications of the SOL and DR status. The electrical indications include the receiver’sexternal alarm contact and NMEA 0183 v1.5 output data, the latter of which contains

valid/invalid position data bits (A = VALID, V = INVALID) within the APA autopilot data sentence andother data sentences.

APPENDIX ESAFETY BOARD’S URGENT SAFETY RECOMMENDATIONSISSUED ON AUGUST 9, 1995M-95-26 and -27 to the U.S. Coast Guard:Immediately recommend that the International Maritime Organization urge its administrationsto advise maritime vessel operators of the circumstances of the Royal Majestygrounding and to encourage the operators to review the design of their integrated bridgesystems to identify potential system and operational failure modes that might result inundetected changes to the autopilot function, and develop modifications as required. (M-95-26)Immediately advise maritime vessel operators of the circumstances of the Royal Majestygrounding and urge them to review the design of their integrated bridge systems with themanufacturer to identify potential system and operational failure modes that might resultin undetected changes to the autopilot function, and develop modifications as required.(M-95-27)Although Safety Recommendation M-95-26 was not officially entered into IMO’s SUBNAV-42 proceedingsbecause of publication approval and time rules, the Coast Guard did distribute numerous copiesof the recommendation, and it was discussed at several of the technical working group sessions. Consequently,Safety Recommendation M-95-26 was classified “Closed—Acceptable Alternate Action” onNovember 14, 1995. In response to Safety Recommendation M-95-27, the Coast Guard published asafety note in the November/December issue of the proceedings of the Marine Safety Council and alsoissued a “Notice to Mariners” advising them to review the operation of their integrated bridge systems toidentify failure modes. As a result, Safety Recommendation M-95-27 was classified “Closed—AcceptableAction” on January 16, 1996.M-95-28 to the International Council of Cruise Lines, the International Chamber of Shipping,the American Institute of Merchant Shipping, and the International Association of IndependentTanker Owners:Immediately advise members of the circumstances of the Royal Majesty grounding andurge those members that operate with integrated bridge systems to review the design oftheir integrated bridge systems for potential system and operational failure modes thatmight result in undetected changes to the autopilot functions.All recipients of Safety Recommendation M-95-28 responded favorably and advised their membersof the circumstances of the Royal Majesty grounding. For the International Chamber of Shipping, therecommendation was classified “Closed—Acceptable Action” on October 27, 1995. For the other threerecipients, the recommendation was classified “Closed—Acceptable Action” on December 12, 1995.M-95-29 to STN Atlas:Immediately inform customers with the NACOS 25 integrated bridge system or similarsystems of the circumstances of the Royal Majesty grounding and review the design andimplementation of their systems to identify potential system and operational failuremodes that might result in undetected changes to the autopilot function.STN Atlas acted promptly and informed all customers of the circumstances of the grounding. Therecommendation was classified “Closed—Acceptable Action” on December 21, 1995.M-95-30 to the National Marine Electronics Association:Immediately advise members of the circumstances of the Royal Majesty grounding andurge members to review their products to identify potential system and operational failuremodes that might result in undetected changes to system functionality, includingchanges in NMEA 0183 position data validity.The recommendation was classified as “Closed—Acceptable Action” on May 6, 1996, followingNMEA’s dissemination of information to all of its member companies.

APPENDIX FPORTIONS OF COAST GUARD TRANSCRIPT OFVHF-FM RADIO TRANSMISSIONS FROM THENANTUCKET SHOAL AREA ON THE EVENING OF JUNE 10, 19952042 fishing vessel (f/v) Sao Marcos [in English]: “Fishing vessel, fishingvessel call cruise boat.”2043 f/v Rachel E [in Portuguese]: “Are you there Toluis [nickname ofTony Sao Marcos]?”f/v Sao Marcos [in Portuguese]: “Yeah, who is this?”f/v Rachel E [in Portuguese]: “It’s Antonio Pimental. Hey, that guy isbad where he is. Don’t you think that guy is wrong in that area.”f/v Sao Marcos [in Portuguese]: “I just tried to call him. He didn’t answerback. He is very wrong.”f/v Rachel E [in Portuguese]: “I’ve been watching him for the last halfhour. He was a big contact on my radar. I picked him up 8 miles away.[source unknown] [in English]: “Channel 16 is a distress channel andthis is international, please change your channel, please change yourchannel.[Portions of the remaining conversation were cut off; however, onesalvageable remark in Portuguese was that f/v Rachel E will try to call thecruise boat.]2045 f/v Rachel E [in English]: “Calling the cruise boat in the position 4102N, 69 24W. Over.”40 sec.Laterf/v Rachel E [in English]: “Calling the cruise boat 41N, 69 24W.Over.”2046 f/v Sao Marcos [in Portuguese]: “Maybe nobody on the bridge ispaying attention.”f/v Rachel E [in Portuguese]: “I don’t know. He is not going the rightway.”[Both vessels say goodbye to each other in Portuguese.]

APPENDIX GABBREVIATIONS AND ACRONYMSARPA: automatic radar plotting aidBoston traffic lanes: Port of Boston Traffic Separation SchemeCFR: Code of Federal RegulationsDNV: Det Norske VeritasDR: dead reckoningFMEA: failure modes and effects analysesGPS: global positioning systemHSI: human systems integrationICCL: International Council of Cruise LinesIEC: International Electrotechnical CommissionIMO: International Maritime OrganizationINTERTANKO: International Association of Independent Tanker OwnersISO: International Standards OrganizationLR: Lloyd’s Register of ShippingNACOS 25: navigation and command systemNAUT-C: optional classification notation developed by DNVNAV: navigation (mode)NAV1: navigation for 1-man bridgeNav O: class notation for ocean areaNav OC: class notation for ocean area/coastal watersNMEA: the National Marine Electronics AssociationSOL: solutionSTN Atlas: STN Atlas ElektronikTC8: Technical Committee 8 of the International Standards Organization (ISO/TC8)TC80: Technical Committee 80 of the International Electrotechnical Commission (IEC/TC80)W1: Watch 1, highest class notation in NAUT-CWG9: working group belonging to the IEC/TC80