Container Ship Struck Key Bridge in Baltimore, Bridge has Collapsed

[chengkp75]

7 minutes ago, Pratique said:

It sounds like an excuse to say there are too many ships so it doesn't make sense to do anything differently. Just my perspective.

I'm not saying that nothing can be done just because there are a lot of ships.  What I am saying is that of those 118k ships, how many have caused bridges to collapse?  What are the odds?  Did the safety systems you designed for Disney guarantee 0% failure rate?  What I am saying is that blackouts on ships are a known failure, and that there is probably very little that can be done about it on the ships (and the Dali actually exceeds most ships in redundancy, in that it had 4 main generators), so maybe some thought should be made when designing a bridge that it could be hit by a ship.

[Pratique]

2 minutes ago, chengkp75 said:

I'm not saying that nothing can be done just because there are a lot of ships.  What I am saying is that of those 118k ships, how many have caused bridges to collapse?  What are the odds?  Did the safety systems you designed for Disney guarantee 0% failure rate?  What I am saying is that blackouts on ships are a known failure, and that there is probably very little that can be done about it on the ships (and the Dali actually exceeds most ships in redundancy, in that it had 4 main generators), so maybe some thought should be made when designing a bridge that it could be hit by a ship.

Agreed on the bridge design. But curious how a single point of failure (tripped breaker) could render the ship helpless for at least several minutes. My take is that the tolerance for risk in the maritime industry is higher than in the amusement park industry. If the Navy was doing less with nuclear subs than we were doing with high energy amusement rides, then it must be a risk tolerance thing. And I'm sure costs are the main reason. Someone is playing the odds.

[chengkp75]

6 minutes ago, Pratique said:

But curious how a single point of failure (tripped breaker) could render the ship helpless for at least several minutes.

Well, as I've stated, there are still a lot of questions, mainly why the two generator breakers tripped, after the transformer breakers tripped.  Was there some other standby/emergency power system that was not working fully/correctly?  Don't know.  These breakers should not have tripped, given the facts as laid out in the report, but they did.  That slowed, somewhat the restoration of power, though the #2 generator had started from standby, and was generating power, and power was restored to all systems within 30 seconds of the second blackout (meaning the standby generator started, came up to speed, and connected to the bus in about 1 minute).  However, restarting all the systems needed to get the main propulsion engine running takes about 2 minutes, as these are high starting load pumps, and they are restored automatically in a timed, phased sequence over about 60 seconds.  Having been in engine rooms where ships have blacked out or lost propulsion, getting things running in the time the Dali crew had, was damn good, with the alarms going off, and the lights going out.

[chengkp75]

17 minutes ago, Pratique said:

f the Navy was doing less with nuclear subs than we were doing with high energy amusement rides, then it must be a risk tolerance thing.

More than risk tolerance, it is risk analysis.  I don't know what you know about the use of risk analysis matrices (or probability and consequence matrix), you cross reference a probability of a failure happening, with the consequences if it does happen.  In your case, a failure of a ride in Disney would likely have a low probability (design features, redundancy), but a high consequence (death, serious injury).  The ship blacking out and striking a bridge would also have a low probability (how many times has it happened in the past), and a likely medium consequence, as the likelihood of a total bridge collapse would be considered (up until now) as not likely, so relatively less threat of loss of life.  So, the Disney ride needs to have more remediation features (again, design features and redundancy) due to its high risk/consequence rating, while designing new systems for a ship would likely not be considered necessary, but changes to operating procedures may be needed.

[BND]

The official Port of Baltimore FB page is reporting that Vision will be the first cruise ship to depart from Baltimore on May 25.

 

[toad455]

22 minutes ago, BND said:

The official Port of Baltimore FB page is reporting that Vision will be the first cruise ship to depart from Baltimore on May 25.

 

 

Sounds right. The upcoming Carnival Pride cruise will leave from Norfolk on May 19 but returning to Baltimore on May 26.

[Charles4515]

14 minutes ago, toad455 said:

 

Sounds right. The upcoming Carnival Pride cruise will leave from Norfolk on May 19 but returning to Baltimore on May 26.

You think they will get a waiver of the PVSA? 

[smokeybandit]

Just now, Charles4515 said:

You think they will get a waiver of the PVSA? 

I hope so. That's quite a curveball to throw at passengers this close to the cruise if they don't already have a passport.

[BND]

I've been watching the live feed. Curiously there's a @smokeybandit posting lol.

[Pratique]

56 minutes ago, chengkp75 said:

More than risk tolerance, it is risk analysis.

The other day my wife and I were discussing how transformative the Titanic disaster was on ship design. There is always room for improvement. It's just a question of will and money and risk tolerance.

 

In my experience, people are really bad at risk analysis. We did it at Disney but it was more of a formal exercise than anything else and not the only driver of our design decisions. People tend to discount some things and overvalue other things, and it can be too speculative sometimes especially when there is a lack of hard data. The one-in-a-zillion chance that a ship would take out the Key Bridge has now happened and only the most negative Nellies would say "I told you so." Now it's time to rethink everything. That, I think, was the difference between what Disney does and the Navy does.

[chengkp75]

1 hour ago, Pratique said:

The other day my wife and I were discussing how transformative the Titanic disaster was on ship design. There is always room for improvement. It's just a question of will and money and risk tolerance.

As far as safety equipment, yes, I would say that Titanic was transformative, but as far as ship design, not so much.  Today's cruise ships are designed as "two compartment" ships, meaning that you can completely flood two adjacent watertight compartments, and the ship will stay afloat.  The Titanic was also built to the "two compartment" standard.  However, in extreme cases, like Titanic and Concordia, that two compartment safety factor is null and void.  The Titanic breached six of her sixteen watertight compartments, all adjacent, and this weight forward caused the ship to tip down by the bow and start overflooding the watertight bulkheads into undamaged compartments.  Did this further downflooding contribute to how fast Titanic sank?  You bet, but with 6 compartments breached there was no force on God's Earth that was going to keep that ship afloat, just too much weight and too much lost buoyancy.  Concordia breached 4 adjacent compartments, and just like Titanic, there was nothing on earth that would keep her afloat, again too much weight and too little buoyancy.

[xtremegk]

4 hours ago, Pratique said:

But the reality is that someone needs to be held accountable for this tragedy and it needs to be explained to the public.

 

If in the end that it all there is to say, then it seems like something else needs to be done to help prevent it from happening again. Maybe new ship design and/or bridge design.

 

There is not always going to be someone to blame. I do think you hit the nail on the head though when it comes to bridge design. Bridge technology has come a long way in protecting piers -- building them in shallower water by having larger spans, introducing much larger dolphins, etc. The FSK Bridge did not renovate to match the current standards by building out larger dolphins.

 

THAT is the takeaway to help try to prevent a tragedy like this in the future, IF in fact what happened on the ship was something unpredictable and unavoidable.

[Pratique]

31 minutes ago, chengkp75 said:

As far as safety equipment, yes, I would say that Titanic was transformative, but as far as ship design, not so much.  Today's cruise ships are designed as "two compartment" ships, meaning that you can completely flood two adjacent watertight compartments, and the ship will stay afloat.  The Titanic was also built to the "two compartment" standard.  However, in extreme cases, like Titanic and Concordia, that two compartment safety factor is null and void.  The Titanic breached six of her sixteen watertight compartments, all adjacent, and this weight forward caused the ship to tip down by the bow and start overflooding the watertight bulkheads into undamaged compartments.  Did this further downflooding contribute to how fast Titanic sank?  You bet, but with 6 compartments breached there was no force on God's Earth that was going to keep that ship afloat, just too much weight and too much lost buoyancy.  Concordia breached 4 adjacent compartments, and just like Titanic, there was nothing on earth that would keep her afloat, again too much weight and too little buoyancy.

I was thinking more along the lines of SOLAS-type things, but point taken about the compartments.

 

I was also thinking about another anecdote for risk analysis, when I once went to Tokyo DisneySea for a design review with my Japanese counterparts. One thing we had been doing for decades in the U.S. was "idiot proofing" the systems as much as possible. The running joke was that you can't outsmart an idiot, but we had developed many time-tested and effective mitigation strategies that the Japanese team had not implemented. Some simple mistakes such as pushing a button at the wrong time would cause bad things to happen under their design.

 

When we brought it up, they seemed offended at the suggestion that their highly trained and disciplined ride operators would ever make a mistake. I shrugged my shoulders (mentally) and then said there could also be an equipment failure, such as a push button shorting closed at the wrong time. They scoffed at that and said they had acquired the best equipment money could buy with a mean time between failure of 20 years. They had some mitigation but it was in downstream control and would not have prevented some bad things from happening. I said, well if it could fail in 20 years it could also fail tomorrow. They didn't like hearing that either. Also, they were using the equipment incorrectly. They bought dual contact switches and were using them to mitigate against one contact failing to close but had not considered the consequences of having one contact weld closed. Again, that would cause bad things to happen. We told them to enter a fail safe state when either contact failed to open or close. They didn't like that idea either.

 

I was scratching my head wondering why they were resisting our recommendations, most of which could be implemented in software, until I realized the reason was that their hazard analysis didn't call for any of it. They had (incorrectly in my opinion) overestimated the reliability of their employees and equipment. When I read the admittedly brief NTSB report about the Dali I can't help thinking about some pretty simple ways the collision could have been avoided if they had been more risk adverse, even though the risk analysis may not have called for any of it.

 

Maybe a new bridge design is all we will ever get out of this incident, but maybe some smart folks will find new ways to mitigate against power failures on board in a more robust way. Just my hope, is all.

[Charles4515]

14 minutes ago, xtremegk said:

 

There is not always going to be someone to blame. I do think you hit the nail on the head though when it comes to bridge design. Bridge technology has come a long way in protecting piers -- building them in shallower water by having larger spans, introducing much larger dolphins, etc. The FSK Bridge did not renovate to match the current standards by building out larger dolphins.

 

THAT is the takeaway to help try to prevent a tragedy like this in the future, IF in fact what happened on the ship was something unpredictable and unavoidable.

The crew should not be made scapegoats. The bridge infrastructure was outdated. 

[chengkp75]

9 minutes ago, Pratique said:

When I read the admittedly brief NTSB report about the Dali I can't help thinking about some pretty simple ways the collision could have been avoided if they had been more risk adverse, even though the risk analysis may not have called for any of it.

Can you share those thoughts?  I'd like to hear them.

[Pratique]

9 minutes ago, chengkp75 said:

Can you share those thoughts?  I'd like to hear them.

These are of course pie in the sky and you may have some good counterarguments.

 

One is simply to use tug boats under the (now extinct) bridge for vessels that cannot conn below 8 knots. Is it 100% perfect? No. It is cost effective? No. Is it overkill? Yes. But if one of the tugs had gotten back to the Dali in time, maybe crisis averted. Knowing the existing deficiencies of the bridge, this is something that should appear on the hazard matrix. If it did, then everyone was just playing the odds. Not unreasonable to do, but still a consideration.

 

Another is looking at the admittedly simple electrical schematics in the report and thinking that there should be a way to prevent the propulsion engine and rudder from shutting down so quickly during an electrical outage, given the relatively involved restart process. I don't have a specific solution, but I'm sure that if there is a will there is a way. Again, probably overkill for most situations, but I'm not convinced that it is impractical to do or in conflict with existing requirements. I'm just thinking outside of the box so to speak.

 

I guess I really just don't like hearing "it isn't necessary" because I've never been successful using that argument against anyone else and I was never trained to think that way either. Also, although I left Disney long ago, some of my software continues to run to this day and thankfully no major incidents have happened with it because we were very risk adverse.

[chengkp75]

3 minutes ago, Pratique said:

One is simply to use tug boats under the (now extinct) bridge for vessels that cannot conn below 8 knots. Is it 100% perfect? No. It is cost effective? No. Is it overkill? Yes. But if one of the tugs had gotten back to the Dali in time, maybe crisis averted. Knowing the existing deficiencies of the bridge, this is something that should appear on the hazard matrix. If it did, then everyone was just playing the odds. Not unreasonable to do, but still a consideration.

While I have gone into and out of Baltimore hundreds of times, passing under the Key bridge every time, it never occurred to me that the tugs were not required for the bridge.  Many places in the world require things like this, even Portland, ME requires it.  When the "Million Dollar Bridge" in Portland was hit by a tanker, she had two tugs with her, but they let the tugs go when actually transiting the bridge (never could figure that one out), now they remain tied to the ship while transiting.  So, no, not infallible, but certainly something most mariners would think would be normal.

 

7 minutes ago, Pratique said:

Another is looking at the admittedly simple electrical schematics in the report and thinking that there should be a way to prevent the propulsion engine and rudder from shutting down so quickly during an electrical outage, given the relatively involved restart process. I don't have a specific solution, but I'm sure that if there is a will there is a way. Again, probably overkill for most situations, but I'm not convinced that it is impractical to do or in conflict with existing requirements. I'm just thinking outside of the box so to speak.

Actually, the Dali is a little more complex than most ships, in that it has a high voltage bus, in addition to the low voltage bus.  This is to power the bow thruster, which requires enormous amounts of power (compared to anything else on the ship), and is similar to cruise ships, where they generate 10k volts to power the propulsion motors or azipods, the thrusters, and the AC chillers.  Everything else is stepped down to 480v for shipboard systems.  Most cargo ships generate 480v from the main generators, and that is the power used for the engine room systems, so the failure of the HV/LV transformer would not have happened on most ships (though it would on large container ships, as these are the types of ships that use thrusters).  So, there is a case where an extra layer of complexity didn't stop the accident, it actually contributed to it. 

 

To show how complex it is for the main engine (the propulsion engine), there needs to be a salt water cooling pump running, and a "low temperature" fresh water cooling pump running (these two need to be running to keep a generator engine running as well), then there will be a "high temperature" fresh water cooling pump, a lubricating oil pump, a fuel supply (low pressure) pump, and a fuel circulating (high pressure) pump, all running off 480v motors.  If any of these are not running, you can't restart the main engine.  These are the pumps that I mentioned before that are on a timed, phased restart program to prevent overloading the generator, i.e. sea water pump first, then low temp cooling, high temp cooling, lube oil, fuel supply, then fuel circ.  Plus, the engineers will have to manually reset several safety interlocks once these pumps are up and running to get the engine to the "ready to start" status, and then a few more seconds to actually start the engine and get it running.

 

Now, as noted in the NTSB report, the steering system did not shut down altogether, one of three pumps (again, more redundancy than most ships which only have 2 steering pumps) is connected to the emergency generator, which will come online automatically when there is a blackout, within 45 seconds.  The problem is, that without propulsion, there is little water flow past the rudder and a ship's rudder requires water flow to work (this is why conventional steering loses effectiveness below about 5 knots).  So, even if more than one steering pump was attached to the emergency generator, you would still have very little steerage as the ship coasts down from 8 knots.

 

I'm not saying something isn't necessary, I'm asking how many layers of redundancy do you want?  Two generators online (even though one can carry the full load) didn't stop the accident, do we run 3 or 4?  What about the pollution from idling those two additional engines, or running all 4 at low load, and more fuel burned.  Do we have two separate busses so that half of the equipment is running on one bus, and half on the other?  How do you power that efficiently, especially once you get to sea?  And, even having standby generators, and standby pumps, doesn't mean the engine or pump will start and run immediately or correctly, as anything can fail at any time.  So, do we have more redundant pumps (most ships have three of each type mentioned above, so that one is running, one is standby, and one can be down for maintenance or act as second standby)?

 

And, just remember, that each addition to a ship costs money, both to build and to operate, and that would be reflected in the freight cost (cost to ship cargo), which in turn is passed along the line, eventually to the consumer of the cargo, and remember also that 85% of the world's economy has been shipped by sea at some point.

[chengkp75]

36 minutes ago, Pratique said:

One is simply to use tug boats under the (now extinct) bridge for vessels that cannot conn below 8 knots.

Just a note, virtually no ship can run their engine at less than 6-8 knots.  And, the decision to not require tugs under the bridge is up to two entities:  Baltimore Harbormaster and USCG Captain of the Port.

[Pratique]

1 hour ago, chengkp75 said:

Just a note, virtually no ship can run their engine at less than 6-8 knots.  And, the decision to not require tugs under the bridge is up to two entities:  Baltimore Harbormaster and USCG Captain of the Port.

Good points, all. I obviously don't have specific technical answers but we know it will cost $$$. That's what it all comes down to. Instead, we now have the cost of replacing a bridge that should never have been struck in the first place. So money here or money there, eventually the costs will be borne by someone. Should it be the shipping industry? We are building new bridges to accommodate them after all.

 

Today the USCG testified to Congress that they will probably do something about marine traffic at the at risk bridges before the final NTSB report comes out. Maybe add more tugs, maybe something else. So it took this to get their attention. Unfortunate since it could have been foreseen.

Edited May 15 by Pratique

[broberts]

Blaming the ship is easy and allows tax payers to avoid responsibility for underfunding bridge safety improvements. 

[Pratique]

4 minutes ago, broberts said:

Blaming the ship is easy and allows tax payers to avoid responsibility for underfunding bridge safety improvements. 

Well the ship struck the bridge, not the other way around. The ever larger ships are driving the need to improve the bridges. So the taxpayers should pay to accommodate the shipping industry? Maybe it's all just baked into the economy one way or another. No such thing as a free ride. This is true of the railroads too. They are trying to operate trains a mile long with one engineer on board, alone, to save money. What could possibly go wrong?

[broberts]

3 minutes ago, Pratique said:

So the taxpayers should pay to accommodate the shipping industry?

 

As they have been doing for centuries. 

 

4 minutes ago, Pratique said:

Well the ship struck the bridge, not the other way around.

 

Sure, but had the bridge had modern protections installed the result would likely not have been catastrophic. Bridge authorities bear some responsibility for failing to implement safety features that would have protected the structure from a known risk.

 

[chengkp75]

31 minutes ago, Pratique said:

So it took this to get their attention. Unfortunate since it could have been foreseen.

Unfortunately, in the maritime industry, it almost invariably takes a catastrophe to make changes.  One reason this is, is that there is no one overriding authority.  Each nation is responsible for the ships flying their flag.  The USCG, nor the NTSB can say that foreign flag ships entering US ports have to abide by safety regulations more strict than those adopted by the international community by SOLAS.  So, change to the ships will require action by the IMO, not just the US.

[Pratique]

4 minutes ago, broberts said:

 

As they have been doing for centuries. 

 

 

Sure, but had the bridge had modern protections installed the result would likely not have been catastrophic. Bridge authorities bear some responsibility for failing to implement safety features that would have protected the structure from a known risk.

 

I am reading expert commentary to the contrary, that a ship with that much mass moving at that speed would overcome anything put in its way. So not sure we can say for sure. Obviously more needs to be done. How to prioritize is a hard problem.

[Pratique]

3 minutes ago, chengkp75 said:

Unfortunately, in the maritime industry, it almost invariably takes a catastrophe to make changes.  One reason this is, is that there is no one overriding authority.  Each nation is responsible for the ships flying their flag.  The USCG, nor the NTSB can say that foreign flag ships entering US ports have to abide by safety regulations more strict than those adopted by the international community by SOLAS.  So, change to the ships will require action by the IMO, not just the US.

You mean mandatory change to the ships. I'm guessing voluntary change is asking too much.