MO-2017-203 Burst nitrogen cylinder causing fatality, passenger cruise ship Emerald Princess, 9 February 2017

1. On 9 February 2017, the crew of the Bermuda-flagged passenger ship Emerald Princess were conducting maintenance on one of the lifeboat launching systems while the ship was berthed at Port Chalmers, Dunedin.
2. The maintenance was completed and the crew were restoring pressure to a bank of high-pressure nitrogen-gas cylinders that formed part of the launching davit ‘stored energy’ system. One of the nitrogen bottles burst, fatally injuring a crew member who was standing close by.
3. The Transport Accident Investigation Commission (Commission) found that the nitrogen cylinder burst at below its normal working pressure because severe external corrosion had reduced the wall thickness to about 30% of its original thickness.
4. The failed nitrogen cylinder and several other pressure cylinders within the stored energy system, despite having been surveyed about two weeks earlier, were not fit for purpose and should not have been left in service.
5. The Commission also found that there is an urgent need for consistent and proper standards to be developed at a global level for maintaining, inspecting, testing and, where necessary, replacing high-pressure cylinders associated with stored energy systems on board ships.
6. The operator took a number of immediate safety actions to prevent a recurrence of the accident on any of its ships.
7. The Commission issued an interim report with early recommendations to the equipment manufacturer, the International Society of Classification Societies, the Cruise Lines International Association and Maritime New Zealand to alert their members and surveyors as appropriate to the circumstances of the accident and to have the condition of similar installations checked.
8. The Commission made two additional recommendations: one for the manufacturer to improve training for its surveyors; and one for Maritime New Zealand to raise, through the appropriate International Maritime Organization safety committee for its consideration, the implications for maritime safety of not having adequate minimum standards for the inspection, testing and rejection of pressure vessels that are part of stored energy systems.
9. A key lesson arising from this inquiry is:

• any sign of corrosion on high-pressure cylinders should be fully investigated by a person competent in examining high-pressure cylinders before any remedial work is undertaken and the cylinders are allowed back into service.

1. On 9 February 2017 Maritime New Zealand reported a fatal explosion on board the passenger cruise ship Emerald Princess.
2. The Transport Accident Investigation Commission (Commission) opened an inquiry under section 13(1) of the Transport Accident Investigation Commission Act 1990 and appointed an investigator in charge.
3. On 10 February 2017 two investigators from the Commission boarded the Emerald Princess in Dunedin to conduct interviews and gather evidence.
4. On 27 February 2017 an investigator boarded the Emerald Princess in Wellington to conduct further interviews with the ship’s crew. They were accompanied by a metallurgist who made a visual examination of the lifeboat (a ship’s small boat for use in an emergency) launching arrangement.
5. On 29 February 2017 an examination of evidence was conducted by a metallurgist at the Commission’s technical facility.
6. On 6 April 2017 two investigators boarded the Emerald Princess in Wellington to conduct further interviews with the ship’s crew.
7. On 10 April 2017 the Commission approved the publication of an interim report.
8. On 30 May 2017 the Commission conducted an interview with the manufacturer of the lifeboat-launching equipment installed on the Emerald Princess.
9. The Commission liaised with industry experts over the next 12 months and assessed industry best practice and relevant rules and regulations on the maintenance of pressure vessels associated with lifeboat launching equipment.
10. On 17 June 2018 the Commission conducted a second interview with the manufacturer of the lifeboat launching equipment.
11. On 19 September 2018 the Commission approved the draft report to be circulated to 11 interested persons for comment.
12. The Commission received submissions from five interested persons, and any changes as a result of these submissions have been included in this final report.
13. The Commission approved the report for publication on 21 November 2018.

Background

1. On 9 February 2017 the Bermuda-flagged passenger ship Emerald Princess berthed at Port Chalmers, Dunedin carrying 3,113 passengers and 1,173 crew on board. The Emerald Princess was fitted with 18 lifeboats, six passenger tenders and two fast rescue boats. The boats were stowed on deck 8 and could be lowered and raised using the lifeboat launching and recovery davits.
2. The davits were hydraulically powered by six hydraulic power packs, three power packs for each side of the vessel. The International Convention for the Safety of Life at Sea (SOLAS) regulations required that an emergency launching and recovery system be provided so that the lifeboats could be launched even if the ship suffered a total power failure. To comply with this regulation, a stored energy system comprising an accumulator and a set of high-pressure nitrogen cylinders was fitted to each launching davit.
3. The nitrogen system had a nominal working pressure range of 180-200 bar. Prior to the vessel’s arrival at Dunedin, the crew had observed that the pressure of the nitrogen system for lifeboat station No. 24 had dropped to about 165 bar.

Narrative

1. On arrival at Dunedin on 9 February 2017, the staff engineer tasked the deck and safety engineer with tracing the source of the nitrogen leak with the assistance of two fitters, Fitter-A and Fitter-B.

1. At about 0900 on 9 February 2017, Fitter-A and the deck and safety engineer carried out a soap bubble test (a test for signs of gas leakage. In this test a soap solution is applied to the surface to be tested; any bubble formation on the applied surface is an indication of a leak) on the nitrogen piping system and the fittings on the nitrogen cylinder, but they found no source of the leak. They did not soap bubble test the nitrogen cylinders because they thought it was highly unlikely that the pressurised cylinders had been structurally compromised.
2. In the absence of any visible leaks, the staff engineer advised the deck and safety engineer to replace the pneumatic manifold (a junction point for the distribution of gases used to provide pneumatic power) because it had been prone to leakages and was most likely the source of the leak.
3. In order to replace the pneumatic manifold, the deck officer and fitter followed the equipment manufacturer’s instructions and depressurised the stored energy system.
4. Once the pneumatic manifold had been replaced and connections made fast, the deck and safety engineer instructed Fitter-A and Fitter-B to re-pressurise the stored energy system by connecting a fully charged spare nitrogen cylinder to the pneumatic manifold via a recharging hose.
5. The deck and safety engineer then left the two fitters to complete this work, to assist another fitter on deck 3 with other repair work.
6. Fitter-A and Fitter-B proceeded to increase the nitrogen pressure to about 160 bar, then informed the deck and safety engineer that the pressure appeared to be holding and the pressure gauge did not indicate any leaks.
7. The deck and safety engineer consulted the staff engineer, who advised starting the hydraulic pump and increasing the nitrogen pressure to its maximum normal working pressure of 200 bar. The deck and safety engineer conveyed this message to Fitter-A and Fitter-B and proceeded to deck 3 to continue assisting with the other repair work.
8. At about 1700 Fitter-B went to deck 7 where the hydraulic pumps were located, and started the pump while Fitter-A remained on deck 8 to monitor the rise of the nitrogen pressure on a control panel close to the nitrogen cylinders (see Figure 4 for the location of the control panel).
9. About a minute after the hydraulic pump was started, a nitrogen cylinder located on lifeboat station No. 24 burst, fatally wounding Fitter-A.

Stored energy system

1. The lifeboats on board the Emerald Princess were lowered from and raised onto the vessel using telescopic overhead davit arms. The telescopic arms on the davit were moved by hydraulic pistons that were powered by two submerged hydraulic pumps.
2. If the hydraulic pumps failed, the stored energy system would provide emergency backup power. The system comprised an accumulator and a set of nitrogen cylinders (see Figure 4).
3. The upper chamber of the accumulator was filled with nitrogen gas at a maximum working pressure of about 200 bar at 20 degrees. The nitrogen pressure was maintained by a set of pressurised nitrogen cylinders connected to the upper chamber via a pneumatic manifold. The manifold was fitted with an overpressure relief device set at 250 bar. The lower chamber of the accumulator was filled with hydraulic oil at a maximum working pressure of about 230 bar. In between the lower and upper chambers was a piston. In the event of a power failure this piston was pressurised by the nitrogen gas in the upper chamber and pushed downwards, pressurising the hydraulic oil in the lower chamber of the accumulator, which in turn operated the hydraulic piston that moved the telescopic davit arms (Figure 6 is a schematic diagram of the lifeboat launching appliance; the red line shows the operation of the stored energy system).

Nitrogen cylinder installation

1. Each lifeboat station had four nitrogen cylinders. Each cylinder had a capacity of 40 litres and was filled with nitrogen to its normal working pressure of about 200 bar. The cylinders were held in a steel frame that raised and restrained the base of each cylinder above the deck.

2. The cylinders were held in place near the top by two round bar steel U-bolt straps. One U-bolt went around a forward cylinders and an aft cylinder and was fastened to the rear portion of the frame (see Figure 7). The front two cylinders of the four in the frame had a steel support strip under the restraining U-bolt to prevent the cylinders being mechanically damaged. A steel strip separated the forward cylinders from the aft cylinders

   

3. The nitrogen cylinders had been manufactured by Tenaris in Dalmine Italy, and designed to EN1964 3-20019 standards. Each cylinder was fabricated from a one-piece forging, with a shrink-fitted foot ring and a threaded neck ring attached.

4. The cylinders were made in batches of no more than 202. Two cylinders from each batch were tested for quality through a burst pressure test on one cylinder and a mechanical test on the other. These tests were witnessed by a surveyor from Lloyds Register. The Lloyds Register certificate stated that the fabrication of cylinders was completed as per Lloyd Register’s procedures and specifications. In addition, the surveyor visually inspected each cylinder and hydraulically tested it at 300 bar. Figure 8 shows the cylinder dimensions.
5. The failed nitrogen cylinder had been hydrostatically pressure tested on 5 September 2005 at the time of fabrication. The burst pressure test certificate showed that the test cylinder burst at 530 bar.

Post-accident inspection and testing 

The process

1. The remains of the burst nitrogen cylinder were recovered together with the other three cylinders from the same frame. The top of the burst cylinder was never found, having probably been ejected into the sea. A randomly selected cylinder from another bank of cylinders was also removed from the vessel for examination.
2. All five cylinders were taken to the Commission’s technical facility in Wellington, where an independent metallurgist examined them.

Examination of the failed cylinder

1. A visual examination of the failed cylinder showed that the failure was typical of an over-pressure burst. A single split had occurred along the length of the cylinder and the cylinder head was missing.
2. The burst nitrogen cylinder had suffered significant corrosion at the point of failure, which was situated approximately 150 millimetres (mm) below where the steel securing band had clamped the cylinder within its frame. The corrosion had developed on the outside of the cylinder. The internal surface was clear of corrosion. Corrosion had reduced the thickness of the cylinder wall by about 70% at the point of failure (from 4.8 mm to about 1.5 mm). A second area of corrosion was noted near to the bottom of the cylinder and a third area where the protective coating had been scraped away to observe the cylinder’s identification details.

3. The metallurgist made the following observations in his report:

   Examination of the fracture revealed that the fracture had initiated at a region of corrosion that was about 1.1m from the original base of the cylinder

   Examination of the corroded area showed:

   Failure had passed through the middle of the region of corrosion.

   The fracture surface of the failure was typical of overload. There was no evidence of fatigue or any other pre-existing defect being present.

   The majority of corrosion product had been lost from the surface The corroded region was oval shaped with the following dimensions: Axial length 200 to 230mm

   Wall thickness:

   Minimum 1.45mm to 1.56 i.e. both sides of the failure

   Away from the corrosion the cylinder was 5.35mm to 5.9mm thick i.e. thicker than the minimum specified of 4.81mm

   The paint had spalled off the surface. This is indication that the underlying steel had been strained

   Away from the corroded area the fracture was typical of ductile overload.

   An area of corrosion was also present on the cylinder near the base and directly below the main area of corrosion where the failure initiated.

   The foot of the failed cylinder was found separated from the cylinder. Examination of this and the base of the cylinder showed they were both corroded and a significant amount of paint was missing.

Examination of a randomly selected cylinder

1. The metallurgist inspected a randomly selected cylinder from the Emerald Princess and found the base of the cylinder extremely corroded.

2. He made the following observations in his report:

   Examination of the intact cylinder revealed that extreme corrosion was present on the base of the cylinder in the region of the foot ring.

   The following were measured on the parallel section of the cylinder away from the damage.

   Diameter 206.8mm

   Wall thickness 5.88mm (steel no paint)

Examination of accumulators on board the Emerald Princess

1. The hydraulic accumulator is part of the stored energy system. It is a pressure storage reservoir in which a hydraulic fluid is held under pressure by nitrogen gas. The metallurgist observed significant corrosion on at least two accumulators whilst on board the Emerald Princess.

2. The metallurgist’s report stated:

   The surface of pressure vessel that houses the hydraulic oil/air piston at lifeboat station 25 was obviously bulged as result of the build-up of corrosion products under the paint and under the support strap. The depth of corrosion was unknown.

   The surface of the pressure vessel that houses the hydraulic oil/air piston at lifeboat station 24 [the station where the failure occurred] was obviously severely bulged as a result of the build-up of corrosion products under the paint. The depth of corrosion was unknown.

The maintenance and inspection regime on board the Emerald Princess

1. Each week the ship’s crew carried out a visual inspection of the stored energy system. Each month a lifeboat launching drill was conducted using the stored energy system to ensure that it was in good working order.
2. The maintenance plan on board the Emerald Princess stated that nitrogen cylinders were to be hydrostatically tested every 10 years. The vessel’s flag state also required that the nitrogen cylinders be tested every 10 years. The nitrogen cylinder that burst had been manufactured in September 2005 and was due for hydrostatic pressure testing in September 2015. At the time of the accident the cylinder had not been pressure tested and was overdue by one year and five months. The maintenance plan had been loaded with the date when the cylinders were installed on the ship at the time of building, rather than the date of manufacture.
3. The stored energy system was part of the lifeboat launching appliance. The International Maritime Organization (IMO) guidelines that were applicable at the time required lifeboats and associated launching appliances to be inspected annually. The guidelines required a more in-depth inspection every five years. The IMO also required that the service provider carrying out the annual and five-yearly inspections be authorised by the flag state and qualified to examine, test and repair each make and type of equipment for which they provided service. The applicable standards and testing regimes for nitrogen cylinders and accumulators are discussed in detail in the analysis section.
4. Annual and five-yearly inspections were carried out on board the Emerald Princess. At the time of the accident the most recent inspection had been a five-yearly inspection that was carried out on 21 January 2017, 19 days prior to the accident.
5. The five-yearly inspection report prepared by the authorised service provider stated that the nitrogen cylinders on board the Emerald Princess were aged and the company should consider swapping them with new nitrogen cylinders. The report also stated that at least one accumulator was corroded and the operator should consider engaging the equipment manufacturer to overhaul and certify the accumulator. (See Appendix 1 for relevant sections from the authorised service provider’s report).

Introduction

1. Pressure vessels are widely used on board ships for various applications. Their failure can be catastrophic and may result in human injury and death, as was the case on board the Emerald Princess.
2. The crew were following the correct procedure for recharging the nitrogen cylinders when the cylinder burst. The failed cylinder was one of four located at lifeboat station No. 24 and had very little to no protection from sea spray. The cylinder was severely weakened by corrosion, which caused it to fail under normal working loads. The shipboard maintenance plan and the various inspection regimes that gave effect to that plan did not detect or remedy the issue before the failure occurred. The cylinder that failed was overdue for maintenance and testing, and should not have been in service at the time of the accident.
3. The following analysis discusses why the nitrogen cylinder remained in service despite being in a dangerous condition. The analysis raises the following two safety issues:

• there are currently no global minimum standards for the inspection, testing and rejection of pressure cylinders that make up part of stored energy systems on lifeboat launching installations, which has resulted in a wide variation in, and in some case inadequate, standards applied by flag state administrations, classification societies and authorised service providers
• technicians who are authorised to conduct mandatory annual and five-yearly inspections of lifeboat-launching installations are not required to have specific training and certification for inspecting any stored energy-release systems and their associated pressure cylinders.

Why did the cylinder burst?

1. The cylinder burst because a region of severe corrosion reduced the cylinder wall thickness from about 4.81 mm to 1.45 mm and significantly compromised the cylinder’s ability to withstand internal pressure. As a result, the cylinder suffered an overpressure burst while the crew attempted to raise the nitrogen pressure from 160 bar to its normal working pressure of 200 bar.
2. There is no clear evidence as to why this particular cylinder was so heavily corroded in the area where the failure started. The adjacent cylinders in the frame were not heavily corroded. Corrosion can be initiated by a number of factors. Mechanical damage to the protective coating in a saltwater environment is a common cause. Seawater being trapped against a steel surface can accelerate corrosion. The straps that retained the bottles in the frame is a place where seawater could have become trapped. They could also have initiated mechanical damage to the protective coating. However, as Figure 15 shows, the location where the worst corrosion occurred was not where the straps were in contact with the bottles.
3. There was no evidence of any pre-existing crack occurring before the failure. The source of the leak in the system that the crew were trying to remedy was never found.

On-board maintenance and inspection of pressure vessels Maintenance

1. The maintenance schedule for nitrogen cylinders and accumulators was calendar based. That is, time was the trigger for the various inspections and tests. Weekly and monthly routines were carried out by the crew, while major maintenance work such as hydrostatic pressure testing of nitrogen cylinders was designated to an authorised service provider or shore-based testing facility.
2. Hydrostatic pressure testing is a standard method of pressure testing cylinders. It involves filling a cylinder with water and pressurising it up to 1.5 times its design pressure limit. The pressure is then held for a prescribed amount of time and the cylinder is then inspected for leaks.
3. The maintenance regime on board the Emerald Princess was kept in a computer-based maintenance system.
4. The hydrostatic pressure testing of nitrogen cylinders was scheduled to have been carried out every 10 years, starting from the date they were first hydrostatically pressure tested. However, the start date entered into the maintenance plan was May 2007, which was the date that the nitrogen cylinders were installed on the vessel during build. However, the cylinder that failed had been manufactured in September 2005, which was when it was first pressure tested. Therefore, it was overdue for testing by one year and five months at the time of the accident. The operator has now addressed this issue and updated its maintenance plan so that it tracks the age of each cylinder based on its manufacture date, rather than its installation date.
5. If the failed bottle had been inspected and tested by a competent authority 17 months earlier, it is very likely that it would have been condemned and the accident avoided. The depth of the corrosion in the cylinder wall was such that it almost certainly would have been prevalent 17 months earlier.
6. Ten years is a long time between testing, particularly for cylinders that are exposed to a seawater environment. Authorities might need to consider reducing this period in some circumstances, or at least having a more rigorous inspection regime to detect any early onset of corrosion.
7. Other options could include the use of better coating and steel protection systems for steel bottles, such as galvanising.

Inspection

1. The deck team and engineering team maintained the lifeboat launching equipment. Both teams inspected the nitrogen cylinders and accumulators with different objectives. The deck team’s work was cosmetic-focused. The engineering team’s work was more condition-based. They were inspecting the accumulators and nitrogen cylinders for condition and operational reliability.
2. The deck team carried out visual inspections of the nitrogen cylinders, and any signs of rust were scraped off with scrapers and painted over. Due to the cosmetic nature of this work it was not logged as a matter of record. Paint can mask a potential problem area. If, for example, a steel surface is not properly treated prior to painting, coating the area with fresh paint can mask a problem area, and in the worst case salt can become trapped under the paint and accelerate rather than slow the corrosion process.
3. Any sign of corrosion on a pressure cylinder is cause for concern, and for that reason the treatment of that corrosion should be preceded by a thorough inspection by a person competent in assessing the pressure cylinder’s fitness for purpose

Inspection standards

Safety issue: There are currently no global minimum standards for the inspection, testing and rejection of pressure cylinders that make up part of stored energy systems on lifeboat launching installations, which has resulted in a wide variation in, and in some cases inadequate, standards applied by flag state administrations, classification societies and authorised service providers.

International Maritime Organization: Resolution MSC.402(96)

1. The IMO has taken a number of steps to address fatal accidents involving lifeboats and associated equipment. The IMO noted that one of the reasons for these accidents was the inadequate maintenance of lifeboats, davits and launching equipment. As a result, in May 2016 the IMO adopted resolution MSC.402(96), which set out to establish a uniform and safe inspection regime for lifeboats and their launching appliances, while also ensuring that the personnel carrying out these inspections were authorised and certified to do so. This mandatory resolution will come into force on 1 January 2020, but existed as guidelines (MSC.1/Circ.1206. Rev.1, Measures to Prevent Accidents with Lifeboats and MSC.1/Circ.1277, Interim Recommendation on Conditions for Authorisation of Service Providers for Lifeboats, Launching Appliances and On-Load Release Gear) at the time of the accident.
2. The resolution stated that weekly and monthly inspections of launching appliances could be carried out by shipboard personnel under the direction of a senior ship’s officer. However, it also stated that annual and five-yearly inspections and operational tests should be carried out by certified personnel representing the manufacturer or an authorised service provider.
3. The resolution also described in detail the examinations and operational tests that should be performed on lifeboats, launching appliances and on-load release gear.

Stored energy system not included

1. Under the applicable guidelines, stored energy systems were to be examined annually for ‘satisfactory condition and operation’; however, neither the guidelines nor the new resolution provided any recommended minimum ‘maintenance and inspection’ standards to ensure that the stored energy system was in a “satisfactory condition and operation”.
2. The IMO provided guidelines on the recommended minimum standards for the inspection, testing and rejection of similar pressure cylinders on board ships, for example carbon dioxide cylinders that form part of a fixed carbon dioxide fire-extinguishing system, and oxygen cylinders that form part of self-contained breathing apparatus. These guidelines were intended to supplement the manufacturers’ approved maintenance instructions while providing a common minimum standard across the maritime industry for the maintenance and inspection of these pressure cylinders.
3. The other cylinders described above are typically installed or kept in locations protected from salt water environments. Stored energy systems, on the other hand, are usually located on sheltered or open decks, yet there are no overarching standards for examining and testing them.
4. Standards for inspection, testing and rejecting nitrogen cylinders and accumulators, if any, are limited to those imposed by vessels’ flag states (A flag state may impose regulations over and above the mandatory standards prescribed by the IMO. For example, although the IMO did not require the nitrogen cylinders to be hydrostatically pressure tested every 10 years, Bermuda, the Emerald Princess’s flag state, required the vessel to comply with this requirement). The inspection standards vary greatly between different flag state administrations. For example, some flag states require that nitrogen cylinders be removed from vessels and hydrostatically tested every 10 years, while others do not.
5. A further consideration for the maintenance of nitrogen cylinders and accumulators is that their condition may not necessarily be time bound. An authorised service provider observed that the condition of nitrogen cylinders and accumulators varied across vessels. Sometimes six-year-old pressure cylinders were observed to be severely corroded and deemed not fit for purpose, while on other ships 15-year-old pressure cylinders were found to be in good condition and fit for purpose. This variation in condition may be attributed to a number of factors, such as the vessels’ trading routes, the locations of the cylinders, the on-board maintenance regimes and the standards of inspection.
6. A lack of guidelines or recommended minimum standards for the inspection, testing and rejection of nitrogen cylinders and accumulators meant that authorised service providers, classification societies and flag state administrations were unable to apply a common approach and carry out inspections based on a common minimum standard.

Training and certification

Safety issue: Technicians who are authorised to conduct mandatory annual and five-yearly inspections of lifeboat-launching installations are not required to have specific training and certification for inspecting any stored energy-release systems and their associated pressure cylinders.

1. MSC.402(96) set the conditions for the authorisation of service providers. This was to ensure that the testing and inspection of lifeboats, launching appliances and on-load release gear were carried out in accordance with SOLAS Chapter III, regulation 20.
2. Further, the technicians carrying out the annual and five-yearly inspections of lifeboats, launching appliances and on-load release gear were to be certified by the manufacturer or authorised service provider for each make and type of equipment that was required to be inspected.
3. The technicians were required to complete education, training and competence assessments before being allowed to carry out any such inspection. As a minimum the education included the relevant rules and regulations, design and construction of lifeboats and launching appliances.
4. The technicians’ training included procedures for examining, testing, operating and repairing lifeboats and their launching appliances. However, it did not include any specialised training in and certification for the inspection of any associated pressure cylinders. There was no regulatory requirement to have these.
5. The authorised technician who carried out the five-yearly inspection of the accumulator and nitrogen cylinders on board the Emerald Princess, just prior to the accident, noted that the nitrogen cylinders should be considered for replacement. The technician was not to know that on the cylinder that failed, corrosion had reduced the wall thickness at the fracture-initiation region to about 30% of the original thickness. Formal training in the assessment of pressure cylinders would have better prepared the technician to determine that the cylinder was not fit for purpose and posed a serious safety risk.
6. The metallurgist who examined the nitrogen cylinders and accumulators installed on the Emerald Princess was experienced in assessing the condition of pressure cylinders. The metallurgist noted that corrosion was present on foot rings fitted on a number of nitrogen cylinders, especially where they were in contact with the support frame.
7. The metallurgist also noted that the accumulator at lifeboat station Nos. 24 and 25 was “obviously bulged as a result of the build-up of corrosion products under the paint and under the support strap”. The metallurgist’s assessment was that at least two accumulators on board the Emerald Princess should have been condemned as unsafe to operate.
8. Nitrogen cylinders and accumulators are high-pressure vessels often exposed to harsh marine environments. There would be significant safety benefits from their being inspected by persons trained and experienced in the inspection of pressure vessels.

1. The crew were following the approved and appropriate procedure for re-pressurising the stored energy system.
2. The cylinder failed at below its normal working pressure because severe external corrosion had reduced the wall thickness from 4.81 millimetres to 1.45 millimetres (about 30% of its original thickness).
3. Despite the stored energy system having been surveyed in accordance with the international requirements of the International Maritime Organization MSC.1/Circular.1206 only two weeks earlier, the failed nitrogen cylinder and several other pressure cylinders were not fit for purpose and should not have remained in service.
4. There is an urgent need for consistent and proper standards to be developed at a global level for maintaining, inspecting, testing and, where necessary, replacing high-pressure cylinders associated with stored energy systems on board ships.

1. There are currently no global minimum standards for the inspection, testing and rejection of pressure cylinders that make up part of stored energy systems on lifeboat launching installations, which has resulted in wide variations in, and in some case inadequate, standards applied by flag state administrations, classification societies and authorised service providers.
2. Technicians who are authorised to conduct mandatory annual and five-yearly inspections of lifeboat-launching installations are not required to have specific training and certification for inspecting any stored energy-release systems and their associated pressure cylinders.

General

1. The Commission classifies safety actions by two types:

   (a) safety actions taken by the regulator or an operator to address safety issues identified by the Commission during an inquiry that would otherwise result in the Commission issuing a recommendation

   (b) safety actions taken by the regulator or an operator to address other safety issues that would not normally result in the Commission issuing a recommendation.

Safety actions addressing safety issues identified during an inquiry

1. Since the accident Princess Cruise Lines Limited (the owner/operator) has taken the following safety actions:

   On board the Emerald Princess – all nitrogen cylinders on board were immediately closed as a precaution. A visual inspection was then undertaken of all cylinders and, once it was clear that corrosion may have been the cause of the failure, all cylinders on board were depressurised and replaced. This process was completed by 9 March 2017; and across the entire fleet, including:

   a fleet-wide visual inspection of all nitrogen cylinders for corrosion. No serious defect was observed from this inspection, although the Group’s safety team noted that, given the circumstances of the incident, a normal visual inspection was insufficient to identify material corrosion in all circumstances. This observation has been taken into account in the long term policy revisions (as to which, see below);

   a fleet-wide inventory of all nitrogen cylinders, including locating and confirming the manufacture dates and certificates. A simultaneous process was put in place to verify the inventory data, which was then entered into AMOS, the planned maintenance system used by the fleet, to ensure there were no gaps or discrepancies; and

   a large number of new cylinders were sourced in anticipation of the need to carry out replacement across the fleet due to the 10-year maintenance/age requirement. In total, over 800 cylinders have now been replaced.

   Further, a number of long-term policy and procedure revisions have taken place, reflecting an acknowledgment that the incident highlighted that there were areas in which existing procedures could be enhanced to ensure crew safety. In particular, there has been a review of the planned maintenance systems, with the involvement of all vessels, and the AMOS work orders in relation to nitrogen systems on launching appliances have been updated. Their guidance and/or job descriptions now contain clear instructions regarding the dates of manufacture, inspection frequencies and requirements, and other relevant information. In additional, AMOS has been changed to permit tracking (and does track) each cylinder individually.

   Standardised guidance has been issued for nitrogen cylinder installations at LSA launching stations. Because the storage and installation of the nitrogen cylinders in the LSA launching arrangements was found to be a potential contributing factor to the onset of corrosion, the guidance eliminates steel-to-steel contact between all surfaces to mitigate this. Adequate securing and protection, by means of Teflon pads, rubber strips or similar material is required to be used. This set-up also allows for better visual inspections of the individual cylinders by both the crew members and approved service providers.

   [X] “Nitrogen Bottles Top Up Procedure for Hydraulic Piston Accumulators”. Following the incident, the Group worked with [x] to sure there was one standard instruction available in this regard. This document is attached to the relevant Fleet Maintenance Manual and a ship’s Staff Chief Engineer or someone at his or her direction ensures that topping-up is performed, by a qualified Fitter, in accordance with the instructions that it contains each time topping-up is required.

   Safety Bulletin SB 005-17, dated 1 August 2017, which has been issued with the following directions (the heightened awareness in the Technical and Safety Departments in relation to these systems, arising from the incident, was a significant factor in the production of the Bulletin):

   A risk assessment of the LSA nitrogen refilling job should be available on board. All personnel assigned to this job should be familiar with it.

   Risk assessments should be conducted for any job involving the transfer of (high pressure) gasses as required by OHS-1407.

   Ships should ensure that:

   For the LSA nitrogen refilling job they have the proper gas transfer kit available. Note that for all [x] systems this is in AMOS and can be found through Makers Reference: U01409.

   The correct gas transfer equipment is available for all similar jobs. All recharging kits should be fitted with pressure reducers, gauges, and bleed valves. Where not available, this should be ordered through the technical department.

   Standardised instructions from [x] “NITROGEN BOTTLES TOP UP PROCEDURE FOR HYDRAULIC PISTON ACCUMULATORS 40002-39-099-A” must be followed during the LSA launching appliance recharging process.

   Such equipment must be kept in a controlled environment, clearly labelled and only used for its intended purpose.

   Work order “LSD201 – Monthly Davit inspection and turnout”. This is conducted by a ship’s crew. You will see that one of the goals of the task is to “ascertain the physical condition of the stored-pressure systems for the launching appliances”, in accordance with the requirements set out. This includes checking the separation of the cylinders and accumulators from steel and other metallic components, to reduce contact corrosion and corrosion due to paint removal from abrasion. It also includes an inspection of the external appearance of the cylinders, stands and securing arrangements for signs of corrosion or defect. Any areas of concern are to be reported immediately to the Staff Chief Engineer and followed up with the ship’s Technical Operations Director. The AMOS history is updated following and, in the event of defects, work orders are raised.

   Work order “LSD203 – Annual inspections of the LSA launching appliances by approved service provider”. As you know, this is conducted generally by [x]. The details of this work order have been amended. It now requires full isolation of each system so that there can be a full inspection of each cylinder and its connections. The external surface of each cylinder is cleaned thoroughly and then inspected for any defects. Serial numbers and manufacture dates are verified and checked against on-board records to ensure the cylinders are within their 10 year lifespan. The findings of the inspections are required to be recorded in the service provider’s report. An example [x] inspection/service report from July 2017, containing detailed information about nitrogen cylinders, is also attached. Any findings of significance are recorded in AMOS and the vessel’s Technical Operations Director is notified. Where a specific item of work needs to be performed on the system, it will be noted in AMOS and a work order raised.

   Work order “PAT0039 – 10 year replacement of cylinders”. This requires that Nitrogen cylinders (and bladder-type accumulators in the LSA launching appliance systems) are to be replaced on or before the 10 year anniversary of manufacture17. Relatedly, the system of monitoring or tracking cylinder age and condition in AMOS has been changed. The previous system involved collective monitoring, based on cylinder installation date. As above, cylinders are now individually tracked in AMOS based on their manufacture date. This is reflected in the work order, which provides that when new cylinders are installed, the “MANUFACTURE date (stamped on the collar of the cylinder…) and NOT the installation date must be entered within Amos and on-board records…”

   Work order “PAT0040 – 10 year overhaul and test of piston-type accumulators”. This job has been added to ensure these accumulators undergo a full overhaul (including dismantling, replacement of seals and full internal and external inspection) and a system test every 10 years. Where possible, these units are also returned to the vessel with galvanic protection against corrosion.

2. Since the accident, the davit manufacturer has taken the following safety actions:

   In order to improve the training of our service technicians, they have been supplementary instructed with “Additional guidance for the inspection of nitrogen cylinders”, see attached internal document CN10/17.

   In order to improve the documentation provided, the refilling procedure has been amended by adding some precautions and distributed to our customers and technicians.

   If not otherwise required by the Flag State of the ship, our “recommendation” is that any nitrogen cylinder deemed unfit due to corrosion should be removed for further assessment and, if more than 10 years have elapsed since initial pressure test at manufacture facility, the cylinder must be hydrostatic pressure tested.

General

1. The Commission may issue, or give notice of, recommendations to any person or organisation that it considers the most appropriate to address the identified safety issues, depending on whether these safety issues are applicable to a single operator only or to the wider transport sector. In this case, new recommendations have been issued to the manufacturer and the Director of Maritime New Zealand.
2. In the interests of transport safety, it is important that these recommendations are implemented without delay to help prevent similar accidents or incidents occurring in the future.

Early recommendations

To the manufacturer:

1. The nitrogen cylinders that formed part of the stored energy alternative launching system on board the Emerald Princess were stowed in a harsh marine environment and had significant external visible corrosion.

   The nitrogen cylinder burst as a result of overload in the area of corrosion thinning.

   The circumstances of this accident raise the question of whether the current inspection requirements for a competent person are adequate for a pressure vessel stored in a harsh marine environment.

   The nitrogen cylinders were inspected annually by the manufacturer’s authorised representative, and the most recent inspection was two weeks prior to the accident. On each occasion the cylinders were found in satisfactory working condition. The Commission is concerned that there might be other pressure vessels part of the same system or similar systems that could pose a significant danger to seafarers and passengers.

   On 10 April 2017 the Commission recommended to the manufacturer that, as a matter of urgency, it contact all known ship owners that have the same or similar emergency launching and recovery systems installed on their vessels, informing them about the circumstances of this accident, and advising them to have the systems inspected immediately by a competent person to check whether the nitrogen cylinders and other pressure vessels associated with the systems are fit for purpose. Any nitrogen cylinders deemed unfit due to corrosion should be removed for further assessment. (010/17)

2. On 21 April 2017 the manufacturer replied in part:

   We shall highlight that the interim report does not reflect that our last service intervention commented that, even if the launching appliance was in satisfactory working condition, the nitrogen bottles were reported aged and consequently recommended replacement.

   As per your recommendation, please be informed that we are promptly contacting all our customers having the same or similar equipment on board and our service networks is following up to support our customers in this dedicated inspection. Any nitrogen cylinder deemed unfit due to corrosion will be required to be removed for further assessment.

Recommendation to the International Association of Classification Societies

1. The nitrogen cylinders that formed part of the stored-energy alternative launching system on board the Emerald Princess were stowed in a harsh marine environment and had significant external visible corrosion.

   The nitrogen cylinder burst as a result of overload caused by corrosion thinning.

   The accident raises the question of whether the current inspection requirements for a competent person are adequate for a pressure vessel stored in a harsh marine environment.

   The Commission is concerned that there might be other pressure vessels part of the same system or similar systems that could pose a significant danger to seafarers and passengers.

   On 10 April 2017 the Commission recommended to the Director of Maritime New Zealand that all New Zealand surveyors and port state control officers be informed about the circumstances of this accident and advise them to pay special attention to any corroded nitrogen cylinders or other pressure vessels when conducting their Class or Flag State surveys, particularly when inspecting pressure vessels stored in an open marine environment. (013/17)

2. On 20 April 2017 Maritime New Zealand replied:

   On 20 April 2017, Maritime New Zealand issued Safety Bulletin 34 to all New Zealand Surveyors and Port State Control Officers, trainee Port State Control Officers, Maritime Officers and their respective managers. This bulletin will also be posted on Maritime New Zealand’s public website-http://www.maritimenz.govt.nz/commercial/safety/safety-updates/safety-bulletins

New recommendations 

To the manufacturer

1. The nitrogen cylinders that formed part of the stored energy system on board the Emerald Princess were stowed in a harsh marine environment and had significant external corrosion.

   The nitrogen cylinders were inspected annually by the manufacturer’s authorised technician. The most recent inspection was two weeks prior to the accident. On each occasion the cylinders were judged to be in satisfactory working condition.

   The circumstances of this accident raise the question of whether the current training requirements for authorised technicians are adequate for a pressure vessel stored in a harsh marine environment.

   On 22 November 2018 the Commission recommended that the manufacturer carry out a review of its current training processes and ensure that inspections of stored energy systems are carried out by technicians who are trained and certified to inspect them. (029/18)

   8.3.2 On 12 December 2018, the manufacturer replied:

   The accident highlighted the need to pay extra attention to all pressured gas cylinders/bottles that, exposed to harsh marine environment (and, sometimes, installed in difficult to reach positions) could experience localized corrosion not easily detected. Therefore, being the safety of human life at sea the core itself of our activity, we already took immediate actions in two ways:

   1. We issued a circular letter to ALL involved shipowners in our data base recommending the immediate and thorough inspection of all cylinders on board their fleets and proposing unconditional replacement of all cylinders older than ten years (in respect to manufacturing date);

   2. We released an internal bulletin providing to our technical personnel specific instructions on how to improve the level of examination on nitrogen cylinders and, in particular, on how to recognize heavy signs of corrosion and other evident damage.

   It must be also stressed that the accident acutely made evident that a vacuum in the actual marine norms and regulations does exist. It is our firm conviction that a coordinate action by Flags administrations, international marine regulation bodies, naval registers as well as shipowners associations will be necessary to fill the current vacuum in order to avoid too much personal interpretation in this delicate; if not feasible to quickly develop specific marine rules, ashore heavy industry standards could be used as a pattern.

To the Director of Maritime New Zealand

1. The cylinder failed at below its normal working pressure because severe external corrosion had reduced the wall thickness from 4.81 mm to 1.45 mm (about 30% of its original thickness).

   The failed nitrogen cylinder and several other pressure cylinders within the stored energy system were not fit for purpose and should not have been in service.

   There is an urgent need for consistent and proper standards to be developed at a global level for maintaining, inspecting, testing and, where necessary, replacing high-pressure cylinders associated with stored energy systems on board ships.

   Under the applicable IMO requirements, the stored energy systems were to be examined annually for “satisfactory condition and operation”; however, the IMO did not provide any recommended minimum standards for the inspection, testing and rejection of pressure vessels that were part of a stored energy system. This resulted in different flag states having different minimum requirements for ensuring that pressure vessels remained in ‘satisfactory condition’. Some flag states had no minimum testing and rejection requirements for pressure vessels associated with stored energy systems.

   On 22 November 2018 the Commission recommended that the Director of Maritime New Zealand raise through the appropriate International Maritime Organization safety committee for its consideration, the implications for maritime safety of not having adequate minimum standards for the inspection, testing and rejection of pressure vessels that are part of a stored energy system. (030/18)

2. On 7 December 2018 Maritime New Zealand replied in part:

   To address the recommendation Maritime New Zealand intends to raise the issue with the relevant IMO body as soon as practicable, whether this is the Maritime Safety Committee, or one of its technical sub-committees. Once we are in a position to do so we will also ensure that New Zealand delegations to relevant IMO meetings are briefed to support work on the issue being progressed.

1. Any sign of corrosion on high-pressure cylinders should be fully investigated by a person competent in examining high-pressure cylinders before any remedial work is undertaken and the cylinders are allowed back into service.

International Maritime Organization (2016) Resolution MSC.402(96) Annex 1, Requirements for maintenance, thorough examination, operational testing, overhaul and repair of lifeboats and rescue boats, launching appliances and release gear.