Grounding of the Panamanian Passenger Ship Royal Majesty on Rose and Crown Shoal Near Nantucket, Massachussetts, June 10, 1995

Abstract: On June 10, 1995, the Panamanian passenger ship Royal Majesty grounded on Rose and
Crown Shoal about 10 miles east of Nantucket Island, Massachusetts, and about 17 miles from where the
watch officers thought the vessel was. The vessel, with 1,509 persons on board, was en route from St.
George’s, Bermuda, to Boston, Massachusetts.

There were no deaths or injuries as a result of this

accident. Damage to the vessel and lost revenue, however, were estimated at about $7 million.

This report examines the following major safety issues: performance of the Royal Majesty’s integrated
bridge system and the global positioning system, performance of the Royal Majesty’s watch officers,
effects of automation on watch officers’ performance, training standards for watch officers aboard
vessels equipped with electronic navigation systems and integrated bridge systems, and design,
installation, and testing standards for integrated bridge systems

As a result of its investigation, the National Transportation Safety Board issued safety recommendations
to Majesty Cruise Line, the U.S. Coast Guard, STN Atlas Elektronik GmbH, Raytheon Marine, the
National Marine Electronics Association, the International Electrotechnical Commission, the
International Council of Cruise Lines, the International Chamber of Shipping, and the International
Association of Independent Tanker Owners.

The National Transportation Safety Board is an independent Federal agency dedicated to promoting
aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the
agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate
transportation accidents, determine the probable causes of the accidents, issue safety recommendations,
study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in
transportation. The Safety Board makes public its actions and decisions through accident reports, safety
studies, special investigation reports, safety recommendations, and statistical reviews.

Information about available publications may be obtained by contacting:

National Transportation Safety Board
Public Inquiries Section, RE-51
490 L'Enfant Plaza, SW
Washington, DC 20594
(202) 314-6551

Safety Board publications may be purchased, by individual copy or by subscription, from:

National Technical Information Service
5285 Port Royal Road
Springfield, Virginia 22161
(703) 487-4600

EXECUTIVE SUMMARY

About 2225 on June 10, 1995, the Panama-

nian passenger ship Royal Majesty grounded on
Rose and Crown Shoal about 10 miles east of
Nantucket Island, Massachusetts. The vessel,
with 1,509 persons on board, was en route from
St. George’s, Bermuda, to Boston, Massachu-
setts. Initial attempts to free the vessel were un-
successful. Deteriorating weather and sea con-
ditions prevented the evacuation of passengers
and crewmembers from the vessel.

On June 11, the Royal Majesty, with the aid

of five tugboats, was freed from its strand. Ini-
tial damage surveys revealed deformation of the
vessel’s double bottom hull. However, no pene-
tration or cracking of the hull was detected, and
no fuel oil had been spilled. The U.S. Coast
Guard gave the vessel permission to proceed to
Boston. On June 12, the vessel arrived in Boston
and disembarked its passengers.

There were no deaths or injuries as a result

of this accident. Damage to the vessel and lost
revenue, however, were estimated at about $7
million.

The National Transportation Safety Board

determines that the probable cause of the
grounding of the Royal Majesty was the watch
officers’ overreliance on the automated features
of the integrated bridge system, Majesty Cruise
Line’s failure to ensure that its officers were
adequately trained in the automated features of
the integrated bridge system and in the implica-
tions of this automation for bridge resource
management, the deficiencies in the design and
implementation of the integrated bridge system
and in the procedures for its operation, and the
second officer’s failure to take corrective action
after several cues indicated the vessel was off
course.

Contributing factors were the inadequacy of

international training standards for watch-
standers aboard vessels equipped with electronic
navigation systems and integrated bridge sys-
tems and the inadequacy of international stan-
dards for the design, installation, and testing of
integrated bridge systems aboard vessels.

This report examines the following major

safety issues:

•

Performance of the Royal Majesty’s
integrated bridge system and the
global positioning system.

•

Performance of the Royal Majesty’s
watch officers.

•

Effects of automation on watch of-
ficers’ performance.

•

Training standards for watch offi-
cers aboard vessels equipped with
electronic navigation systems and
integrated bridge systems.

•

Design, installation, and testing
standards for integrated bridge sys-
tems.

As a result of its investigation of this acci-

dent, the Safety Board issued safety recommen-
dations to Majesty Cruise Line, the U.S. Coast
Guard, STN Atlas Elektronik GmbH, Raytheon
Marine, the National Marine Electronics Asso-
ciation, the International Electrotechnical Com-
mission, the International Council of Cruise
Lines, the International Chamber of Shipping,
and the International Association of Independent
Tanker Owners.

The Accident

About 2225

on June 10, 1995, the Panama-

nian passenger ship Royal Majesty (see figure 1)
grounded on Rose and Crown Shoal near Nan-
tucket Island, Massachusetts. The Royal Maj-
esty, carrying 1,509 passengers and crewmem-
bers, was en route from St. George’s, Bermuda,
to Boston, Massachusetts. No injuries or deaths
resulted from the grounding.

On the night of the accident, the Royal Maj-

esty was on the last day of a 7-day voyage. The
ship had left Boston for Bermuda on June 5. The
vessel had arrived in St. George’s on June 7,
where it was berthed until it departed Bermuda
on June 9 for the return trip to Boston. The ves-
sel was scheduled to arrive in Boston about
0530 on June 11.

The return trip to Boston was divided into

two legs. The first leg normally extended from
St. George’s to the entrance of the approach to
the Port of Boston Traffic Separation Scheme
(Boston traffic lanes)—a distance of more than
500 miles over open ocean. The second leg
normally took the vessel in a northerly direction
through the traffic lanes along the eastern edge
of Nantucket Shoals and around the eastern
shores of Cape Cod. The entire voyage to Bos-
ton (a distance of about 677 miles—see figure
2) normally took about 41 hours.

The navigator testified that on June 9, he

went on duty about an hour before the scheduled
departure time of 1200. He said that he custom-
arily tested the vessel’s navigational equipment
before getting underway. He stated that when he
tested the navigation equipment, including
“compasses, repeaters, radars, NACOS 25, GPS,
Loran-C, and the communications systems”
during the half hour before the vessel departed
St. George’s, he found the equipment to be in

This report uses eastern standard times based on the 24-

hour clock.

“perfect” operating condition. He said that
shortly after departure, he set the navigation and
command system (NACOS) 25 autopilot on the
navigation (NAV) mode.

He further stated that

later when the vessel dropped off the harbor pi-
lot (about 1230), he compared the position data
displayed by the global positioning system
(GPS)

and by the Loran-C

and found that the

two sets of position data indicated positions
within about a mile

of each other.

According to the watch officers on duty, the

northbound trip was uneventful during the first
24 hours. The watch officers stated that the
Royal Majesty followed its programmed track,
as indicated on the display of the automatic ra-
dar plotting aid (ARPA) maintaining a course of
about 336°.

A description of the vessel’s radar and navigational

equipment is contained in a section on vessel information
later in the report. When set on the NAV mode, the
NACOS 25 autopilot automatically corrected for the effect
of set and drift caused by the wind, sea, and current to keep
the vessel within a preset distance of its programmed track.

The GPS is a satellite-based radio navigation system de-

signed to provide continuous and accurate position data
under all weather and sea conditions. The accuracy of the
system is based on the GPS unit’s ability to receive, iden-
tify, and measure radio signals from orbiting satellites. The
GPS receiver on the Royal Majesty, when fully operational,
was capable of providing position data accurate to within
100 meters to the NACOS 25 autopilot (see discussion later
in this section).

The Loran-C is a radio-based navigation system de-

signed to provide position data along the coasts of the
United States. The system is based on the Loran-C unit’s
ability to receive, identify, and measure time-difference
radio signals from a series of land-based Loran stations.
The accuracy of the system is largely dependent on the
user’s location in relation to the transmitting stations. For
example, the Loran lines of position in the Bermuda area
cross at oblique angles, whereas along the U. S. coast, nu-
merous lines of position cross at much sharper angles to
provide greater accuracy.

In this report, the term mile means nautical mile.

Unless otherwise specified, only true courses and bear-

ings are noted in this report.

INVESTIGATION

At 1200 on June 10, the navigator was again

on watch, assisted by a quartermaster. Accord-
ing to the navigator, the Royal Majesty main-
tained its course of 336°, and its speed was 14.1
knots (over ground). Entries in the vessel’s
bridge log indicated cloudy skies, winds out of
the east-northeast at 8 knots, and seas between 1
and 3 feet. Meteorological visibility was report-
edly at least 10 miles.

The navigator stated that during his watch,

he was using the port ARPA on the 12-mile-
range scale. (See figure 3.) He also stated that
he was plotting hourly fixes on the chart of the
area using position data from the GPS. He stated
that although he frequently checked the position
data displayed by the Loran-C, all of the fixes
that he plotted during the voyage from Bermuda
were derived from position data taken from the
GPS and not the Loran-C. (See figure 4. In the
lower photograph, the lower receiver was in-
stalled after the accident.) The navigator further
stated that in the open sea near Bermuda, the
positions indicated by the GPS and Loran-C
would have been expected to be within ½ to 1
mile of each other. As the vessel approached
closer to the United States, the positions would
have been expected to be within about 500 me-
ters of each other.

At 1600, the watch changed, and the ves-

sel’s chief officer relieved the navigator. The
chief officer was assisted by a quartermaster,
who acted as either a helmsman or a lookout on
an as-needed basis. The chief officer stated that
he used the port radar set on the 12-mile range.
He further stated that no procedure specified the
number of radars to use, but that usually two
were used in bad weather. He stated that be-
cause the weather was good and visibility was
clear, he used one radar. The chief officer also
indicated that he relied on the position data from
the GPS to plot hourly fixes during his watches
and that the Loran-C was used as a backup sys-
tem in case the GPS malfunctioned. He stated,
however, that for the 1700 and 1800 hourly
fixes he compared the data from the GPS with
the data from the Loran-C and that in both in-
stances the Loran-C indicated a position about 1
mile to the southeast of the GPS position.

The chief officer testified that before the

1700 hourly fix, at about 1645, the master tele-
phoned the bridge and asked him when he ex-
pected to see the BA buoy, the buoy that marked
the southern entrance to the Boston traffic lanes
(see figure 5). The chief officer responded that
the vessel was about 2½ hours away (35.25
miles at 14.1 knots) from the buoy. The master
testified that he asked the chief officer to call
him when he saw the buoy. According to the
chief officer, about 45 minutes later (1730), the
master visited the bridge, checked the vessel’s
progress by looking at the positions plotted on
the chart and at the map overlay exhibited on the
ARPA display, and asked a second time whether
the chief officer had seen the BA buoy.

The

chief officer responded that he had not. Shortly
thereafter, the master left the bridge.

According to the chief officer, about 1845,

he detected on radar a target off his port bow at
a range of about 7 miles and concluded that the
target was the BA buoy. He stated that his con-
clusion had been based on the GPS position
data, which indicated that the Royal Majesty
was following its intended track, and on the fact
that the target had been detected about the time,
bearing, and distance that he had anticipated
detecting the BA buoy. He further testified that
on radar the location of the target coincided with
the plotted position of the buoy on the ARPA
display. He said that about 1920, the radar target
that he believed to be the BA buoy passed down
the Royal Majesty’s port side at a distance of 1.5
miles. He stated that he could not visually con-
firm the target’s identity because of the glare on
the ocean surface caused by the rays of the set-
ting sun.

He testified that about 1930, the master

telephoned the bridge and asked him for the
third time whether he had seen the BA buoy.
According to the chief officer, he responded that

The master testified that it was his practice to visit the

bridge about 10 to 15 minutes after the change of the watch
and that he typically called or visited the bridge between
two and four times during each watch. Each visit to the
bridge lasted between 10 and 15 minutes. He also testified
that when he visited the bridge he typically checked the
vessel’s position by looking around and by examining the
chart and the NACOS 25 map overlay on the ARPA.

the ship had passed the BA buoy about 10 min-
utes earlier (about 1920). The master then asked
whether the chief officer had detected the buoy
on radar; the chief officer replied that he had.
According to the testimony of the chief officer
and the master, the chief officer did not tell the
master that he had been unable to visually con-
firm the identify of the BA buoy, and the master
did not ask whether the buoy had been visually
confirmed.

The second safety officer (second officer)

testified that he arrived on the bridge about 1955
and prepared to assume the watch from the chief
officer. According to the testimony of both offi-
cers, during the subsequent change-of-the-watch
briefing (2000), they discussed the traffic con-
ditions and the vessel’s course, speed, and posi-
tion. According to the testimony, the chief offi-
cer did not discuss with his relief the circum-
stances surrounding his identification of the BA
buoy. The second officer testified that at 2000,
he assumed the watch, assisted by two quarter-
masters,

and that the chief officer left the

bridge. The second officer stated that shortly
after assuming the watch, he reduced the range
setting on the port radar from the 12-mile range
to the 6-mile range. He testified that he relied on
the position data from the GPS in plotting
hourly fixes during his watches and that he con-
sidered the Loran-C to be a backup system. He
also stated that it was not his practice to use the
Loran-C to verify the accuracy of the GPS.

The quartermaster standing lookout on the

port bridge wing (port lookout) stated that about
2030 he saw a yellow light off the vessel’s port
side and reported the sighting to the second offi-
cer. According to the quartermaster, the second
officer acknowledged the report, but took no
further action. At the time of the sighting, the
NACOS 25 was showing the Royal Majesty’s
position to be about halfway between the BA
and BB buoys. (The BB buoy is the second buoy
encountered when traveling northbound in the
Boston traffic lanes.) Shortly after the sighting
of the yellow light, both the starboard and port
lookouts reported the sighting of several high

The two quartermasters served as port and starboard

lookouts.

red lights off the vessel’s port side.

According

to the lookouts, the second officer acknowl-
edged the report, but took no further action.

The port lookout stated that shortly after the

sightings of the yellow and red lights, the master
came to the bridge. The master testified that he
spent several minutes talking with the second
officer and checking the vessel’s progress by
looking at the plotted fixes on the chart and the
map overlay on the ARPA display. According to
the master, the GPS and ARPA displays were
showing that the vessel was within 200 meters
of its intended track. The master then left the
bridge. According to the testimony of both the
master and the second officer, no one told the
master about the yellow and red lights that the
lookouts had sighted earlier.

The master testified that about 2145, he

telephoned the bridge and asked the second offi-
cer whether he had seen the BB buoy. The mas-
ter stated that the second officer told him that he
had seen it.

According to the master, about 2200 he ar-

rived on the bridge for the second time during
that watch. He testified that after talking with
the second officer for several minutes, he
checked the vessel’s progress by looking at the
positions plotted on the chart and at the map
overlay on the ARPA display. He stated that he
again asked the second officer whether he had
seen the BB buoy and the second officer replied
that he had. Satisfied that the positions plotted
on the chart and that the map displayed on the
radar continued to show the vessel to be fol-
lowing its intended track, the master left the
bridge about 2210. He stated that he did not
verify the vessel’s position using either the GPS
or the Loran-C for two reasons: (1) his officers
had reported that the BA and BB buoys had
been sighted, and (2) he had observed that the
map overlay on the ARPA display showed that
the vessel was following its intended track.

A series of radio towers with flashing red lights are on

the eastern end of Nantucket. Because the towers are about
30 miles from the traffic lanes, the lights are not generally
visible to vessels transiting the traffic lanes.

The second officer testified that he had not

seen the BB buoy but had informed the master
otherwise because he had “checked the GPS and
was on track” and because “perhaps the radar
did not reflect the buoy.” He also testified that
on the previous transits of the traffic lanes, he
had sighted buoys both visually and by radar.

According to the testimony of the lookouts,

a few minutes after the master left the bridge,
the port lookout reported to the second officer
the sighting of blue and white water dead ahead.
According to this lookout, the second officer
acknowledged receiving the information, but did
not discuss it or take action. The port lookout
stated that the vessel later passed through the
area where the blue and white water had been
sighted.

The second officer testified that about 2220,

the Royal Majesty unexpectedly veered to port
and then sharply to starboard and heeled to port.
The second officer stated that because he was
alarmed and did not know why the vessel was
sheering off course, he immediately switched
from autopilot to manual steering. The master,
who was working at his desk in his office, felt
the vessel heel to port and ran to the bridge. He
stated that when he arrived on the bridge, he
saw the second officer steering the ship manu-
ally and instructed one of the lookouts to take
over the helm. The master then turned on the
starboard radar, set it on the 12-mile range,

and observed that Nantucket was less than 10
miles away. According to the master, he imme-
diately went into the chart room to verify his
position. He stated that he then immediately or-
dered the helmsman to apply hard right rudder.
However, before the helmsman could respond,
the vessel grounded, at 2225. The master stated
that he then had the vessel’s GPS and Loran-C
checked and realized for the first time that the
GPS position data was in error by at least 15
miles. The Loran-C position data showed the
vessel where it had grounded, about 1 mile

According to the master, the starboard radar was typi-

cally turned off during good weather. When he used the
starboard radar, he normally set it on the 12-mile range. He
further stated that no procedures prescribed the radar scale
to use; it was the option of the watch officer on duty.

south of Rose and Crown Shoal.

(See figure

6.) Charts of the area indicate that the shoal,
which is about 10 miles east of Nantucket’s
Sankaty Head Light, has a hard sandy bottom.

Postaccident Events

The master testified that immediately after

the grounding, he called the engineroom and
told the engineering officer on duty that the ves-
sel had grounded and that he should immedi-
ately inspect the vessel’s double bottom hull and
fuel tanks for signs of leakage. According to the
master, several minutes later, the engineroom
called the bridge and reported that there was no
evidence that the vessel was taking on any wa-
ter. The master responded by asking the engin-
eroom personnel to repeat the inspection, which
they did. The master stated that about 2245 the
engineroom again reported to him that no evi-
dence of leakage had been found. Shortly there-
after, the master instructed the vessel’s cruise
director to inform the passengers and crewmem-
bers that the vessel had run aground, that it was
not in any danger, and that the crew was trying
to free the vessel by using its engines. At 2310,
the U.S. Coast Guard, after receiving a message
from a passenger via cellular telephone, called
the Royal Majesty, at which point the Royal
Majesty requested Coast Guard assistance. Ac-
cording to the testimony of the master, he had
been about to notify the Coast Guard when the
Coast Guard called him.

Several unsuccessful attempts were made

between 2245 and 0015 to free the vessel using
the main engines. Shortly thereafter, Majesty
Cruise Line, the owner of the vessel, made

Rose and Crown Shoal is one of numerous shoals that

lie east and south of Nantucket Island, making the area one
of the most dangerous for ships. (See “Waterway Informa-
tion” later in this report for a more detailed discussion.)

According to 46 Code of Federal Regulations 4.05-

1(a), immediately after the addressing of resultant safety
concerns, the owner, agent, master, operator, or person in
charge shall notify the nearest Marine Safety Office, Ma-
rine Inspection Office, or Coast Guard Group Office when-
ever a vessel is involved in a marine casualty consisting of
an unintended grounding. According to the Coast Guard,
the time interval was reasonable and the Coast Guard took
no enforcement action regarding the notification.

arrangements to hire tugboats to pull the vessel
off the shoal.

At 0024 on June 11, the passengers were

told that the efforts to free the vessel had been
unsuccessful and that the vessel was awaiting
the arrival of tugboats. Later that morning, the
passengers were told that they and their luggage
would be transferred to ferries for transport to
Hyannis, Massachusetts, and then to Boston.

At 1330 on June 11, the ferries M/V Brant

Point and Point Gammon arrived on scene.

The Brant Point and Point Gammon together
could hold about 1,200 persons.

At 1550, the tugboats Vincent Tibbets, Har-

old Rheinhauer, Resolute, Reliance, and Venus
arrived on scene. Meanwhile, sea conditions
continued to deteriorate. About 1600, plans to
offload passengers to the ferries were canceled
because sea conditions had become too hazard-
ous. Shortly thereafter, the Brant Point and the
Point Gammon returned to Hyannis.

At 2154, the Royal Majesty, with the aid of

five tugboats, was refloated and escorted to a
safe anchorage near Chatham, Massachusetts,
where the damage was surveyed. At 0742 on the
morning of June 12, the Coast Guard gave the
vessel permission to begin the 6-hour trip to
Boston. At 1535, the vessel was safely moored
with its port side to the Black Falcon Passenger
Terminal in Boston. Passengers began disem-
barking the vessel at 1710.

The Coast Guard/Safety Board hearing into

the grounding of the Royal Majesty was held
June 14 through June 16 in Boston. After the
hearing, the Safety Board learned that two fish-
ing vessels were just east of Fishing Rip Shoal
on the evening of June 10. They observed a
cruise ship pass about ¾ mile west of the fishing
vessels’ position heading in a northerly direc-
tion. About 2042, one of the fishing vessels ra-
dioed a cruise ship at “41 02N, 69 24W” via
VHF-FM channel 16. They later stated it was
their intent to inform the vessel that it was in an

Hyline Cruises in Hyannis, Massachusetts, owned and

operated the two ferries. Hyline Cruises operates a ferry
service between Cape Cod and Nantucket and Martha’s
Vineyard.

area not frequented by large cruise ships. The
calls to the cruise ship were in English; how-
ever, all the transmissions between the fishing
vessels, including the transmission regarding the
ship being in the wrong location, were in Portu-
guese. An unknown person interrupted the Por-
tuguese conversation and requested that the
fishermen change channels. (See appendix F.)

According to international regulations

(SOLAS-Regulation 8), when ships such as the
Royal Majesty are at sea they are required to
maintain a continuous listening watch on the
navigating bridge on 156.8 MHz (channel 16).
During the Coast Guard Marine Board of In-
quiry, the second officer was not asked whether
he was monitoring channel 16 on the night of
the accident.

Since that time, a spokesperson

for Majesty Cruise Line has identified the per-
son who interrupted as possibly the second offi-
cer. The Safety Board could not confirm this.
According to the Coast Guard, the call to the
cruise ship from the fishing vessel did not con-
vey any urgency and would not have alerted the
second officer aboard the Royal Majesty or the
radio operator at U.S. Coast Guard Group
Woods Hole, where the transmissions were re-
corded, that the Royal Majesty or any other
cruise ship was in danger.

Injuries

The accident did not cause any deaths or

injuries.

Vessel Damage

On June 16, the Royal Majesty left Boston

for the Sparrows Point Shipyard in Baltimore,
Maryland, where it was drydocked and repaired.
The grounding of the Royal Majesty had dam-
aged its outer hull extensively. According to the
field survey conducted by Lloyds Register on
June 19, a portion of the vessel’s outer shell
plating, which was about 51 feet wide and 41
feet long, needed to be cropped and renewed.
The report also indicated that the bottom fuel oil

The second officer was released by Majesty Cruise

Line after the accident and is not available in this country.

tanks and the internal steel structure between the
vessel’s internal tank tops and hull plating had
been substantially damaged. No oil spilled as a
result of the accident.

On June 22, the vessel was refloated and

returned to Boston. On June 24, the vessel re-
sumed passenger service. Total structural dam-
age was estimated at about $2 million. Lost
revenue for the period the vessel was out of
service was estimated at about $5 million.

Crew Information

Master.—The master, age 53, held a mas-

ter’s certificate for seagoing vessels that had
been issued by Panama on June 7, 1991. He also
held a master’s certificate from the Greek gov-
ernment that was originally issued in 1974. He
had been going to sea for 32 years. During his
career, he had served in a variety of licensed
deck officer positions on tankships and passen-
ger ships. Between 1968 and 1992, he had sailed
as chief officer and master on several passenger
vessels built in the 1950s. Majesty Cruise Line
assigned him as master of the Royal Majesty in
November 1992. He stated that the Royal Maj-
esty was the first vessel that he had served on
that had an integrated bridge system.

The master testified that he had not con-

sumed any alcohol before the grounding, that he
had not taken any prescription medicine, and
that he was not required to wear eyeglasses. He
stated that he typically slept about 7 hours each
night, from 2400 to 0700, and then took a 1-hour
or 1½-hour nap in the afternoon, schedule per-
mitting.

Chief Officer.—The chief officer, age 43,

held a master’s certificate for seagoing vessels
that had been issued by Panama on May 20,
1994. He also held a chief officer’s certificate
issued by the Greek government in 1982. He had
been going to sea since 1971. During his career,
he had served in a variety of licensed deck offi-
cer positions on cargo ships, tankships, and pas-
senger ships. Between 1981 and 1992, he had
been chief officer on four passenger vessels

“Vessel Information,” the next section of the report,

discusses integrated bridge systems.

built in the 1950s. Majesty Cruise Line hired
him as chief officer on the Royal Majesty in
1992. The Royal Majesty was the first vessel he
had served on that had an integrated bridge sys-
tem. At the time of the grounding, he had spent
30 of the previous 36 months as a bridge watch
officer aboard the Royal Majesty.

The chief officer stated that routinely after

finishing his 1600-to-2000 watch, he would jog
on deck (weather permitting) for about 45 min-
utes, work out in the vessel’s gym for about 15
minutes, and retire around 2200. He normally
slept until about 0330. He stated that typically
he also slept about 2½ hours before starting his
1600 watch.

Navigator.—The navigator, age 30, held a

second officer’s certificate for seagoing vessels
that had been issued by the Greek government
on May 18, 1994. He also held a second offi-
cer’s license from Panama. He had been going
to sea in a licensed capacity since March 20,
1987. During his career, he had served 8 months
as second officer on a tankship and 7 months as
second officer on two passenger ships that had
been built in the 1950s. Majesty Cruise Line
hired him as a second officer on the S/S Se-
abreeze on July 18, 1994. He was assigned as
navigator aboard the Royal Majesty on August
1, 1994. The Royal Majesty was the first vessel
that he had served on that had an integrated
bridge system.

The navigator testified that he had not con-

sumed alcohol in the 24 hours before his last
watch, that he was not taking any prescription
drugs, and that he was not required to wear eye-
glasses.

Second Officer.—The second officer, age

33, held a chief officer’s certificate for seagoing
vessels that had been issued by the Greek gov-
ernment on January 4, 1991. He also held a
chief officer’s license from Panama. He had
been going to sea in a licensed capacity since
May 1984. During his career, he had served in a
variety of licensed deck officer positions on

There was no information in the navigator’s testimony

about the amount of sleep he received in the 24 hours be-
fore his last watchstand or about his sleep pattern.

bulk carriers and passenger ships. He had sailed
as second officer and chief officer on five pas-
senger vessels between 1987 and 1994. Majesty
Cruise Line hired him as a second officer on
May 1, 1995. After 3 weeks of on-the-job train-
ing, the master allowed him to stand a naviga-
tion watch alone. On May 21, 1995, he assumed
his duties as watch officer for the 0800-to-1200
watch. The Royal Majesty was the first vessel
that he had served on that had an integrated
bridge system.

The second officer testified that he had not

consumed alcohol or taken any prescription
medicine in the 24 hours before his last watch.
He stated that he slept about 7 hours after fin-
ishing his previous 2000-to-2400 watch and that
he had also taken a 2-hour nap before beginning
his 2000 watch on June 10.

Vessel Information

General.—The Royal Majesty was a con-

ventional steel-hull, bulbous-bow, passenger
liner designed for unrestricted international
voyages. The vessel was constructed in 1992 at
Kvaener Masa Yard in Turku, Finland. Panama
had certified the vessel to carry 1,256 passen-
gers and 490 crewmembers, a total of 1,746 per-
sons. The vessel held the highest vessel classifi-
cation for construction issued by Det Norske
Veritas (DNV). The vessel’s principal charac-
teristics follow:

Length overall:

568 feet (173.16 meters)

Breadth:

91 feet (27.60 meters)

Draft (departure
Bermuda):

forward: 18 feet, 0.5 inches
(5.5 meters); aft: 19 feet, 6
inches (5.95 meters)

Gross registered
tonnage:

32,396

Displacement:

17,214 tons

Service speed:

19 knots

Propellers:

two controllable pitch

The Royal Majesty was fitted with the fol-

lowing navigation, communications, shiphan-
dling, and collision-avoidance equipment:

Radar:

Two Krupp Atlas

Model 8600

A/CAS with ARPA

Radar:

One Krupp Atlas slave radar
with ARPA

Autopilot: STN Atlas Elektronik
GPS:

Raytheon RAYSTAR 920 with
dead-reckoning backup mode option
installed (NNE-205 DR interface)

Loran-C:

Raytheon RAYNAV 780

VHF radios: Two Sailor radios (with dual

monitoring capabilities)

Speed log:

Atlas Dolog 23

Gyro
compass:

Anschutz

Course
recorder:

Anschutz

Integrated Bridge System.—The Royal

Majesty had an integrated bridge system. Ac-
cording to the definition of the International
Electrotechnical Commission (IEC),

issued

after the vessel was built, an integrated bridge
system is a combination of systems that are in-
tegrated in order to allow centralized access to
sensor information and command/control from
workstations. One of the main components of
the vessel’s integrated bridge system was STN
Atlas Elektronik (STN Atlas) NACOS 25.

The

NACOS 25 was a special upgrade of the first
generation NACOS 20 integrated navigation
system, of which approximately 130 have been
sold and installed on vessels of various types
and service.

The NACOS 25 was specifically

designed for service on six Baltic Sea ferries
constructed at Kvaener Masa Yard. Some were
sold to Italian vessel owners. According to STN
Atlas, 14 NACOS 25 units were sold to owners
of passenger ships. The last unit was sold in
May 1988 to the shipyard constructing the Royal
Majesty. However, because of construction de-
lays, the Royal Majesty’s NACOS 25 equipment

Krupp Atlas was the previous name of STN Atlas

Elektronik.

A later section of the report discusses the IEC and in-

tegrated bridge systems in general.

According to STN Atlas, 260 such units have been sold

worldwide; 200 are currently in service. (Safety At Sea.
June 1995, page 36.)

was held in stock until installation in the spring
of 1992.

The Royal Majesty’s NACOS 25 was capable of
creating radar maps and exhibiting them on the
ARPA display (see figure 7). The radar maps
could be tailored to include reference points
along the vessel’s intended track (aids to navi-
gation, navigation marks, waypoints, turning
points, etc.). Navigation lines could also be
added to these maps for the purpose of outlining
the perimeter of traffic lanes, channels, and ar-
eas containing hazards to safe navigation.

The navigator testified that a radar map had

been created for the voyage between St.
George’s and Boston. He also testified that the
map, showing the vessel’s preprogrammed
track, waypoints, and the location of the buoys
near the intended track, was exhibited on the
ARPA display before the accident.

The autopilot portion of the NACOS 25,

using programmed information (latitude and
longitude of waypoints and the vessel’s maneu-
vering characteristics), gyro and speed data, and
position data from the GPS or the Loran-C, was
capable of automatically steering the vessel
along a preprogrammed track. When engaged
and operating in the NAV mode, the autopilot
steered the ship in accordance with the pro-
grammed track while automatically compensat-
ing for the effect of gyro error, wind, current,
and sea. According to the Royal Majesty’s
bridge officers, the NACOS 25 autopilot was
engaged and operating in the NAV mode from
the time the vessel departed St. George’s (1400
on June 9) to before the grounding.

The Raytheon GPS unit installed on the

Royal Majesty had been designed as a stand-
alone navigation device in the mid- to late
1980s, when navigating by dead reckoning
(DR)

was common and before the GPS satel-

lite system was fully operational. The GPS unit
was designed to default to either a DR mode or

DR is a means of navigating. After an initial position is

established, the position is estimated over time using data
input from the vessel’s speed log and gyro. The accuracy of
DR calculations depends on the accuracy of the speed input
and the effects of wind and current.

a hybrid navigation mode (accepting position
data from a Loran-C, Omega, or Transit satellite
navigation receiver). The Royal Majesty’s GPS
was configured by Majesty Cruise Line to
automatically default to the DR mode when sat-
ellite data were not available.

When the

RAYSTAR 920 GPS unit switches to DR mode,
it

•

issues a series of aural chirps simi-
lar to those of a wristwatch alarm
(the total duration of the series is 1
second);

•

continuously displays SOL (solu-
tion)

and DR on a liquid crystal

display; the display measures 3
inches high by 3.5 inches wide (see
figure 8);

•

changes the state of National Ma-
rine Electronics Association
(NMEA)

0183 status field bits

from valid to invalid, indicating that
valid position data are no longer
being transmitted; and

•

closes an electronic switch that is
provided as a means of activating an
external alarm or other device of the
installer’s choice (such as an exter-
nal flashing light, audio alarm,
etc.).

RAYSTAR 920 DR mode capability requires course

and speed input either by manual entry or via an optional
interface box. The Royal Majesty’s RAYSTAR 920 was
configured to use the DR interface box. According to STN
Atlas, during the construction of the Royal Majesty, STN
Atlas was told that the GPS would be backed up by a Lo-
ran-C system during periods of GPS data loss, but was not
told that the GPS receiver would default to the DR mode.

Raytheon engineers informed the Safety Board that

SOL is meant to indicate that the GPS satellite position
solution is invalid or not available. According to the Ray-
star 920 operation manual, SOL means the unit cannot
calculate its lat/long position.

The NMEA 0183 is an industry-standard electronic

signal specification that defines how data are to be trans-
mitted from an electronic device.

An external alarm was not connected to this switch on

the Royal Majesty.

All the watch officers testified that they did

not see SOL and DR displayed on the GPS unit
during their watches before the grounding. Their
testimony indicated that they understood the
meaning of these symbols and had seen them on
previous occasions.

The Raytheon RAYSTAR 920 GPS and the

Raytheon RAYNAV 780 Loran-C were de-
signed to output position and other navigation
data in NMEA 0183 v1.5 format.

The output

included the recommended minimum GPS data
sentence, RMC, which contained, among other
data, latitude/longitude position coordinates.

A position receiver that transmits data is a
“talker” device in NMEA nomenclature; the
Raytheon 920 GPS identified itself as a GP
talker, which signified a GPS position receiver
sending GPS position data. A position receiver
such as the Raytheon 920 GPS, while operating
in different position modes, could identify itself
as an integrated instrument (II) talker. At the
time the system was designed, the NMEA speci-
fied a SYS sentence to identify the operational
mode of a hybrid system. The SYS sentence de-
fines the mode in which the receiver is operat-
ing: GPS (G), Loran (L), Omega (O), Transit
(T), or Decca (D). However, DR is not a speci-
fied system mode in the NMEA 0183 SYS sen-
tence. Thus, Raytheon designed the 920 GPS to
identify itself as a “GP” talker regardless of
GPS or DR mode and used the NMEA 0183
valid/invalid data bits as the means of notifying
“listeners” that its data were invalid when in DR
mode. However, the sentence formatter GDP
was available in NMEA 0183 v1.5 to indicate
dead reckoned geographic position fixes.

Although both the GPS and Loran-C simul-

taneously sent position data to the NACOS 25,
the NACOS 25 was designed to use position
data from only one external position receiver at

NMEA 0183 v1.5 was released in December 1987.

According to STN Atlas, the NACOS, at the time of

delivery for Royal Majesty, was programmed to read the
NMEA 0183 v1.1 sentence GLL (geographic longi-
tude/latitude) for position input. The sentence RMC was
only introduced with the NMEA 0183 v1.5 after the design
of the Radar Atlas 8600 was finished. (The radar provides
the interfaces to the position receiver(s), in a NACOS sys-
tem.)

a time, as selected by the crew. That is, the
NACOS 25 was not designed to compare the
GPS and the Loran-C position inputs, nor was it
designed to display both sets of position data to
the bridge officers simultaneously so that they
could compare the data. On June 9 and through-
out the voyage, the autopilot was set by the crew
to accept and display position data from the
GPS receiver, which was the position receiver
normally selected by the crew during the 3 years
the vessel had been in service.

Once the position receiver is selected, the

NACOS 25 recognizes the chosen position re-
ceiver based on the talker identifier codes in the
NMEA 0183 data stream; for example, GP in
the data stream from the Raytheon 920 GPS.
According to STN Atlas, its designers did not
expect a device identifying itself as GP to send
position data based on anything other than GPS
satellite data, particularly not DR-derived posi-
tion data. Further, STN Atlas expected invalid
GPS position data to be recognizable by nulled
position data fields, by halted data transmission,
by a separate proprietary SLL sentence,

or by

no changes in the position latitude/longitude.
The latter case would trigger the NACOS posi-
tion-fix alarm; the other cases would cause the
NACOS to switch its position input to estimated
(its own DR mode) and to highlight this infor-
mation at all NACOS and radar displays until
the transmission is resumed and/or the SLL sen-
tence contains the valid data bit.

According to the NMEA, NMEA 0183 pro-

vides three methods to indicate whether the
transmitted data are inaccurate or unavailable:
(1) null fields where the sentence is transmitted
but no data are inserted in the fields in question;
(2) by using system-specific status sentences
(available only for Loran-C; and (3) by the use
of “status” or “quality indicator” characters in
specific sentences. There are no other provisions
within NMEA 0183 to indicate invalid data in
transmitted sentences. In version 1.5, the use of

NMEA 0183 provides proprietary data sentences for

special use between devices produced by the same manu-
facturer, but not between devices by two different manu-
facturers unless the two different manufacturers have coor-
dinated use of such data sentences.

null fields is the most common method, as most
sentences do not have status fields. According to
STN Atlas’s interpretation of this specification,
when a position receiver with a GPS talker
identifier has no GPS position data available, it
must transmit null fields instead.

The NACOS 25 autopilot was programmed

to continuously calculate its own independent
DR position in order to provide a comparison
with the position data provided by the external
position receiver (GPS or the Loran-C in the
case of the Royal Majesty). If the autopilot’s DR
position and the external position-receiver’s po-
sition (GPS or Loran-C positions in the case of
the Royal Majesty) are within a specified dis-
tance of each other,

the autopilot considers the

position data from the external position receiver
to be valid, makes any necessary course correc-
tions, and uses the new external position re-
ceiver’s position to continue its own independ-
ent DR calculations. If, however, the two posi-
tions are more than the specified distance apart,
the autopilot sounds a loud alarm

and presents

a visual indication (warning position fix) on all
the NACOS displays, including the radars,
meaning that a position discrepancy has been
detected that requires the watch officers’ imme-
diate attention. If the lateral distance between
the GPS position and the preprogrammed track
line exceeds the specified distance, the autopilot
sounds a loud alarm and presents a visual indi-
cation (warning track limit exceeded) on the
NACOS display, meaning that the vessel is off
the intended track.

The navigator stated that during the 11

months he had been aboard the vessel, he had
observed a phenomenon he called “chopping.”
Other deck officers stated that they too had wit-
nessed this phenomenon. According to the navi-
gator, chopping occurred when, for whatever

The NACOS 25 autopilot has off-track and position-fix

alarms that allow the operator to set the off-track and posi-
tion-comparison limits anywhere between 10 and 990 me-
ters. On the day of the accident, the limit was set at 200
meters. This value, which is displayed to the crew as
TRACK LIMIT, is used for both the off-track and the posi-
tion-fix alarm calculations.

The alarm is designed to be audible within a range of

about 10 meters under normal ambient noise conditions.

reason, the position data displayed by the GPS
were unreliable. Majesty Cruise Line’s elec-
tronics technician and the Raytheon staff indi-
cated that chopping could have been the result
of atmospheric interference with GPS signals or
the obstruction of the GPS antenna’s view of the
satellites by the vessel’s superstructure and/or
tall buildings or other structures while the vessel
was in port. These circumstances degraded the
GPS signal, changing the calculated position,
and consequently caused the radar map display
to jump erratically, which the crew referred to
as chopping.

According to the navigator’s testimony,

when chopping occurred, the 1-second series of
aural chirps sounded and SOL and DR appeared
on the GPS display. The master testified that
chopping also usually set off the NACOS 25
position-fix alarm, indicating that the difference
between the NACOS 25 DR position and the
GPS position was greater than 200 meters. He
stated that watchstanders had found, through
trial and error, that if they acknowledged the
alarm before switching to the COURSE mode,

the autopilot automatically accepted the errone-
ous position data and the radar map moved
about the ARPA display. To avoid this, watch-
standers switched the autopilot from the NAV
mode to the COURSE mode before acknowl-
edging the alarm. Thus, they could use the map
until the GPS returned to normal. According to
the master, chopping generally lasted a few
minutes. Nothing in the testimony of the watch
officers suggested that chopping had occurred
during the trip from Bermuda to Boston.

According to Majesty Cruise Line, the GPS

antenna, originally installed on the radar mast,
had been moved in February 1995, several
months before the grounding, as part of an effort
to eliminate the chopping. Majesty Cruise
Line’s electronics technician indicated that as a
result of the move, the antenna’s view of the
satellites was less obstructed and the crew com-
plained much less about chopping.

In COURSE mode, the NACOS 25 system steers a se-

lected course while correcting for drift using the Doppler
log traverse speed component.

The Royal Majesty’s integrated bridge sys-

tem was also fitted with an automatic bell logger
(bell log), which was located against the after
bridge bulkhead. At regular intervals, the bell
log recorded the propeller pitch settings, engine
revolutions per minute, true course, and speed.
It also recorded the time of each entry in
Greenwich mean time.

The course and speed

data that were recorded by the bell log came
from the vessel’s GPS.

The bell log showed that it was turned on at

1131:54 on June 9. Between 1131:55 and
1133:17, the bell log recorded a course of 197°,
000°, and 197°, indicating that the GPS data
were invalid. This could be the result of the GPS
receiver being turned on and going through its
satellite acquisition process, chopping, antenna
connection problems, or other problems. The
record also showed that between 1133:18 and
1202, the Royal Majesty was steering various
courses. Between 1130 and 1202, the vessel was
still moored alongside the pier.

Such course

variation while the vessel is stationary is con-
sistent with normal GPS position variation and
the resulting calculation of courses between
those slightly different positions. The bell log
recorded various courses between 1203, when
the ship left the pier, and 1252, consistent with
port departure. At 1252:02, the bell log once
again began recording consecutive courses of
197° and 000°, when, in fact, the vessel was
steering a course of 333°, as shown by the ship’s
course recorder. At 1309:06, the bell log re-
corded a course of 336°. After that recording,
the bell log recorded 197°/000° headings con-
tinuously until after the vessel’s arrival in Bos-
ton.

(See table 1.) After the accident, Majesty

Cruise Line advised the Safety Board that the

Mean solar time in which the day begins at midnight

on the meridian of Greenwich. For this report, the entry
times have been converted to local time.

During this time, the Royal Majesty was moored with

its port side to the Ordnance Island Passenger Terminal in
St. George’s.

The Royal Majesty’s bridge logs indicated that the ves-

sel departed the Ordnance Island Passenger Terminal at
1203, dropped off its pilot at 1230, and then altered course
to 059°. Shortly before 1300, the vessel altered course to
336° and remained within 1° to 3° of this heading until the
grounding.

anomalous 197°/000° courses recorded by the
bell log were the result of the GPS receiver be-
ing in the SOL and DR modes.

The bell log also recorded speed calcula-

tions based on information provided by the GPS.
The bell log recorded 18 speed calculations
between 1200 on June 9 (departure time from
the pier) and 2000 on June 10. These speed cal-
culations and the time at which they were re-
corded are listed in table 2. The Royal Majesty’s
watch officers also maintained written records
of the vessel’s speed during the voyage in the
bridge log and in the speed record. According to
entries made in the bridge log between 1400 on
June 9 and 1200 on June 10, the vessel’s aver-
age speed was 19.06 knots. The bridge-log
speed data, however, were calculated using po-
sition data from the GPS. If the GPS was in DR
mode, the bridge-log speed data would not ac-
count for wind, seas, and current. The speed
data recorded by watchstanders in the speed re-
cord were based on distances between DR posi-
tions shown on the GPS. The distances between
DR positions depended on the speed supplied by
the Doppler speed log.

The speed data, which

were recorded at hourly intervals between 1500
on June 9 and 2200 on June 10, indicated that
between 1400 on June 9 and 2200 on June 10
the vessel’s average speed was 18.79 knots. The
speed record also showed that between 1200 and
2200 on the day of the accident, the vessel’s
average speed was 13.87 knots.

The Doppler speed log provided watchstanders with a

digital readout of the vessel’s speed (over ground) at any
given moment in time. The readout did account for wind,
sea, and current.

The Royal Majesty was also fitted with an

Atlas 481 echo sounder (fathometer)

with

digital readout. The fathometer data could be
displayed on the NACOS screen by pressing a
button. The fathometer had a recorder, which
was in the chart room. Postaccident examination
of the fathometer recorder indicated that it was
not turned on at the time of the accident.

An echo sounder, or electronic depth sounder, is an in-

strument that indicates water depth below the bottom hull
plating. Hereinafter, the term fathometer will be used in the
report.

The chief officer, the navigator, and the second officer

testified that the echo sounder was turned on before the
accident. The recorder had a separate on/off button.

The fathometer was also fitted with alarms

that were activated whenever the vessel tran-
sited waters shallower than the water for which
the alarms were set. In addition to an aural
alarm, a flashing message appeared on the
NACOS display. Both the aural alarm and the
flashing message could be overridden by watch-
standers.

Table 1—Bell-log record of courses, June 9, 1995 (based on data from the GPS unit)

Time

Course

Made Good

Time

Course

Made Good

Time

Course

Made Good

Time

Course

Made Good

1131:54

(GPS unit

turned on)

(continued from

previous column)

(continued from

previous column)

(continued from

previous column)

1132:46

197.0

1147:11

094.0

1201:35

210.0

1321:59

1133:01

1147:59

115.0

1201:52

203.0

1322:47

197.0

1133:17

197.0

1149:35

159.0

1202:07

212.0

1324:41

1137:17

291.0

1150:07

129.0

1202:40

206.0

1324:55

197.0

1138:05

275.0

1150:23

181.0

1203:11

213.0

1332:57

1138:21

258.0

1150:55

064.0

1204:15

169.0

1333:45

197.0

1138:37

306.0

1151:11

097.0

1205:51

091.0

1349:29

1139:09

215.0

1151:59

1206:23

097.0

1349:45

197.0

1139:25

250.0

1152:15

047.0

1206:55

088.0

1357:45

1139:41

232.0

1152:31

078.0

1211:11

082.0

1358:07

197.0

1139:57

250.0

1152:47

131.0

1219:12

090.0

1406:01

1140:13

261.0

1153:19

092.0

1219:27

082.0

1406:33

197.0

1141:01

038.0

1153:35

151.0

1228:32

076.0

1141:17

242.0

1153:51

133.0

1229:19

070.0

1141:49

298.0

1154:55

174.0

1230:09

064.0

1142:07

326.0

1155:11

130.0

1242:41

055.0

1142:23

345.0

1155:43

213.0

1244:33

037.0

1142:39

289.0

1155:59

320.0

1245:37

025.0

1143:41

074.0

1156:15

271.0

1252:02

197.0

1144:31

025.0

1156:31

261.0

1255:45

1145:03

100.0

1156:47

217.0

1256:01

197.0

1145:19

079.0

1157:03

227.0

1304:01

1145:35

068.0

1157:19

208.0

1305:05

197.0

1146:07

080.0

1158:39

216.0

1309:06

336.0

1146:33

008.0

1200:04

221.0

1311:46

197.0

The bell log continued to record the 197º/000º headings until after the vessel’s arrival in Boston.

The chief officer and

the navigator testified that
the fathometer alarm was
normally set to go off
when the water beneath
the keel was less than 3
meters (9.75 feet) deep.
On the night of the
grounding, the Royal Maj-
esty’s deep draft was 19
feet 6 inches. Based on
statements from the chief
officer and the navigator,
the alarm should have ac-
tivated when the Royal
Majesty entered water
with a depth of 29 feet 4
inches or less. During the
hour preceding the
grounding, the Royal Maj-
esty passed over Great Rip and Davis Shoals,
where in some areas the depth of the water was
less than 29 feet 4 inches. The master, chief of-
ficer, and second officer did not recall seeing or
hearing the fathometer alarm before the
grounding. Postaccident examination revealed
that the fathometer alarm was set at 0 meters.
According to the navigator, the alarm was nor-
mally set at 0 when the vessel was in port or in a
harbor to prevent the alarm from being continu-
ously activated.

Crew Training on Integrated Bridge Sys-

tem.—The Royal Majesty entered service in
June 1992. The master, who joined the vessel in
November of that year, stated that before joining
the vessel, he had read all the manuals and tech-
nical documents related to the integrated bridge
system (see next section). He stayed aboard the
ship for 1 month with the master he was reliev-
ing and received on-the-job training related to
the integrated bridge system from that master
and the navigator who was aboard the vessel
when it entered service.

The chief officer of the Royal Majesty had

joined the ship in 1992. He stated that he had
also received on-the-job training (3 weeks) from
the same navigator as the master had.

The navigator who was aboard the Royal

Majesty at the time of the accident had joined
the ship in August 1994. According to him, he
was responsible for the orientation and training
of new officers in the operation of the NACOS
25, GPS, Loran-C, Decca, fathometer, gyro(s),
speed log, ARPA radars, and engine controls.
He stated that he was solely responsible for pro-
gramming the radar maps onto the ARPA dis-
play. He stated that it was his responsibility to
ensure that watch officers fully understood how
the different systems worked and interacted with
each other. He further stated that one of his re-
sponsibilities was to tell the master when a
newly assigned watch officer was fully prepared
to stand a bridge watch alone. The navigator
stated that the master made the final decision
about whether an individual was sufficiently
qualified to operate the bridge equipment and
was fully conversant in the ship’s watchstanding
procedures.

The second officer joined the Royal Majesty

on May 1, 1995. He received 3 weeks of on-the-
job training—2 weeks with the navigator and 1
week with the chief officer. According to his
testimony, the 3 weeks of on-the-job training
included his being familiarized with the compo-
nents of the integrated bridge system but also
with other bridge watchstanding duties and re-

Table 2—Bell-log record of the speed calculations based on in-

formation obtained from the GPS unit

June 9, 1995

June 10, 1995

Time

Speed (Knots)

Time

Speed (Knots)

1200:03

13.3

0000:03

12.7

1206:39

14.7

0400:03

12.7

1210:23

16.0

0800:03

12.7

1223:43

17.3

1200:03

12.7

1225:03

18.8

1600:03

12.7

1228:31

21.1

2000:04

12.7

1233:19

22.3

1252:01

12.7

1309:05

21.3

1311:45

12.7

1600:03

12.7

2000:04

12.7

The bell-logger printout continued to record a speed made good of 12.7 knots

from 2000 (June 10) up to the time of the vessel’s arrival in Boston on June 12.

sponsibilities, fire and boat drills, vessel main-
tenance, and various other officer duties and
responsibilities.

According to the testimony of the watch of-

ficers, there was no formal classroom or simu-
lator-based training on the integrated bridge
system, nor was any curriculum, checklist, or
exam used during the 3 weeks of on-the-job
training to measure the extent of the trainee’s
knowledge of the system or its components.

According to STN Atlas, the manufacturer

of the NACOS 25, STN Atlas offers classroom
and simulator training in the operation of its
equipment at an additional cost to the purchaser.
STN Atlas also indicated that several companies
and organizations in Europe were qualified to
provide formal classroom and simulator-based
training in the operation of the STN Atlas
NACOS 25. Majesty Cruise Line did not obtain
such training from STN Atlas or any other or-
ganization, nor was it required to by any inter-
national regulations or standards.

Written Guidance on Use of the NACOS

25.—STN Atlas supplied several supporting
manuals with the NACOS 25 on the Royal Maj-
esty. Manuals for the Atlas NACOS 25 system
included Specifications, Navigation Instruc-
tions, “Brief Navigation Instructions,” Operat-
ing Instructions, and “Brief Operating Instruc-
tions.”

In addition, STN Atlas provided manu-

als for the Atlas 8600 ARPA radar and the pro-
gramming of maps using the ARPA radar. STN
Atlas notes the following in its concluding re-
marks in the Navigation Instructions:

The navigator’s role is that of overseer
of the ship’s progress and proper func-
tioning of the automatic equipment. If
the system performs faultlessly, it could
happen that the navigator loses interest
in overseeing a faultlessly functioning
system. Before entering into this situa-
tion one must set about planning the
next stage of development.

The briefs were laminated two-page summaries of the

larger manuals and were meant to be used as quick refer-
ence material.

In the next stage of development, one
must consider changing the automation
so that the supervising of the navigation
will be done automatically instead of by
the navigator.

Waterway Information

The Royal Majesty grounded on Rose and

Crown Shoal about 10 miles east of Sankaty
Head Light, which is on the eastern shore of
Nantucket Island and about 17.0 miles west of
the vessel’s intended track (the northbound
Boston traffic lane). The shoal extends ap-
proximately 5 miles in a north-south direction
and about 3 miles in an east-west direction. The
minimum depth of the water in this area ranges
between 3 and 7 feet at mean low water. The
area is also known to contain breakers. The
shoal is marked by a lighted whistle buoy
(2RC). The buoy’s red light flashes at 2.5-
second intervals and is visible at a distance of at
least 6 miles when visibility is clear.

Rose and Crown Shoal is one of several

broken shoals that compose Nantucket Shoals—
the general name of the shoals that extend 23
miles east and 40 miles south of Nantucket Is-
land. The currents in this area are strong and
erratic, reaching a velocity of 3 to 5 knots
around the edges of the shoals. According to
Volume 2 of U.S. Coast Pilots (Atlantic Coast:
Cape Cod to Sandy Hook), Nantucket Shoals is
“one of the most dangerous parts of the coast of
the United States.” It also states that “this area
should be entirely avoided by deep draft vessels
when possible and by light draft vessels without
local knowledge.”

The shoals, which are shifting in nature, are

bordered to the south and east by several aids to
navigation. The southwest corner of Nantucket
Shoals is marked by the Davis South Shoal
lighted whistle buoy. The buoy has a red light
that flashes at 4-second intervals and is visible
at a distance of about 4 miles when visibility is
clear. Marking the southeast corner of Nan-
tucket Shoals is the Asia Rip (AR) lighted bell
buoy. This buoy, which is about 17 miles west
of the Royal Majesty’s intended track and
15 miles (on a bearing of 248°) away from the
BA buoy, has a yellow light that flashes at 2.5-

second intervals. Fifteen miles to the south-
southwest of the AR buoy and 30 miles west of
the Royal Majesty’s intended track is the Nan-
tucket Shoals lighted horn buoy. This buoy,
which replaced the original Nantucket Light-
ship, is a large navigational buoy

that has a

yellow light that is 40 feet above the water and
flashes at 6-second intervals.

Large deep-draft vessels operating between

Bermuda and Boston generally use the Boston
traffic lanes east of Nantucket and Cape Cod.
The purpose of the traffic lanes is to separate
northbound and southbound vessels and to pro-
vide a deep-water route for vessels en route to
and from Boston that keeps them clear of Nan-
tucket Shoals. A traffic separation zone sepa-
rates the northbound and southbound lanes.
Marking the separation zone are a series of
lighted buoys (BA, BB, BC, BD, BE, and BF).
Each buoy has a flashing yellow light and a ra-
dar reflector and has a distinctive flashing char-
acteristic. For example, the yellow light on the
BA buoy, which marks the southeast entrance to
the traffic lanes, flashes four times at 20-second
intervals. The BA buoy also sounds a whistle at
10-second intervals when certain rough sea con-
ditions exist.

Meteorological Information

The weather and sea conditions recorded by

the Royal Majesty crew between 1800 and 2230
on June 10 generally indicated cloudy skies,
force 4 winds

(between 11 and 16 knots) out

of the east, and seas between 2 and 4 feet. Visi-
bility at sea level was reported to be at least 10
miles.

A review of the bridge log for the 24-hour

period beginning at 2100 on June 9 indicated
that the Royal Majesty encountered winds aver-
aging 15.9 knots out of the east-northeast. Based
on the Beaufort scale, a 16-knot wind could

A 40-foot-diameter, automated disc-shaped buoy used

to replace lightships. Most large navigational buoys are
used in conjunction with major traffic separation schemes.

Based on the Beaufort scale, a numerical scale from 0

to 12 that rates wind according to ascending velocities (0
corresponds to calm winds at 0 to 1 knots, and 12 corre-
sponds to hurricane winds above 65 knots).

generate a wind-driven current capable of set-
ting the Royal Majesty toward the west-
southwest at a rate of 0.32 knots, or a distance
of about 8 miles over a 24-hour period. The ef-
fect of the wind on the vessel’s vast superstruc-
ture would have also contributed to the vessel’s
westerly drift.

Toxicological Information

The Coast Guard does not have the author-

ity to order postaccident toxicological testing in
accidents on foreign vessels that occur in inter-
national waters.

However, Majesty Cruise

Line requested that all watchstanders on the
bridge at the time of the grounding and the
master provide specimens for toxicological
testing. The company tried to obtain the services
of a testing firm that could travel to the site of
the grounding. On the following day, June 11,
the company found a contractor in New Hamp-
shire who agreed to collect the specimens. He
arrived on scene in a chartered fishing vessel
and was transported to the Royal Majesty on a
Coast Guard vessel about midnight. The Coast
Guard requested that the contractor wait until it
was safe to board, as the Coast Guard was still
in the process of freeing the vessel. After
boarding, he was directed to the office of the
ship’s doctor and began collecting the speci-
mens soon thereafter.

Twenty-five to 28 hours after the grounding,

the master, the second officer, and the two look-
outs on duty at the time of the grounding gave
blood and urine specimens for alcohol and drug
testing specified in 46 Code of Federal Regula-
tions (CFR) Part 4 and in 49 CFR Part 40. The
specimens were shipped for testing to the Meth-
odist Medical Center in Peoria, Illinois. The re-
sults of the tests were negative.

Watchstanding Policies and Practices

Three licensed deck officers and six unli-

censed crewmen were assigned to the watch-
standing duties aboard the Royal Majesty. Each
stood a 4-hour-on/8-hour-off watch rotation.
The watches for the three licensed deck officers
were as follows:

33 CFR Chapter 1, Subpart 2.05-5.

0000-0400/1200-1600

Navigator

0400-0800/1600-2000

Chief Officer

0800-1200/2000-2400 Second

Officer

The master of the Royal Majesty, who did

not stand a regular watch, oversaw the perform-
ance of the watch officers. According to the
master, in good weather he typically visited the
bridge two to three times during the course of a
watch and frequently telephoned the officer of
the watch for navigation and traffic updates. He
stated that he visited the bridge more frequently
when the weather or sea conditions were bad or
when visibility was poor.

Company policy governing the activities of

the bridge watchstanders aboard the Royal Maj-
esty are contained in its “Bridge Procedures
Guide” and the Majesty Cruise Line’s Opera-
tions Manual. The two-page “Bridge Procedures
Guide” (see appendix B) was posted on the
bridge of the Royal Majesty before the accident.
According to Majesty Cruise Line, the purpose
of the “Bridge Procedures Guide” is to provide
watchstanders “with a description of the day-to-
day bridge procedures that are recognized as
good practice and to promote through them the
safety of the M/V Royal Majesty, her passen-
gers, and crew.”

The Operations Manual contains a collec-

tion of policies, letters, and circulars covering
such topics as checking the vessel’s position,
fire and boat drills, and payroll and accounting
procedures. Duties of the officer on watch are
listed on page 3 of Majesty Cruise Line’s Cir-
cular No. 9, dated July 9, 1992 (see appendix
C). The circular states that deck watch officers
are to “check the ship’s position as often as
conditions and circumstances allow, but never
longer than 30-minute intervals.” The circular
does not state how the ship’s position is to be
checked, nor does it require that GPS and Lo-
ran-C position data be compared. The circular
also does not require that a written record be
maintained of GPS or Loran-C observations or
of radar ranges and bearings of nearby floating
aids to navigation and/or landmarks.

The master testified that he required his

watch officers to plot the vessel’s position on an
hourly basis. A postaccident examination of

National Oceanic and Atmospheric Administra-
tion chart No. 13200 (Georges Bank and Nan-
tucket Shoals) indicated that hourly fixes had
been plotted on the chart of the area starting
about 100 miles to the south of the accident site
and continuing up into the Boston traffic lanes.

Circular No. 9 and the “Bridge Procedures

Guide” discuss when the master should be
summoned to the bridge. Among the circum-
stances that should prompt a call to the master is
the failure of watch officers to sight land or a
navigation mark or to obtain a sounding by the
expected time.

Postaccident Testing of GPS

After the accident, representatives from

Majesty Cruise Line and the Coast Guard ex-
amined the Royal Majesty’s GPS antenna and
receiver. They found that the GPS antenna cable
had separated from the factory connection at the
antenna. The antenna cable, which was factory-
assembled, showed no sign of physical damage,
other than having been separated from the con-
nection. The Safety Board examination also re-
vealed that the cable was openly routed on the
roof of the bridge and that it had been painted
with a brush or roller at least twice when the
bridge was being painted (see figure 9). Traffic
on the roof of the bridge was limited to Majesty
Cruise Line employees. However, the GPS cable
was not secured to the roof or protected from
someone tripping over it, kicking it, or other-
wise damaging it and the nearby antenna con-
nector.

Postaccident testing at Raytheon

indicated

that because the GPS antenna cable was sepa-
rated from the connection, the GPS receiver
transmitted DR-derived position data instead of
satellite-derived position data to the NACOS 25
autopilot.

Safety Board’s Urgent Safety Recom-
mendations

The Safety Board’s postaccident testing and

inspection of the integrated bridge system on the

Appendix D has more details about the postaccident

testing done by representatives of the Safety Board, Ray-
theon Marine, and Majesty Cruise Lines.

Royal Majesty raised concerns about the safety
of the world’s maritime fleet and the safety of
passengers and crews on vessels with similar
integrated bridge systems, as well as the poten-
tial damage to the environment that could result
from a release of hazardous cargo. Conse-
quently, on August 9, 1995, the Safety Board
issued five urgent safety recommendations to
the Coast Guard, the International Council of
Cruise Lines (ICCL), the International Chamber
of Shipping, the American Institute of Merchant
Shipping, the International Association of Inde-
pendent Tanker Owners (INTERTANKO), STN
Atlas, and the NMEA. The recommendations
urged the organizations to immediately advise
maritime vessel operators of the circumstances
of the Royal Majesty’s grounding and to en-
courage the operators to review the design of
their integrated bridge systems to identify po-
tential system and operational failure modes. All
five recommendations were acted upon and,
consequently, have been classified either
“Closed—Acceptable Action” or “Closed—Ac-
ceptable Alternate Action.”42

Safety Board’s Public Forum

The grounding of the Royal Majesty sug-

gested to the Safety Board a need to assess the
current state of the art in integrated bridge sys-
tems. As a first step, the Safety Board held a
public forum on integrated bridge systems on
March 6-7, 1996, to examine data-transmission
standards, design standards for integrated bridge
systems, human-factors considerations in the
design of integrated bridge systems, training and
certification of mariners responsible for operat-
ing integrated bridge systems, and the impact of
integrated bridge systems on safety, workload,
and watchkeeping. Participating in the public
forum were representatives of the vessel opera-
tors, standards organizations, manufacturers of
integrated bridge systems, and classification
societies. Government representatives and ma-
rine educators from the major maritime schools,
colleges, and universities also participated.

Appendix E has the full text and status of each urgent

safety recommendation.

The following sections highlight some of

the comments from the various participants.

Manufacturers.—The public forum showed

that manufacturers of integrated bridge systems
are designing and building the components of
their systems in accordance with internationally
recognized standards, proprietary standards, and
the standards of the classification societies.
Manufacturers stated that problems were occa-
sionally encountered in matching subsystems,
such as Loran-C and GPS, speed logs, and gyro
compasses, with the integrated bridge system
that they manufacture. They expressed concern
about the maintenance of system integrity
throughout the life of the integrated system as
subcomponents are added or replaced. They ex-
pressed the belief that an independent authority
is needed to ensure system integrity.

Standards Organizations.—The Interna-

tional Maritime Organization (IMO), a United
Nations organization, produces performance
standards for navigation equipment required on
commercial vessels. Such standards are nor-
mally cast in general terms. Once adopted, each
of the IMO performance standards is reviewed
by either Technical Committee 8 (TC8) of the
International Standards Organization (ISO) or,
more often, by Technical Committee 80 (TC80)
of the IEC, depending upon whether the equip-
ment is mechanical or electric/electronic. Nor-
mally, one of the two organizations will develop
specifications (called standards) that enable
manufacturers to design and build navigation
equipment that will meet the appropriate IMO
performance standard. It is not unusual for the
ISO and the IEC to work jointly to produce
standards.

The ISO and the IEC are parallel interna-

tional organizations, working in close coopera-
tion to form a world system of standardized
working procedures, terminology, and docu-
mentation presentation. The TC8 has 10 sub-
committees working on various areas, including

ship bridge layout

for one-person watchkeep-

ing.

The work of the IEC is managed through

more than 200 technical committees, and the
TC80, formed in 1979, is the technical commit-
tee concerned with marine navigation and radio-
communication equipment and systems. The
TC80 has 10 working groups.

In 1990, the TC80 notified the IMO that it

was forming a working group (WG9) to develop
a draft IMO performance standard for integrated
bridge systems. The proposed standard was
completed and submitted to the IMO in July
1996. The proposed standard is expected to be-
come an IMO performance standard by about
1999.

In the absence of an ISO or IEC standard,

manufacturers use other internationally recog-
nized standards, such as those of the NMEA.
The NMEA, a U.S. organization of manufactur-
ers, dealers, and installers of marine electronic
equipment, actively encourages international
membership and participation. The NMEA In-
terface Standards Committee, for example, has
representatives from nearly all the companies in
the world that manufacture marine electronic
equipment.

The NMEA and the IEC have members on

each other’s working groups and in 1995 col-
laborated to produce a harmonized standard for
data transmission (NMEA 0183 and IEC 1162-
1), which will facilitate matching subsystems
like GPS with integrated bridge systems and the
Global Maritime Distress and Safety System.

The NMEA and the IEC have agreed to work

ISO standard ISO 8468 currently covers ship bridge de-

sign and layout.

One-person watchkeeping, sometimes referred to as

one-man or solo watchkeeping, means that the officer of
the watch is the sole person on the bridge. This concept
envisages reducing cost by eliminating the lookout position
from the navigation watch.

The Global Maritime Distress and Safety System is an

automated radio transmitting and receiving device on the
bridge. It can automatically send distress messages that give
the vessel’s identification and position and receive telex in-
formation on navigation, weather, and search and rescue.

together on future transmission standards and to
keep both standards in harmony.

The NMEA representative stated that manu-

facturers have sometimes made different inter-
pretations of the NMEA standards and that
electronic equipment has been mismatched. The
NMEA representative further stated that the
0183 standard by itself does not regulate the use
of the data in NMEA-provided sentences. The
NMEA counts on the knowledgeable input to,
and sensible implementation of, the NMEA
standard by equipment designers. This process
has improved vastly over the past few years and
many of the early problems with implementation
no longer exist. Helping in this regard is the
trend in international performance standards for
marine electronic equipment to specify the use
of specific NMEA 0183/IEC 1162-1 sentences.
The representative stated that he believes that
the new improved standards have reduced the
possibility of mismatching.

Classification Societies.—The DNV has

been involved in bridge navigation issues since
the early 1970s; the classification society was
motivated to enter this nontraditional area by the
high number of groundings and collisions at-
tributable to human error. The DNV studied the
bridge environment, including design of work
stations, organizational matters, range and qual-
ity of instrumentation, and man/machine inter-
face. The DNV then developed some standards
for bridge design and equipment that might re-
duce situation-induced errors. These standards
were offered as an optional classification nota-
tion,

NAUT-C.

Classification societies have normally been concerned

solely with developing classification rules (notations) for a
vessel's hull, the machinery, and certain essential systems
(ballast systems, piping, sanitation systems, ventilation, etc.).
For a vessel to be classed by a society, the vessel must be
constructed and maintained in accordance with the rules of
the classification society. Surveyors (inspectors) employed by
the selected classification society inspect the vessel during
construction and periodically afterward as long as the vessel
is classed. Classification is essential for obtaining insurance.
Navigation equipment is not required to be classed; thus, the
navigation bridge does not have to be constructed or outfitted
in accordance with classification society rules. With growing
interest in reducing navigation errors and with the interest in
using technology to reduce bridge manning, most classifica-
tion societies now offer optional classification rules (nota-

Currently, the highest class notation offered

by the DNV is Watch 1 (W1), which addresses
equipment requirements, qualifications of the
integrated bridge system operator, operating
procedures, documentation on maneuvering per-
formance, and a contingency plan. The DNV
requires that vessel officers attend classes pro-
vided by the integrated bridge system manufac-
turer. An officer who has been trained by the
manufacturer and has operated an integrated
bridge system at sea may instruct other officers.
All operators of an integrated bridge system
must be certified by the DNV.

Germanischer Lloyd was the coordinator for

the German Ship of the Future program, which
involved various elements of the German mari-
time industry. The intention of this research
program was to employ automatic navigation
systems to do routine functions; as a result,
watchkeeping at any time, day or night, could be
handled by one person. The culmination of the
Ship of the Future program was marked in 1985
by the commissioning of a prototype vessel with
an integrated bridge system. In 1991, Germanis-
cher Lloyd published its Rules for Bridge De-
sign on Sea-Going Ships - One-man Control
Console. The rules were based on 5 years of
operational experience with advanced naviga-
tion systems. A ship complying with the rules
receives the optional class notation Nav O
(ocean area) or Nav OC (ocean area/coastal
waters).

Lloyd’s Register of Shipping (LR) pub-

lished rules for navigation bridge arrangements
in 1988 and in January 1996, after completing
further research, replaced those rules with a
more comprehensive notation (NAV-1).

The

LR is planning to offer an integrated bridge

tions) covering bridge design, layout, and equipment.

The development of NAV-1 followed a 3-year research

project known in Europe as Advanced Technology to Opti-
mize Manpower Onboard Ships. The object of the project
was to improve the competitiveness of European Common
Market commercial vessels by using advanced technology,
including the integration of bridge equipment and functions,
to reduce bridge manning and contribute to navigation safety.
The participants in the research project included nine Euro-
pean companies and, in addition to the LR, equipment
manufacturers, ship owners, research organizations, and one
national authority.

system notation, IBS, which will be an en-
hancement of NAV-1. The notation also will
address software, and will require that the “de-
velopment, modification, replication and instal-
lation of the software be subject to quality plans
which meet the requirements of acceptable stan-
dards, e.g. the ISO 9000 series.” The LR will
accept certification of the software quality pro-
cedures by a recognized authority as evidence of
compliance. Also, the LR can now provide
comprehensive software assessment to manu-
facturers. (The DNV tests software at the manu-
facturer’s plant for each model of an integrated
bridge system and whenever there are changes
in software.)

Nippon Kaiji Kyoukai published rules for

navigation bridge systems in February 1995. In
preparing the rules, the organization considered
current Japanese technology, other technical
developments, vessel-owner desires, and inter-
national standards, including those of the IMO,
the ISO, and the IEC.

The Nippon Kaiji Kyoukai notation BRS1

covers “functionality of the bridge design lay-
out, configuration, bridge environment, and es-
sential navigational equipment to be installed
and work stations for one officer bridge opera-
tion on the open sea.”

The Korean Registry of Shipping has intro-

duced requirements for one-man bridge operated
ships. In developing its rules, the organization
gave a high priority to the safety and reliability
of systems. The organization also focused on the
human element, including ergonomic criteria
and bridge design and installation, as well as on
technical performance standards, system redun-
dancy, and reliability.

The American Bureau of Shipping pub-

lished guidelines for one-man bridge operation
in 1992.

ANALYSIS

General

The weather at the time of the accident was

clear, visibility was at least 10 miles, seas were
calm, and winds were light. Except for the GPS
antenna cable connection, all other navigation
equipment and the main propulsion, steering,
and auxiliary systems were fully operational
before and after the accident. The investigation
indicated that the certifications of the master
and the deck officers were in accordance with
current international requirements. Accordingly,
the Safety Board concludes that the weather, the
mechanical condition of the Royal Majesty, ex-
cept for the GPS antenna cable, and the officers’
certifications were not factors in the accident.

Because the accident happened in interna-

tional waters, the Coast Guard did not have the
authority to order toxicological testing. How-
ever, the master, the second officer, and the two
lookouts on duty at the time of the accident pro-
vided blood and urine specimens for alcohol and
drug testing, as requested by Majesty Cruise
Line. On the basis of test results, the Safety
Board concludes that drugs were not a factor in
the accident. However, because the specimens
were obtained more than 24 hours after the ac-
cident, the alcohol tests were of little value; had
there been any alcohol, it probably would have
been metabolized and eliminated. Although in-
vestigating Coast Guard personnel observed no
indications that the officers had been under the
influence of alcohol, the Safety Board could not
determine conclusively that alcohol was not a
factor in the accident.

The master and two of the deck officers, in-

cluding the second officer, who was on duty at
the time of the accident, testified that their
work/rest routines during the days preceding the
accident were normal. In particular, the second
officer slept about 7 hours after finishing his
2000-to-2400 watch and had also taken a 2-hour
nap before beginning his 2000 watch on
June 10, the day of the accident. In short, the

Safety Board concludes that fatigue was not a
factor in the grounding of the Royal Majesty.

The Safety Board assessed the fishing ves-

sel’s attempts to call a cruise ship shortly before
the grounding of the Royal Majesty. Although
the Safety Board could not conclusively deter-
mine whether the second officer was in fact
monitoring channel 16, international require-
ments and company procedures required him to
do so. Because the position transmitted by the
fishing vessel was approximately 17 miles away
from where the second officer believed the ves-
sel to be and because the English transmissions
made by the fishing vessel to the cruise ship did
not convey any urgency or immediacy and were
interspersed with Portuguese conversation, the
Safety Board believes it was reasonable that the
second officer did not respond to these trans-
missions. The transmissions do, however, pro-
vide evidence of the location of the Royal Maj-
esty almost 2 hours before the grounding.

The grounding occurred near Nantucket Is-

land in an area known as Rose and Crown
Shoal—a location more than 17 miles west of
the vessel’s intended track. The investigation,
therefore, focused on determining how a large
passenger vessel with a sophisticated integrated
bridge system, manned by experienced watch
officers, and operated in clear weather through
calm seas could travel, unknown to the crew,
more than 17 miles off course.

The Accident

Shortly after the vessel left St. George’s, the

navigator set the NACOS 25 autopilot on the
NAV mode. When engaged and operating in the
NAV mode, the autopilot could steer the vessel
along a predetermined route using programmed
information (latitude and longitude of waypoints
and the vessel’s maneuvering characteristics),
gyro and speed data, and position data from ei-
ther the GPS or the Loran-C while automatically
compensating for the effect of gyro error, wind,
current, and sea. On the day of the accident, the

crew had selected, as it normally had done since
the vessel entered service, the GPS as the source
of position data for the NACOS 25.

To compensate for the possible lack of sat-

ellite data, the GPS unit on the Royal Majesty
had been designed to receive speed and gyro
heading data so that when GPS satellite data
were not available, the unit would automatically
default to a DR mode, in which the lati-
tude/longitude data transmitted to the autopilot
were derived from DR calculations rather than
satellite-based position data. When the GPS unit
defaulted to the DR mode after the vessel left
Bermuda, the autopilot was unable to recognize
the status change; and, thus, its subsequent
navigation did not correct for the effect of wind,
current, or sea.

The bell-log record provided evidence that

complete interruption of valid satellite-based
position data occurred about 1311:46, which
was about an hour after the vessel left St.
George’s. From that point on, the bell log con-
tinued to record alternate courses of 197° and
000° until after the vessel’s arrival in Boston,
although, in fact, the vessel was maintaining a
course of about 336° during that time. It ap-
peared that a temporary interruption of valid
satellite-based data occurred at 1252:02, about
52 minutes after the vessel left Bermuda, as the
course and speed recorded were 197° and 12.7
knots, respectively—the same readings that
were later recorded. The course of 336° re-
corded at 1309:06 was consistent with the ves-
sel’s course at that time. Similarly, the bell-log
record of speed calculations based on the data
provided by the GPS unit indicated that the last
accurate recording occurred at 1309:05 when
the bell log recorded a speed of 21.3 knots.
However, from that point on until the vessel’s
arrival in Boston on June 12, the bell log con-
tinued to record a speed of 12.7 knots, a speed
not consistent with the speeds recorded in the
bridge log and speed record. In summary, the
Safety Board concludes that starting about 52
minutes after the Royal Majesty left St.
George’s, the GPS receiver antenna cable con-
nection had separated enough that the GPS
switched to DR mode, and the autopilot, not
programmed to detect the mode change and in-

valid status bits, no longer corrected for the ef-
fects of wind, current, or sea. Over time, the
effects of the east-northeasterly wind and sea set
the Royal Majesty in a west-southwesterly di-
rection and away from its intended track, re-
sulting in the 17-mile error. Further evidence
came from a Coast Guard transcript of radio
transmissions from two fishing vessels that were
in the vicinity of Fishing Rip Shoal on the eve-
ning of June 10 and had seen a large passenger
cruise ship about 16 miles west of the Boston
traffic lanes.

The investigation determined that the GPS

antenna, which was originally installed on the
radar mast, had been moved in February 1995,
several months before the grounding, as part of
an effort to eliminate chopping. An examination
of the GPS antenna cable indicated that it was
routed in such a way that it could be kicked or
tripped over, which could induce separating
stress at the antenna cable connection, and that
it had been painted on at least two occasions.
However, precisely when the painting was done
was not known. In short, it could not be deter-
mined whether the GPS antenna failed as a re-
sult of crewmembers’ inadvertently damaging it
while they were doing routine maintenance, as a
result of crewmembers’ tripping over the cable,
or as a result of other unknown factors. Never-
theless, the Safety Board concludes that openly
routing the GPS antenna cable in an area where
someone occasionally walked increased the risk
of damage to the cable and related connectors.
The Safety Board believes, therefore, that to
decrease the risk of damage, Majesty Cruise
Line should eliminate the practice of openly
routing navigation equipment cable to decrease
the risk of damage and that the ICCL should
encourage its members to do the same.

Watch Officers’ Performance

The crew’s failure to detect the ship’s errant

navigation for more than 34 hours raises serious
concerns about the performance of the watch
officers and the master. None of the three watch
officers or the master determined that the GPS
had switched to DR mode or that the Royal
Majesty had been on an errant course through-
out the trip from St. George’s. Further, the chief

officer and the second officer, who stood the
last two watches before the grounding, failed to
recognize that the Royal Majesty was on an er-
rant course despite several indications that the
vessel was not on its intended track. The inves-
tigation, therefore, examined the events leading
up to the accident from the time the Royal Maj-
esty departed St. George’s, including the in-
specting of equipment and the setting of the
fathometer alarm. The investigation also exam-
ined the watchstanding practices of the watch
officers and their lack of response to several
indications that the vessel was not following its
intended track, including the sighting of red
lights, the failure to sight the BB buoy, and the
sighting of blue and white water.

Equipment Inspection.—The navigator said

that he had tested the navigational equipment
before the vessel left St. George’s and found the
equipment to be in “perfect” operating condi-
tion. Because the evidence from the bell log in-
dicated that interruption of GPS data did not
occur until about 1252, about an hour after the
vessel had left port, the GPS receiver would
probably not have shown the SOL and DR mes-
sages before that time. Consequently, the navi-
gator may indeed have inspected the GPS re-
ceiver before the departure when the other navi-
gation equipment was inspected and found no
anomalies.

Fathometer Alarm.—Although the testi-

mony indicated that the fathometer alarm was
usually set at 3 meters, the postacccident inves-
tigation determined that the fathometer alarm
was set at 0 meters—the setting used when the
vessel was in port or in harbor so that the alarm
would not be continuously activated. During the
voyage, no one detected that the fathometer set-
ting was improper, and the fathometer recorder
was not turned on. Because the fathometer
alarm was set at 0 meters, the aural fathometer
alarm would not have activated; thus, the setting
effectively rendered the alarm useless.

Before it grounded, the Royal Majesty

passed over several areas in which the depth of
water beneath the keel was significantly less
than 3 meters. Had the alarm been set as usual to
3 meters, it would have activated several times

before the vessel grounded. The Safety Board
concludes that had the fathometer alarm been set
to 3 meters, as was the stated practice, or had
the second officer chosen to display the
fathometer data on the control console, he
would have been alerted in time for him to take
corrective action that the Royal Majesty was in
far shallower water than expected and, thus, was
off course. Because of the proximity of Davis
Bank (a shoal about 8 miles southeast of the
grounding site; the water is between 15 and 40
feet deep) it is possible that he would have been
alerted perhaps as long as 40 minutes before the
grounding.

GPS Status.—Once the ship had been

placed under the control of the automated navi-
gation system, the watch officers’ operating
tasks were to ensure that the automated naviga-
tion system equipment was operating properly
and to verify that the Royal Majesty was fol-
lowing the intended track. The testimony of the
watch officers and the charts used by these offi-
cers indicated that hourly fixes were being
plotted during the voyage, as instructed by the
master. The navigator and the second officer
both testified that the hourly fixes they plotted
were based on position data from the vessel’s
GPS. However, according to testimony, no offi-
cer, including the master, recognized the SOL
and DR messages, indicating that the GPS posi-
tion data were not reliable, until after the
grounding. Because the crew noticed the SOL
and DR messages immediately after the
grounding and because postaccident testing con-
firmed that the SOL and DR messages were
functioning properly and should have been dis-
played, the watch officers apparently read the
position coordinates on the GPS unit to accom-
plish their manual plotting task, without attend-
ing to the SOL and DR messages. The Safety
Board concludes that the watch officers’ moni-
toring of the status of the vessel’s GPS was de-
ficient throughout the voyage from St. George’s.

Cross-checking of Position Data.—Despite

failing to recognize the SOL and DR indicators,
the officers could have discovered that the GPS
had defaulted to DR mode by using an inde-
pendent source of information, such as the Lo-
ran-C. According to the chief officer and the

navigator, they periodically compared the GPS
data with the Loran-C data during the voyage.
The second officer, however, stated that he did
not check the Loran-C because it was used as a
backup only if the GPS failed. At the site of the
grounding, the Loran-C indicated the correct
position of the Royal Majesty, and there was no
evidence that the Loran-C was malfunctioning
during the voyage. Thus, had the officers regu-
larly compared position information from the
GPS and the Loran-C, they should not have
missed the discrepant coordinates, particularly
as the vessel progressed farther from its in-
tended track. The Safety Board concludes that
deliberate cross checking between the GPS and
the Loran-C to verify the vessel’s position was
not being performed and should have been on
the voyage from St. George’s.

Use of Position-fix Alarm.—Evidence sug-

gested that instead of monitoring the position
instrumentation, the watch officers relied on the
position-fix alarm, a feature of the autopilot de-
signed to alert watchstanders to any degradation
of position data from the position sensor in use.
According to the officers, the only times the
GPS positions could not be depended on for ac-
curacy were during chopping episodes, which
could usually be recognized because they were
accompanied by an erratic movement of the ra-
dar map and the sounding of the position-fix
alarm. Because chopping did not occur on the
accident voyage and because the position-fix
alarm never activated, the crew probably be-
lieved there was no need to suspect that the GPS
was not providing satellite-derived position
data. On this voyage, the position-fix alarm was
set to activate only when the position data gen-
erated by the GPS and the DR position data
generated by the autopilot differed by more than
200 meters. Because the GPS and autopilot
shared common gyro and speed inputs, the DR
position data transmitted by the GPS when it
defaulted to the DR mode was essentially iden-
tical to the DR position data calculated by the
autopilot. Consequently, the position-fix alarm
would not have activated after the GPS de-
faulted to the DR mode. The Safety Board con-
cludes that even though it is likely that the
watch officers were not aware of the inherent

limitation in using the position-fix alarm to
monitor the accuracy of GPS position data, it
was inappropriate for them to rely solely on the
alarm to warn them of any problems with the
GPS data.

Identification of Navigation Aids.—Al-

though the officers’ inadequate monitoring led
to the errant track and was a serious deviation
from acceptable methods of operating auto-
mated equipment, the grounding itself could
have been avoided had the chief officer and the
second officer followed longstanding good
watchkeeping practices when approaching land.
During the 1600-to-2000 watch preceding the
accident, the chief officer did not visually iden-
tify the buoy he saw on the radar about 1900
and apparently assumed that it was the BA
buoy, which marked the entrance to the traffic
lanes. The target that he probably observed was
the AR buoy, which marked a wreck about 17
miles west of the traffic lanes, and it was proba-
bly coincidental that he detected it when and
where he anticipated seeing the BA buoy. He
later explained that he was not concerned about
confirming that the target was the BA buoy be-
cause the information displayed at the time on
the GPS and ARPA displays indicated to him
that confirmation was not necessary.

When the second officer assumed the fol-

lowing watch, he did not detect, either visually
or by radar, the next buoy in the traffic lanes,
the BB buoy, when it was expected. Contrary to
standing orders from the master, he failed to
report that he had not seen the BB buoy; and
when the master called the bridge anticipating
passing the buoy, the second officer stated that
he had observed it.

The second officer continued to miss op-

portunities to avoid the grounding when the
lookouts reported sighting several high red
lights (later determined to be on Nantucket Is-
land), sighting a flashing red light on the port
bow, and sighting blue and white water ahead of
the Royal Majesty. He acknowledged these ob-
servations, but he failed to take any action.

The second officer’s response to these

sightings should have been deliberate and
straightforward. He should have been concerned

as soon as the BB buoy was not sighted and then
again when the lookouts sighted the red lights.
Had he then increased the radar range from 6
miles to 12 miles on the port radar, the one radar
in use, or turned on the starboard radar and set it
to the 12-mile range, he would have detected
Nantucket Island. He would also have seen that
the radar pictures did not conform to the radar
maps exhibited on the ARPA display. In addi-
tion, had he checked a chart of the area for the
source of the flashing red light, he would have
learned that the nearest flashing red light was
the Rose and Crown Shoal buoy and, thus,
would have been warned that the ship was not in
the traffic lanes, as he believed it was.

Additionally, the second officer should have

checked the Loran-C to cross check his position,
as he knew the Loran-C to be accurate in this
area. Had he still been uncertain about the posi-
tion of the Royal Majesty after checking the Lo-
ran-C, he should have called the master and the
navigator to the bridge for assistance. The
Safety Board concludes that the sighting of
lights not normally observed in this area and the
second officer’s inability to confirm the pres-
ence of the BB buoy should have taken prece-
dence over the automation display on the central
console and compelled the second officer to
promptly use all available means to verify his
position.

Fundamental seamanship practices caution

against exclusive reliance on any one source of
position information for navigation. When a
watch officer finds visually sighted navigation
aids that conflict with a position determined by
automated instrumentation, he should promptly
verify the vessel’s position by using proper pro-
cedures. The Safety Board concludes that the
chief officer and the second officer did not ob-
serve good watchkeeping practices or act with
heightened awareness of the precautions that are
needed when a vessel approaches the Boston
traffic lanes and landfall. Consequently, in view
of the actions of the watch officers on the Royal
Majesty, the Safety Board believes that Majesty
Cruise Line should review and revise as neces-
sary the bridge watchstanding practices on all its
vessels to ensure that all watch officers adhere
to sound watchstanding practices and proce-

dures, including using landmarks, soundings,
and navigational aids to verify a vessel’s posi-
tion, relying on more than one source for posi-
tion information, and reporting to the master any
failure to detect important navigational aids.
The Safety Board believes that the ICCL should
encourage its members to take the same steps.
The Safety Board further believes that Majesty
Cruise Line and the members of the ICCL
should periodically review the performance of
all officers on board their vessels.

Master’s Monitoring of the Vessel’s Prog-

ress.—The investigation determined that the
master of the Royal Majesty frequently visited
the bridge to keep himself informed about
bridge operations and to confirm that the pas-
sage was progressing satisfactorily. By request-
ing that the chief officer and the second officer
report their sightings of the BA and BB buoys,
the master made a reasonable effort to assure
himself that the Royal Majesty was following its
intended track. It is likely that the chief officer
was not aware that he had misidentified the BA
buoy, which marked the entrance to the traffic
lanes, and unknowingly passed on erroneous
information about the buoy to the master and the
second officer. The second officer, however,
deliberately misinformed the master when asked
whether he had seen the BB buoy. Thus, the
master was grossly misled by the second officer
and was denied the opportunity to investigate
clues indicating that the ship was not following
the intended track.

The evidence suggests, however, that the

master did not have any better understanding of
the automated navigation system and the func-
tioning of the GPS than the watch officers. His
requirement that the officers plot courses manu-
ally did not result in anyone monitoring the ves-
sel position by using an independent source of
position information. Because the officers used
the GPS data to get the coordinates for the man-
ual plotting, the fixes on the chart corresponded
with the map and positions displayed on the
central console; thus the manual plotting in no
way verified the validity of the GPS data. The
master appeared to share the deck officers’ reli-
ance on the automated navigation system, since
he did not ask for deliberate cross checks be-

tween the GPS and the Loran-C or make any
comparisons himself. The Safety Board con-
cludes that the master’s methods for monitoring
the progress of the voyage did not account for
the technical capabilities and limitations of the
automated equipment.

Effects of Automation on Watch Officers’
Performance

Innovations in technology have led to the

use of advanced automated systems on modern
maritime vessels. However, bridge automation
has also changed the role of the watch officer on
the ship. The watch officer, who previously was
active in obtaining information about the envi-
ronment and used this information for control-
ling the ship, is now “out of the control loop.”
The watch officer is relegated to passively
monitoring the status and performance of the
automated systems. As a result of passive
monitoring, the crewmembers of the Royal Maj-
esty missed numerous opportunities to recognize
that the GPS was transmitting in DR mode and
that the ship had deviated from its intended
track. The Safety Board examined why the
watch officers missed the opportunities.

When the GPS unit defaulted to its DR

mode, it displayed both SOL and DR, indicating
that the GPS solution was no longer valid and
that the unit had switched to a DR mode. Al-
though the watch officers testified they used the
GPS data for plotting, each officer also testified
that he did not see SOL displayed on the GPS
unit. Ineffective monitoring of sophisticated
automated equipment is not new. The Safety
Board has investigated several aviation acci-
dents in which pilots failed to monitor flight
instruments during automated flight.

Likewise,

empirical research on the monitoring of auto-

(a) National Transportation Safety Board. 1986. China

Airlines Boeing 747-SP, N4522V, 300 nautical miles
northwest of San Francisco, California, Feb. 19, 1985.
Aviation Accident Report NTSB/AAR-86/03. (b) National
Transportation Safety Board. 1984. Scandinavian Airlines
System Flight 901, McDonnell Douglas DC-10-30, John F.
Kennedy Airport, Jamaica, New York, February 28, 1984.
Aviation Accident Report NTSB/AAR-84/15. (c) National
Transportation Safety Board. 1973. Eastern Air Lines, Inc.,
L-1011, N310EA, Miami, Florida, December 29, 1972.
Aviation Accident Report NTSB/AAR-73/14.

mation has shown that humans are poor moni-
tors of automated systems.

The problem of

poor monitoring of automated systems was also
known to STN Atlas, the manufacturer of the
NACOS 25 system. STN Atlas warns in its op-
erating manual for the NACOS 25 that opera-
tors, with little to do, may fail to monitor the
automated NACOS 25 system.

The watch officers’ failure to recognize the

SOL or DR messages may also have been related
to the absence of any loud alarm signifying poor
GPS data. Before the separation of the antenna
cable connection, failures of the GPS system
triggered the NACOS 25 position-fix alarm.
This could have led to what Wiener and Curry
(1980) referred to as a primary/backup inver-
sion.

The primary indicators of the status of

the GPS unit are SOL and DR. As a backup to
these primary indicators, the watch officers
could use the position-fix alarm to signal inac-
curate GPS data. As Wiener and Curry warned,
the watch officers and the master of the Royal
Majesty relied exclusively on the position-fix
alarm instead of monitoring for SOL or DR. In
1988, the Safety Board investigated another case
of primary/backup inversion in the crash of a
Northwest Airlines Boeing 737 in Romulus,
Michigan.

The plane crashed while the crew

was attempting to take off in the wrong flight
configuration. The crew apparently relied on an
onboard configuration warning system instead
of manually checking the position of the flaps
and slats.

The Board’s investigation also found that

the watch officers failed to use independent al-
ternative means to verify the Royal Majesty's

(a) Parasuraman, R.; Molloy, R.; Singh, I. 1993. “The

performance consequences of automation-induced compla-
cency.” The International Journal of Aviation Psychology,
3(1): 1-23. (b) Kessel, C. J.; Wickens, C. D. 1982. “The
transfer of failure-detection skills between monitoring and
controlling dynamic systems.” Human Factors, 24(1), 49-
60.

Wiener, E. L.; Curry, R. E. 1980 “Flight deck automa-

tion: problems and promises.” Ergonomics, 23 995-1011.

National Transportation Safety Board. 1988. Northwest

Airlines, Inc., McDonnell Douglas DC-9-382, N312RC,
Detroit Metropolitan Wayne County Airport, Romulus,
Michigan, August 16, 1987. Aviation Accident Report
NTSB/AAR-88/05.

position. Research on operator monitoring per-
formance suggests that the reliability or trust-
worthiness of an automated system

could have

affected the officers’ verification of the GPS
position data. The complete automated naviga-
tion system, including the GPS, on the Royal
Majesty had proven to be a highly reliable and
accurate system, and the watch officers’ testi-
mony suggested that they believed the GPS was
superior to other onboard position instrumenta-
tion. Also, the watchkeeping procedures of the
master and the watch officers did not include an
effective mechanism for comparing the GPS
with other position instrumentation. Although
the master required the watch officers to plot
fixes manually as an apparent check on the sys-
tem, this procedure did not provide an inde-
pendent verification of the GPS information.
The Safety Board concludes that the watch offi-
cers on the Royal Majesty may have believed
that because the GPS had demonstrated suffi-
cient reliability over 3 ½ years, the traditional
practice of using at least two independent
sources of position information was not neces-
sary.

After failing to recognize the mode change

on the GPS system, the watch officers had nu-
merous opportunities to detect that the vessel
had drifted away from its intended track. The
failure of the chief officer and the second officer
to recognize that the Royal Majesty was off
course may be explained by how convincing the
display of position information was. The
NACOS 25 presented the watch officers with a
detailed map view (on the ARPA display) that
indicated the position of the ship. The map dis-
play provided a very salient and seemingly accu-
rate picture of the Royal Majesty's course. Re-
search on decisionmaking indicates that cues
that are most salient, such as the map display,
tend to bias operators when they make diagnos-
tic decisions.

Further, research on decision-

making in the presence of automation has indi-

Mosier, K. L., Skitka, L. J., and Heers, S. T. Automa-

tion and Accountability for Performance. In: Proceedings
of the 8

International Symposium on Aviation Psychol-

ogy. Columbus, OG: The Ohio State University, 1995.

Wickens, C. D. 1984. Engineering Psychology and

Human Performance. Columbus, Ohio: Merrill.

cated that automation can bias an operator’s de-
cisions.

Both the chief officer and the second officer

exhibited decisionmaking bias toward the auto-
mated map display. Based on information from
the map display, the chief officer felt no need to
visually verify his identification of the BA buoy.
The second officer was overly reliant on the
map display when he failed to cross check the
vessel’s position despite repeated indications of
the Royal Majesty's deviation from its intended
track. The Safety Board concludes that all the
watchstanding officers were overly reliant on
the automated position display of the NACOS
25 and were, for all intents and purposes, sailing
the map display instead of using navigation aids
or lookout information.

Notwithstanding the merits of advanced

systems for high-technology navigation, the
Safety Board does not consider the automation
of a bridge navigation system as the exclusive
means of navigating a ship, nor does the Board
believe that electronic displays should replace
visually verifiable navigation aids and land-
marks. The human operator must have the pri-
mary responsibility for the navigation; he must
oversee the automation and exercise his in-
formed judgment about when to intervene
manually.

As the grounding of the Royal Majesty

shows, shipboard automated systems, such as
the integrated bridge system and the GPS, can
have a profound influence on a watchstander’s
performance. However, the full impact of auto-
mated systems on watchstanding performance
has yet to be examined in detail. The Coast
Guard has begun this effort by examining how
automation affects watch officers’ tasks and
workload. The Safety Board believes further
research is necessary. Therefore, the Safety
Board recommends that the Coast Guard con-
tinue its research on shipboard automation, fo-
cusing on watch officers’ monitoring and deci-

Mosier, K. L.; Skitka, L. J. 1966. “Humans & automa-

tion, Made for each other?” In Raja Parasuraman and
Mustapha Mouloua. Eds. Automation and Human Per-
formance: Theory and Applications. Mahwah, NJ: Law-
rence Erlbaum Associates.

sionmaking aboard ships with automated inte-
grated bridge systems.

Integrated Bridge System Design and
Location

The performance of the watch officers dur-

ing the voyage and the circumstances leading to
the grounding were linked to several error-
inducing deficiencies in the design of the
equipment and to an inefficient layout of system
displays on the bridge.

Although the Raytheon 920 GPS receiver’s

NMEA 0183 output data should have been pro-
grammed to identify the receiver as an inte-
grated instrument (II) talker with a system mode
(SYS) sentence to indicate GPS or DR mode, the
industry standard NMEA 0183 data protocol did
not provide a SYS identifier for DR mode. In
short, the NMEA did not consider that hybrid
mode receivers could use DR as one of their
modes of determining position. Consequently,
the Raytheon designers chose to use the GPS
GP identifier in the NMEA 0183 output, re-
gardless of whether the Raytheon 920 GPS de-
vice was transmitting valid GPS data or DR-
derived position data.

To account for this, however, Raytheon also

programmed the Raytheon 920 GPS to auto-
matically set the NMEA 0183 valid/invalid po-
sition data bits to the invalid state when the GPS
was operating in the SOL and/or DR mode. In
doing so, Raytheon assumed that a listener de-
vice, such as the NACOS 25, using position data
from a GP talker would recognize when the data
were flagged invalid.

Once the desired position receiver is se-

lected by the crew, the NACOS 25 takes posi-
tion data from the chosen position receiver
based on the “talker” identifier code in the
NMEA 0183 data stream; in this case, GP in the
data stream from the Royal Majesty’s Raytheon
920 GPS. STN Atlas designers did not expect a
device identifying itself as GP to send position
data based on anything other than GPS data,
particularly not on DR-derived position data.
Further, STN Atlas expected inaccurate or failed
GPS position data to be recognizable by nulled
position data fields or by no change in the posi-

tion latitude/longitude, the latter of which would
trigger the NACOS 25 position-fix alarm. STN
Atlas therefore chose not to program the
NACOS 25 to check the valid/invalid bits in the
NMEA 0183 data stream as a means of detect-
ing invalid GPS data. Consequently, when the
GPS defaulted to the DR mode, the NACOS 25
autopilot was unable to recognize the status
change; and thus its subsequent navigation did
not correct for the effect of wind, current, or
sea. The Safety Board concludes that because
the industry standard NMEA 0183 data protocol
did not provide a documented or standardized
means of communicating or recognizing that a
DR positioning mode was in use by a hybrid,
DR-capable position receiver, Raytheon and
STN Atlas adopted different design philoso-
phies about the communication of position-
receiver mode changes for the Raytheon 920
GPS and the NACOS 25.

Nevertheless, STN Atlas was aware of and

claimed compatibility with the NMEA 0183
protocol containing the valid/invalid status bits
used by Raytheon and was capable of making
the NACOS 25 NMEA 0183 interface fully
compatible with those specifications if it wanted
to do so (including the recommended minimum
GPS data sentence RMC). Therefore, the Safety
Board further concludes that STN Atlas should
have, in order to help ensure safety and com-
patibility with different NMEA 0183 position
receivers, programmed the Royal Majesty’s
NACOS 25 to recognize the valid/invalid status
bits in the NMEA 0183 data, including those
specified in the NMEA 0183 v1.5 RMC recom-
mended minimum GPS data sentence. The
Safety Board is aware that since the accident,
STN Atlas has taken steps to program its inte-
grated navigation system NMEA 0183 inter-
faces to meet a newer, more comprehensive
NMEA 0183 version and to ensure that no DR-
capable position receivers are used with its
NACOS-integrated navigation system. The
Safety Board believes that Raytheon should de-
sign its hybrid positioning systems to identify
themselves as integrated instruments (II) with an
appropriate system mode identifier (SYS) in co-
ordination with the NMEA. Further, the Board
believes that the NMEA and the IEC should re-

vise their electronic interface standards to pro-
vide an explicit means of indicating when hy-
brid position receivers are transmitting DR-
derived position data. Finally, the Board be-
lieves that the NMEA and the IEC should advise
their members to (1) immediately inform the
NMEA and the IEC of perceived inadequacies
in electronic interface standards and (2), if ap-
plicable, design their hybrid positioning systems
to identify themselves (“talk”) as integrated in-
struments (II) with an appropriate system mode
identifier (SYS).

Although the Royal Majesty was equipped

with multiple position receivers, the NACOS 25
autopilot was not configured to compare posi-
tion data from multiple independent position
receivers, such as the Raytheon 920 GPS and
the 780 Loran-C receivers. Given the Royal
Majesty’s frequent proximity to land and the
expected reasonable accuracy of the Loran-C in
that area, the NACOS 25 could have recognized
the large discrepancy between the GPS and the
Loran-C positions as the vessel approached
Nantucket Shoals had it been able to compare
them. The Safety Board concludes that had the
autopilot been configured to compare position
data from multiple independent position receiv-
ers and had a corresponding alarm been installed
that activated when discrepancies were detected,
the accident may have been avoided. The safety
benefits associated with the redundancy of such
critical systems as position receivers would help
prevent such single-point catastrophic failures
as occurred on the Royal Majesty. The Safety
Board believes, therefore, that STN Atlas should
design its integrated bridge systems to incorpo-
rate multiple independent position receivers,
comparison of position data from those receiv-
ers, and related crew alerts regarding changes in
position-receiver accuracy, selection, and mode.

The NACOS 25 central console provided ef-

ficient access to and display of most information
needed to conduct a passage when the GPS was
fully operational. However, where various
sources of position information were possible
(i.e., GPS, Loran-C, or DR), as with the NACOS
25 autopilot, it was important to delineate
clearly which mode was in use. On the Royal
Majesty, because the NACOS 25 could not de-

tect the GPS’s change to DR mode, the central
console display switched from GPS to DR-
derived positions without changing its display in
any perceivable way or notifying the crew. The
integrated bridge system, as configured, did not
indicate to the officers at the central console that
the navigation system had defaulted to the DR
mode.

The design of the integrated bridge system

consolidated most of the officers’ watchstanding
navigation activities at the central console when
the Royal Majesty was underway. The officer on
watch could remain in the console seat for most
of his watch and execute maneuvers along with
most of the essential navigation tasks. However,
key components of the system were installed
elsewhere so that the officers needed to leave
the console area to do monitoring tasks. In order
to cross check the position instrumentation and
to verify that the navigation system was not in
the DR mode, officers needed to see equipment
displays in the chart room behind the console
area on the bridge. The GPS and the Loran-C
receivers were convenient only when manual
chart work was being performed. The Safety
Board concludes that because watch officers
must verify proper equipment operation fre-
quently, alternative sources of critical equip-
ment status should have been displayed directly
on the console or on repeaters located where
they could be seen from the central console.

Of particular concern was the alarm system

for the GPS. The internal aural alarm for the
GPS lasted 1 second, despite its critical func-
tion. Neither the brief aural alarm nor the visual
alarm, in the form of very small DR and SOL
characters on the GPS receiver’s screen, could
be easily seen or heard at the command console.
Rather, the GPS receiver was in the chart room.
The remoteness of the location probably pre-
cluded the watch officers’ hearing the alarm or
initially noticing the DR and SOL indications
when the GPS defaulted to the DR mode. Fur-
ther, the installer of the integrated bridge system
did not connect the GPS receiver’s external
alarm switch to a loud and continuous external
alarm, even though one was available. Had the
GPS external alarm been installed or had its in-
ternal aural alarm required the user to take ac-

tion to silence it, the officers would have been
alerted to the GPS antenna problem shortly after
leaving St. George’s. Consequently, the Safety
Board concludes that the Raytheon 920 GPS
receiver’s brief aural alarm, the remoteness of
the receiver’s location, and the failure of the
installer to connect the GPS external alarm re-
sulted in the inadequacy of the aural warning
sent to the crew when the GPS defaulted to the
DR mode. In view of the foregoing, the Safety
Board believes that Raytheon should design its
position receivers to provide continuous aural
alarms that require the user to take action to si-
lence them. The Board further believes that the
NMEA should recommend that its members de-
sign and install critical aural alarms that are
continuous and require the user to take action to
silence them. Finally, the Safety Board believes
that the ICCL, the International Chamber of
Shipping, and INTERTANKO should recom-
mend to their members that they ensure that in-
tegrated bridge systems installed on their vessels
provide critical aural alarms that are continuous
and require the user to take action to silence
them.

The failure of the GPS antenna connection

and the subsequent failure of the NACOS 25
autopilot to recognize the GPS data as invalid
and to sound an alarm resulted in a single-point,
“silent” failure mode on the Royal Majesty.
Aeronautical and aerospace design safety prac-
tices typically require the analysis of potential
failure modes via failure modes and effects
analyses (FMEAs). FMEAs of the Royal Maj-
esty’s integrated bridge system could have high-
lighted the need for multiple independent com-
parisons of positioning systems to detect dis-
crepancies between systems, the need for re-
moval of the DR input to the Raytheon 920 GPS
receiver, and the need for the NACOS 25 to in-
terrogate the NMEA 0183 valid/invalid position
data bits. The Safety Board concludes that
FMEAs of the Royal Majesty’s integrated bridge
system would probably have disclosed the
shortcomings of the system’s components.
Therefore, the Safety Board believes that the
Coast Guard should propose to the IMO that it
develop standards for integrated bridge system
design that will require:

•

multiple independent position-
receiver inputs;

•

monitoring position-receiver data
for failures/invalid data and subse-
quent positive annunciation to the
crew;

•

comparing position-receiver data for
significant discrepancies between
position receivers, and subsequent
positive annunciation to the crew;
and

•

FMEAs during the design process
and once again when all peripheral
devices and equip-ment details have
been “frozen” if the FMEA during
the design process does not account
for all peripheral device/equipment
variations.

The Safety Board also believes that STN

Atlas should recommend that all of its custom-
ers have final FMEAs for their installations,
because overall integrated bridge system and
peripheral device installation details frequently
vary from installation to installation.

Further, the Safety Board believes that, in

the interim, the ICCL, the International Cham-
ber of Shipping, and INTERTANKO should
recommend that each of their members ensure
that their existing and new integrated bridge
systems incorporate the following:

•

multiple independent position-
receiver inputs;

•

monitoring position-receiver data
for failures/invalid data and subse-
quent positive annunciation to the
crew;

•

comparing position-receiver data for
significant discrepancies between
position receivers, and subsequent
positive annunciation to the crew;
and

•

FMEAs on existing systems, during
the design process for new systems,

and whenever peripheral devices or
equipment details change.

Human Systems Integration

It is apparent that the marine industry is un-

dergoing the same evolution in automation that
the aviation and other transportation industries
are. Accidents involving automated systems,
like the grounding of the Royal Majesty, high-
light the importance of considering the abilities
of the human operator in automated systems.
Rothblum et al. concluded:

Automation is becoming more prevalent
on commercial ships, affecting such ar-
eas as engineering, bridge, and cargo
operations. When designed properly and
used by trained personnel, such auto-
mation can be helpful in improving op-
erational efficiency and safety. How-
ever, when designed poorly or misused
by undertrained or untrained personnel,
automated equipment can be a contrib-
uting cause to accidents. In one study of
100 marine casualties, inadequate
knowledge about equipment was found
to be a contributing cause in 35 percent
of the casualties. The most frequently
cited problem was the misuse or nonuse
of radar. Lack of training is not the only
problem. Poor equipment design can in-
duce the mariner to make mistakes. In
the same study, one-third of the acci-
dents were found to be caused partly by
poor human-factors design of the
equipment.

Inadequate training and poor human-factors

design are often the result of applying a tech-
nology-centered philosophy to automated sys-
tems.

This approach seeks to replace mariner

functions with machine functions without con-
sidering the mariners’ capabilities and limita-

Rothblum, Sanquist, Lee, and McCallum. “Identifying

the Effects of Shipboard Automation on Mariner Qualifi-
cations and Training and Equipment Design.” Paper pre-
pared for ISHFOB ’95: Informational Symposium—Hu-
man Factors on Board. Bremen, Germany. November 15-
17, 1995.

Norman, S; Billings, C.E.; and others. 1988. Aircraft

automation philosophy: A source document. Moffett Field,
CA: NASA Ames Research Center.

tions. As a result, the approach has the effect of
leaving the mariner out of meaningful control or
active participation in the operation of the ship.
A human-centered philosophy towards automa-
tion recognizes that the mariner is the central
element in the operation of the ship. Conse-
quently, the philosophy emphasizes designs that
fully utilize human capabilities and protect
against human limitations, such as unreliable
monitoring and bias in decisionmaking.

Human systems integration (HSI), part of

the systems engineering

process addressing

the psycho-social aspects of system design, rep-
resents a method by which automation can be
designed with a human-centered philosophy.
HSI addresses such areas as human-factors en-
gineering,

training, manpower, and personnel.

The types of human engineering analyses asso-
ciated with HSI (i.e., task analysis, and error
analysis) help us to understand the impact of
automation on human tasks and on the entire
system’s performance.

Several standards and guidelines have been

produced to ensure that human factors are ad-
dressed in system designs, thus reducing the
potential for human error. These standards ad-
dress behaviors related to automation and spec-
ify design parameters that keep the systems’
operating characteristics within the physical and
cognitive capabilities of humans. The U.S. De-
partment of Defense and the National Aeronau-
tics and Space Administration have long recog-
nized the importance of addressing human fac-
tors early in the system design, development,
and overall acquisition processes and have pub-
lished relevant human engineering standards and
guidelines.

Systems engineering is the management function that

controls the total system development effort for the purpose
of achieving an optimum balance of all system elements.
Generally, those elements are equipment, software, person-
nel, facilities, and data. HSI specifically addresses the per-
sonnel, or human interactive, aspects of the system.

Human-factors engineering is the application of the prin-

ciples of human behavior to the design of equipment and
systems to enhance performance, safety, and quality.

Department of Defense: DOD 5000.2 “Defense Acquisi-

tion Management Policies and Procedures;” MIL-H-46855,
“Human Engineering Requirements for Military Systems,

Other sectors of the maritime industry have

incorporated human-factors engineering rou-
tinely. For example, the American Society of
Testing and Materials has adopted much of the
Department of Defense human engineering
standards in designing off-shore oil platforms.

Thus, while human engineering is a known con-
cept in the marine industry, there have not been
any unifying efforts to integrate this concept
into the marine engineering and manufacturing
sector. Additionally, human engineering in the
broader context of HSI has been given little or
no consideration. Consequently, the potential
for error causing behavior related to these sys-
tems has not been adequately addressed by the
marine industry.

To assess the HSI involved in the automated

systems on the Royal Majesty, the Safety Board
examined the training the officers received and
the design of the automated systems in the con-
text of human-factors engineering.

Watch Officers’ Training in Using the In-

tegrated Bridge System.—The investigation
determined that although the manufacturer of
the NACOS autopilot, STN Atlas, had class-
room and simulator training available to pur-
chasers of the system, the owner of the Royal
Majesty had not purchased any training. When
the vessel was placed in service, the manufac-
turer provided an orientation during sea trials to
the first complement of officers assigned to the
ship; however, of the officers on the Royal Maj-
esty at the time of the grounding, only the chief
officer had been a part of that complement.

The investigation determined that the watch

officers on the Royal Majesty during the
grounding were familiar with the basic opera-
tion of the automated navigation equipment, but
that no one, with the possible exception of the
navigator, appeared to be fully proficient with
the system, as evidenced by the lack of knowl-

Equipment, and Facilities;” MIL-STD-1472, “Human Engi-
neering Design Criteria for Military Systems, Equipment, and
Facilities;” MIL-STD 1800, “Human Factors Engineering;”
MIL-STD 1801, “User-System Interface.”

ASTM Standard F1166-88, Standard practice for hu-

man engineering design for marine systems, equipment and
facilities. ASTM Philadelphia, Pennsylvania.

edge about the GPS receiver’s DR mode capa-
bility. The crew’s automated navigation equip-
ment training consisted primarily of on-the-job
training, the type of training on which the ma-
rine industry has historically relied. For exam-
ple, the second officer’s preparation to operate
the automated navigation system was described
as him reading the equipment manuals acquired
with the system installation, observing bridge
operations by the other officers, and using the
equipment under their supervision. Because the
second officer’s introduction to the system con-
sisted of watching others or operating the sys-
tem himself during routine conditions, he
probably had very little experience in recogniz-
ing and coping with system malfunctions.

The Safety Board has long supported on-

the-job training as an important aspect of an op-
erator’s training. However, with the implemen-
tation of sophisticated, automated navigational
equipment, the Safety Board believes that on-
the-job training alone may not be sufficient. The
Safety Board is particularly concerned that there
were no procedures to determine the proficiency
of the officers in operating the automated navi-
gation system, including the navigator who, ac-
cording to his testimony, was responsible for all
instruments on the bridge and the orientation
and training of new officers. The Safety Board
concludes that the on-the-job training program
employed by Majesty Cruise Line to train the
Royal Majesty’s watch officers in the operation
of the integrated bridge system did not ade-
quately prepare the officers to identify and re-
spond to system malfunctions. Therefore, the
Safety Board believes that Majesty Cruise Line
should provide initial and recurrent formal
training on essential technical information,
equipment functions, and system operating pro-
cedures to all bridge watchstanding personnel
on all of its ships that are equipped with inte-
grated bridge systems. The Safety Board also
believes that the ICCL should encourage its
members to take the same steps.

As discussed earlier, the watch officers, in

particular the second officer and the chief offi-
cer, abandoned the good watchstanding prac-
tices of properly monitoring and cross checking
the progress of their vessel and instead relied

almost solely on the GPS and the ARPA display
to provide them with information about the ves-
sel’s movements. The circumstances of the
grounding of the Royal Majesty and the discus-
sions at the Safety Board’s public forum suggest
that there is a need for the international mari-
time community to address the issue of improv-
ing training for deck officers assigned to vessels
equipped with electronic navigation equipment
and integrated bridge systems. The Safety Board
is concerned that the inadequacy of training
given to the crew of the Royal Majesty in the
use of sophisticated electronic navigation
equipment and integrated bridge systems may be
typical of the industry. Therefore, the Safety
Board believes that the Coast Guard should pro-
pose to the IMO that it develop appropriate per-
formance standards for the training of watch
officers assigned to vessels equipped with so-
phisticated electronic navigation equipment and
integrated bridge systems and then require this
training.

The deficient monitoring of the integrated

navigation system by the deck officers and the
second officer’s failure to recognize the danger
to the Royal Majesty before the grounding point
to the usefulness of training in bridge resource
management. As shown by its issuance of Safety
Recommendations M-93-18, and -19, the Safety
Board has advocated such training for deck offi-
cers who operate conventional navigation
bridges. The grounding of the Royal Majesty,
however, shows the need to address procedures
for and training in effective monitoring of auto-
mated navigation equipment.

Bridge resource management training

adapted for watch officers working with fully
automated navigation systems or integrated
bridge systems could improve the officers’ per-
formance. The training would help them make
decisions that are not biased by their use of
automated equipment. It would improve their
situational awareness,

which, research

Situational awareness is a concept referring to percep-

tion of an operating environment, comprehension of events
and circumstances pertaining to that environment, and a
projection of their status. Endsley, M., Situational Aware-
ness. Presentation to National Transportation Safety Board,
June 6, 1996.

shows,

declines when operations are auto-

mated.

On June 25, 1993, as a result of its investi-

gation of the grounding of the United Kingdom
passenger vessel RMS Queen Elizabeth 2 (near
Cuttyhunk Island, Vineyard Sound, Massachu-
setts, on August 7, 1992, the Safety Board is-
sued Safety Recommendations M-93-18 and -19
to the Coast Guard. The Safety Board requested
that the Coast Guard:

Propose to the IMO that standards and
curricula be developed for bridge re-
source management training for the
masters, deck officers, and pilots of
ocean-going ships. (M-93-18)

Propose to the IMO that the masters,
deck officers, and pilots of ocean-going
ships be required to successfully com-
plete initial and recurrent training in
bridge resource management. (M-93-19)

On September 27, 1993, responding to

Safety Recommendation M-93-18, the Coast
Guard Commandant wrote:

I partially concur with this recommen-
dation. The U.S. will propose at the
25th Session of the IMO Subcommittee
on STW that standards and curricula be
developed for bridge resource manage-
ment training for masters and deck offi-
cers of seagoing ships. However, the
Coast Guard views pilot qualifications
as a matter for port State regulation. I
will keep the Board informed of our
progress regarding this recommenda-
tion.

On January 7, 1994, the Safety Board re-

sponded:

Pew, R.W. Situational Awareness and its Analysis in

Accident Situations. Presentation by Bold, Beranek and
Newman, Inc., to the National Transportation Safety Board,
June 7, 1995. Also, Endsley, M.L. and Kiris, E.O., The
Out-of-the-Loop Performance Problem: Impact of Level of
Automation and Situational Awareness., ref. In Mouloua,
M. and Parasuraman, R., Eds., Human Performance in
Automated Systems: Current Research and Trends,
Hillsdale, New Jersey, Lawrence Erlbaum Associates,
1994. Pp. 51,55.

The Safety Board agrees that, in the
end, pilot qualifications are a matter for
the port State to enforce. The intent of
the recommendation is for the IMO to
develop a specified standard that would
serve as a model that the port States
could adopt. The United States has re-
cently been more receptive to the idea
of developing a unilateral standard if it
is included in the Standards of Training
and Watchkeeping. Consequently, the
Board encourages the Coast Guard to
pursue this issue at the IMO. Because
the Coast Guard states it will propose
the recommendation to the IMO, Safety
Recommendation M-93-18 has been
classified “Open--Acceptable Re-
sponse,” pending implementation by the
IMO.

On September 27, 1993, responding to

Safety Recommendation M-93-19, the Coast
Guard Commandant wrote:

I partially concur with this recommen-
dation. The United States will propose
that IMO agree in principle to requiring
masters and deck officers on seagoing
ships to complete initial and recurrent
training in bridge resource management.
However, the Coast Guard views pilot
qualifications as a matter for port State
regulation. I will keep the Board in-
formed of our progress regarding this
recommendation.

On January 7, 1994, the Safety Board re-

sponded that for the reasons stated in the discus-
sion of Safety Recommendation M-93-18, the
Safety Board encouraged the Coast Guard to
actively promote the IMO’s acceptance of
Safety Recommendation M-93-19. Because the
Coast Guard had agreed to “proposing in princi-
ple” the recommendation, the Board classified
Safety Recommendation M-93-19 “Open--
Acceptable Alternate Response,” pending the
outcome of the Coast Guard’s efforts.

Therefore, the Safety Board reiterates

Safety Recommendations M-93-18 and -19 and
urges the Coast Guard to work closely with the

IMO in order to expedite the intended outcome
of these recommendations.

The Safety Board also believes that the

Coast Guard, as part of the foreign flag passen-
ger ship control verification examination pro-
gram, should assess the adequacy of installed
integrated bridge systems and verify that the
ships’ officers are properly trained in their op-
eration and possible failure modes. Furthermore,
as part of the same program, the Coast Guard
should verify that the watchstanding procedures
of ships’ officers include the use of multiple
independent means of position verification.

Human-factors Engineering.—Where mul-

tiple modes of operation are possible on a sys-
tem, an important human-factors engineering
principle is the clear delineation to the operator
of what mode is in use and of when a change in
mode occurs. Because different operating pro-
cedures may be required for the different modes
in use, the operator must be aware of the mode
to remain in the decisionmaking process. Thus,
the display of which modes and functions are in
use should be clearly evident to the operator.

A good example of automation mode confu-

sion occurred on January 20, 1992, when an Air
Inter Airbus A320 crashed on a mountainside
while on approach to the Strasbourg-Entzheim
Airport. The French Transport Ministry’s in-
vestigation determined that the pilots had be-
come confused with the vertical speed/flight
path angle display mode on the A320’s flight
control unit and had entered a 3,300 foot/minute
automatic rate of descent instead of an intended
3.3 angle of descent to the airport. The displays
of the vertical speed and the flight path angle
were almost identical and thus easily confused.

Not only did the GPS receiver on the Royal

Majesty display the DR coordinates in the same
character size and format as the coordinates de-
rived from satellite data, it switched to the DR
mode automatically, without requiring a human
to acknowledge that the mode was acceptable.
However, as previously discussed, deficiencies
in the alarm, the distance of the receiver from
the operator, and the inadequacy of the crew’s
procedures also contributed to the crew’s failure
to recognize the change to DR mode.

The size of characters, the viewing distance,

and the use of contrasting colors are a few of the
factors that should be considered in designing
character displays for alerts and warnings. Alert
messages and status indicators about critical
information, such as the GPS defaulting to the
DR mode, should be distinctively displayed. In
this case, the SOL and DR alert messages were
much smaller than the normal status informa-
tion.

An operator may also become desensitized

when an alert appears frequently with normal
status information. In this case, whenever chop-
ping occurred, SOL and DR were displayed. The
watch officers had noticed these messages many
times before and perhaps had learned to pay lit-
tle attention to them.

The Safety Board concludes that the Royal

Majesty’s integrated bridge system had several
shortcomings with respect to human-factors en-
gineering. First, mode information was not
available to the crew at the central console (the
normal position). Second, the GPS/DR alarm
and status indicators, which could have alerted
the crew to the mode change, were either not
installed (external alarm) or not salient enough
(internal alarm) to attract the watchstanders’
attention. Finally, the integrated bridge system
as implemented on the Royal Majesty failed to
adequately define the watch officers’ tasks and
procedures. If the automation on board the
Royal Majesty had been appropriately imple-
mented and integrated with the human operator,
the vessel probably would not have grounded.
Because of the Safety Board’s concern that
automation on other vessels has not been appro-
priately implemented and integrated with the
human operator, the Board believes that the
Coast Guard should propose to the IMO that it
apply existing human-factors engineering stan-
dards in the design of integrated bridge systems
on vessels.

Certification of Integrated Bridge Sys-
tems

A draft IMO performance standard for inte-

grated bridge systems is currently under review
and is expected to be adopted and implemented

by 1999. At the Safety Board’s public forum on
integrated bridge systems, manufacturers of in-
tegrated bridge systems pointed out that inte-
grating the various components like ARPA,
autopilot, electronic chart system (or radar
map), and monitoring systems involves careful
matching and FMEAs to eliminate any potential
interface problems. The recently developed in-
terface standards from the IEC and the NMEA
(IEC 1162-2 and NMEA 0183) should facilitate
the matching of subsystems manufactured by
one manufacturer to an integrated bridge system
manufactured by another. These standards and
an IMO performance standard should eliminate
many of the potential interface problems. The
Safety Board concludes that there is a need to
have performance standards for integrated
bridge systems, and to require that the systems
be inspected and certified.

The proposed IMO performance standard

for integrated bridge systems includes a re-
quirement that the manufacturers of integrated
bridge systems be certified by the ISO. Thus, it
would appear that the safeguards for guarantee-
ing the quality of software during manufacturing
likely will become an IMO requirement. Such a
requirement could ensure that the people re-
sponsible for developing the software are well
qualified and that the manufacturer has proce-
dures for verifying the quality of the software.

Developments in electronic equipment,

however, are very rapid, and it is sometimes
possible for developments to occur more quickly
than standards can be produced. Further, the
possibility exists that software may be changed,
possibly inappropriately, during the life of an
integrated bridge system. Therefore, the selec-
tion and matching of electronic equipment will
still require highly qualified personnel who are
familiar with the equipment, the data to be
transmitted, the format of the data, and the ap-
plicable standards. The Safety Board believes
that there is a need for some competent author-
ity to conduct continuing oversight to ensure
that future changes in subsystems or software on
integrated bridge systems are compatible and
that system integrity is maintained. Also, the
Safety Board believes that certifying navigation
bridges equipped with integrated bridge systems

CONCLUSIONS

The weather, the mechanical condition of
the Royal Majesty, except for the global po-
sitioning system receiver, the officers’ certi-
fications, drugs, and fatigue were not factors
in the accident.

Although Coast Guard personnel observed
no indications that the officers had been un-
der the influence of alcohol, alcohol could
not be conclusively ruled out as a factor in
the accident because of the delay in col-
lecting the blood and urine specimens.

About 52 minutes after the Royal Majesty
left St. George’s, Bermuda, the global posi-
tioning system receiver antenna cable con-
nection had separated enough that the global
positioning system switched to dead-
reckoning mode, and the autopilot, not pro-
grammed to detect the mode change and in-
valid status bits, no longer corrected for the
effects of wind, current, or sea.

Openly routing the global positioning sys-
tem antenna cable in an area where someone
occasionally walked increased the risk of
damage to the cable and related connectors.

Had the fathometer alarm been set to 3 me-
ters, as was the stated practice, or had the
second officer chosen to display the
fathometer data on the control console, he
would have been alerted that the Royal Maj-
esty was in far shallower water than ex-
pected and, thus, was off course. He would
have been alerted perhaps as long as 40
minutes before the grounding, and the
situation could have been corrected.

The watch officers’ monitoring of the status
of the vessel’s global positioning system
was deficient throughout the voyage from
St. George’s.

Deliberate cross checking between the
global positioning system and the Loran-C
to verify the Royal Majesty’s position was

not being performed and should have been
on the voyage from St. George’s.

Even though it is likely that the watch offi-
cers were not aware of the limitation inher-
ent in using the position-fix alarm to moni-
tor the accuracy of GPS position data, it was
inappropriate for them to rely solely on the
alarm to warn them of any problems with
the GPS data.

The sighting of lights not normally observed
in the traffic lanes, the second officer’s in-
ability to confirm the presence of the BB
buoy, and the sighting of blue and white
water should have taken precedence over
the automation display on the central con-
sole and compelled the second officer to
promptly use all available means to verify
his position.

10.

The chief officer and the second officer did
not observe good watchkeeping practices or
act with heightened awareness of the pre-
cautions that are needed when a vessel ap-
proaches the Boston traffic lanes and land-
fall.

11.

The master’s methods for monitoring the
progress of the voyage did not account for
the technical capabilities and limitations of
the automated equipment.

12.

The watch officers on the Royal Majesty
may have believed that because the global
positioning system had demonstrated suffi-
cient reliability over 3 1/2 years, the tradi-
tional practice of using at least two inde-
pendent sources of position information was
not necessary.

13.

All the watchstanding officers were overly
reliant on the automated position display of
the navigation and command system 25 and
were, for all intents and purposes, sailing
the map display instead of using navigation
aids or lookout information.

14.

Because the industry standard 0183 data
protocol did not provide a documented or
standardized means of communicating or
recognizing that a dead-reckoning position-
ing mode was in use by a hybrid, dead reck-
oning capable position receiver, Raytheon
and STN Atlas adopted different design
philosophies about the communication of
position-receiver mode changes for the
Raytheon 920 global positioning system and
the navigation and command system 25.

15.

STN Atlas should have, in order to help en-
sure safety and compatibility with different
National Marine Electronics Association
(NMEA) 0183 position receivers, pro-
grammed the Royal Majesty’s navigation
and command system 25 to recognize the
valid/invalid status bits in the NMEA 0183
data, including those specified in the NMEA
0183 v1.5 RMC recommended minimum
global positioning system data sentence.

16.

Had the navigation and command system 25
autopilot been configured to compare posi-
tion data from multiple independent position
receivers and had a corresponding alarm
been installed that activated when discrep-
ancies were detected, the grounding of the
Royal Majesty may have been avoided.

17.

Because watch officers must verify proper
equipment operation frequently, alternative
sources of critical equipment status should
have been displayed directly on the console
or on repeaters located where they could be
seen from the central console.

18.

The brief aural alarm of the Raytheon 920
global positioning system receiver, the re-
moteness of the receiver’s location, and the
failure of the installer to connect the global
positioning system external alarm resulted
in the inadequacy of the aural warning sent
to the crew when the global positioning
system defaulted to the dead-reckoning
mode.

19.

Failure modes and effects analyses of the
Royal Majesty’s integrated bridge system
would probably have disclosed the short-
comings of the system’s components.

20.

The on-the-job training program employed
by Majesty Cruise Line to train the Royal
Majesty’s watch officers in the operation of
the integrated bridge system did not ade-
quately prepare these officers to identify
and respond to system malfunctions.

21.

The Royal Majesty’s integrated bridge sys-
tem did not adequately incorporate human-
factors engineering.

22.

There is a need to have performance stan-
dards for integrated bridge systems, and to
require that the systems be inspected and
certified.

RECOMMENDATIONS

As a result of its investigation of this acci-

dent, the National Transportation Safety Board
reiterates the following recommendations:

To the U.S. Coast Guard:

Propose to the International Maritime
Organization that standards and curric-
ula be developed for bridge resource
management training for the masters,
deck officers, and pilots of ocean-going
ships. (M-93-18)

Propose to the International Maritime
Organization that the masters, deck offi-
cers, and pilots of ocean-going ships be
required to successfully complete initial
and recurrent training in bridge resource
management. (M-93-19)

Also as a result of the investigation, the Na-

tional Transportation Safety Board makes the
following recommendations:

To Majesty Cruise Line:

Provide initial and recurrent formal
training on essential technical informa-
tion, equipment functions, and system
operating procedures to all bridge
watchstanding personnel on all its ships
that are equipped with integrated bridge
systems. (M-97-1)

Review the bridge watchstanding prac-
tices on all its vessels, and revise, as
necessary, to ensure that all watch offi-
cers adhere to sound watchstanding
practices and procedures, including us-
ing landmarks, soundings, and naviga-
tional aids to verify a vessel’s position,
relying on more than one source for po-
sition information, and reporting to the
master any failure to detect important
navigational aids. (M-97-2)

Periodically review the performance of
all officers on board its vessels.
(M-97-3)

Eliminate the practice of openly routing
navigation equipment cable to decrease
the risk of damage. (M-97-4)

To the U.S. Coast Guard:

Propose to the International Maritime
Organization that it develop appropriate
performance standards for the training
of watch officers assigned to vessels
equipped with sophisticated electronic
navigation equipment and integrated
bridge systems and then require this
training. (M-97-5)

Propose to the International Maritime
Organization that it develop standards
for integrated bridge system design that
will require

•

multiple independent position-
receiver inputs;

•

monitoring position-receiver data
for failures/invalid data and subse-
quent positive annunciation to the
crew;

•

comparing position-receiver data for
significant discrepancies between
position receivers, and subsequent
positive annunciation to the crew;
and

•

failure modes and effects analyses
(FMEAs) during the design process
and once again when all peripheral
devices and equipment details have
been “frozen” if the FMEA during
the design process does not account
for all peripheral device/equipment
variations. (M-97-6)

Propose to the International Maritime
Organization that it apply existing hu-
man-factors engineering standards in the
design of integrated bridge systems on
vessels. (M-97-7)

Propose to the International Maritime
Organization that a provision be in-
cluded in the performance standard for
integrated bridge systems that would re-
quire that a competent independent
authority inspect and certify the naviga-
tion bridge of each commercial vessel
equipped with an integrated bridge sys-
tem when the system is installed and
throughout its life. (M-97-8)

Continue its research on shipboard
automation, focusing on watch officers’
monitoring and decisionmaking aboard
ships with automated integrated bridge
systems. (M-97-9)

As part of the foreign flag passenger
ship control verification examination
program, assess the adequacy of in-
stalled integrated bridge systems and
verify that the ships’ officers are prop-
erly trained in their operation and possi-
ble failure modes. (M-97-10)

As part of the foreign flag passenger
ship control verification examination
program, verify that the watchstanding
procedures of ships’ officers include the
use of multiple independent means of
position verification. (M-97-11)

To STN Atlas Elektronik GmbH:

Design its integrated bridge systems to
incorporate multiple independent posi-
tion receivers, comparison of position
data from those receivers, and related
crew alerts regarding changes in posi-
tion-receiver accuracy, selection, and
mode. (M-97-12)

Recommend that all its customers have
final failure modes and effects analyses
for their integrated bridge system in-
stallations. (M-97-13)

To Raytheon Marine:

Design its hybrid positioning systems to
identify themselves as integrated in-
struments (II) with an appropriate sys-
tem mode identifier (SYS) in coordina-

tion with the National Marine Elec-
tronics Association. (M-97-14)

Design its position receivers to provide
continuous aural alarms that require the
user to take action to silence them.
(M-97-15)

To the National Marine Electronics Associa-
tion:

Revise the 0183 electronic interface
standard to provide an explicit means of
indicating when hybrid position receiv-
ers are transmitting dead reckoning-
derived position data. (M-97-16)

Advise its members to (1) immediately
inform the National Marine Electronics
Association and the International Elec-
trotechnical Commission of perceived
inadequacies in electronic interface
standards and (2), if applicable, design
their hybrid positioning systems to
identify themselves (“talk”) as inte-
grated instruments (II) with an appropri-
ate system mode identifier (SYS).
(M-97-17)

Recommend to its members that they
design and install critical aural alarms
that are continuous and require the user
to take action to silence them.
(M-97-18)

To the International Electrotechnical Com-
mission:

Advise its members to (1) immediately
inform the National Marine Electronics
Association and the International Elec-
trotechnical Commission of perceived
inadequacies in electronic interface
standards and (2) if applicable, design
their hybrid positioning systems to
identify themselves (“talk”) as inte-
grated instruments (II) with an appropri-
ate system mode identifier (SYS).
(M-97-19)

Revise the 1162 electronic interface
standard to provide an explicit means of
indicating when hybrid position receiv-

ers are transmitting dead reckoning-
derived position data. (M-97-20)

To the International Council of Cruise Lines:

Recommend that its members provide
initial and recurrent formal training on
essential technical information, equip-
ment functions, and system operating
procedures to all bridge watchstanding
personnel on their ships that are
equipped with integrated bridge sys-
tems. (M-97-21)

Recommend that its members review
the bridge watchstanding practices on
all their vessels, and revise as necessary
to ensure that all watch officers adhere
to sound watchstanding practices and
procedures, including using landmarks,
soundings, and navigational aids to ver-
ify a vessel’s position, relying on more
than one source for position informa-
tion, and reporting to the master any
failure to detect important navigational
aids. (M-97-22)

Recommend that its members periodi-
cally review the performance of all offi-
cers on board their vessels. (M-97-23)

Recommend that its members eliminate
the practice of openly routing naviga-
tion equipment cable to decrease the
risk of damage. (M-97-24)

Recommend to its members that they
ensure that integrated bridge systems in-
stalled on their vessels provide critical
aural alarms that are continuous and re-
quire the user to take action to silence
them. (M-97-25)

Recommend that its members ensure
that their existing and new integrated
bridge systems incorporate the follow-
ing:

•

multiple independent position-
receiver inputs;

•

monitoring position-receiver data
for failures/invalid data and subse-
quent positive annunciation to the
crew;

•

comparing position-receiver data for
significant discrepancies between
position receivers, and subsequent
positive annunciation to the crew;
and

•

failure modes and effects analyses
on existing systems, during the de-
sign process for new systems and
whenever peripheral devices or
equipment details change.
(M-97-26)

To the International Chamber of Shipping
and to the International Association of Inde-
pendent Tanker Owners:

Recommend that its members ensure
that their existing and new integrated
bridge systems incorporate the follow-
ing:

•

multiple independent position-
receiver inputs;

•

monitoring position-receiver data
for failures/invalid data and subse-
quent positive annunciation to the
crew;

•

comparing position-receiver data for
significant discrepancies between
position receivers, and subsequent
positive annunciation to the crew;
and

APPENDIX B

MAJESTY CRUISE LINE’S

ROYAL MAJESTY’S “BRIDGE PROCEDURES GUIDE”

The purpose of this guide is to provide you with a description of day-to-day Bridge procedures that

are recognized as good practice and to promote through them safety of the Royal Majesty, her passengers
and crew. This guide is posted on the Bridge so that you may keep yourselves thoroughly familiar with
its content which is not written in an arbitrary manner but with sincere wish that you will understand
your responsibilities and perform your duties in a professional manner.

The officer on watch is my representative, and your primary responsibility at all times is the safe

navigation of the vessel. You must at all times comply with the 1972 International Regulations for Pre-
venting Collisions At Sea.

You should keep your watch on the Bridge, which you should in no circumstances leave until prop-

erly relieved. A prime responsibility of the Officer on Watch is to ensure the effectiveness of the navi-
gating watch. It is of essential importance that all times you ensure that an efficient lookout is main-
tained. You may visit the chart room, when essential, for short periods for the necessary performance of
your navigational duties, but you should previously satisfy yourself that it is safe to do so and ensure that
a good lookout is kept.

You continue to be responsible for the safe navigation of the vessel despite my presence on the

Bridge until I inform you specifically that I have assumed responsibility.

You should not hesitate to use the sound signaling apparatus at your disposal in accordance with the

1972 International Regulations for Preventing Collisions At Sea.

You are responsible for the maintenance of a continuous and alert lookout. This is the most important

consideration in the avoidance of casualties. The keeping of an efficient lookout requires to be inter-
preted in its fullest sense which includes the following: A) An alert all round visual and aural lookout to
ensure a full grasp of the current situation including the presence of ships and landmarks in the vicinity.
B) Close observation of the movements and compass bearing of approaching vessels. C) Identification of
ships and shore lights. D) The need to ensure that the course is steered accurately and that wheel orders
are correctly executed. E) Observation of the radar and echo sounder displays. F) Observation of changes
in the weather, especially the visibility.

You should bear in mind that the engines are at your disposal. You should not hesitate to use

them in case of need. However, timely notice of engine movements should be given when possible. You
should also keep prominently in mind the maneuvering capabilities of this ship, including its stopping
distances.

CONTROL OF MAIN ENGINES: There are two aspects with which you are mainly concerned:

(A) Control of revolutions and pitch ahead and astern. You should be familiar with the operation of the
engine/propellers control mechanism, bow thrusters, and rudders.

CHANGING OVER THE WATCH: The relieving officer on watch should ensure that members of

his watch are fully capable of performing their duties and, in particular, that they are adjusted to night
vision. You should not take over the watch until your vision is fully adjusted to the light conditions and
you have personally satisfied yourself regarding: A) Standing orders and other special instructions relat-
ing to the navigation of the vessel. B) The position, course, speed, and draught of the vessel. C) Prevail-
ing and predicted tides, currents, weather, visibility, and the effect of these factors upon course and

speed. D) The navigational situation including: i) The operational condition of all navigation and safety
equipment. ii) Errors of gyro and magnetic compasses. iii) The movement of vessels in the vicinity. iv)
Conditions and hazards likely to be encountered during the watch. v) The possible effects of heel, trim,
water density, and squat on under keel clearances. If at any time you are to be relieved, a maneuver or
other action to avoid any hazard is taking place, your relief should be deferred until such action is com-
pleted. You should not hand over the watch to the relieving officer if you have any reason to believe that
the latter is under any disability which would preclude him from carrying out his duties effectively. If in
doubt, you should inform me at once.

You should make regular checks to ensure that: A) The helmsman or the autopilot is steering the cor-

rect course. B) The standard compass error is established at least once a watch and, when possible, after
any major alteration of course. C) The standard and gyro compasses are compared frequently and repeat-
ers synchronized. D) The automatic pilot is tested in the manual position at least once a watch. E) The
navigation and signal lights and other navigation equipment are functioning properly.

HELMSMAN/AUTOMATIC PILOT: You should bear in mind the need to station the helmsman

and change over the steering to manual control in good time to allow any potentially hazardous situation
to be dealt within a safe manner. With a vessel under automatic steering, it is highly dangerous to allow a
situation to develop to the point where you are without assistance and have to break the continuity of the
lookout in order to take emergency action. The change-over from automatic to manual steering and visa
versa should be made by or under the supervision of a responsible officer.

NAVIGATION IN COASTAL WATERS: The largest scale chart on board, suitable for the area

and corrected with the latest information, should be used. You should identify positively all relevant
navigation marks. Fixes should be taken at intervals whose frequency must depend upon factors such as
distance from nearest hazard, speed of ship, set experienced, etc. In cases such as a planned approach to
an anchor berth or harbor entrance, fixing may be virtually continuous.

RESTRICTED VISIBILITY: When restricted visibility is encountered or suspected, your first re-

sponsibility is to comply with 1972 International Regulations for Preventing Collisions At Sea with par-
ticular regard to the sounding of fog signals, use of safe speed and availability of engines for immediate
maneuver. In addition you should A) Inform me. B) Post lookout(s), helmsman and in congested areas,
revert to hand-steering immediately, C) Exhibit navigation lights. D) Operate and use the radar. All of the
above actions should, if possible, be taken in good time before visibility deteriorates.

CALLING THE MASTER: You should notify me immediately under the following circumstances:

A) If visibility is deteriorating. B) If the movements of other vessels are causing concern. C) If difficulty
is experienced in maintaining course. D) On failure to sight land or a navigation mark or to obtain a
sounding by the expected time. E) If either land or a navigation mark is sighted or a marked change in the
soundings occurs unexpectedly. F) On the breakdown of the engines, steering gear, or any other essential
navigational equipment. G) If any doubt about the possibility of weather damage. H) In any other situa-
tion in which you are in doubt. Despite the requirement to notify me immediately in the foregone circum-
stances, you should not hesitate to take immediate action for the safety of the ship, where circumstances
so require.

NAVIGATION WITH PILOT EMBARKED: The presence of a pilot does not relieve you from

your duties and obligations. You should cooperate closely with the pilot and maintain an accurate check
on the vessel’s position and movements. Alterations of course and/or changes in wheel and/or engine
orders should be transmitted through you. If you are in any doubt as to the pilot’s actions or intentions,
you should seek clarification from the pilot and, if still in doubt, notify me immediately and take what-
ever action is necessary before I arrive.

APPENDIX C

MAJESTY CRUISE LINE’S CIRCULAR NO. 9

DUTIES OF THE OFFICER ON WATCH

OPS

10.

11.

12.

13.

14.

15.

The paper work required during the watch is to be done on the bridge

CIRCULAR NO. 9 PAGE 3

done in the bridge, never in the chartroom. When you need to go

to the chartroom you should be brief.

Smoking in the chartroom is not allowed.

JULY 1992

One quartermaster is to always be on the lookout position.

Check the compasses during your watch twice, and enter the readings in the relevant book. Check the course,
the position, navigation lights, traffic in the area, course and distance of ships in the vicinity before you take
over the watch.

Check the compass error at least once during your watch (weather condition permitting) and enter the
readings in the relevant book.

Check the ship’s position as often as conditions and circumstances allow, but never longer than 30 minute
intervals.

You summon the Master to the bridge when:

The visibility is less than 5 miles.

b) The wind changed direction, which could cause drifting from course.
c)

Another ship is crossing the bow and the bearings are steady.

d) You have doubts about the position.
e)

Traffic is congested or ship is about to pass dangerous areas.

If the Master is not in his office and cannot be found immediately, use the P.A. system by saying “THIS IS
THE BRIDGE” Never say “THE CAPTAIN IS REQUESTED ON THE BRIDGE. ”

In case of fog, after you have summoned the Master to the bridge, do the following:

Engines on “stand by. ”

b) Radar “on.”
c)

Whistle “on.”

d) Switch from auto pilot to hand steering.
e)

Close the watertight doors.

One quartermaster on the “lookout” position on the bridge and one AB at the bow.

Plot the course, position, and speed of all ships in the vicinity.

h) When the fog has cleared, recall all above actions.

Never pass another ship, land, or any other object less than 1.5 miles distance.

Start maneuvering the ship to avoid a collision, never less than 3 miles distance.

Close all the portholes and headlights during bad weather conditions.

One radar is to always be “ON” if the conditions require so. Relevant entry is to be made in the radar book.

Never leave your position before you are relieved by the Officer of the next watch.

Always be alert during your watch.

APPENDIX D

POSTACCIDENT TESTING OF GPS RECEIVER AND ANTENNA

The Raytheon RAYSTAR 920 Global Positioning System (GPS) receiver and antenna used for

navigation during the grounding of the Royal Majesty were tested at Raytheon headquarters on July 6,
1995.

Present for the tests were representatives from the National Transportation Safety Board, Ray-

theon Marine, and Majesty Cruise Line. A new Raytheon RAYSTAR 920 GPS receiver and antenna,
randomly removed from Raytheon stock, were first tested to establish a baseline for functionality and
performance. The Raytheon GPS receiver and antenna from the Royal Majesty were then tested for com-
parison. Speed log and gyro compass inputs from bench test equipment were used to simulate dead reck-
oning (DR) data inputs when necessary. The test results follow:

•

The Raytheon RAYSTAR 920 GPS receiver and antenna from the Royal Majesty functioned
per design and in a like manner to that of a new Raytheon RAYSTAR 920 GPS receiver and
antenna.

•

An “open” in the GPS antenna cable shield wire, such as would result if the shield wire
pulled out of any connector leading to the antenna, results in the GPS receiver going into the
SOL and DR modes within 2 to 3 seconds of the “open” being established, regardless of
whether speed/course data are being input to the GPS receiver.

•

As few as 1 to 3 strands of GPS antenna cable shield wire permit continued operation of the
antenna pre-amp and, therefore, system functionality.

•

As long as the Raytheon 920 GPS receiver’s internal audio alarm function is active (user se-
lectable; “ON” in the case of the Royal Majesty’s unit), going from a satellite fix condition to
the SOL and DR modes results in a brief (<1 second) audio alarm chime (similar to a wrist-
watch alarm in volume and tone).

•

As long as the Raytheon 920 GPS receiver’s external alarm function is active (user select-
able), going from a satellite fix condition to the SOL and DR modes results in a continuous
closing of the external alarm contacts (which could be used to wire up external or remote
audio alarms of various forms).

•

When satellite data input is removed from the operating Raytheon 920 GPS receiver and
speed/course data (e.g., DR data) are available, a single audio alarm chime is emitted, and the
receiver continues to output NMEA 0183 v1.5 data, with the LAT/LONG portion of the
NMEA 0183 v1.5 data continuing to update based on the DR data and the last GPS position.

•

When both satellite data and speed/course data (e.g., DR data) inputs are removed from the
operating Raytheon GPS receiver, two brief and separate audio alarm chimes are emitted,
and the receiver continues to output NMEA 0183 v1.5 data; but the LAT/LONG portion of
the NMEA 0183 v1.5 data stay fixed at the last position.

•

An “open” in the antenna cable center conductor results in the GPS receiver going into the
SOL and DR modes within 2 to 3 seconds of the “open” being established, regardless of
whether speed/course data are being input to the GPS receiver.

The Safety Board has maintained possession of the Royal Majesty’s GPS receiver and antenna since June 15, 1995.

APPENDIX E

SAFETY BOARD’S URGENT SAFETY RECOMMENDATIONS

ISSUED ON AUGUST 9, 1995

M-95-26 and -27 to the U.S. Coast Guard:

Immediately recommend that the International Maritime Organization urge its admini-
strations to advise maritime vessel operators of the circumstances of the Royal Majesty
grounding and to encourage the operators to review the design of their integrated bridge
systems to identify potential system and operational failure modes that might result in
undetected changes to the autopilot function, and develop modifications as required. (M-
95-26)

Immediately advise maritime vessel operators of the circumstances of the Royal Majesty
grounding and urge them to review the design of their integrated bridge systems with the
manufacturer to identify potential system and operational failure modes that might result
in undetected changes to the autopilot function, and develop modifications as required.
(M-95-27)

Although Safety Recommendation M-95-26 was not officially entered into IMO’s SUBNAV-42 pro-

ceedings because of publication approval and time rules, the Coast Guard did distribute numerous copies
of the recommendation, and it was discussed at several of the technical working group sessions. Conse-
quently, Safety Recommendation M-95-26 was classified “Closed—Acceptable Alternate Action” on
November 14, 1995. In response to Safety Recommendation M-95-27, the Coast Guard published a
safety note in the November/December issue of the proceedings of the Marine Safety Council and also
issued a “Notice to Mariners” advising them to review the operation of their integrated bridge systems to
identify failure modes. As a result, Safety Recommendation M-95-27 was classified “Closed—Accept-
able Action” on January 16, 1996.

M-95-28 to the International Council of Cruise Lines, the International Chamber of Shipping,

the American Institute of Merchant Shipping, and the International Association of Independent
Tanker Owners:

Immediately advise members of the circumstances of the Royal Majesty grounding and
urge those members that operate with integrated bridge systems to review the design of
their integrated bridge systems for potential system and operational failure modes that
might result in undetected changes to the autopilot functions.

All recipients of Safety Recommendation M-95-28 responded favorably and advised their members

of the circumstances of the Royal Majesty grounding. For the International Chamber of Shipping, the
recommendation was classified “Closed—Acceptable Action” on October 27, 1995. For the other three
recipients, the recommendation was classified “Closed—Acceptable Action” on December 12, 1995.

M-95-29 to STN Atlas:

Immediately inform customers with the NACOS 25 integrated bridge system or similar
systems of the circumstances of the Royal Majesty grounding and review the design and
implementation of their systems to identify potential system and operational failure
modes that might result in undetected changes to the autopilot function.

STN Atlas acted promptly and informed all customers of the circumstances of the grounding. The

recommendation was classified “Closed—Acceptable Action” on December 21, 1995.

APPENDIX F

PORTIONS OF COAST GUARD TRANSCRIPT OF

VHF-FM RADIO TRANSMISSIONS FROM THE

NANTUCKET SHOAL AREA ON THE EVENING OF JUNE 10, 1995

2042

fishing vessel (f/v) Sao Marcos [in English]: “Fishing vessel, fishing

vessel call cruise boat.”

2043

f/v Rachel E [in Portuguese]: “Are you there Toluis [nickname of

Tony Sao Marcos]?”

f/v Sao Marcos [in Portuguese]: “Yeah, who is this?”

f/v Rachel E [in Portuguese]: “It’s Antonio Pimental. Hey, that guy is

bad where he is. Don’t you think that guy is wrong in that area.”

f/v Sao Marcos [in Portuguese]: “I just tried to call him. He didn’t an-

swer back. He is very wrong.”

f/v Rachel E [in Portuguese]: “I’ve been watching him for the last half

hour. He was a big contact on my radar. I picked him up 8 miles away.

[source unknown] [in English]: “Channel 16 is a distress channel and

this is international, please change your channel, please change your
channel.

[Portions of the remaining conversation were cut off; however, one

salvageable remark in Portuguese was that f/v Rachel E will try to call the
cruise boat.]

2045

f/v Rachel E [in English]: “Calling the cruise boat in the position 41

02N, 69 24W. Over.”

40 sec.
Later

f/v

Rachel E [in English]: “Calling the cruise boat 41N, 69 24W.

Over.”

2046

f/v Sao Marcos [in Portuguese]: “Maybe nobody on the bridge is

paying attention.”

f/v Rachel E [in Portuguese]: “I don’t know. He is not going the right

way.”

[Both vessels say goodbye to each other in Portuguese.]