Course Handout - Transportation Disasters, Maritime

Copyright Notice: This material was written and published in Wales by Derek J. Smith (Chartered Engineer). It forms part of a multifile e-learning resource, and subject only to acknowledging Derek J. Smith's rights under international copyright law to be identified as author may be freely downloaded and printed off in single complete copies solely for the purposes of private study and/or review. Commercial exploitation rights are reserved. The remote hyperlinks have been selected for the academic appropriacy of their contents; they were free of offensive and litigious content when selected, and will be periodically checked to have remained so. Copyright Š 2001-2018, Derek J. Smith.


First published online 08:00 BST 30th April 2001, Copyright Derek J. Smith (Chartered Engineer). This version [2.0 - copyright] 09:00 BST 4th July 2018.


Transportation Disasters , Maritime

Key to Abbreviations:

HSC = Health and Safety Commission

knot = speed in nautical miles per hour, the standard measure of speed for aviation and marine purposes. The difference between knots and miles per hour (mph) arises because a nautical mile is 6076 feet, whereas a land mile is only 5280 feet. To get knots from mph, multiply the former by 5280/6076 (ie. roughly 0.87), and to get mph from knots, multiply the former by 6076/5280 (ie. roughly 1.15).

NTSB = National Transportation Safety Board

ro/ro = "roll-on/roll-off", the standard concept car ferry for the last 50 years; sometimes (cynically) "roll-on/roll-over"

Sovereign of the Seas Shipping Disaster, 1696: This ship was destroyed by a fire started by a candle. She could have been saved because the fire was spotted in good time, but it turned out there was no fire-fighting gear on board! (Nor was there on the Kaprun funicular train 304 years later - see Disasters - Rail!)

Titanic Shipping Disaster, 1912: In this incident on 14th-15th April 1912, the RMS Titanic, on her maiden voyage to New York, stuck an iceberg and sank with the loss of 1513 out of the 2224 passengers and crew aboard her. The disaster still strikes a chord because it combines a veritable catalogue of technical errors, with (a) the horrors of a totally inevitable and long drawn-out death, and (b) the best elements of Greek tragedy, namely human weakness, folly, and hubris. Amongst the errors were:

  • lookouts without binoculars; sailing at full speed in an area known to contain icebergs; no use of searchlights at night; no double hull; no longitudinal watertight bulkheads; insufficiently high transverse watertight bulkheads; insufficient lifeboats and rafts for the number of people on board; insufficient lifeboat drill

For general data see the very comprehensive Encyclopaedia Titanica, for the design deficiencies click here, and for a summary of Lord Mersey's recommendations on increasing safety click here.

Princess Victoria Shipping Disaster, 1953: In this incident on 31st January 1953, the British Railways ro/ro ferry Princess Victoria sank en route from Stranraer in Scotland to Larne in Ireland with the loss of 133 lives. This was an early indicator of a fundamental flaw with the ro/ro design concept, namely that the large open car deck could flood far more quickly than the labyrinth of small separate compartments beneath it, thus rendering a damaged vessel almost instantly top heavy. The Princess Victoria suffered exactly this when her stern doors were damaged in a storm. Nonetheless, the ro/ro design was commercially successful and popular with the paying public because it was quick to load and unload, so it was retained, and has since contributed to the Herald of Free Enterprise (1987), Doņa Paz (1987), and Estonia (1994) disasters.

Andrea Doria Shipping Disaster, 1956: In this incident on 25th July 1956, while en route for New York, the Italian liner Andrea Doria was rammed in heavy fog by the Swedish cruise ship Stockholm. She suffered heavy damage to her starboard side, both above and below the waterline, and developed a severe list in that direction which prevented any of her port side lifeboats being launched. She took 11 hours to go down, so most of her passengers and crew were rescued, many by the French liner Ile de France which happened to be in the area. 52 died. Investigations revealed that both ships had fatally misinterpreted their radar screens, and judged the Andrea Doria at fault for attempting to pass on the left instead of the right (the rule of the road at sea).

Herald of Free Enterprise Shipping Disaster, 1987: In this incident on 6th March 1987, the British ro/ro ferry Herald of Free Enterprise capsized shortly after leaving the port of Zeebrugge, Belgium. She had sailed with her bow doors open because the Assistant Bosun - having been on duty for 24 hours - had fallen asleep, and upon reaching 17.5 knots the bow wave topped the 8 foot head beyond which it was high enough to flood over onto the unprotected car deck. In seconds the ship had developed a 30ē list to port, whereupon the captain turned her violently to starboard, which - while worsening the list - successfully brought her over a sandbank to the right of the main channel. Here she settled more than half submerged, but with enough of her starboard side out of the water for more than half the 600 passengers and crew to escape. 193 lost their lives.

It emerged in the subsequent investigation that it was common practice throughout the cross-channel industry at the time for vessels to start moving with their bow doors open. It also emerged that previous requests for "door locked" indicators on the bridge had been turned down by the owners and that the Zeebrugge turn-around was always under time pressure since the Herald was a double decked ferry but the port only had a single loading ramp. The incident reopened the debate over the safety of the ro/ro concept. It showed how desperately unstable these vessels were once the sea got on the car deck (one survivor described the ship as going from "safe to sunk" in only 90 seconds). The incident also demonstrated the value of effective contingency planning, for the behaviour of the Belgian emergency services was exemplary. Indeed, it has been estimated that most of those who did survive would not have done so (due to the cold) had the Zeebrugge port authorities not spent years drilling themselves for precisely such an eventuality.

Doņa Paz Shipping Disaster, 1987: In this incident on 20th December 1987, the Philippines ro/ro ferry Doņa Paz, crowded with Christmas travellers, collided with a tanker while en route for Manila, and sank with the loss of an estimated 4000-5000 lives. There were only 24 survivors. The investigation blamed the tanker for the collision per se, but the rapid foundering of the ferry was another example of the inherent vulnerability of the ro/ro design concept. This incident has the dubious honour of being the world's worst peacetime maritime disaster.

USS Vincennes Air Disaster, 1988: Because this is essentially a military command and control disaster, it is dealt with in the section on military systems failures. [To be transferred, click here.]

Marchioness Shipping Disaster, 1989: In this incident on 20th August 1989, the River Thames pleasure cruiser Marchioness struck by the dredger Bowbelle near Southwark Bridge, London, and sank with the loss of 51 passengers.

Exxon Valdez Shipping Disaster, 1989: In this incident on 24th March 1989, the tanker Exxon Valdez, en route from the Exxon terminal in Prince William Sound, Alaska, went hard aground on a reef, discharging 11 million gallons of crude oil into the sea, and necessitating a $2 billion clean up which took three years to complete. In the ensuing NTSB investigation, it emerged that the ship had left the officially marked navigation channel to avoid ice, this at a time when the Captain, Joseph Hazelwood, had departed the bridge, leaving an unqualified crew member in command. Here are the known timings:

2112hr: The vessel slipped her moorings, assisted by two tugs, and under the direction of a locally experienced harbour pilot, Ed Murphy, headed for the harbour entrance, Valdez Narrows, about seven miles away. Captain Hazelwood and the Third Mate, Gregory Cousins, were also on the bridge, along with helmsman Harry Claar and lookout Paul Radtke.

2135hr: Captain Hazelwood left the bridge, ignoring company standing orders that two Exxon officers should be on the bridge for these narrows. Murphy did not intervene, because he saw this as largely a company matter.

2217hr: The vessel entered the three mile long narrows, at a speed of 6 knots.

2249hr: The vessel passed successfully through the narrows, and increased speed into Prince William Sound (PWS).

2305hr: Murphy asked for Hazelwood to return to the bridge, because his part in the proceedings was over, and he was about to disembark.

2320hr: Hazelwood formally "took the con" from Murphy, and steered 219 degrees making for the open sea at the end of PWS.

2324hr: With the assistance of Third Mate Cousins, Murphy disembarked onto the accompanying pilot boat, leaving Hazelwood briefly alone on the bridge.

2325hr: Hazelwood radioed the US Coast Guard's Vessel Traffic Centre (VTC) that the pilot had been dropped.

2330hr: Hazelwood radioed again, saying that he was going to come round to port to a heading of 200 degrees and slow down to 12 knots (although subsequent data tapes show the engines kept accelerating). His intention was to complete the remaining 40 miles of PWS in the inbound traffic lane rather than the outbound, because this route was usually less troubled by ice. This was standard practice whenever the inbound lane was clear, and another tanker, the Arco Juneau, had performed the same manoeuvre four and a half hours earlier. To execute this sort of lane change safely, however, the course needs to be reset to its original value as soon as the required lateral correction has been made, and this the Exxon Valdez failed on this occasion to do.

2339hr: Third Mate Cousins plotted a fix placing the vessel in the middle of the two lanes, whereupon Hazelwood ordered a further course change to 180 degrees - ie. another 20 degrees away from its original value. This course change was not reported to the VTC, and meant that the vessel was now heading more obliquely across the inbound lane for the shallow waters beyond. [Given the tanker's position and speed, a further turn to port was a major error of judgement not often remarked upon in the reports. It may or may not be coincidental that there is a history of left-right confusion in aviation disasters. Helmsman Kagan is reported to have displayed a propensity to just such left-right confusion during the investigations (Outside Magazine, October 1997; available online.)]

2340hr: The duty radarman at the VTC changed shift.

2343hr: With the vessel now on the desired heading of 180 degrees, Hazelwood put the autosteer on. [Again this action makes no sense other than to indicate considerable disorientation on Hazelwood's part.]

Time Unknown: Claar was relieved by Robert Kagan at the helm.

2347hr: The tanker left the safety of the inbound lane and entered the shallows, with Bligh Reef still between it and the open sea.

2350hr: The relief lookout, Maureen Jones, relieved Radtke and immediately warned that the ship was out of position with respect to the Bligh Reef lightbuoy (it being to starboard, when it should have been to port). Hazelwood and Cousins then conferred over how to regain the designated shipping lane, and Hazelwood requested full speed. [This action is clearly documented in a number of reports, and although it seems dangerous to accelerate into what was effectively a cul-de-sac, the acceleration would have taken 43 minutes to have taken full effect.] Hazelwood then left the bridge to Third Mate Cousins and helmsman Kagan.

2355hr: Six minutes after being instructed to do so, Cousins released the autosteer and ordered a course change to starboard, intending to bring the ship round onto a heading of 240 degrees (although this would have taken several minutes to take effect). Unfortunately, Kagan understeered and Cousins was slow to check on him (Seattle Times, 14th March 1999).

about 0003hr: Cousins rang down to Hazelwood to report that the turn was proceeding dangerously slowly, and while Hazelwood was halfway back up to the bridge .....

0004hr: ..... the vessel ran aground.

0004hr - 0019hr: The tanker's engines were left running and the rudder position adjusted in an attempt to stabilise the ship.

0019hr: These attempts were discontinued, and the engines set to idle.

0026hr: Hazelwood radioed the incident in.

The investigations looked very closely at whether Hazelwood had been under the influence of alcohol. Certainly, the results of a blood alcohol test carried out 10 hours after the incident still exceeded the legal limit for vessel masters, and Exxon fired him the day this became known (Anchorage Daily News, 14th May 1989). The data was subsequently deemed legally inadmissable, however, so the investigators also obtained forensic phonetics testimony from Malcolm Brenner, NTSB Senior Human Performance Investigator. This showed that Hazelwood's speech when radioing after the event was considerably slower than it had been before it, and it was finally judged that alcohol had played a part in impairing his control. Exxon undertook to pay compensation of $900 million to state and federal authorities, and were fined $250 million for criminal offences. In addition, the company was ordered in 1994 to pay a further $5 billion in punitive damages, but has persistently appealed this latter judgement. For thus causing the world's largest environmental disaster, Captain Hazelwood was sentenced in 1998 to 1000 hours community service.

Here are some of the lessons of this incident: 

  • Conceptual Design Weakness: The policy of putting oil terminals in areas of natural beauty was (and still is) bound to go wrong sooner or later (as locals had been loudly pointing out since the terminal had first been proposed). [See Finagle's Law.]
  • Design Weakness: The vessel was not built with a double hull. New tankers must now be built with a double hull, regardless of the additional expense involved, but oil companies are resisting (Anchorage Daily News, 13th May 1999). Only three of the 26 tankers currently operating in PWS are fitted with double hulls.
  • Alcohol: Although the NTSB judged that alcohol had played a part in impairing Captain Hazelwood's control (see above), his master's licence was suspended for 9 months for a different offence, that of leaving the bridge. Both the Coast Guard and the courts rejected the more serious charge of drunkenness. The New Jersey Institute of Technology website is particularly critical of the harbour pilot, Ed Murphy, on this matter, because he testified to having smelled alcohol on Hazelwood's breath before boarding the vessel, and knew that it was against Exxon policy for him to be absent from the bridge. Yet on neither account did he say anything.
  • Handover: There had been three shift changes both on board the vessel and in the VTC in the half hour prior to the grounding, and there has been little written on how much was said by those handing over to those taking over. This is concerning, given that shift changes with hurried handovers are a known risk factor in medical errors.
  • Complacency and Ignored Warnings: A number of other factors are identified at the New Jersey Institute of Technology website, including an interesting revelation about the VTC radar system [click here]. They report that this had been criticised by a former Coast Guard commander as lacking range and resolution necessary to perform the sort of close control used with aviation controllers. The NTSB report also extends some blame to the Coast Guard for failing to provide proper guidance within PWS. There had been 8700 incident-free previous departures in the 12 years since the terminal had started operations.
  • Situational Awareness: The incident is a good example of how it is difficult to maintain continuity of awareness in the face of constant comings and goings.
  • Taking Things for Granted: The incident is also a good example of how easy it is for indiscipline and sloppiness to become common practice. It is one thing to delegate a specific task, but another thing altogether to delegate overall responsibility for its safe completion. You can only ever be as good as the people you have working for you, and as captain you must monitor their performance closely. According to Captain John Wilson, an old friend and shipmate of Hazelwood, he was simply too trusting. Specifically, he should "have watched his mate a little bit closer" (Outside Magazine, October 1997; available online).

The Exxon Valdez was repaired in 1991 and renamed Sea River Mediterranean. It no longer does the Alaska run, however. For further general details click here, for more on the double hull issue click here, and for more on the damages claims click here.

Estonia Shipping Disaster, 1994: In this incident on 28th September 1994 - the latest in a series of ro/ro disasters going back to 1953 - the Estonian ferry Estonia lost her bow doors in a storm and sank with the loss of 852 lives. There were 137 survivors. The subsequent investigation determined that the 50-ton bow "visor" - the upwardly pivotable bow - had been poorly engineered. It had started to sheer off at 00:55am (henceforth T), but remained essentially in place until T+10 when it began to flap loose in the waves. By T+15, the visor had begun to push open the inner safety doors as well, and water began to splash over into the car deck. This was noticed on CCTV from the engine room, but presumed to be rainwater; pumps were switched on, but the bridge was not informed. At T+20, with the situation not improving, an engineer went up to the car deck to investigate further, and found water up to his knees! At about the same time, the visor detached itself totally from its mountings and fell into the sea, and the now unprotected inner doors burst fully open. Unfortunately, although the situation had so far taken some 20 minutes to develop, the damage had still not been detected on the bridge (indeed even when the bow was wide open to the sea the panel lights on the bridge were still showing green). The ship therefore remained at full speed, shovelling up seawater like a scoop and rapidly developing a 15ē list to starboard. Most critically of all, given that it was gone midnight and most passengers were asleep, no general alarm had yet been sounded. As it was, most passengers had worked out for themselves from the list what was going on, and general panic ensued in the narrow lower stairways. Too late the ship was stopped, and by T+25 the list was already too severe for any but the fittest to ascend. At T+27, the first SOS was transmitted and the general alarm sounded, but it was too late. By T+40, the ship was floating on its side with hundreds of passengers balanced on it as though on a rolling log, and at T+55 it sank. Here are some of the important issues:

  • Conceptual Design Weakness: This was yet another in a long series of ro/ro type ferry disasters.
  • Design Weakness: There was no "defence in depth" in the design of the inner bow doors, which were not strong enough in their own right to keep the sea out.
  • Maintenance Error: The bow door warning light was defective.
  • Procedural Error: The bridge were slow to send off an SOS and sound the general alarm.

[For further details, including a first hand account by one of the survivors, click here.]

Kursk Submarine Disaster, 2000: In this incident on 12th August 2000, the 14,000 ton Russian submarine Kursk suffered an internal explosion and sank with the loss of all 118 hands. Preliminary explanations differ and investigations will in any event be subject to intense military secrecy, but there is substantial early agreement that a missile must have detonated prematurely on test firing.

Express Samina Shipping Disaster, 2000: In this incident on 26th September 2000, the Greek ferry Express Samina struck a reef off the Aegean island of Paros, and sank drowning 80 passengers. Survivors have alleged that members of the crew had been watching TV at the time.

USS Greeneville Submarine Disaster, 2001: Because this is essentially a military command and control disaster, it is dealt with in the section on military systems failures. [To be transferred, click here.]



[Disasters Database Menu]