ACCIDENT REPORT

Report on the investigation of the

grounding of

Muros
Haisborough Sand

North Sea

3 December 2016
M A R I N E A C C I D E N T I N V E S T I G AT I O N B R A N C H

SERIOUS MARINE CASUALTY REPORT NO 22/2017 OCTOBER 2017

 Extract from

The United Kingdom Merchant Shipping

(Accident Reporting and Investigation)

Regulations 2012 – Regulation 5:

“The sole objective of the investigation of an accident under the Merchant Shipping (Accident

Reporting and Investigation) Regulations 2012 shall be the prevention of future accidents

through the ascertainment of its causes and circumstances. It shall not be the purpose of an

investigation to determine liability nor, except so far as is necessary to achieve its objective,

to apportion blame.”

NOTE

This report is not written with litigation in mind and, pursuant to Regulation 14(14) of the

Merchant Shipping (Accident Reporting and Investigation) Regulations 2012, shall be

inadmissible in any judicial proceedings whose purpose, or one of whose purposes is to

attribute or apportion liability or blame.

© Crown copyright, 2017

You may re-use this document/publication (not including departmental or agency logos) free of
charge in any format or medium. You must re-use it accurately and not in a misleading context.
The material must be acknowledged as Crown copyright and you must give the title of the source
publication. Where we have identified any third party copyright material you will need to obtain
permission from the copyright holders concerned.

All MAIB publications can be found on our website: [Link]/maib

For all enquiries:

Marine Accident Investigation Branch
First Floor, Spring Place
105 Commercial Road
Southampton Email: maib@[Link]
United Kingdom Telephone: +44 (0) 23 8039 5500
SO15 1GH Fax: +44 (0) 23 8023 2459
Press enquiries during office hours: 01932 440015
Press enquiries out of hours: 020 7944 4292
CONTENTS
GLOSSARY OF ABBREVIATIONS AND ACRONYMS

SYNOPSIS 1

SECTION 1 - FACTUAL INFORMATION 2

1.1 Particulars of Muros and accident 2

1.2 Narrative 4
1.2.1 Grounding 4
1.2.2 Post-grounding 8
1.3 Crew 9
1.3.1 General 9
1.3.2 Master and bridge team 9
1.3.3 ECDIS training 10
1.4 Passage planning 10
1.4.1 Original plan 10
1.4.2 Revised plan 11
1.4.3 Onboard procedures 12
1.5 MARIS ECDIS900 12
1.5.1 Approval and installation 12
1.5.2 Alarms 12
1.5.3 Post-accident examination 13
1.6 Simulations 15
1.6.1 Maris ECDIS900 15
1.6.2 Other ECDIS 17
1.7 Previous similar accidents 17
1.7.1 CFL Performer 17
1.7.2 CSL Thames 17
1.7.3 Ovit 17
1.7.4 Commodore Clipper 18
1.8 ECDIS research 18

SECTION 2 - ANALYSIS 20

2.1 Aim 20
2.2 The grounding 20
2.3 Plan revision 20
2.4 Oversight 21
2.5 Position monitoring 21
2.6 ECDIS use 22
2.7 ECDIS functionality 22

SECTION 3 - CONCLUSIONS 24

3.1 Safety issues directly contributing to the accident that have been addressed or
resulted in recommendations 24
3.2 Safety issues not directly contributing to the accident that have been addressed
or resulted in recommendations 24
SECTION 4 - ACTION TAKEN 25

4.1 MAIB actions 25

4.2 Actions taken by other organisations 25

SECTION 5 - RECOMMENDATIONS 26

FIGURES

Figure 1 - Extract of original and revised passage plans

Figure 2 - Bridge layout

Figure 3 - Reconstruction of ECDIS display at 0025

Figure 4 - Reconstruction of ECDIS display at 0208

Figure 5 - Reconstruction of ECDIS display at 0220

Figure 6 - Reconstruction of ECDIS display at 0248 (standard)

Figure 7 - Reconstruction of ECDIS display at 0250 (‘all’ and zoomed in)

Figure 8 - Maris ECDIS900 showing the ‘guard zone’ settings

Figure 9 - Maris ECDIS900 showing alarms generated on the ‘check route’ page

Figure 10 -
Muros’s passage plan on ENC GB2A2182

Figure 11 -
Muros’s passage plan on ENC GB300106
ANNEXES

Annex A - Extract of SCTW Table A-II/1 – Specification of minimum standard of

competence for officers in charge of a navigational watch on ships of
500 gross tonnage or more

Annex B - ECDIS – International carriage requirements

GLOSSARY OF ABBREVIATIONS AND ACRONYMS
2/O - Second officer

AIS - Automatic Identification System

BNWAS - Bridge navigational watch alarm system

DNV - Det Norske Veritas

DPA - Designated person ashore

ECDIS - Electronic chart display and information system

ENC - Electronic navigational chart

HRM - Hispano Radio Marítima S.A.

IHO - International Hydrographic Organization

IMO - International Maritime Organization

kts - knots

m - metre

SENC - System electronic navigational chart

SOLAS - International Convention for the Safety of Life at Sea 1974, as

amended

STCW - International Convention on Standards of Training, Certification and

Watchkeeping for Seafarers 1978, as amended

TSS - Traffic separation scheme

UTC - Universal Time Co-ordinated

XTD - Cross-track distance

TIMES: all times used in this report are UTC +1 unless otherwise stated
SYNOPSIS
At 0248 (UTC+1) on 3 December 2016, the bulk carrier Muros ran aground on Haisborough
Sand on the east coast of the United Kingdom. Attempts to manoeuvre clear of the
shallows were unsuccessful but the vessel was re-floated 6 days later with tug assistance.
There were no injuries and no pollution, but damage to Muros’s rudder necessitated the
vessel being towed to Rotterdam, Netherlands, for repair.

The MAIB investigation identified, inter alia:

• The vessel was following a planned track across Haisborough Sand. The passage
plan in the ECDIS had been revised by the second officer less than 3 hours before the
grounding and it had not been seen or approved by the master.

• A visual check of the track in the ECDIS using a small-scale chart did not identify
it to be unsafe, and warnings of the dangers over Haisborough Sand that were
automatically generated by the system’s ‘check route’ function were ignored.

• The second officer monitored the vessel’s position using the ECDIS but did not take
any action when the vessel crossed the 10m safety contour into shallow water.

• The effectiveness of the second officer’s performance was impacted upon by the time
of day and a very low level of arousal and she might have fallen asleep periodically.

• The disablement of the ECDIS alarms removed the system’s barriers that could have
alerted the second officer to the danger in time for successful avoiding action to be
taken.

The MAIB has recently investigated several grounding incidents in which the way the
vessels' ECDIS was configured and utilised was contributory. There is increasing evidence
to suggest that first generation ECDIS systems were designed primarily to comply with
the performance standards required by the IMO, as these systems became a mandatory
requirement on ships, with insufficient attention being given to the needs of the end user.
As a consequence, ECDIS systems are often not intuitive to use and lack the functionality
needed to accommodate accurate passage planning in confined waters. This situation
has led to seafarers using ECDIS in ways which are at variance with the instructions and
guidance provided by the manufacturers and/or expected by regulators.

The MAIB is conducting a safety study, in collaboration with the Danish Maritime Accident
Investigation Board, designed to more fully understand why operators are not using ECDIS
as envisaged by regulators and the system manufacturers. The overarching objective is to
provide comprehensive data that can be used to improve the functionality of future ECDIS
systems by encouraging the greater use of operator experience and human centred design
principles.

In view of the actions already taken, no recommendations have been made in this report.

1
 SECTION 1 - FACTUAL INFORMATION
1.1 PARTICULARS OF MUROS AND ACCIDENT
SHIP PARTICULARS
Vessel’s name Muros
Flag Spain
Classification society Bureau Veritas
IMO number/fishing numbers 9397640
Type General cargo
Registered owner Vizcaina Balear de Navegacion S.A.
Manager(s) Naviera Murueta S.A.
Construction Steel
Year of build 2008
Length overall 89.9m
Gross tonnage 2998
Minimum safe manning 8
Authorised cargo General cargo
VOYAGE PARTICULARS
Port of departure Teesport, UK
Port of arrival Rochefort, France
Type of voyage International
Cargo information Bulk fertiliser
Manning 9
MARINE CASUALTY INFORMATION
Date and time 3 December 2016 at 0250 UTC +1
Type of marine casualty or incident Serious Marine Casualty
Location of incident 52º 55’.5N, 001º 41’.6E (Haisborough Sand,
North Sea)
Injuries/fatalities None
Damage/environmental impact Rudder damaged
Ship operation On passage
Voyage segment Mid-water
External & internal environment Wind: South-south-east force 3-4.
Sea: slight to moderate. Visibility: good
(darkness). Height of tide: 1.2m
Draught Forward 6.03 - Aft 6.16m
Persons on board 9

2
 Muros

3
 1.2 NARRATIVE

1.2.1 Grounding

During the evening of 2 December 2016, the Spain registered bulk carrier Muros
was on passage between Teesport, UK and Rochefort, France, loaded with fertiliser.
It was dark, the visibility was good and the wind was south-easterly between 6 and
15 knots (kts).

The master was in charge of the bridge navigation watch and was accompanied by
the bosun and the deck cadet. The vessel’s electronic navigation equipment, which
included the electronic chart display and information system (ECDIS) 1, radar and the
bridge navigational watch alarm system (BNWAS), were functioning correctly, but
the echo sounder had been switched off shortly after leaving Teesport. The BNWAS
was set to alert at 3-minute intervals.

At 2350, the second officer (2/O) arrived on the bridge to take over the navigational
watch. An able seaman also arrived to take over as lookout. Muros was following a
track displayed on the ECDIS and was making good a course of 146º in autopilot
steering at a speed of 11.2kts2 (Figure 1). During the watch handover, the master
instructed the 2/O to amend the passage plan to route via the Sunk traffic separation
scheme (TSS) instead of via the North Hinder Junction. At about 0010 the following
morning, the master, bosun and the deck cadet left the bridge.

The 2/O amended the passage plan on the ECDIS at the starboard bridge conning
position (Figure 2) and at 0025 she adjusted the vessel’s heading set on the
autopilot to 140˚ to follow the revised track (Figure 3). The 2/O then sat in the
starboard chair. The lookout alternated between standing on the bridge’s port side
and sitting in the port chair. He routinely reset the BNWAS.

Over the next 1½ hours, the bridge watch remained very quiet with only a few other
vessels in the vicinity. At 0208, Muros was 600m to the north-east of the revised
track and was making good a speed of 10.1kts when the 2/O adjusted Muros’s
heading to 146º towards waypoint ‘Happisburg’ to the south of Haisborough Sand
(Figure 4).

At 0220 (Figure 5), the 2/O noticed that Muros’s speed shown on the ECDIS
display had reduced to 9.1kts. She thought this was unusual as there had been no
change in the wind or sea conditions. At 0248 (Figure 6), the 2/0 felt a change in the
vessel’s motion and saw its speed quickly reduce. In response, she selected manual
steering. The 2/O also called the master and informed him that the vessel’s speed
was only 0.8kt, but that she did not know why. The master told the 2/O to inform the
chief engineer.

1
Muros’s primary means of navigation was the Marine Information System AB Type ECDIS 900 (Maris
ECDIS900) Mk 10. The vessel did not carry paper charts.
2
All courses and speeds are ‘over the ground’ unless stated otherwise.

4
Reproduced from Admiralty Charts BA 1406-0 and 1408-0 by permission of the Controller of HMSO and the UK Hydrographic Office

Key
Muros track
Muros revised route
Muros original route
2350

0025

0208

Bacton

Happisburg

Cross
Sand

Figure 1: Extract of original and revised passage plans

(note: all times UTC+1)

5
 Echo sounder
Data organiser ECDIS
ECDIS BNWAS
Autopilot

Radar

BNWAS reset VHF

Figure 2: Bridge layout

Image courtesy of Maris/Red Ensign Training/UK Hydrographic Office

Figure 3: Reconstruction of ECDIS display at 0025

6
Image courtesy of Maris/Red Ensign Training/UK Hydrographic Office

Figure 4: Reconstruction of ECDIS display at 0208

Image courtesy of Maris/Red Ensign Training/UK Hydrographic Office

Figure 5: Reconstruction of ECDIS display at 0220

7
 Image courtesy of Maris/Red Ensign Training/UK Hydrographic Office

Figure 6: Reconstruction of ECDIS display at 0248 (standard)

1.2.2 Post-grounding

Within 1 minute of being called by the 2/O, Muros’s master and chief engineer
arrived on the bridge. Meanwhile, the 2/O had zoomed in the ECDIS display and
changed the chart view from ‘standard’ to ‘all’3, which showed more detailed depth
information (Figure 7). The master realised that the vessel was aground and put the
engine telegraph control to stop.

Over the next 2 to 3 minutes, the remainder of Muros’s crew, apart from the cadet,
arrived on the bridge, where the 2/O had started to go through the grounding
checklist. The general alarm was not sounded and the cadet remained asleep in her
cabin. The chief officer soon left the bridge to see if there was any water ingress in
the ballast tanks, while the chief engineer carried out checks in the engine room. No
water ingress or other damage was found.

The master used the engines and rudder to try to manoeuvre Muros clear of the
shallows. The vessel initially moved astern but, by 0330, it was firmly aground on a
heading of 190º. The master checked the tidal information and saw that low water
was at 0350. Meanwhile, the chief officer sounded around the vessel with a lead
line.

At 0357, Muros’s master called Humber Coastguard on very high frequency radio
channel 16. He informed the coastguard that the vessel was aground but that there
was no pollution. The master also contacted the vessel’s designated person ashore

3
The ‘standard’ chart view included classes of objects important for navigation and route planning such as
limits of fairways and channels, landmarks and warnings. The ‘all’ chart view included additional information
such as spot depths, cables and pipelines, ferry crossings and depth contours deeper than the safety contour.

8
Image courtesy of Maris/Red Ensign Training/UK Hydrographic Office

Figure 7: Reconstruction of ECDIS display at 0250 (zoomed in and ‘all’)

(DPA) in Bilbao, Spain. The master attempted to re-float the vessel at high water at
0930, but he was unsuccessful and the DPA subsequently arranged for salvors to
assist.

The salvors arrived on board Muros during the morning of 4 December 2016.
Five days later, the vessel was re-floated and towed clear of Haisborough Sand.
Subsequent surveys while the vessel was at anchor identified that its rudder was
damaged. Consequently, Muros was towed to Rotterdam for repair.

1.3 CREW

1.3.1 General

Muros’s nine crew were Spanish nationals and established employees of Naviera
Murueta S.A., the vessel’s manager. The crew all held the STCW4 certificates
of competency required for their positions on board and met the Convention’s
requirements concerning hours of work and rest. The working language on board
Muros was Spanish. The crew usually worked 4 months on board the vessel
followed by 2 months on leave.

1.3.2 Master and bridge team

At sea, the navigation watches were kept by the master (0800-1200 and
2000-2400), the chief officer (0400-0800 and 1600-2000) and the 2/O (0000-0400
and 1200-1600). In port, during cargo operations, the chief officer and the 2/O kept
6-hour watches as the duty deck officer.

4
STCW - International Convention on Standards of Training, Certification and Watchkeeping for Seafarers
1978, as amended’.

9
 Muros’s master was 60 years old and had been on board the vessel for 3 months.
He had worked for Naviera Murueta for 7½ years and had served on Muros and its
sister ship Medal over the previous 4 years. He had spent 38 years at sea and had
been a master for 27 years.

Muros’s 2/O was 27 years old and qualified as a deck officer in 2013. She had then
worked on board ships managed by Naviera Murueta. The 2/O was nearing the
completion of her second period on board Muros. The lookout was 51 years old and
had been on board Muros for 2 months. He had previously worked on board three
other ships managed by Naviera Murueta.

1.3.3 ECDIS training

Muros’s master and deck officers had attended generic ECDIS training courses5
and had completed type-specific training on the Maris ECDIS900. The type-specific
training was computer-based and provided by Hispano Radio Marítima S.A. (HRM).
The 2/O had completed generic ECDIS training in 2014 and the type-specific
training in August 2015.

1.4 PASSAGE PLANNING

1.4.1 Original plan

The 2/O was the navigation officer and was responsible for preparing passage
plans under the master’s direction. She had planned Muros’s voyage from Teesport
to Rochefort while the vessel was alongside in Teesport. However, plans for the
berth-to-pilot (Teesport) and for the pilot-to-berth (Rochefort) segments of the
route had been used on previous voyages and were already saved in the ECDIS.
Consequently, the 2/O planned only the open water segment from pilot station to
pilot station. She then merged the open water segment with the pilotage segments
to provide the overall voyage plan.

Muros’s master checked and signed the voyage plan to Rochefort after the vessel
had sailed from Teesport. It was his usual practice to sign the plan at the earliest
convenient opportunity after it had been completed by the 2/O. When he reviewed
the plan again after taking over the navigation watch at 2000 on 2 December, he
realised that the intended route was via the North Hinder junction rather than via the
Sunk TSS. The master was more familiar with the route via the Sunk TSS, which
was shorter than the route via the North Hinder. Therefore, he instructed the 2/O to
amend the voyage plan when she arrived on the bridge to take over the navigational
watch at 2350.

5
Generic ECDIS training is based on IMO Model Course 1.27, which was intended to address the competency
requirements for officers of the watch detailed in STCW, tables A-II/1 (Annex A).

10
1.4.2 Revised plan

To amend the voyage plan to pass via the Sunk TSS, the 2/O selected the ‘planning’
mode on the starboard ECDIS display. The display was also configured to ‘dark
night’6, ‘standard’ and ‘two colour waters’. With ‘dark night’ and ‘two colour waters’
selected, the area within the safety contour7 was blue and the area outside the
safety contour was black.

The 2/O used the ECDIS mouse and cursor to ‘drag and drop’8 several waypoints
included in the original voyage plan (including waypoints ‘Bacton’ and ‘Happisburg’)
further to the west (Figures 1 and 4). She then scanned over the amended route
starting at the Sunk TSS and working towards the north.

While scanning the route, the 2/O noticed that the revised track appeared to pass
close to Cross Sand, the shallows to the south of Haisborough Sand. The 2/O
zoomed onto a larger chart scale that provided better clarity and saw that the course
line was more than one mile from the shoal water indicated by the safety contour.

The 2/O zoomed back out to a smaller chart scale and thought that the intended
course line also passed close to the shallows of Haisborough Sand. However, the
proximity of the course line was similar to the course line she had recently checked
further to the south, and she did not zoom onto a larger scale to obtain a more
accurate assessment. The 2/O assumed that the course line would be clear of the
safety contour by a similar margin to that near Cross Sand.

When the 2/O had completed her visual check of the revised route, she saved it
as a new route in the ECDIS and printed a copy of the plan. On saving, the ECDIS
automatically executed its ‘check route’9 function and many potential charted
hazards along the route were displayed. However, the 2/O was aware that the ‘check
route’ function had checked the whole of the route from the berth at Teesport to the
berth in Rochefort, and she assumed that the hazards were concentrated in the
pilotage areas. The 2/O cleared the window showing the hazards, set the new route
as the active route and returned the starboard ECDIS to ‘monitoring’ mode. The 2/O
signed the printed copy of the passage plan and placed it in the chart and radio area
at the rear of the bridge.

6
The ECDIS900 display could be operated in ‘bright day’, ‘dusk’ and ‘dark night’.
7
The safety contour is a critical feature intended to show the operator the difference between safe and
potentially unsafe water, and is calculated by the user. It is based on several factors including draught, squat,
height of tide and the required under keel clearance. When a safety contour depth is set, if the selected
contour is not available the system defaults to the next deepest contour available. (For example, if the safety
contour was set to 15m but the ENC contours available were only every 10m, then the display would show the
safety contour at 20m).
8
‘Drag and drop’ is a colloquialism used to describe a method by which waypoints can be moved manually
using a computer mouse.
9
The ‘check route’ function checks the route against all charted dangers that may be present along the route
legs. It scans the vector database, including manually updated objects and user data objects loaded on the
chart and calculates the dangers inside the safety passage defined by the cross-track distance (XTD) values
and the safety contour and safety height settings.

11
 1.4.3 Onboard procedures

The safety management system manuals on board Muros included procedures for
passage planning. These contained step-by-step instructions for route planning
using the Maris ECDIS900, and required the vessel’s master to approve all voyage
plans. The ECDIS900 operator manual (version 4/2010) was carried on board.

No non-conformities in the vessel’s navigation procedures were identified in either

an internal audit conducted by the DPA in January 2016 or during an external audit
conducted by the Spanish Maritime Authority in March 2016.

1.5 MARIS ECDIS900

1.5.1 Approval and installation

The Maris ECDIS900 Mk 10 was certified by Det Norske Veritas to be compliant

with the International Convention for the Safety of Life at Sea 1974, as amended
(SOLAS). The system was supplied and fitted on board Muros by HRM in August
2011. HRM confirmed that the installation met the applicable requirements of
the International Electrotechnical Commission, the International Hydrographic
Organization (IHO) and SOLAS.

Muros’s ECDIS comprised two terminals, one on each side of the bridge centre
console (Figure 2). The port terminal was marked as ‘planning’ and the starboard
one as ‘monitoring’. However, both terminals could be used in either mode. The
vessel’s electronic navigational charts (ENC) were supplied by PRIMAR, operated
by the Norwegian Hydrographic Service.

In addition to Muros, eight other vessels managed by Naviera Murueta were fitted
with the Maris ECDIS900, which HRM had also installed. The international carriage
requirements for ECDIS are at Annex B.

1.5.2 Alarms

The Maris ECDIS900 could generate alarms related to navigation safety, automatic
identification system (AIS) targets, vessel sensors, route, and track control steering.
The parameters/limits for each alarm could be customised by the operator. When an
alarm was triggered, a message was displayed, the danger highlighted on the chart,
and an audible signal sounded.

The Maris ECDIS900 operator manual included:

The ECDIS900 checks the safety of the navigation and triggers an alarm when
the value of the sea depth at the current ship position is lower than the Safety
Contour value entered in the Chart settings, Chart depths tab (see “Chart
depths” on page 65)…

The safety depth must not be less than the safety contour value.

The ECDIS900 checks the planned position prior to the start of the voyage as
well as the ship’s position during the voyage in relation to the planned route
and the surrounding dangers. The system checks the dangers in a guard zone
defined in front of the ship.

12
 To activate the guard zone alarm function, toggle the Check safety zone
function ON on the Alarms tab of the Ship properties (see “Alarms tab” on
page 96). The safety zone is a portion of circle centered on the ship’s position
and defined by an angle and a distance in front of the ship. The distance is
calculated according to the speed of the ship and a specified time set by the
mariner. [sic]

1.5.3 Post-accident examination

Examination of Muros’s ECDIS on 10 December 2016 identified:

●● The audible alarm was not functioning. It had been disabled via software
usually only accessed by service engineers. The unserviceability of the
audible alarm had not been reported as a defect.

●● The depth settings were:

○○ Deep contour10: 10m

○○ Safety contour: 8.5m

○○ Shallow contour: 10m

○○ Safety depth11: 7m.

●● The guard zone was set to 40º and 10 minutes. However, the ‘Check safety
zone’ check box was not ticked and the ‘Highlight and display dangers’ box
was set to ‘never’ (Figure 8). Therefore, the guard zone was not active.

●● The settings in the ‘guard zone’ and the ‘target alarms’ areas of the ‘ship
alarms’ page and the contours and depth settings were ‘locked’. The
adjustment of these settings was password protected and Muros’s deck
officers reportedly were unaware of the password. The crew considered the
resulting absence of alarms to be beneficial.

●● The cross-track distance (XTD)12 was set to 0.5 mile and route alarms were
selected.

●● With the Teesport - Rochefort route selected, over 3000 warnings were
indicated on the ‘check route’ page, including the risk of grounding on
Haisborough Sand (Figure 9).

●● The 2/O was able to navigate the Maris ECDIS900 menus and sub-menus to
good effect. She was familiar with the system’s functions but did not routinely
use the ‘check route’ function due to the apparent irrelevance and triviality
of many of the dangers highlighted. She was aware that the ‘check route’
function could be applied to individual legs of a voyage plan.

10
The deep and shallow contours control only the colour shading.
11
The safety depth enables spot soundings shallower than the depth set to be highlighted. The Maris ECDIS900
operator manual advised that The safety depth must not be less than the safety contour value (Paragraph
1.5.2).
12
The XTD alarm is used to provide a warning of when a vessel is about to deviate by a specified distance from
the planned route.

13
 Figure 8: Maris ECDIS900 showing the ‘guard zone’ settings

Figure 9: Maris ECDIS900 showing alarms generated on the ‘check route’ page

14
 ●● The master’s philosophy regarding the use of ECDIS was that outside pilotage
waters the vessel should stay clear of the blue areas. As this was not always
possible when navigating in pilotage waters, the master’s philosophy was to
follow the advice of the pilot and to keep within buoyed channels. The master
had confidence in the 2/O’s ability to use the system effectively.

During the ECDIS examination, historical voyage data was replayed on board in
‘bright day’ mode, which showed that the vessel’s track displayed was consistent
with the track re-constructed from AIS data. During the replay, the ‘approaching
waypoint’ warning was also displayed as Muros approached waypoint ‘Bacton’, to
the north of Haisborough Sand.

During Muros’s passage to Rotterdam for repair, the ECDIS software or operating
programme stopped functioning (crashed) and, although some historical data was
recovered, it was insufficient to enable full replay. It was reported that the ECDIS
had previously crashed periodically on board Muros but it could not be determined
why or what type of data was routinely lost.

1.6 SIMULATIONS

1.6.1 Maris ECDIS900

To review the alarm functions of the Maris ECDIS900, a track across Haisborough
Sand corresponding to the track planned by Muros’s 2/O was input into a Maris
ECDIS900 at Red Ensign Training in Cowes, UK. Simulations to verify the
relationship between the guard zone and the alarms/highlighting of dangers showed
that:

●● The guard zone had to be active for the safety contour alarm to be triggered.

●● With a safety contour set at 8.5m, the 10m charted contour was highlighted.

●● It was possible to customize which dangers were highlighted when entering

the guard zone but no dangers were highlighted when ‘never’ was selected on
the alarms page.

●● Soundings shallower than the safety depth were not highlighted and did not
trigger an alarm on entering the guard zone unless they were embedded in
the SENC13 as isolated dangers.

●● The system alarmed when the guard zone crossed the safety contour only if
the safety depth was equal to, or deeper than, the safety contour setting.

During the simulations, the method used by Muros’s 2/O to check the proximity of
the intended track to the 10m safety contour near Cross Sand was repeated. When
the display was zoomed out, ENC cell GB 2A218214 was selected and the intended
track passed over the 10m contour (Figure 10). However, when the display was
zoomed out, ENC cell GB300106 was selected and the intended track was over 2
miles from the 10m contour (Figure 11), which was further to the south-west.

13
An ECDIS converts ENC data into its own internal system ENC (SENC) format for optimal chart image
creation. SENC data can differ between manufacturers.
14
The first digit of a cell’s number indicates the intended use: 1=overview, 2=general, 3=coastal, 4=approach,
5=harbour and 6=berthing.

15
 Image courtesy of Maris/Red Ensign Training/UK Hydrographic Office

Figure 10: Muros’s passage plan on ENC GB2A2182

Image courtesy of Maris/Red Ensign Training/UK Hydrographic Office

Figure 11: Muros’s passage plan on ENC GB300106

16
1.6.2 Other ECDIS

Similar simulations to those conducted with the Maris ECDIS900 were conducted
at ECDIS Ltd, UK, using four other approved ECDIS models from different
manufacturers. These simulations identified that:

●● The setting of safety depth and safety contour was inconsistent. Some
systems did not allow safety depth to be shallower than the safety contour,
and one system required the safety contour and safety depth to be input as a
single value.

●● Some systems did not allow the ‘guard zone’ to be disabled or made inactive.

●● The methods of defining the shape and area of a ‘guard zone’ varied.

●● Differing labelling protocols were used for the guard zone and included ‘look-
ahead’, ‘safety region’, ‘safety zone’ ‘safety frame’ and ‘searchlight’.

1.7 PREVIOUS SIMILAR ACCIDENTS

1.7.1 CFL Performer

On 12 May 2008, the Netherlands registered dry cargo ship, CFL Performer, ran
aground on Haisborough Sand (MAIB report 21/2008). The grounding occurred
after the chief officer adjusted the passage plan in the vessel’s ECDIS, a Furuno
FEA – 2107. The check of the adjusted route, which took the vessel directly over
Haisborough Sand, was only cursory and was not cross-checked by the master. The
grounding alarm did not activate because the guard zone (watch vector) had not
been set. The MAIB investigation established that, despite ECDIS being used as a
primary means of navigation, none of the ship’s officers had been trained in its use.

1.7.2 CSL Thames

On 9 August 2011, the Malta registered self-discharging bulk carrier, CSL Thames,
grounded in the Sound of Mull, Scotland (MAIB report 02/2012). The grounding
occurred after the OOW had made an alteration of course to avoid another vessel
but did not realise that the new course took the ship into shallow water. He did
not see the visual grounding alarm shown on the ECDIS, a Telko TECDIS 4.6.0,
because he was not monitoring the display. In addition, the audible grounding
alarm did not sound because the alarm had been disconnected from the ECDIS.
It was also identified that the ECDIS safety contour was set to 10m, which was
inappropriate with respect to the vessel’s draught, and that the master’s and other
watchkeepers’ knowledge of the ECDIS system was insufficient.

1.7.3 Ovit

On 18 September 2013, the Malta registered chemical tanker Ovit ran aground on
the Varne Bank in the Dover Strait (MAIB report 24/2014). The vessel’s primary
means of navigation was the Maris ECDIS900. The investigation identified that:

●● The passage was planned by an inexperienced and unsupervised junior

officer. The plan was not checked by the master before departure or by the
officer of the watch at the start of his watch.

17
 ●● The ship’s position was monitored solely against the intended track shown on
the ECDIS. Navigational marks on the Varne bank were seen but not acted
upon.

●● The scale of the chart shown on the ECDIS was inappropriate. The operator
defined settings applied to the system were unsuitable and the system’s
audible alarm did not work.

●● The officer of the watch’s situational awareness was so poor that it took him
19 minutes to realise that Ovit had grounded.

●● Although training in the use of the ECDIS fitted to the vessel had been
provided, the master and deck officers were unable to use the system
effectively.

1.7.4 Commodore Clipper

On 14 July 2014, the Bahamas registered ro-ro passenger ferry Commodore Clipper
grounded on a charted, rocky shoal in the approaches to St Peter Port, Guernsey
(MAIB report 18/2015). The Transas Navi-sailor 4000 ECDIS was the ferry’s primary
means of navigation and the MAIB investigation identified that it had not been
utilised effectively. The investigation report noted that:

In particular, the safety contour value was inappropriate, the cross-track error
alarm was ignored and the audible alarm was disabled.

The report also stated:

After ECDIS was approved for use as the primary means of navigation, its
alarms activated frequently during Commodore Clipper’s passages. Along
with the bridge teams from other vessels in the company’s fleet, the crew on
the bridge of Commodore Clipper found the constant ECDIS audible alarms
a significant distraction. As a result of concerns raised by the masters of its
vessels, the company allowed the audible alarms to be disabled across its fleet.
Nevertheless, the visual alarms remained active and could still be observed on
the ECDIS display. The company did not notify the Flag State of its decision to
allow the ECDIS audible alarm to be disabled.

1.8 ECDIS RESEARCH

Recent research by an MSc15 student at Lund University16 explored the experiences

of ECDIS operators with a view to identifying ways to inform system design and
development in the future. Inter alia, the research identified:

●● The technology was not reliable and could not be trusted.

●● User experience was required to determine when the information displayed

was reliable.

●● Automated functions were deselected to fit local contexts and reduce

workload.
15
Master of Science
16
The student was an investigator with the Danish Maritime Accident Investigation Board (DMAIB).

18
●● Alarm functions were disturbing.

●● Information on ECDIS displays duplicated information shown elsewhere and

led to clutter.

●● The operator-ECDIS interface was complex.

●● ECDIS use reduced basic navigational skills.

●● Difficulty was experienced when transferring between systems.

19
 SECTION 2 - ANALYSIS
2.1 AIM

The purpose of the analysis is to determine the contributory causes and

circumstances of the accident as a basis for making recommendations to prevent
similar accidents occurring in the future.

2.2 THE GROUNDING

Figure 1 shows that Muros’s revised track passed directly over Haisborough Sand.
Since the depth of water over the central area of these shallows was significantly
less than 5m and the height of tide was 1.2m, it was inevitable that Muros, which
had a draught of over 6m, would run aground.

Muros’s route over Haisborough Sand was planned and monitored by the 2/O
using the vessel’s ECDIS. However, system and procedural safeguards intended to
prevent grounding were either overlooked, disabled or ignored.

In planning, the dangers automatically highlighted by the ‘check route’ function

were dismissed, the intended track over Haisborough Sand was not inspected at
a sufficiently large scale, and the revised route was not reviewed or authorised
by the master. In execution, the vessel’s passage into the shallows was either not
recognised or not acted upon by the 2/O and the ECDIS grounding alarm did not
sound or display because the defined guard zone was not active and the audible
alarm had been disabled.

2.3 PLAN REVISION

The 2/O amended Muros’s voyage plan to route the vessel via the Sunk TSS rather
than the North Hinder Junction soon after she took over the navigational watch.
She was following the master’s instructions and her use of the mouse and cursor to
‘drag and drop’ four waypoints included in the original plan (Figure 1) further to the
west was a quick, pragmatic and accepted method that would probably have taken
only a few minutes to complete. However, although the 2/O scanned the revised
route visually, scrolling from south to north, she did not identify that the track over
Haisborough Sand was unsafe and did not conform with the buoyage in the area.

The 2/O saw that the course line near Cross Sand was close to the safety contour
shown on the display (Figure 10), but when she zoomed in, the track was clear
of the safety contour (Figure 11). The simulations conducted at Red Ensign Ltd
(paragraph 1.6.1) showed that this was due to differences between ENC cells
GB2A2182 (scale 1: 700000) and GB300106 (scale 1: 90000). The larger scale
cell was more accurate and contained more detailed information and, although
the change of ENC when zooming in and out would have been displayed, this was
either not seen by the 2/O or the implications of the change of chart scale were not
recognised. This led to the incorrect assumption that the track over Haisborough
Sand would also be clear of the shallows by a similar margin to the course line
further to the south.

The automatic initiation of the ECDIS’s ‘check route’ function when the revised route
was saved, highlighted the dangers over Haisborough Sand (Figure 9). However,
these were not examined because they were among about 3000 other warnings,

20
 many of which the 2/O considered to be connected to the pilotage segments of
the voyage plan and irrelevant. Although the 2/O was aware that the ‘check route’
function could be applied to individual legs of a voyage plan, she preferred to rely on
visual checks alone.

2.4 OVERSIGHT

That Muros’s master did not check and approve the voyage plan before the vessel
sailed from Teeside, was significant. In this respect, his interactions with the 2/O
were probably influenced to varying degrees by time pressures and workload in
port, the vessel’s watchkeeping arrangements, and the 2/O’s apparent competence
as a navigator and in the use of ECDIS. The master’s confidence in the 2/O, and his
practice of signing the passage plan at the earliest convenient opportunity, meant
that the important safeguard of an independent check of the passage plan, as
required by the onboard procedures, was bypassed.

In addition, although the master’s decision to revise the route initially input into
Muros’s ECDIS by the 2/O, was expedient given the distance and time saved, he did
not notice the vessel’s routing via the North Hinder Junction until between 2000 and
0000. Consequently, the 2/O had to make the required changes to the plan almost
as soon as she relieved the master of the bridge watch. Although the requirement to
amend the passage plan conflicted with the 2/O’s watchkeeping duties, the options
of the master keeping the navigation watch until the 2/O had amended the plan, or
the 2/O calling the master to check the changes as soon as they were completed,
do not appear to have been contemplated.

2.5 POSITION MONITORING

During the bridge watch, the 2/O adjusted the autopilot heading at 0208 and noticed
the speed reductions at 0220 and 0248. However, although the starboard ECDIS
display was easily visible from where the 2/O was sitting (Figure 2), she did not:

●● Adjust the heading on the autopilot until Muros had passed the ‘Bacton’
waypoint, despite an ‘approaching waypoint’ alert being displayed earlier and
the vessel being to the north-east of the intended track (Figure 4).

●● React to the vessel’s vector on the ECDIS heading directly towards the safety
contour at the north-west end of Haisborough Sand (Figure 4).

●● React to Muros crossing the 10m safety contour at about 0218, despite seeing
that the vessel’s speed unexpectedly slowed to about 9kts, 2 minutes later
(Figure 5). Or,

●● Immediately appreciate that the vessel might have grounded when its speed
reduced to less than 1kt at 0248, despite being well within the blue area inside
the safety contour shown on the ECDIS display (Figure 6).

Although the 2/O incorrectly assumed that the revised route was safe, it is difficult
to comprehend why this assumption did not change as Muros headed towards, and
then over, the safety contour. However, it is possible that the 2/O’s performance was
adversely affected to some degree by the time of day and a low level of arousal.

21
 Research has shown that alertness and performance tend to be at their
lowest during the early hours of the morning as the human circadian rhythm is
synchronised with the normal pattern of daytime wakefulness and sleep at night.
This was highlighted in the MAIB’s Bridge Watchkeeping Safety Study (MAIB Safety
Study 1/2004), which identified that a significant percentage of groundings occurred
between 0000 and 0600.

In this case, Muros’s grounding occurred at 0248 when the 2/O’s level of alertness
was likely to have been at its lowest. Although the 2/O had the opportunity to
rest during the 8 hours before her bridge watch, the watch had been uneventful
for over 2 hours, during which the 2/O was sitting in a comfortable chair with the
lookout better placed to reach the BNWAS reset button. In such circumstances,
the 2/O’s arousal was probably reduced to such a low level that it impacted on her
effectiveness. Low levels of alertness and arousal might also have led to the 2/O
falling asleep for brief periods.

2.6 ECDIS USE

The Maris ECDIS900 was operated on board Muros in a very simplistic manner. The
use of the ‘standard’ chart view and ‘two colours’, along with the master’s philosophy
of ensuring his vessel navigated outside the blue areas shown on the ECDIS, was
easy to follow and apparently safe. However, the use of software to disable the
audible alarm and the locking of the guard zone settings (Figure 8), removed the
system’s barriers intended to alert bridge watchkeepers to imminent danger. It has
not been possible to determine when or by whom the audible alarm was disabled
and the guard zone and other settings were locked. Although the crew saw these
actions to be beneficial, they significantly reduced the ECDIS’s intended advantage
over paper charts. In addition, the use of the ‘standard’ chart view limited the
information displayed (see Figures 6 and 7), and the reliance of visual checks when
passage planning was prone to error unless the reliability of information shown at
different chart scales was considered.

In the previous similar groundings investigated by the MAIB between 2008 and 2013
(Paragraph 1.7), the way ECDIS was used was also found to be contributory to
varying degrees. Common themes identified included the disablement of the audible
alarm, making the ‘guard zone’ inactive, not using automatic functions to check
passage plans, using inappropriate chart scales and safety contours, and insufficient
operator knowledge and training. Like the circumstances on board Muros, the
ECDIS had not been used as expected by the regulators or the equipment
manufacturers.

2.7 ECDIS FUNCTIONALITY

The International Maritime Organization (IMO) Resolution MSC.232(82)17 (adopted

in December 2006)18 states that ‘The primary function of the ECDIS is to contribute
to safe navigation.’ Therefore, the difference between the way ECDIS was intended
to be used and the way it was used on board CFL Performer, CSL Thames,
Ovit, Commodore Clipper and, more recently, on board Muros, is a cause for
concern. The previous investigation reports focused on the operator’s ability to
use the system. However, the continued and potentially widespread deselection

17
MSC – Maritime Safety Committee.
18
Adoption of the revised performance standards for electronic chart display and information systems (ECDIS).

22
 of automated functions to fit local contexts and reduce workload (paragraph 1.8)
indicates that there are wider problems with the systems’ design. If this is the case,
ECDIS has the potential to hinder rather than assist safe navigation.

The ‘alarm fatigue’ caused by ECDIS has been well-documented and it is

anticipated that the introduction of version 4.0 of the IHO S52 presentation library19,
which specifies the charted objects that should trigger and alarm, will result in
fewer alarms. While other difficulties with the usability of ECDIS, such as those
connected with the insufficient density of depth contours in pilotage waters, and the
inconsistencies between ECDIS models related to terminology and safety-critical
settings (Paragraph 1.6.2), might be successfully addressed through hydrographic
standards and regulation in due course, other usability issues will not.

Compliance with performance standards does not necessarily lead to the design of
equipment that is intuitive to use and, as there are over 30 ECDIS manufacturers,
the potential for variation is considerable. It is evident that several manufacturers
are striving to improve ECDIS functionality, both at the request of users and on their
own initiative. However, if ECDIS is to make its intended contribution to navigation
safety, further research is required to assess in detail the difficulties faced by ECDIS
operators and the consequences of the systems’ limitations so that these can be
addressed in future designs.

19
The IHO S52 “Specifications for Chart Content and Display Aspects of ECDIS” became a requirement for new
ECDIS from 1 September 2015 and for existing systems from 1 September 2017.

23
 SECTION 3 - CONCLUSIONS
3.1 SAFETY ISSUES DIRECTLY CONTRIBUTING TO THE
ACCIDENT THAT HAVE BEEN ADDRESSED OR RESULTED IN
RECOMMENDATIONS

1. The intended track over Haisborough Sand was unsafe and grounding was
inevitable given the vessel’s draught and the depth of water available. [2.2]

2. The route over Haisborough Sand was planned and monitored using the vessel’s
ECDIS. However, system and procedural safeguards intended to prevent grounding
were either overlooked, disabled or ignored. [2.2]

3. The 2/O’s visual check of the revised route did not identify that the track over
Haisborough Sand was unsafe or that it did not conform with the buoyage in the
area. [2.3]

4. The track over Haisborough Sand was not planned or checked on an appropriate
scale chart. [2.3]

5. The revision of the passage plan conflicted with the 2/O’s watchkeeping duties. [2.4]

6. The master did not check and approve the revised route. [2.4]

7. The 2/O’s monitoring of the vessel’s position was probably impacted upon by
the time of day and a very low level of arousal, which would have reduced her
effectiveness and might have caused her to fall asleep for brief periods. [2.5]

8. The use of software to disable the audible alarm and the guard zone removed the
ECDIS barriers intended to alert bridge watchkeepers to imminent danger. [2.6]

9. The use of the ‘standard’ chart view limited the information displayed and the
reliance of visual checks when passage planning was prone to error. [2.6]

10. The ECDIS on board Muros had not been used as expected by the regulators or
equipment manufacturers. [2.6]

3.2 SAFETY ISSUES NOT DIRECTLY CONTRIBUTING TO THE

ACCIDENT THAT HAVE BEEN ADDRESSED OR RESULTED IN
RECOMMENDATIONS

1. The potentially widespread de-selection of automated functions to fit local contexts

and reduce workload is indicative of wider problems with ECDIS design. [2.7]

2. Further research is required to assess the difficulties faced by ECDIS operators and
the consequences of the systems’ limitations so that these can be addressed in
future designs. [2.7]

24
SECTION 4 - ACTION TAKEN
4.1 MAIB ACTIONS

The MAIB has:

Commenced a safety study, in collaboration with the Danish Maritime Accident

Investigation Board, to provide further research on the reasons why seafarers are
utilising ECDIS in ways that are often at variance with the instructions and guidance
provided by the system manufacturers and regulators. The overarching objective
of the study is to provide comprehensive data that can be used to improve the
functionality of future ECDIS systems by encouraging the greater use of operator
experience and human centred design principles.

4.2 ACTIONS TAKEN BY OTHER ORGANISATIONS

Naviera Murueta has:

●● Completed an investigation into Muros’s grounding and circulated the

investigation report among its fleet.

●● Instructed all masters and officers of the fleet of the importance of following
established procedures.

●● Amended its onboard procedures with regard to the security and use of
ECDIS functions.

25
 SECTION 5 - RECOMMENDATIONS
In view of the actions already taken, no recommendations have been made.

26
Marine Accident Report