Human Factors perspective on ships steering control

In line with Murphy’s law, steering control failure on ships usually happens at the worst possible moments, for instance when the ship is in a narrow channel or close to other traffic. Many incident reports point out that ‘human error’ is often the main cause.

As Human Factors expert I think the real human error took place long before the incident, and was not caused by the crew, but by the builders and designers. When basic Human Factors considerations are neglected, the human error will be already ‘built into the design’.

This article discusses steering controls of seagoing ships. With the help of some recent reports of grounding and collision incidents related to steering, we make an analysis of the Human Factors and safety aspects, and come up with 10 practical design guidelines.

Background

Movement of a ship is normally controlled from the navigation bridge. Examples of movement control devices are steering wheels, tillers and joysticks, pitch controllers, bow thruster controls, Autopilots and Dynamic Positioning and Tracking units (DP/DT). On larger vessels multiple control sets of these systems can be found on several locations on the bridge: at the navigation console, wing consoles, helmsman console, DP workstations etcetera.

In case of a failure in the normal steering control system, the Officer On Watch (OOW) must act quickly to regain control of the vessel’s movement. When the ship is sailing in restricted areas, like rivers, shipping channels and ports, the timeframe to act is often not more than a few minutes. Because of the many technical components involved, this period is usually not sufficient to analyze and solve the initial problem. Therefore it is essential that the OOW can quickly switch over to an ‘emergency mode’, in which propulsion and steering control is provided by an independent system, entirely separated from the normal controls. Safety regulations ensure these emergency backup systems (also called auxiliary control systems) are present on every ship.

Incident reports

Incident reports show that – despite of emergency backup systems – steering control failure incidents still happen, sometimes with groundings and collisions as result:

Halit Bey

On 22 April 2014, tanker Halit Bey (L 162m, IMO 9410143) grounded in the st. Lawrence river in Canada, as a result of lost steering control. Investigation revealed that the ship was equipped with multiple steering control panels and several back-up control systems. One of these systems acted as override: when a small unlabeled joystick on the navigation console was touched unintentionally, it automatically took over steering control, and switched off all other steering control systems. The bridge team was not familiar with this additional backup joystick and its specific behavior. The six-person bridge team and two pilots tried to regain control by switching between several steering control systems and steering modes, but without success. Giving full power astern and attempts for an emergency anchoring could not prevent the ship from grounding on the river bank, 9 minutes later. Tugs were able to refloat the vessel. No casualties or damage was reported.

Investigation turned out that steering control was ‘lost’, but all systems worked as designed. The bridge team was not able to discover the correct configuration of switches and buttons in time to regain the lost steering control before the ship grounded. It also revealed that multiple backup systems were installed, and that this overload of redundancy and resulting user interface complexity contributed to the crew’s confusion.

John S McCain

On 21 August 2017, US Navy destroyer John S McCain (L 154m) collided with tanker Alnic MC in Singapore Strait, as a result of lost steering control. When entering the crowded Singapore Strait, the commanding officer ordered to transfer the propulsion control from the first helmsman’s workstation to a second workstation, so one helmsman could concentrate on steering, while a second helmsman could control the propulsion of the ship. During this operation the first helmsman suddenly lost steering control. Apparently steering control was unintentionally transferred to the second workstation too, without being noticed by the crew. Immediate attempts were made to regain steering control by switching over to an emergency steering location elsewhere on the ship. For this purpose both the bridge and emergency location have a control override button: when pressed control is instantly transferred to the nearest workstation.

The crew of the emergency location pressed the big red override button, by which they successfully took over steering control from the bridge. However, in the mean time the operator on the bridge wrongly assumed that his red button should be pressed, to transfer control to the emergency location. By doing so, in fact he took back control. So, after a few switching operations and much confusion, steering control was restored on the bridge. However, during these operations, the ship had turned into a collision course with the nearby tanker Alnic. Within 3 minutes after control was lost the bow of the tanker Alnic hit the navy ship midships in a sleeping accommodation part of the vessel. Ten sailors were killed. 48 were injured.

Investigation turned out that steering control was ‘lost’, but all systems worked as designed. After an unintended transfer of steering control location, the system was unable to successfully inform the bridge crew which system was now in control, and how to get back to the initial situation. When the crew intentionally tried to move the steering control location, the system behaved differently than expected by the operator.

Orsula

On 15 December 2011, bulk carrier Orsula (L 200m, IMO 9110901) grounded on a river bank near Trois Rivières in Canada, as a result of lost steering control. When the pilot commanded a course change, the steering system did not respond. Several attempts were made to change course by using the steering hand wheel, but without any rudder response. Preparations were made to stop the ship by reversing the engine and emergency anchoring. Also the master was called to the bridge. He was able to quickly restore steering control by switching the system over to a backup system. However, three minutes after the initial steering failure the ship grounded. Tugs were able to refloat the vessel. No casualties ware reported, but the hull took some damage.

Investigation revealed that one of the potentiometers of the hand wheel had failed – the one connected to the main steering gear. Before the master appeared on the bridge the crew had not attempted to switch over to the second steering system, or to use the Non Follow Up steering controls. Both backup systems worked as designed. In a following investigation the authorities reviewed bridge crew knowledge about steering backup systems on 8 ships of different sizes, owners and nationalities. On 6 vessels the crew was not fully familiar with the use of emergency backup steering systems or the NFU mode.

Human Factors Analysis

Based on a design experience of 20 years and over 25 large vessels, we have no doubt there are many more incidents with similar conclusions. The incident reports point out that situational awareness problems are likely to occur when the steering mode controls are not designed in a simple, straightforward, intuitive and self-explaining way. In two of the above cases steering control was lost because the crew unintentionally switched the system to another mode or location. The system failed to inform the user which workstation or set of controls was active, and how to switch it back to the previous state.

There seems to be no standardized setup or user interface for steering controls on a ship. As a result, the crew has to familiarize with each individual ship they work on. Differences in design can be subtle, and sometimes we find exactly the same physical controls and labels, but with different functional behavior. Since steering equipment is very reliable, bridge crews do not have much experience with using backup systems. And if they need to, it is possible that their knowledge of the current ship get mixed with memories of other vessels, that might have a slightly different setup. Some companies have an internal standard, but in many cases the steering control design is based on a proposal of the steering equipment vendor, system integrator or yard. So even with a company standard, the actual controls, and control panel arrangement may vary from ship to ship.

A complicating factor is that on many ships movement control is divided over several systems, usually supplied by different makers. Apart from steering controls, there may also be controls for propulsion, bowthrusters, stern thrusters, azimuth thrusters, autopilot and DP/DT. All these systems may be linked in certain steering modes or controlled separately in other modes. Each of the systems and control panels may use a different vocabulary to address emergency backup systems. Labeling of the controls is often rudimentary or ambiguous and provides not much information about their functionality and relation with other controls. In case of darkness: illumination of buttons may be OK, but the overall panel arrangement is often hard to see in the dark. As a result, the crew is not always confident about using switches for engaging backup systems, as they are not sure which systems will be affected and in what way.

A specific safety issue we found in accident reports is about ‘override controls’. This is a type of backup device that automatically takes over control whenever a dedicated override tiller or joystick is touched – regardless of the setting of other steering mode selectors and steering location selectors. A pitfall of this concept is that the system assumes that the operator will only switch to override mode as result of a deliberate, well-thought action – which is not always the case. Sometimes an override is touched unintentionally, without the operator being aware of it.

The system also assumes that the user is fully aware of how the override affects to all other components in the steering system setup. Again this is not always the case, and can be complicated anyway, in case multiple steering control modes and locations are present. A weak point of all override systems is that they are not symmetrical in their behavior: it is easy to engage the override, but it can be complicated to switch back to the previous mode.

Dangerous examples of overrides were found on the Halit Bey and Orsula. On these vessels (and many others) it is possible to take control by using the override joystick, whereas the master steering mode selector switch is still in the FU (FollowUp), NFU (NonFollowUp), or Autopilot position. As a result the operator gets conflicting information, and interpretation errors are inevitable. From a Safety and Human Factors’ point of view, the operator should always be in control, and be fully aware of the selected mode – even when the mode is changed unintentionally. Best option for this purpose is to use one master steering mode selector– and only this one, to engage emergency backup steering modes when required.

Another interesting factor is time. All three incidents took place within 9 minutes, two of them in just 3 minutes. This is barely enough to get a good overview of the problem at hand, and in most situations it is not sufficient for a systematic analysis of the problem. As a consequence the amount of backup systems should be limited, preferably to one, since engaging and testing each of the backup systems will take a few minutes, because of latency in the control systems and inertia of the steering gear and ship.

The steering system is often not the only means of movement control available. Many vessels can also use bow thrusters or allow independent control of propeller thrust. Using these systems, which are in fact no part of the steering gear, may be more effective to control the ships movement than try to restore rudder control, when the available time is very limited. It is remarkable that in all of the above incident reports the crew’s initial focus was entirely on ‘regaining steering control’, and that other means of movement control were neglected, or applied too late. This may have technical reasons: a bow thruster unit may need some start-up time, and many ships with a fixed propeller setup need to slow down, stop and restart the engine in reverse, before they can effectively reduce speed.

Commercially driven behavior can also be a relevant factor, making officers reluctant to reduce the vessels speed, as long they see alternative ways to regain control.

Guidelines

Below are 10 design guidelines for steering control on ships, based on Human Factors principles. Leading principle is that the steering system should always inform the user clearly which of the control devices on the bridge is in charge, and allow the user to change the selected mode manually from one central location:

Provide one normal steering control system, connected to the main steering gear. All input devices connected to the normal steering control system should be of full Follow Up type (FU).
Provide one independent emergency steering control system, connected to the auxiliary steering gear of the ship. For this purpose use the most direct and straightforward way of individual rudder control possible, preferably by a Non Follow Up (NFU) input device.
Use a different kind of input device for normal steering and emergency steering. For instance, when a tiller is used for main steering, use a 2-axis joystick, rocker switch, or arrow buttons for emergency steering.
For NFU controls, use only spring-loaded types.
Provide one ‘master steering mode selector’ on the main navigation console, which allows the operator to make an exclusive choice between all available steering modes and locations. Arrange the manual interaction modes to one side of the scale, and the more automated control modes to the other side. Example: ‘Emergency NFU, FU Nav, FU Wing PS, FU Wing SB, Autopilot, DP/DT’.
The ‘master steering mode selector’ must be designed in a way that it provides clear feedback about which mode is selected and about the operational status of the selected mode, both in daylight and darkness. The mode selector should be protected against unintentional use.
Suitable control types for a ‘master steering mode selector’ are (1) a rotary dial selector switch, (2) a group of pushbuttons (selected mode to be illuminated), or (3) a touch panel. Options 1 and 2 are preferred, since they usually provide a good tactile feedback. In case a touch panel is used, it must be of a highly reliable type and preferably dedicated to steering mode selection only. The operator should not have to navigate through menu’s to access the steering mode control graphic.
Provide a visual indication (light or display) at the master steering mode selector and at every control input device to show which steering location is actually in control.
Avoid using ‘override’ backup controls.
Provide an audible and visual alarm to indicate a malfunctioning of each steering system and power supply.

Clarification

We suggest using only the terms ‘normal steering’ and ‘emergency steering’. Several other terms are also commonly used, like main, master, auxiliary, backup, etcetera, but these are less self-explaining.

It is recommended to use for normal manual steering only Follow Up input devices. A Follow Up (FU) input device (hand wheel or tiller) is rotated by the user to a certain rudder angle setpoint. The steering control system will then activate the rudder gear to rotate in the right direction and stop automatically when the chosen angle setpoint is reached. Because of the large size and inertia of the rudder, this takes more time than the rotation of the hand-wheel itself, so the steering gear is ‘following’ the users command. The alternative concept is called Non Follow Up (NFU). In this case the rudder is moved as long the user holds the control device. When the device is released, the rudder motion stops.

From a Human Factors’ perspective a strong point of the FU concept is that it requires considerable less mental effort: the user can set an angle, without having to wait and constantly check if the rudder angle indicator has reached the desired position. During this process of checking, the user can not focus entirely on the ships navigation.

Sometimes we see that NFU input devices are used on additional workstations, like bridge wing consoles. Reason to apply NFU controls here, is that the device is spring loaded: it is only active when manually operated and when released it jumps back into the neutral position. Therefore a NFU control device does not need a take-over protocol for switching over, and is technically simpler to make.

This technical simplicity is exactly the reason that NFU is still the best choice for emergency steering. As mentioned before, in case of a steering failure there is usually no time to analyze the source of the malfunctioning. By using a direct NFU mode, most of the technical control components are bypassed. This makes sense in case of emergency, in which case predictability and reliability are more important than operational comfort and speed.

We recommend using clearly distinct input devices for normal steering control and emergency control. This helps the operator to realize that both input devices are connected to separate, independent steering systems. Be noted that the SOLAS regulations allow to control both normal and emergency by one combined control device. However, the incident report of the Orsula shows that this can easily lead to confusion.

Recommended is to use one and only one master steering mode selector. Main reason for this is that in case of lost steering control, the user should not have to wonder which combination of switches and dials would engage the emergency mode: there is only one switch, and that is also the one the operator is already most familiar with.

An exception to this rule can be made for touch screen based master steering mode selectors. If redundancy of the touch panel is regarded necessary, a duplicate can be used, as long as the functionality is identical, and the duplicate is located near the first one.

Discussion

It may be expected that a simple setup will be simple in design too. However, this is not always the case. Below is a quick overview of challenges designers and engineers have to face:

Multiple makers: unwanted complexity is introduced when the steering (control) system is based on components of multiple makers and vendors. Usually these components do not fit perfectly, resulting in additional switches, panels, displays and vocabulary.
Combined mode selection for steering, propulsion and bow thrusters: when designed carefully this can result in a strong solution and a simple user interface. However, it also comes with engineering challenges, as some propulsion modes may not have an equivalent for the steering gear and vice versa.
Specifically on special purpose ships, designers often have to struggle to fit all instrumentation into the limited space of the console. As a result the emergency steering controls are sometimes moved to a side panel, in which case the orientation of the control device is not parallel to the vessels centre line. In case of emergency, this can lead to dangerous situations. It would be helpful if vendors put a bit more effort into making compact controls.

We also have a recommendation for captains: encourage bridge crew to slow down the vessel’s speed in case of steering problems. The available amount of time to take back control will increase drastically: a quick and simple way to improve safety.

Interested in more do’s and don’t concerning Human Factors of ship’s design ? Please let me know, and I will dedicate another article to your question. Or take a look on www.maritime-ergonomics.com

ir. Niels de Groot Eur.Erg. ErgoS Human Factors Engineering – www.ergos.eu

References

Transportation Safety Board of Canada, Grounding chemical products tanker Halit Bey, Grondines, Quebec, 22 April 2014, Marine investigation report M14C0045, https://www.tsb.gc.ca/eng/rapports-reports/marine/2014/M14C0045/M14C0045.html

US National Transportation Safety Board, Collision between US Navy Destroyer John S McCainand Tanker Alnic MC, Singapore Strait, 5 Miles Northeast of Horsburgh Lighthouse, 21 August 2017, Marine Accident Report NTSB/MAR-19/01 PB2019-100970, https://www.ntsb.gov/investigations/AccidentReports/Reports/MAR1901.pdf

Transportation Safety Board of Canada, Grounding Bulk Carrier Orsula, Battures de Gentilly, Bécancour, Quebec, 15 December 2011, Marine investigation report M11L0160, https://www.tsb.gc.ca/eng/rapports-reports/marine/2011/m11l0160/m11l0160.pdf

Federal Bureau of Maritime Casualty Investigation of Germany, Allision between Offshore Supply Vessel VOS STONE and a wind turbine on 10 April 2018, Marine Investigation report 118/18, https://www.bsu-bund.de/SharedDocs/pdf/EN/Investigation_Report/2019/Investigation_Report_118_18.pdf

IMO International Maritime Organization, International Convention for the Safety of Life at Sea (SOLAS), 1974

Download a PDF version of this article: