I:\MEPC\45\2-1.doc

For reasons of economy, this document is printed in a limited number. Delegates arekindly asked to bring their copies to meetings and not to request additional copies.

INTERNATIONAL MARITIME ORGANIZATION

IMO

E

MARINE ENVIRONMENT PROTECTIONCOMMITTEE45th sessionAgenda item 2

MEPC 45/2/127 June 2000

Original: ENGLISH

HARMFUL AQUATIC ORGANISMS IN BALLAST WATER

IACS Hazard Identification (HAZID) ofBallast Water Exchange at Sea - Bulk Carriers

Submitted by the International Association of Classification Societies (IACS)

SUMMARY

Executive summary: This paper presents the IACS report "Hazard Identification DuringBallast Water Exchange at Sea - Bulk Carriers".

Action to be taken: See paragraph 7

Related documents: MEPC 41/9/2

1 A HAZID-report on ballast water exchange at sea (BWE) bulk carriers has been compiled byIACS and is attached at annex. The “Structured What-IF checklist Technique” (SWIFT) has beenapplied to ballast water exchange (BWE) at sea.

2 In 1998, IACS conducted a preliminary hazard identification study (HAZID) of BWE for allship types, identifying various additional hazards and recommending that each ship should have aBWE plan (MEPC 41/9/2). A BWE plan has now been developed for a representative bulk carrier,and it was decided to carry out a HAZID of this ship and its plan using the SWIFT.

3 In the BWE plan for the selected bulk carrier a set of safety critical parameters are calculatedfor the sequence of ballast operations that are required to replace the ballast water taken onboard inharbour by ballast water taken onboard at sea. Such a plan should be provided for each loadingcondition (light ballast, heavy ballast, homogeneous loading, alternate loading etc.). The parameterspresented for the selected ship were: lightship weight, bunkering weight, water ballast, cargo,dead-weight, displacement, draft equiv.(draft corresponding to displacement), draft at fore peak.,draft at aft peak, trim, transverse meta-center above base line, KG, free surface correction by liquid,G’M=GM-GG’, C.C.G, L.C.B, L.C.F, M.T.C, T.P.C, propeller immersion, max bending moment,and maximum shear force.

MEPC 45/2/1 - 2 -

I:\MEPC\45\2-1.doc

4 The BWE plan for the selected ship was a plan based on the sequential method (sequentialemptying and refilling tanks/holds). Some intermediate loading conditions were at the design limitfor strength. For the purpose of this HAZID, however, the group also considered associated hazardswhere a flow through method may be employed for BWE.

5 The conclusions drawn as a result of this HAZID can be found at section 11 of the annexedreport, and are reproduced as follows:

.1 Ballast system needs more attention because of increased hazards during BWE at sea(with BWE at sea the ballast system is safety critical).

.2 New rules for ballast system should be considered.

.3 New rules for survey of testing of ballast systems should be considered.

.4 BWE should be addressed in IMO regulations (e.g. ISM, STCW).

.5 Severity of hazards combined with frequency of operation suggest necessity for FSAfor relevant risk control options.

.6 Procedures, training, and planning for BWE should be consistent with other safetycritical operations.

.7 Design of ballast system and associated control and vent system should take accountof BWE at sea.

.8 Class rules should be assessed to establish the degree of coverage and improvedwhere necessary.

.9 Recognised safety margins should be verified for use during BWE allowing for actualweather conditions.

.10 IMO should further develop BWM model plans, including model plans for genericship types. The ICS/INTERTANKO plan could be used as a starting point.

.11 Loading instruments should be verified to become a safeguard during BWE.

.12 The overall decision on BWM should take account of hazards to the ship,environmental drawbacks, as well as the environmental benefits.

.13 Hazards of BWM may not be fully appreciated within the shipping industry as awhole. More education and awareness may be necessary.

.14 Standard guidelines for the development of BWM/BWE should be developed.

.15 It should be recognised that BWE at sea significantly increases the risk affecting BCoperation. It is important to allow the master not to proceed with BWE in case ofunfavourable weather conditions.

.16 Existing safety measures and monitoring/safety systems/gauging on board should bereassessed to take into account additional hazards arising from BWE at sea.

- 3 - MEPC 45/2/1

I:\MEPC\45\2-1.doc

.17 BWE should not be allowed at sea unless a BWE plan has been developed based onverified, updated information and approved.

.18 Class rules should be reviewed with regard to BWE at sea in terms of:

• Permissible strength limits;

• Sloshing loads and the unique aspects of the flow through method; and

• Explicit considering BWE by flow through method.

.19 Hazards identified here are not unique to BCs and can apply to all ship types.However, other ship types will present hazards not present for BCs (e.g. related tostability).

.20 The study should be extended to other bulk carriers and non-BC.

6 FUTURE IACS ACTION

IACS has categorized the identified hazards into three principal areas and has tasked threespecialist IACS working groups to evaluate current rule requirements and the need for enhancementsin aspects related to the capacity and functionality of the ballast system and the ship's strength andstability. The impact of the "flow through" and "sequential" methods on new ships (which can bedesigned to more efficiently and safely carry out ballast water exchange) versus existing ships will beconsidered in association with the time duration and complex/numerous steps needed to carry outcomplete exchange for certain types of ships.

Action requested of the Committee

7 The Committee is invited to note the foregoing, take action as appropriate and advise theMaritime Safety Committee accordingly.

***

MEPC 45/2/1

I:\MEPC\45\2-1.doc

ANNEX

International Association of Classification Societies(IACS)

HAZIDof

Ballast Water Exchange at SeaFor

Bulk CarriersBy

SWIFT

MEPC 45/2/1ANNEXPage 2

I:\MEPC\45\2-1.doc

1. OBJECTIVE OF THE STUDY

The objective of the study was to identify hazards that are unique to BWE at sea, so as to assist withthe development of rules and regulations by IACS or at IMO.

2. DEFINITIONS OF BWM/BWE PLANS

Ballast water Management Plan (BWM plan): A ballast water management plan typically wouldconsist of the following sections:

1) Description of ship particulars;

2) Explanation of the need for ballast water management;

3) Description of ballast water arrangements on board;

4) Safety considerations relevant to ballast water management;

5) Procedures for managing ballast water on board. If ballast water exchange is a selectedmanagement option this section is the ballast water exchange plan (BWE plan);

6) Ballast water sampling points (for crew or port state control by quarantine authorities);

7) Crew training and familiarisation;

8) Duties of ballast water management officer;

9) Ballast water reporting form and ballast water handling log; and

10) IMO resolution A.868(20).

A model ballast water management plan has been prepared by International Chamber ofShipping/INTERTANKO.

In the future ballast water management plans may become mandatory by IMO. Currently ballastwater management plans are prepared in accordance with A.868 (20).

Ballast water exchange plan (BWE plan): The BWE plan is a document containing a description ofa sequence of ballast water operations resulting in ballast water exchange. A sequence is presentedfor relevant loading/ballast conditions. For each step in the intermediate ballast water exchangesequence it is documented that the ship is within allowable strength and stability limits.

A BWE plan may be part of the BWM plan. For a bulk carrier the BWE plan may also be part of theloading manual which is approved by class according to UR S1A.

At the SWIFT meeting such a BWE plan was presented.

MEPC 45/2/1ANNEX

Page 3

I:\MEPC\45\2-1.doc

3. GENERAL APPROACH TO THE STUDY

3.1 Main Elements of study

The main elements of the study approach were:

• Select a representative bulk carrier and BWE plan.

• Examine the BWE plan and identify critical intermediate loading conditions under which safetymargins are lowest. Develop a detailed procedure for the selected loading condition, identifyingsystems and personnel involved in the operation.

• Identify hazards, i.e. deviations from plan that might lead to an accident, especially hazards thatare unique to BWE at sea.

• Identify safeguards, i.e. statutory, class or internal requirements that can prevent or mitigate eachhazard.

• Rank hazards and categorise safeguards in order of priority (for later analysis, as required byHAZID (Step 1 of FSA), in the Interim Guidelines for the Application of Formal SafetyAssessment (FSA) to the IMO Rule-Making Process).

• Consider how representative is the specific design for the bulk carrier fleet as a whole, includingclass society differences.

• Prepare a HAZID study report with recommendations fore new safety rules and regulations byIACS and at IMO.

3.2 Structured What-If Checklist (SWIFT) Technique

SWIFT is a systematic team-oriented technique for hazard identification (HAZID). It can becontrasted with other HAZID techniques as follows:

• SWIFT can be used to address systems and procedures at a high level. It considers deviationsfrom normal operations identified by brainstorming, supported by checklists.

• Standard HAZOP (hazard and operability study) is usually applied to process flow at a detailedpiping & instrumentation level, and identifies deviations from design intent by means ofguide-words. It may be noted that in the marine industry the term HAZOP is often used looselywhere the term HAZID (for an operation) would be more appropriate.

• FMEA (failure modes and effects analysis) addresses hardware at the level of detailed equipmentitems, and does not usually consider the human element.

SWIFT, like standard HAZOP, can be used to address operability issues as well as safety hazards.

SWIFT may be used simply to identify hazards for subsequent quantitative evaluation, oralternatively to provide a qualitative evaluation of the hazards and to recommend further safeguardswhere appropriate.

MEPC 45/2/1ANNEXPage 4

I:\MEPC\45\2-1.doc

SWIFT, like any group-based HAZID technique, relies on expert input from the team to identify andevaluate hazards. The SWIFT facilitator’s function is to structure the discussion. The SWIFTrecorder keeps an on-line record of the discussion on a standard log-sheet.

There is no single standard approach to SWIFT - one of its strengths is that it is flexible, and can bemodified to suit each individual application.

3.3 SWIFT Protocol used in the study

1. Define BWE operationsConsider each operation in sequence.

2. Brainstorm possible hazards, e.g. “What if...?”, “How could...?”List but do not discuss hazards yet.Once ideas are exhausted, use previous accident experience to check for completeness.

3. Structure the hazards into a logical sequence for discussion.Start with the major ones, so that escalation of initiating ones can be cross-referenced.

4. Consider each hazard in turn.Consider possible consequences if the event occurs.Consider safeguards that are in place to prevent the event occurring.Consider whether additional safeguards are neededRecord discussion on SWIFT log-sheets

5. Reconsider whether any hazards have been omitted, using a generic checklist

3.4 SWIFT generic checklist

• Operating errors and other human factorse.g. crew error, accidents (falls, trapping, trips, access to dangerous areas), illness or injury,passenger error, abuse of equipment etc.

• Measurement errorse.g. passenger numbers, cargo/vehicles, trim, GM, navigation etc

• Equipment/instrumentation malfunctione.g. structural failures, equipment failure, control system failure etc

• Maintenancee.g. dangerous areas, permit systems, control of modifications, mechanical handling, danger topassengers etc

• Utility failuree.g. power, air, fire water, communication systems, lighting etc

• Integrity failure or loss of containmente.g. fire, loss of containment

MEPC 45/2/1ANNEX

Page 5

I:\MEPC\45\2-1.doc

• Emergency operatione.g. evacuation, fire etc

• External factors or influencese.g. transport accidents, impact, other accidents on-board or near to the ship, terrorism etc

4. REFERENCE DOCUMENTS

• ICS/INTERTANKO model ballast water management plan

• Documents available for a particular ship:

• Ship capacity plan• Ship-specific BWE plan (as part of BWM)• Loading Manual (also includes BWE plan)• Piping System Diagram• Hull Piping Diagram except living quarter• Machinery Arrangements in E/R• Instrument List• Valve Remote Control System• Damage Stability Calculation

• Interim Guidelines for the Application of Formal Safety Assessment (FSA) to the IMORule-Making Process (Steps 1 and 3)

• IMO resolution A.868(20)

5. SHIP TYPE-BULK CARRIER

5.1 Selected ship

The selected representative bulk carrier was an existing 73,000 dwt 7-hold single-skin Panamaxvessel, for which a BWE plan had been developed, based on the sequential exchange method. It wasnoted that the aft peak had to be emptied and filled twice to stay within acceptable limits (propellerimmersion). No.4 cargo hold is used for ballast water in the heavy ballast condition. The ship was asingle side skin bulk carrier, with topside and lower hopper tanks, which load high density cargo andcomply with the strength and stability survivability standards of SOLAS chapter XII and has anapproved loading manual complying with IACS UR S1A.

The selected BC has 2 main ballast pumps situated in the machinery space, serving all ballast tanksincluding the fore and aft peak tanks through two ballast main running through the pipe tunnellocated amidships and of the same height as the port & starboard DB ballast One ballast mainconnected fore peak, aft peak, port side DB tanks, hopper tanks and No.4 cargo hold. The otherballast main connected starboard side DB tanks, hopper tanks and No.4 cargo hold. The two ballastmain are cross connected such that either both or each of the pumps can be used to serve either portor starboard or both the ballast. The ballast pumps are also connected through appropriate isolationvalves to the bilge system and fire pump. Hopper and DB tanks are connected. The ballast mainconnected to each DB and the fore peak tank has isolation valves fitted at the tank situated inside the

MEPC 45/2/1ANNEXPage 6

I:\MEPC\45\2-1.doc

pipe tunnel and in the case of fore-peak, inside the tank. The ballast pumps are fitted with isolationvalves at the pump as well as the appropriate valves at the overboard discharge and the sea suctionsport 7 starboard. Valves status (open/closed) is indicated in the control room as well locally inside thepipe tunnel. The valves are remotely operated. Each ballast tank is fitted with vent pipe withautomatic means of closure at the outlets located at the main deck level. Also tank level reading areavailable in control room.

5.2 Representative ship

As far as the hazards were concerned this ship was considered representative of all existing singleside skin bulk carriers, with topside and lower hopper tanks, which load high density cargo andcomply with the strength and stability survivability standards of SOLAS chapter XII and has anapproved operating manual complying with IACS UR S1A. Bulk Carriers carrying deck loads, andcombination carrier were excluded.

6. PROCEDURE FOR BWE

Design of ballast system, venting system, tank level system.

Development of BW management plan, BWE plan, loading manual.

Ship informed that BWE will be necessary before leaving port.

Sequence of ballasting operations at sea, each involving:

Planning prior to start: How long will it take? Is there an appropriate weather window?(Consider strength and stability margins for the operation under predicted weatherconditions).Line-up and open appropriate valves for BWE (tank valve, close other tank valves).Typically up to 10 valve alignments per operation to flood/empty a tank. There are speciallocking arrangements for floodable cargo hold valves.Check that vents are clear. (Vents may be designed to avoid under/over pressure).Confirm tank level (by remote gauge or manual sounding).Open ballast pump suction and overboard discharge valves (or sea chest suction valves).Start the pump.Monitor tank level. As end of operation approaches, monitor more closely and reduce pumpspeed.Stop pump.Close valves.Confirm tank level reading and record in log.

7 LOADING CONDITIONS

7.1 Ballast conditions

• Light ballast condition - with DB and hopper tanks filled with BW and no cargo. This would beused in calm or moderate weather, and hence would be the most likely starting condition forBWE. If the cargo hold is filled at sea, BWE of this hold may be unnecessary as the BW isalready ‘clean’.

• Heavy ballast condition - with DB and hopper tanks and No4 floodable hold filled with BWand no cargo. This would be used in severe weather.

MEPC 45/2/1ANNEX

Page 7

I:\MEPC\45\2-1.doc

• Partly loaded condition - with some cargo and some ballast tanks filled with BW. This may bethe starting condition for BWE, with less BW involved. Details of such partly loaded conditioncould be varying (strength and stability wise). In this condition all BW would not normallyneed to be discharged at the arrival port.

7.2 Critical intermediate conditions

The BWE plan for the representative ship showed Conditions 51 and 42 were the most critical interms of BM and SF. The ballasting operations outlined above would be similar for all conditions.

The stability margins were well above the safety limits and thus it was not considered necessary toexpand on this issue in detail.

8. RESULTS OF HAZARD BRAINSTORMING

1. Inadequate ballast system design2. Valve failure3. Pump Failure4. Pipeline Failure5. Overpressure in Tank6. Remote operation system failure7. Valve control system failure8. Power failure9. Gauging system failure10. Tank under-pressure11. Maloperation of valve12. Failure of Venting System13. Remote/Local valve indication failure14. Structural failure15. Maloperation of closing devices in cargo hold16. Failure to remove closing devices17. Valve open/closing in wrong sequence18. Miscalculation onboard19. Poor maintenance20. Continuous use of pumps21. Inadequate/insufficient manpower22. Inadequate training23. Unintended filling of tanks (cross)24. Overfilling of tanks25. Original BWE plan wrong/inadequate26. BWE plan not used/followed27. Blockage of sea suction28. Icing on deck29. Weather changes30. BE in severe weather (HE)31. Time pressure32. Reduced system capability33. Low quality weather prediction34. Suction/overboard head location does not suit pump performance35. Exceed permissible bending moment36. Exceed permissible shear force

MEPC 45/2/1ANNEXPage 8

I:\MEPC\45\2-1.doc

37. Exceed permissible weight in one hold38. Lack of adequate stability39. Filling/emptying tank too quickly40. Exceed permissible trim41. Propeller not immersed42. Insufficient forward draft causing slamming43. Submerged LL44. Sloshing in half full tanks45. Global structural failure46. Torsion stresses47. Bad visibility48. List angle49. Loll50. Insufficient manoeuvrability51. Collision52. Illness53. Fire54. Flooding55. Grounding56. Shell damage57. Inadequate survey58. Wrong material specification59. Unsupervised maintenance60. Contamination of BS by pollutant61. Taking on board contaminated water as BW62. Failure to adhere to BWM plan63. Manhole cover removed64. Error in strength calculation/verification65. Unknown corrosion, reduced scantling66. Wrong BWE plan on board67. Outdated BWE plan on board (modification of ship)68. Misjudgement of stability69. Gauging system wrongly calibrated70. Onboard computer failure71. Lack of system understanding72. Failure to monitor BW operation (HF)73. Complacency74. Communication failure75. Common cause failure of S&P Ballast pump (e.g. flooding)76. Vulnerable ballast pump location (e.g. in fore peak)77. Inaccessible equipment78. Wrong tagging of valves79. Start wrong pump80. Inadequate contingency planning81. Inadequate/lack of recording of operation82. Failure to monitor empty spaces83. Pipe duct bilge alarm failure (or lack of)84. Increased work load85. Inadequate ventilation of pipe ducts (HF)86. Ship not informed that ballast water exchange is necessary before leaving port

MEPC 45/2/1ANNEX

Page 9

I:\MEPC\45\2-1.doc

9. LIST OF HAZARDS IDENTIFIED

The hazards are structured into a logical sequence, starting with those which were initially expectedto be the major ones, so that escalation of initial ones could be cross-referenced. Also, hazards weregrouped together when similar, or could have been dealt with by similar risk control options. Thenumbering is sequential. The numbering is not related to the numbering in the previous paragraph.

Hazard definition Inadequate ballast system designFit for purpose in general, not for BWE at sea

IDNo

1

Causes New building: Lack of experience at yard. Tradition. Lack ofguidance or regulation. Poor design process and quality checking.Financial constraints.Design of existing ships may not be suited for BWE at sea.

FI

Consequences Pump system capacity too low.Inability to BWE efficiently.Special measures for flow through method.Inadequate monitoring and capacity of venting system to releaseliquid.

SI

Current safeguards Minimum vent sizes (Class).Minimum ballast tank capacity (Class/IMO).Class Rules specify minimum requirement if a ballast system isfitted, but do not have direct requirements for ballast systems.Class societies have slightly different Rules.

RI

Recommendations Design criteria for ballast systems should consider BWE at sea

Hazard definition Inadequate BWE planBWE plan/sequence as part of loading manual will be developedby consultant or yard, for the owner, approved by Class.BWE plan will be referred to/included in BWM plan (Seedefinitions above).

IDNo

2

Causes Human errors, e.g. poor training, lack of knowledge.Communication errors, e.g. wrong data fromdesigner/owner/consultant/yard/classSoftware error. Calculation error undetected.Lack of updating.Last minute completion of BWE plan.

FI

Consequences Unfavourable mass distribution (ID 5).Submerged load line (ID 6)Insufficient stability (ID 15)

SI

Current safeguards Class approval of BWE plan (Only for BC). Same approach asnormal class approval of loading manual.

RI

Recommendations Research into effects of BWE on structures and stability of ships should becontinued

MEPC 45/2/1ANNEXPage 10

I:\MEPC\45\2-1.doc

Hazard definition Inadequate BWM plan(See definitions above)

IDNo

3

Causes Insufficient guidance. Lack of knowledge. Wrong information.Misinterpretation of the BWE plan by the BWM plan author.

FI

Consequences As ID 2Procedural error in BWE (ID 9)Wrong BWE sequence used (ID 4)

SI

Current safeguards Existing guidance on BWM plan development.Will be audited in ISM audit.

RI

Recommendations IMO should develop guidelines for preparation of BWM plans, with dueconsideration of the human element.A ship’s BWE plan should be harmonised with the BWM plan.

Hazard definition Wrong BWE sequence usedMost ships will have many BWE sequences (for differentloading/ballasting conditions)

IDNo

4

Causes Human errors, e.g. misjudgement of actual loading condition FIConsequences As ID 2. SICurrent safeguards All BCs have loading instruments (UR S1). This could be used to

simulate the BWE sequence for the actual loading condition priorto BWE.

RI

Recommendations Loading instruments should have automated BWE simulation capabilities.Deviating BWE sequences should be carefully checked against established limits.

Hazard definition Unfavourable mass (e.g. ballast water) distribution duringBWE

IDNo

5

Causes Inadequate BWE plan (ID 2)Inadequate BWM plan (ID 3)Wrong BWE sequence used (ID 4)Failure of ballast system (ID 7)Inadequate planning of ballast operation (ID 8)Maloperation of ballast system (ID 9)Local structural damage (ID 13)Hull damage (ID 14)Ballast control system failure (ID 18)Gauging system failure (ID 20)

FI

Consequences Exceed permissible bending moment, shear force, torsion stress,weight in hold.Excessive trim (ID 16), propeller not immersed, insufficientforward draft.Structural failure (ID13)Hull damage (ID 14)Total loss

SI

Current safeguards Class Rules. BWE Plan RIRecommendations As ID 4.

Hazard definition Immersion of load line during BWE IDNo

6

Causes As ID 5Misjudgement of existing draft

FI

Consequences Progressive flooding.Structural failure (ID13)Hull damage (ID 14)Total loss

SI

Current safeguards Draft marks read in port RIRecommendations Means for measuring draft at sea may be necessary for BWE at sea

MEPC 45/2/1ANNEXPage 11

I:\MEPC\45\2-1.doc

Hazard definition Failure of ballast system IDNo

7

Causes Failure or damage to pumps, valves, pipes, vent pipes, or suctionblockage or inadequate location of suction and discharges.Inadequate strainers or filters in system, insufficient backupsystem.

FI

Consequences Inability to continue BWE. Increased duration of BW operation.Lack of ballasting capability.Unfavourable mass distribution (ID 5).Immersion of load line (ID 6).

SI

Current safeguards Design. Limited redundancy. Maintenance. RIRecommendations As ID 1. Ships should have maintenance schedule for ballast system. Ballast

system should be surveyed. Ballast system should be performance tested.

Hazard definition Inadequate planning of ballast operation (planning by crewprior to BWE operations)

IDNo

8

Causes Lack of training and knowledge, time pressure, insufficient crewavailability (ID 26), complacency, procedural violation, failure toadhere to BWE plan. Inaccurate weather forecast.

FI

Consequences Inability to conduct safe BWE.Wrong BWE sequence used (ID 4).BWE sequence not followed.Unrealistic workload on crew.Unfavourable mass distribution (ID 5).Immersion of load line (ID 6)Failure of ballast system (ID 7).Local structural damage (ID 13).Insufficient stability (ID 15).

SI

Current safeguards Training, adequate ship specific BWM plan including BWE plan. RIRecommendations As ID 3. Training should emphasise hazards with BWE. Careful planning of

manpower availability might be necessary.

Hazard definition Maloperation of ballast system during BWE IDNo

9

Causes Failure to follow BWE plan, failure to monitor BWE operation,poorly written BWE procedures.Maloperation of valve, wrong sequence of valve opening/closing,maloperation of closing devices (ballast system and cargo hold),wrong tagging of valves.Inadequate training (ID 31), insufficient crew availability (ID 26),time pressure, increased workload due to BWE, complacency,procedural violation, lack of system knowledge, communicationerror.

FI

Consequences Unfavourable mass distribution (ID 5).Immersion of load line (ID 6)Failure of ballast system (ID 7).Local structural damage (ID 13).Insufficient stability (ID 15)

SI

Current safeguards Training, adequate ship specific BWM plan including BWE plan.Acknowledgement of commands.

RI

Recommendations As ID 3 and 31. Valves should be clearly and accurately marked in the commonworking language of the crew. The BWM plan should include requirements formonitoring of the BWE operation. Procedures should be written in accordancewith published guidance for HF (Reference: 1&2).

MEPC 45/2/1ANNEXPage 12

I:\MEPC\45\2-1.doc

Hazard definition BWE in unsuitable weather conditionsUnsuitable weather for the ship takes into account the maximumallowable SWBM and sheer force

IDNo

10

Causes Time pressure, lack of knowledge, misjudging the weathersituation. Unpredicted change in weather. Increased duration ofBW operation.

FI

Consequences Hull damage (ID 14)Loss of watertight integrity (ID 27)Slamming (ID 11)Sloshing (ID 12)

SI

Current safeguards The master has discretion not to do BWE in bad weather.Permissible values for SWBM, SF and torsion.

RI

Recommendations It is a matter for consideration by IACS to decide if the permissible values ofSWBM and SF for BWE could be increased above the allowable values while atsea due to the fact that BWE is only undertaken under favourable weatherconditions.

Hazard definition Slamming during BWE IDNo

11

Causes Rough sea and insufficient forward draft during BWE FI

Consequences Local structural damage in the forward region SI

Current safeguards Checked for minimum draft during design. Selection of course andspeed during operation.

RI

Recommendations BWE should only take place in an appropriate weather window

Hazard definition Sloshing during BWE IDNo

12

Causes Partial filling of floodable cargo hold (or ballast tanks) andsignificant roll/pitch motion if BWE carried out in unsuitableweather. (Unsuitable is defined by wave period rather than waveheight)Level in tank passes through barred filling range

FI

Consequences Local structural damage in hold (ID 13) SI

Current safeguards Checking of sloshing during design. Selection of course and speedduring operation. Use flow through may avoid passing throughbarred filling ranges. Use suitable weather window. Internalstructure of ballast tanks is generally considered adequate towithstand sloshing.

RI

Recommendations As ID 11.Sloshing should be considered an essential element of design loads for ballastwater exchange.

MEPC 45/2/1ANNEXPage 13

I:\MEPC\45\2-1.doc

Hazard definition Local structural damage in ballast tank or floodable holdduring BWE

IDNo

13

Causes Over/Under pressure and corrosion. Sloshing (ID 12). Poormaintenance. Gauging system failure (ID 20). Venting systemfailure (ID 19). Overloading of tanks. Undetected damage dueto cargo operations.

FI

Consequences Undetected flooding, power failure due to flooding ofmachinery spaces, progressive structural failure.Unfavourable mass distribution (ID 5).Immersion of load line (ID 6)Insufficient stability (ID 15).

SI

Current safeguards Design, maintenance, inspection by crew, surveys, ClassRules. Corrosion protection. Adherence to BWE plan

RI

Recommendations BWE (flow through) during icing situation should be avoided.

Hazard definition Hull damage during BWE IDNo

14

Causes Slamming, unfavourable mass distribution (see above)Collision due to reduced visibility and manoeuvrabilityGrounding due to BWE in shallow waters

FI

Consequences Flooding, power failure due to flooding of machinery spaces,progressive structural failure.Unfavourable mass distribution (ID 5).Immersion of load line (ID 6)Failure of ballast system (ID 7).Local structural damage (ID 13).Insufficient stability (ID 15).

SI

Current safeguards Design, maintenance, inspection by crew, surveys, classRules. COLREG. Grounding is unlikely as BWE will be indeep sea.

RI

Recommendations

Hazard definition Insufficient stability during BWE IDNo

15

Causes Loss of watertight integrity (ID 27)Hull damage (ID 14)Inadequate recognition of transient ballasting conditions (e.g.free surface effects, movement of VCG and mass). Failure tofollow BWE plan. Misjudgement of stability margins.Adverse heel angle and loll. Icing on deck (flow through).

FI

Consequences As for excessive heel and loll (ID 17) SICurrent safeguards Recognised stability margins. Adherence to BWE plan. RIRecommendations Stability margins should be developed that are relevant to BWE, considering

relevant sea states.

MEPC 45/2/1ANNEXPage 14

I:\MEPC\45\2-1.doc

Hazard definition Excessive trim during BWE IDNo

16

Causes Unfavourable mass distribution (ID 5)Icing on deck during flow through.

FI

Consequences Propeller emergence. Lack of visibility from the bridge, reducedmanoeuvrability. Slamming. Loss of stability. Power failure.Inability of ballast system to operate. Inability to launchlifeboats. Other system failures.

SI

Current safeguards IMO resolution on bridge visibility. BWE plan and onboardmonitoring of BW operation.

RI

Recommendations Class review of BWE plans should check systematically propeller emergence andvisibility during BWE. See also ID 17.

Hazard definition Excessive heel during BWE IDNo

17

Causes Unfavourable mass distribution (ID 5)Insufficient stability (ID 15)Icing on deck during flow through.

FI

Consequences CapsizeBallast system failure (ID 7).Inability of ballast system to operate [inability to perform BWEby flow through method due to pump-head insufficient to pumpwhen outlet is on high side.]Power failureReduced manoeuvrability.Inability to launch lifeboat. Other system failures.

SI

Current safeguards Adequate ballast system design. BWE plan and onboardmonitoring of BW operation.

RI

Recommendations Ballast system should be designed to enable ballasting operations to avoid causingexcessive heel and free surfaces. Time for effective intervention must be allowed.BWE should be developed to avoid any appreciable heel.

Hazard definition Ballast control system failure during BWE IDNo

18

Causes Power failure, cable failure, component failure, computer failure(for automated), hydraulic system failure, pneumatic systemfailure, inadequate system/component design, system feedbackfailure, inadequate maintenance, inadequate training,maloperation. Inadequacy of the system fluid, includingcontamination.

FI

Consequences Inability to continue BWE. Increased duration of ballastoperation.Uncontrolled ballasting (ID 32)Unfavourable mass distribution (ID 5)Immersion of load line (ID 6)Failure of ballast system (ID 7).

SI

Current safeguards Adequate design to suit BWE. Fail-safe philosophy used insome class Rules. Class requirement for secondary means tooperate valves.

RI

Recommendations System design should consider BWE at sea. Minimum Requirements should bedeveloped for safe operation, considering fail-safe requirements, system monitoringand alarms, backup, redundant system (no single critical failure), adequate filtersand strainers.

MEPC 45/2/1ANNEXPage 15

I:\MEPC\45\2-1.doc

Hazard definition Tank venting system failure during BWE IDNo

19

Causes Obstructions, icing, debris, poor maintenance, inadequate design,maloperation, wave damage

FI

Consequences Tank over/under pressure.Tank structural failure (ID 13).Inability to ballast.

SI

Current safeguards Current (varying) class requirements. Inspection prior to start ofBW operation. Class/statutory survey.

RI

Recommendations Venting system should be suited for BWE at sea. Vent sizes should be designed formaximum pumping capacity from all pumps used during BWE. Harmonisedguidelines should be developed. Design should account for the flow throughmethod.

Hazard definition Gauging (tank level) system failure during BWEIncludes operator error

IDNo

20

Causes Poor maintenance, control system failure, component failure,power failure, weather damage. Inability to access gauging pointsdue to weather, fire, excessive list. Inaccuracy of gauging in badweather, wrong tank manually gauged, wrong manual reading orreporting. Excessive workload (ID 26)

FI

Consequences Lack of control of ballasting operation, e.g. unintended fillinglevels of tanks/hold. Over/under pressure.

SI

Current safeguards Training, inspection, experience, varying class rules. RIRecommendations Gauging system should be designed for BWE at sea. Automated/improved gauging

system should be encouraged.

Hazard definition Continuous use of pumps during BWE IDNo

21

Causes Pumps not designed for BWE at sea FIConsequences Pump failure (ID 7). Early wear-out of pump. Lack of time to

maintenance. Inadequate power balance may cause power failure.Fire in electricity supply.

SI

Current safeguards Over current protection for electrical pump. Temperature alarmon other pumps.

RI

Recommendations Pump system & supporting systems should be designed (or upgraded for existingvessels) for BWE at sea, providing adequate availability.

Hazard definition Personal accidents due to BWE at sea IDNo

22

Causes BWE at sea may require visits to compartments and pipe ductsnot normally used at sea. Inadequate ventilation. Inadequateaccessibility of valves and other ballast system componentsIce on deck, water on deck (flow through method).Tank gauging in bad weather.Increased workload (ID 26). Inefficient bilge system in ducts orother relevant compartments. Poor lighting. Poor monitoring ofwater levels or air in spaces not normally used.

FI

Consequences Injuries, reduced health, fatalities. SICurrent safeguards IACS UR Z-12 for safe entry into confined spaces RIRecommendations Personal safety requirements should be developed for BWE at sea.

MEPC 45/2/1ANNEXPage 16

I:\MEPC\45\2-1.doc

Hazard definition Loading instrument (computer) inaccurate or inadequate forBWE

IDNo

23

Causes Software error FIConsequences Wrong BWE sequence (see ID 2.) SICurrent safeguards Review of loading instruments according to S1A. RIRecommendations Review of requirements for loading instruments should include BWE.

Hazard definition Loading instrument failure during BWE IDNo

24

Causes Software error, power failure, excessive vibrations, unintendedliquid ingress

FI

Consequences Wrong BWE sequence (see ID 2.) SICurrent safeguards Environmental testing for single system or provision of backup

system, varying class requirements for acceptance. Procedure formanual backup of computer.

RI

Recommendations Backup procedure should be available, and adequate training.

Hazard definition Inaccurate knowledge of cargo massIn a mixed loading condition, cargo mass is an input to theloading instrument for BWE

IDNo

25

Causes Difficulty in estimating cargo mass. FIConsequences As ID 2.

Less relevant for pure ballast conditions as ballast water mass isbetter known than cargo mass

SI

Current safeguards Routines used on board RIRecommendations Crew should be adequately trained for BWE, including knowledge of the

inaccuracy in cargo mass estimation.

Hazard definition Insufficient crew availability for BWE workload IDNo

26

Causes Increased workload due to BWELow manningSickness

FI

Consequences Increased potential for human error. Increased time to carry outBWE. Reduced monitoring and recording capability. Inadequateplanning.

SI

Current safeguards Minimum manning requirements. Decide not to BWE ifinsufficient crew.

RI

Recommendations Manning must be carefully planned considering BWE. Master decision must berespected.

Hazard definition Loss of watertight integrity during BWE IDNo

27

Causes Flooding through open manhole covers (flow through),open/closing devices.

FI

Consequences As ID 9.Personnel accidents (ID 22)

SI

Current safeguards Inspection. Procedures on board. RIRecommendations Procedures to prevent loss of watertight integrity should be part of BWM plan

MEPC 45/2/1ANNEXPage 17

I:\MEPC\45\2-1.doc

Hazard definition Fire on board during BWE IDNo

28

Causes Traditional causes. See also ID 21. FIConsequences Inability to complete BWE. Reduced strength due to fire

damage. Reduced fire fighting capability if BWE is continued.SI

Current safeguards Traditional safeguardsContingency planning (ID 29)

RI

Recommendations Fire drills should include BWE.

Hazard definition Inadequate contingency planning for BWE IDNo

29

Causes Lack of manpower (ID 26). Lack of experience with BWE. Lackof awareness of hazards. Lack of training (ID 31).

FI

Consequences Inappropriate response making emergency worse. Lack ofavailability of adequate equipment, e.g. emergency lighting

SI

Current safeguards Limited coverage in available model BWM plans. RIRecommendations Proper coverage of contingency plans in BWM plan.

Hazard definition Inadequate survey of BWE systems IDNo

30

Causes Current surveys do not address BWE FIConsequences Failure of ballast system during BWE. SICurrent safeguards Inspected, but not considering BWE at sea RIRecommendations Surveys should be extended to cover BWE

Hazard definition Inadequate training for BWE IDNo

31

Causes Complacency due to familiarity with ballast operations in port.Lack of understanding of the hazards of BWE at sea.

FI

Consequences Inadequate planning of ballast operation (ID 8)Maloperation of ballast system (ID 9)BWE in unsuitable weather (ID 10)Wrong BWE sequence used (ID 4)

SI

Current safeguards ISM, STCW RIRecommendations IMO should require training consistent with other safety critical operations.

Training must ensure adequate knowledge and understanding of the BWEoperation, hazards and associated systems, and should specifically include trainingfor contingency

Hazard definition Uncontrolled ballasting during BWE operation IDNo

32

Causes Inadequacy of tank/hold isolation, ingress of water [overboarddischarges], in particular for flow through method. Human error.Component failure. Procedural violation. Unknown corrosion inscantling.

FI

Consequences Unfavourable mass distribution (ID 5)Submerged load line (ID 6)Insufficient stability (ID 15)

SI

Current safeguards Class Rules. Current BWE plan, if any. RIRecommendations Isolation valves should be fitted at tank and holds.

Positive closing non-return valves at overboard discharge should be considered.

MEPC 45/2/1ANNEXPage 18

I:\MEPC\45\2-1.doc

Hazard definition Inaccessibility of components used for BWE IDNo

33

Causes Inadequate design for use at sea, poor lighting. Adverse weather. FIConsequences Poor maintenance. Inability to operate. Increased probability of

error or procedural violation. Personnel accident (ID 22)SI

Current safeguards ISM Code RIRecommendations As ID 22

10. RANKING OF HAZARDS

10.1 Purpose

This chapter provides notes for the risk ranking element of a Structured What-If Checklist (SWIFT)review of ballast water exchange (BWE) at sea.

10.2 Severity Index

The following severity index was used:

SI SEVERITY EFFECTS ON HUMAN SAFETY EFFECTS ON SHIP S(fatalities)

1 Minor Single or minor injuries Local equipment damage 0.012 Significant Multiple or severe injuries Non-severe ship damage 0.13 Severe Single fatality or multiple severe

injuriesSevere casualty 1

4 Catastrophic Multiple fatalities Total loss 10

10.3 Frequency Index

The following frequency index was used:

FI FREQUENCY DEFINITION F(per ship year)

7 Frequent Likely to occur once per month on one ship 105 Reasonably

probableLikely to occur once per year in a fleet of several ships, i.e.likely to occur several times during the ship’s life

0.1

3 Remote Likely to occur once per year in a fleet of several tens ofships, i.e. likely to occur in the total life of several similarships

10-3

1 Extremely remote Likely to occur once in 10 years in the world fleet ofseveral hundred ships.

10-5

By insisting to use a logarithmic scale the Risk index for ranking purposes may be calculated asRI = FI + SI

E.g. An event rated “remote” (FI=3) with severity “moderate” (SI=2) would have RI=5

10.4 Risk Matrix

The risk matrix (risk indices in bold) used therefore was:

MEPC 45/2/1ANNEXPage 19

I:\MEPC\45\2-1.doc

SEVERITY (SI)1 2 3 4

FI FREQUENCY Minor Moderate Serious Catastrophic7 Frequent 8 9 10 116 7 8 9 105 Reasonably probable 6 7 8 94 5 6 7 83 Remote 4 5 6 72 3 4 5 61 Extremely remote 2 3 4 5

Risk reduction options affecting hazards with higher RI are considered most desirable.

10.5 Hazard Ranking

All hazards were ranked individually by each member of the team (excluding the facilitator andrecorder). An average risk index was estimated for each hazard. As the team felt that the risk rankingwas uncertain and may be arbitrary, it was decided to present only the order of hazard rank withoutlisting the rank index. Actual risk ranking should be presented after actual risk analysis (step 2 ofFSA).

The resulting ranking of hazards was (highest risk first):

29, 9, 31, 5, 2, 12, 1, 7,10,11, 13, 26, 17, 4, 8, 20, 15, 16, 21, 22, 19, 18, 27, 30, 3, 25, 33, 28, 14, 24,32, 23, 6.

11. CONCLUSIONS

1. Ballast system needs more attention because of increased hazards during BWE at sea (WithBWE at sea the ballast system is safety critical).

2. New Rules for Ballast system should be considered.

3. New Rules for survey of testing of ballast systems should be considered.

4. BWE should be addressed in IMO regulations (E.g. ISM, STCW).

5. Severity of hazards combined with frequency of operation suggest necessity for FSA forrelevant risk control options.

6. Procedures, training, and planning for BWE should be consistent with other safety criticaloperations.

7. Design of ballast system and associated control and vent system should take account of BWE atsea.

8. Class rules should be assessed to establish the degree of coverage and improved wherenecessary.

MEPC 45/2/1ANNEXPage 20

I:\MEPC\45\2-1.doc

9. Recognised safety margins should be verified for use during BWE allowing for actual weatherconditions.

10. IMO should further develop BWM Model plans, including model plans for generic ship types.The ICS/INTERTANKO plan could be used as a starting point.

11. Loading instruments should be verified to become a safeguard during BWE.

12. The overall decision on BWM should take account of hazards to the ship, environmentaldrawbacks, as well as the environmental benefits.

13. Hazards of BWM may not be fully appreciated within the shipping industry as a whole. Moreeducation and awareness may be necessary.

14. Standard guidelines for the development of BWM/BWE should be developed.

15. It must be recognised that BWE at sea significantly increases the risk affecting BC operation. Itis important to allow the master not to proceed with BWE in case of unfavourable weatherconditions.

16. Existing safety measures and monitoring/safety systems/gauging on board should be reassessedto take into account additional hazards arising from BWE at sea.

17. BWE should not be allowed at sea unless a BWE plan has been developed based on verified,updated information and approved.

18. Class rules should be reviewed with regard to BWE at sea in terms of :

• Permissible strength limits;

• Sloshing loads and the unique aspects of the flow through method; and

• Explicit considering BWE by flow through method.

19. Hazards identified here are not unique to BCs and can apply to all ship types. However, othership types will present hazards not present for BCs (e.g. related to stability).

20. The study should be extended to other bulk carriers and non-BC.

12. REFERENCES

1. Improving Compliance with safety procedures; reducing Industrial Violations, HFRG, HSEBook, 1995, ISBN 0717 609 707.

2. Developing best operating procedures: Guide to designing good manuals and job aids. TheSRD Associating, SRDA-R1, July 1991. Edited by A.S. Bardsley & A.M. Jenkins, SRD HFDept. Prepared by Dr. A Shephard, Loughbourough University on behalf of SRD.

MEPC 45/2/1ANNEXPage 21

I:\MEPC\45\2-1.doc

Interim Guidelines for the Application of Formal Safety Assessment (FSA) to the IMO Rule-MakingProcess

13. SWIFT TEAM

13.1 SWIFT Meeting

The hazard identification has been carried out in accordance with the IMO ‘INTERIM GUIDELINESFOR THE APPLICATION OF FORMAL SAFETY ASSESSMENT (FSA) TO THE IMO RULEMAKING PROCESS’

The team carried out the HAZID in a three day SWIFT meeting at the Det Norske Veritas office inLondon October 6-8, 1999. The planning was carried out by the chairman and facilitator prior to themeeting. The BWE plan for the selected ship was distributed prior to the meeting.

The members of SWIFT team were selected to represent all competence areas relevant to the hazardspresented during ballast water exchange at sea. The members are:

1. Dr. R. Skjong, Det Norske Veritas, Chairman/Reporting

2. Mr. J. Spouge, Det Norske Veritas, Facilitator

3. Mr. M. Dogliani, RINA, Hydrodynamic Loads (Participated day 1&2)

4. Mr. Segretain, Bureau Veritas, Structures

5. Mrs. A. Jost, Germanischer Lloyd, Stability

6. Mr. M. Mahmood, American Bureau of Shipping, Piping & Systems

7. Capt. G.J. Greensmith, Lloyd’s Register, Operation

8. Mr. G. Hughes, Det Norske Veritas, Human element

9. Mr. O. M. Nesvåg, Det Norske Veritas, Machinery/Electrical Systems/Automation

13.2 Short CV's

Dr. Rolf Skjong: Chief Scientist, Structures and Systems Reliability, DNV, Strategic ResearchDepartment. Experience: 15+ years in risk and reliability analysis, specialist in structural reliabilitytheory, Norwegian specialist in FSA at IMO/MSC (66, 67, 68, 69, 70), member of the IACS/ADHOC Group on FSA, Norwegian specialist on FSA in the EU Concerted Action on FSEA. Teamleader IACS/PT/HAZID/BWE, project manager and project responsible of a number of internationaljoint industry projects, including structural reliability projects, for the ships, offshore, and processindustries. Published about 50 papers in technical journals and conference proceedings.

Mr. J. Spouge: Principal Engineer with DNV London Technical Consultancy. 12 years experience inquantitative risk assessment of shipping operations, offshore installations and road transport.Experience in leading and participating in SWIFT studies for tankers, passenger ferries, air trafficcontrol and railway operations. Previously worked in ship safety research with the UK NationalMaritime Institute. Chartered Naval Architect; BSc in Ship Science from Southampton University,1982.

MEPC 45/2/1ANNEXPage 22

I:\MEPC\45\2-1.doc

Mr. M.Dogliani: Naval Architect. Head of Scientific research Section at RINA. 14 years experienceon wave loading, stochastic processes, structural reliability. Experience in risk analysis (FMEA forHSC). Former member of IACS AHG/FSA. Chairman of IACS WP/HE.

Mr. J.F.Segretain: Naval architect (hydrodynamics). Head of Development department (rules andtechnical software) in Bureau Veritas. 16 years of experience within BV for propulsive installations,hull drawings approval, classification rules and structural calculation tools. Bureau Veritasrepresentative to IACS WP/S.

Mrs. A. E. Jost: Dipl. Ing, Naval Architect. Expert on stability and Load Line matters atGermanischer Lloyd. Experience: 12 + years in approval of stability and load line related matters;German Expert in the Joint North West European Research Project on Ro-Ro Ferry Safety; Chairmanof IACS WP/SSLL. Member of IACS/PT/HAZID/BWE.

Mr. M. Mahmood : Manager of Technology Development, American Bureau of Shipping Europe.Graduate of Surrey University in Mechanical Engineering. Prior to that he sailed on various types ofmerchant marine vessels up to the rank of Chief Engineer. Since graduating from Surrey, he workedwith P&O as Senior Project Engineer on their new building program. He has been with ABS since1975, in various capacities including Manager of the Engineering Services. He has been involvedwith the Offshore Safety Case regime and has participated in Hazop analysis for systems on offshoreunits and ships systems. Member of IACS/PT/HAZID/BWE.

Capt. G.J. Greensmith: Senior Statutory Examiner in Lloyd’s Registers, Marine Division, Tankerand Chemical Group. Holds a UK Deck Class 1 (Master Mariners) Certificate of Competence, 14years in the UK Merchant Navy serving with major oil companies, 5 years in Senior Officerspositions. 12 years with Lloyd’s Register, involved in MARPOL and International Chemical and GasCode statutory certification work including approval of operations manuals required by theconventions. Member of the IACS AHG BLG/WP and IACS/PT/HAZID/BWE, technical adviser atMEPC to a signatory delegation.

Mr. G. Hughes: Gareth joined DNV in August 1997, as a senior engineer. He is currentlyresponsible for the development of human factors business within DNV. Prior to joining DNV,Gareth spent eight years as a consultant with AEA Technology’s human factors department. Duringthis period Gareth developed his experience of using human reliability techniques for Safety andReliability applications across a wide range of safety critical industries including; nuclear, transport,defence, chemical processing etc. Gareth has extensive knowledge of the application of task analysisand human reliability analysis techniques and participated, as an expert, in an HSE funded study toprovide a comparison of their use. Gareth was more recently a member of the PT-HRA team whodeveloped the method for the incorporation of the human element into FSA, and member of IACSPT/HAZID/BC. Gareth has an MBA from the Open University and a BSc in Ergonomics gained atLoughborough University.

Mr. O.M. Nesvåg: M. Sc. in electrical engineering from the University of Trondheim, Norway.Working area: Det Norske Veritas, Division Technology and Products, Electrical Systems. Memberof IACS/PT/HAZID/BWE. Four years experience.

________