MA

RIN

E A

CCID

ENT

INV

ESTI

GAT

ION

BRA

NCH

AC

CID

ENT

REP

OR

T

LESS SERIOUS MARINE CASUALTY REPORT NO 28/2011 December 2011

Report on the investigation of

the catastrophic failure of a capacitor

in the aft harmonic filter room on board

RMS Queen Mary 2while approaching Barcelona

23 September 2010

Extract from The United Kingdom Merchant Shipping (Accident Reporting and Investigation)

Regulations 2005 – Regulation 5:

“The sole objective of the investigation of an accident under the Merchant Shipping (Accident Reporting and Investigation) Regulations 2005 shall be the prevention of future accidents through the ascertainment of its causes and circumstances. It shall not be the purpose of an investigation to determine liability nor, except so far as is necessary to achieve its objective, to apportion blame.”

NOTE

This report is not written with litigation in mind and, pursuant to Regulation 13(9) of the Merchant Shipping (Accident Reporting and Investigation) Regulations 2005, shall be inadmissible in any judicial proceedings whose purpose, or one of whose purposes is to attribute or apportion liability or blame.

© Crown copyright, 2011

You may re-use this document/publication (not including departmental or agency logos) free of charge in any format or medium. You must re-use it accurately and not in a misleading context. The material must be acknowledged as Crown copyright and you must give the title of the source publication. Where we have identified any third party copyright material you will need to obtain permission from the copyright holders concerned.

Front cover photograph (Queen Mary 2) courtesy of Jörn Prestien.

All MAIB publications can be found on our website: www.maib.gov.uk

For all enquiries:Marine Accident Investigation BranchMountbatten HouseGrosvenor SquareSouthampton Email: maib@dft.gsi.gov.ukUnited Kingdom Telephone: +44 (0) 23 8039 5500SO15 2JU Fax: +44 (0) 23 8023 2459

CONTENTS

PageGLOSSARY OF ABBREVIATIONS AND ACRONYMS

SYNOPSIS 1

SECTION 1- FACTUAL INFORMATION 3

1.1 ParticularsofRMS Queen Mary 2andaccident 31.2 Background 41.3 Narrative 41.4 Damage 91.5 Vesselmanagement 111.6 Electricalsystem 11

1.6.1 Powergenerationanddistribution 111.6.2 Propulsiontransformersandpowerconverters 111.6.3 Maincircuitbreakersandprotectiondevices 121.6.4 Selectivitystudy 13

1.7 Automationandpowermanagement 141.7.1 Integratedautomationsystem 141.7.2 Alarmsamplingsequenceandhistory 141.7.3 Propulsionsystemalarmlog 141.7.4 Powermanagementsystem 15

1.8 Harmonics 151.8.1 Harmonicdistortion 151.8.2 Harmonicdistortioninmarinesystems 151.8.3 Theharmfuleffectsofharmonics 171.8.4 Totalharmonicdistortion 171.8.5 QM2 seatrialsandsystemmodelling 18

1.9 Harmonicfilters 211.9.1 Harmonicmitigation 211.9.2 Acceptancetests 231.9.3 Maintenancemanualandsafetymanagementsystem 23

1.10 Capacitors 251.10.1 Design,constructionandmanufacturing 251.10.2 TestoffailedcapacitorsbyVishay 271.10.3 TestoffailedcapacitorscommissionedbyMAIB 281.10.4 Overvoltageintheelectricalnetwork 301.10.5 Dielectricoiltest 301.10.6 Supplyandreturnshistory 311.10.7 Maintenanceandfailurehistory 311.10.8 Classificationsocietysurveyrecords 321.10.9 Polypropylenevapour 321.10.10 Improvementsmadetocapacitordesign 33

1.11 Currentimbalancedetectionsystem 331.11.1 Construction 331.11.2 TestbyConverteam 351.11.3 ExaminationbyVishay 351.11.4 Internationalstandardforcurrenttransformers 361.11.5 Monitoringandprotection 361.11.6 Historyofimbalancealarms 38

1.12 Arc-flash 381.12.1 Phenomenonofarc-flash 381.12.2 Highvoltageregulationsforenclosures 391.12.3 Testofsoot 391.12.4 Expertopinion 40

1.13 Hi-Fogfiresuppressionsystem 401.13.1 Manufactureanddesign 401.13.2 Designappraisal 411.13.3 Currentregulations 42

1.14 Popularityofelectricpropulsionandvariablefrequencydrives 421.15 Similaraccidents 43

1.15.1 Capacitorfailures 431.15.2 Arc-flashaccidents 43

SECTION 2 - ANALYSIS 44

2.1 Aim 442.2 Theaccident 44

2.2.1 Explosion 442.2.2 Sequentialblackout 45

2.3 Harmonicdistortionofcurrentandvoltage 462.3.1 Awareness 462.3.2 Simulationsandtrials 462.3.3 Monitoringandin-serviceverification 47

2.4 Capacitorfailures 492.4.1 Initiationoffailure 492.4.2 Progressiontocatastrophicfailure 502.4.3 Designchangesinnewcapacitors 512.4.4 Maintenanceandreplacementhistory 522.4.5 Currentimbalancedetectionsystem 52

2.5 Highvoltageenclosures 532.5.1 Protection 532.5.2 Awarenessofarc-flash 54

2.6 Alarmmanagement 542.7 Water-mistinhighvoltagecompartments 54

SECTION 3 - CONCLUSIONS 56

3.1 Safetyissuesdirectlycontributingtotheaccidentwhichhaveresultedinrecommendations 56

3.2 Othersafetyissuesidentifiedduringtheinvestigationalsoleadingtorecommendations 56

SECTION 4 - ACTION TAKEN 58

SECTION 5 - RECOMMENDATIONS 59

FIGURES

Figure 1 - Propulsionsystemandharmonicfilter

Figure 2 - Highvoltageelectricalnetwork

Figure 3 - PositionofQM2atthetimeoftheaccident

Figure 4 - Locationofharmonicfilter

Figure 5 - Hi-fogglassbulbintheaftmainswitchboardroom

Figure 6 - Waterintheaftharmonicfilterandmainswitchboardrooms

Figure 7 - Failedcapacitor

Figure 8 - Topviewofbulgedcapacitor

Figure 9 - Evidenceofarcingontheharmonicfilterbusbars

Figure 10 - Powerconvertersforpropulsionmotors

Figure 11a - Generators’poweroutput

Figure 11b - Variationofvoltageatpropulsionmotorno.1,halfdriveno.1,immediatelyaftercapacitorexplosion

Figure 12a - Simulationofexpectedtotalharmonicdistortionofvoltagewithoneharmonicfilterinuse

Figure 12b - Simulationofexpectedtotalharmonicdistortionofvoltagewithoutharmonicfilters

Figure 13 - Simulationofexpectedtotalharmonicdistortionofvoltagewiththreedieselgeneratorsandat70%propulsionpoweroutput

Figure 14 - Rank11.3ofharmonicfilters

Figure 15 - Failuremodesanalysissectioninmanufacturer’smaintenancemanualforharmonicfilters

Figure 16a - Capacitorusedinharmonicfilters

Figure 16b - Internalelements

Figure 16c - Blockdiagram

Figure 16d - Singlecapacitorelement

Figure 17 - Creaseoncapacitorelement

Figure 18 - Holesincapacitorelementfrombulgedcapacitor

Figure 19 - ExtractfromConverteam’sdrydockattendancereporttoCarnivalUKin2008

Figure 20 - Currenttransformerfortheimbalancedetectionsystem

Figure 21 - Currentimbalanceindicatorsintheaftharmonicfilterroom

Figure 22 - Currentimbalancetransformerfortheimbalancedetectionsystemwithitscasingcutopen(inset:secondarycoil)

Figure 23 - Enginecontrolroomdisplayofharmonicfilteroperatingparameters

Figure 24 - ItemisedlistingofareasfittedwithHi-fogoutlets

ANNEXES

Annex A - Alarmlist(IASandP1200)

Annex B - SafetydatasheetfordielectricoilJarylecC101

Annex C - Capacitorexaminationreport,byVishay

Annex D - DNVcircularletter,dated20December2007,regardingpolypropylenefilmvapour

Annex E - Currenttransformerfailureanalysisreport,byVishay

Annex F - MountingandmaintenanceinstructionsbyVishay

Annex G - Arc-flashanalysis,byUKMinistryofDefence

Annex H - Electricalhazardsof‘Hi-fog’,byOmegaPointLaboratoriesLtd,forMarioffCorporationOy

Annex I - Arc-flashincidentcasehistories,byIEEE

Annex J - MAIBSafetyBulletin4/2010

Annex K - MAIBFlyertotheShippingIndustry

GLOSSARY OF ABBREVIATIONS AND ACRONYMS

µF microfarad

ABB AseaBrownBoveri

AC alternatingcurrent

C celsius

cm centimetre

COSWP CodeofSafeWorkingPracticesforMerchantSeamen

CSM Continuoussurveyofmachinery

DC directcurrent

DG Dieselenginedrivengenerator

DNV DetNorskeVeritas

ECR Enginecontrolroom

EMI Electromagneticinterference

FSS InternationalCodeforFireSafetySystems

FWBLAFF Fixedwater-basedlocalapplicationfire-fightingsystem

GTG Gasturbinedrivengenerator

GUI GraphicalUserInterface

HF Harmonicfilter

HV highvoltage

Hz hertz

IACS InternationalAssociationofClassificationSocieties

IAS Integratedautomationsystem

IEC Internationalelectrotechnicalcommittee

IEEE TheInstitutionofElectricalandElectronicEngineers

IMO InternationalMaritimeOrganization

IO Input-output

IP Ingressprotection

ISM InternationalSafetyManagementcode

ISO InternationalOrganizationforStandardization

K kelvin

kA kiloamperes

kg kilogramme

kV kilovolts

LR Lloyd’sRegister(Europe,MiddleEastandAsia)

mA milliampere

MCA MaritimeandCoastguardAgency

mg/g milligram/gram

mH millihenry

ml millilitre

MOD MinistryofDefence

mS millisecond

MSB Mainswitchboard

MV megavolts

MVA megavoltsamperes

MW megawatts

NK NipponKijiKyokai

PLC Privatelimitedcompany

PMS Powermanagementsystem

QM2 RoyalMailShipQueenMary2

RMS rootmeansquare

RPM revolutionsperminute

SMS Safetymanagementsystem

SOLAS InternationalConventionfortheSafetyofLifeatSea,1974

THD Totalharmonicdistortion

THDv Totalharmonicdistortionofvoltage

UPS Uninterruptiblepowersupply

UTC UniversalCo-ordinatedTime

V volts

Times: Alltimesusedinthisreportarelocal(UTC+2)unlessotherwisestated

LIST OF DEFINITIONS

A-60division AnA-Classdivisionisasuitablystiffenedsteel(orequivalentmaterial)bulkheadordeckthatiscapableofpreventingthepassageofsmokeandflametotheendofa1hourstandardfiretest.Whenitisinsulatedsuchthattheaveragetemperatureoftheunexposedsidewillnotincreasemorethan140ºCabovetheoriginaltemperature,andthatthetemperatureatanyonepointwillnotincreasemorethan180ºCabovetheoriginaltemperaturewithin60minutes,thedivisionisclassifiedasA-60.

Arcing Uncontrolledconductionofelectricalcurrentfromphasetoground,phasetoneutral,and/orphasetophaseaccompaniedbytheionizationofthesurroundingair.

Busbars Anelectricalconductor,maintainedataspecificvoltageandcapableofcarryingahighcurrent,usuallymadeofcopperoraluminiumandusedtodistributecurrenttomultipledevices.

Capacitor AnACdevicethatstoresenergyintheformofanelectricfield.

Deltaandstarconnections Whenathreephasevoltagesupplyisconnectedsuchthatitterminatesinasinglepoint,itiscalledastarconnection.

Whenathreephasevoltagesupplyisconnectedinatrianglesuchthateachphaseformsonesideofthetriangle,itiscalledadeltaconnection.

Dielectricmedium Amediumthatisapoorconductorofelectricityusedbetweentheconductingelementsofacapacitor,havingthepropertyofretainingelectrostaticchargeandtherebyincreasingthecapacitanceofthecapacitor.

VR

VB

Vy

VR

VB

Vy

Electricaldegrees Theunitusedtorepresentthephasedifference(indegreesortime)betweentwoelectricalwaveformsofthesamefrequency.

Impedance AmeasureofoppositiontotheflowofcurrentinanACcircuit.Itisthecomplexsumofresistance,capacitivereactanceandinductivereactance.

Inductor Aninductor(also,reactor)isapassiveelectricalcomponentthatcanstoreenergyinamagneticfieldcreatedbytheelectriccurrentpassingthroughit.

Inversetimecharacteristic Thebehaviourofarelayorotherelectronicswitchingdevicewhichrespondswithinaperiodoftimeinverselyproportionaltothemagnitudeofthemeasuredsignal.

Non-sinusoidalornon-linearcurrent Acurrentorvoltagewaveformwhichdoesnotcorrespondexactlytothesinewaveshapeofthesupplyvoltage.

Partialdischarge Alocalisedbreakdownofdielectricinsulationinahighvoltageenvironment,affectingonlyasmallareaandwhichdoesnotextendtothefulldistanceofthetwoconductors.

Powerconverter Anelectricalorelectro-mechanicaldevicewhichconvertselectricpowerfromoneformtoanother.

Pulse AtermusedintheACtoDCrectificationcircuitindicatingthenumberofDCoutputsproducedfromonecompleteACcycle.

Reactance Theresistancetocurrentflowinacapacitivecircuitiscalledcapacitivereactancewhiletheresistancetocurrentflowinaninductivecircuitiscalledinductivereactance.

Reactivepower Thecomponentofelectricalpowerflowwhichdoesnotperformusefulworkbutwhichisneverthelessrequiredtodrivetherealpowerthroughcapacitiveandinductivecircuitsisknownasreactivepower.

Reactor Seeinductor.

Resonance Thepropensityofasystemtooscillatewithincreasingamplitude,limitedonlybythesystem’sdampingcharacteristics.Resonanceoccursonlyatcertainfrequenciesandisoftentriggeredbysubtleandminorchangesinthesystem.

Sub-transientreactance Thereactancevalueinmotorsandgeneratorsduringthefirstcycleofafaultcurrentusedtocalculatethemaximumfaultcurrentthemachinecantolerate.Inabout0.1secondthesub-transientreactanceincreasestotransientreactance,andafter0.5to2secondsitreachesthesteadystatereactanceofthemachine.

Synchronousmotors AnACmotorwhosespeedvariesindirectproportiontothefrequencyofthesuppliedvoltage.

Thyristor Asemiconductordeviceusedtoswitchlargeamountsofelectricpowerwithasmalltriggeringcurrentorvoltage.

Transformer Adevicewithtwoormoreelectricalwindingscoupledbyamutuallymagneticfield.

1

SYNOPSIS

At0425on23September2010,asRMSQueenMary2(QM2)wasapproachingBarcelona,anexplosionoccurredinthevessel’saftmainswitchboardroom.Withinafewseconds,allfourpropulsionmotorsshutdown,andthevesselblackedoutshortlyafterwards.Fortunately,thevesselwasclearofnavigationalhazardsanddriftedinopensea.

Theemergencygeneratorstartedautomaticallyandprovidedessentialsuppliestothevessel,anditwasquicklyestablishedthattheexplosionhadtakenplaceintheaftharmonicfilter(HF)room,situatedwithintheaftmainswitchboard.Theaftmainswitchboardwasisolated,maingeneratorswererestartedandtheshipwasabletoresumepassageat0523,subsequentlyberthinginBarcelonaatabout0900.Noonewasinjured.

TheaccidentcausedextensivedamagetotheaftHFandsurroundingstructure.Twowater-mistfiresuppressionsprayheadswereactivated,oneintheaftharmonicfilterroomandtheotherintheaftmainswitchboardroom.

TheexplosionwastriggeredbydeteriorationinthecapacitorsintheaftHF.Internalarcingbetweenthecapacitorplatesdeveloped,whichvaporisedthedielectricmediumcausingtheinternalpressuretoincrease,untilitcausedthecapacitorcasingtorupture.Dielectricfluidvapoursprayedout,ignitingandcreatingthelikelyconditionsforanarc-flashtooccurbetweenthe11000voltbusbarsthatfedpowertotheaftHF.

Acurrentimbalancedetectionsystem,whichwastheonlymeanstowarnagainstcapacitordeterioration,wasfoundtobeinoperable,anditwasevidentthatithadnotworkedforseveralyears.

TheelectricaldisturbancefromthecapacitorfailurecauseditscircuitbreakertoopenandisolatetheaftHFfromtheelectricalnetwork.Itwasnotpossibletodeterminetheexactcauseofthesubsequentblackoutbecausetheoptionforstoringhistoricaldataconcerningblackoutswasnotchosenatbuild.However,itisconsideredmostlikelythatthedisruptionwithintheaftHFatthetimeoftheaccidentcausedgeneralinstabilityintheelectricalnetworkwhichcouldnotbecontainedandledtothegeneratorsshuttingdown.

Lloyd’sRegister(Europe,MiddleEastandAsia)(LR)hasbeenrecommendedtotakeforwardproposalstotheInternationalAssociationofClassificationSocietiesto:

• Establisharequirementforallnewvesselsfittedwithharmonicmitigationequipmenttomodeltheeffectofitslossandprovidedatatocrewsothatappropriatecorrectiveactioncanbetakeninsuchcircumstances.

• Requireon-lineorperiodicmonitoringofharmonicdistortionofvoltageonallvesselswithhighvoltagepowersystemstogiveearlywarningagainstpotentialproblems.

• Developrequirementstodetectandmitigateagainstthefailureofhigh-energystoragedevicesandtoensurethatprotectiondevicesofcriticalitemsarefailsafe.

LRhasalsobeenrecommendedtoreviewitsrulesontheuseofwater-basedfire-fightingsystemsinareascontaininghighvoltageequipmentandtoworkwiththeInternationalAssociationofClassificationSocietiestoproposeappropriateguidelinestotheInternational

2

MaritimeOrganizationforinclusionintheInternationalCodeforFireSafetySystems.TheMaritimeandCoastguardAgencyhasbeenrecommendedtoproducespecificguidanceregardingtheharmfuleffectsofexcessiveharmonicdistortioninelectricalnetworksandtoupdatetheCodeofSafeWorkingPracticesforMerchantSeamentoraiseawarenessaboutthehazardsofarc-flashinhighvoltageequipment.

QM2’smanager,CarnivalUKhavealsobeenrecommendedto:improvethestandardsofprotectionagainsttheeffectofharmonicdistortionandcomponentfailure;and,toreviewthemachineryalarmsystemsfittedtoQM2 inordertoidentifyandprioritisethosealarmswhichindicatefailureconditionsthatcouldsignificantlyaffectthesafetyofthevessel.

PhotographcourtesyofJörnPrestien

Queen Mary 2

3

SECTION 1 - FACTUAL INFORMATION

1.1 PARTICULARS OF RMS QUEEN MARY 2 AND ACCIDENT

SHIP PARTICULARS

Flag UnitedKingdom

Classificationsociety Lloyd’sRegister

IMOnumber 9241061

Type Passengercruiseliner

Registeredowner CarnivalPLC

Manager(s) CarnivalPLC

Construction Steel

Lengthoverall 344.3m

Grosstonnage 148528

Propulsion(power) Dieselelectric(4x21.5MW)

VOYAGE PARTICULARS

Portofdeparture Southampton

Portofarrival Barcelona

Typeofvoyage Internationalvoyage

MARINE CASUALTY INFORMATIONDateandtime 23September2010at0425

Typeofmarinecasualtyorincident

LessSeriousMarineCasualty

Locationofincident 40º44.36N,001º49.42E,36nmSWofBarcelona

Placeonboard Aftharmonicfilterroom

Injuries/fatalities None

Damage/environmentalimpact

Twocapacitorsdamaged,busbarsandinsulatorsonseveralothersdamaged,bulkheadstiffenersbuckled,enclosurepaneldoorsblownout,steeldoorsdamaged.

Shipoperation Onpassage

Voyagesegment Mid-water

Personsonboard 3823attimeofaccident

4

1.2 BACKGROUND

QM2waspropelledbyfourvariablespeedelectricmotorsknownas‘poddeddrives’.Thevariationofspeedwasachievedbychangingtheelectricalfrequencyinthepowersupplytothemotors.Anunwantedeffectofvaryingthefrequencywasdistortionofthesupplyvoltagewaveform.Thedegreeofdistortionwasquantifiedastotalharmonicdistortionandhadtobemaintainedwithinlimitsdefinedbythevessel’sclassificationsociety.OnQM2,thiswasachievedbyusingharmonicfilters(HF);HFunits,consistingofatunedloadofcapacitorsandinductors,wereconnectedtotheforwardandaftmainswitchboards(MSB).EachHFconsistedoftwosections,knownasrank11.3andrank4(Figure1).

TheMSBswereconnectedtoeachotherthroughcircuitbreakers(Figure 2).EachHFwaslocatedinsideaseparateroomwithintheMSBcompartment.BothMSBandHFcompartmentswereprotectedbyawater-mistbasedlocalapplicationfire-fightingsystemknownbyitstradenameasHi-Fog.

1.3 NARRATIVE

At0415on23September2010,thewatchkeepingofficeronthebridgeofQM2gave2hours’noticetotheengineroomwatchkeeperinpreparationforarrivingatBarcelona(Figure 3).ThevesselhaddepartedfromSouthamptonon19Septemberandwasonacourseof026ºataspeedof18.6knotswithallfourpoddeddrivesrunning.Therewerefourengineersintheenginecontrolroom(ECR)includingtwofromtheprevious,offgoingwatch.Justafter0425theyheardaloudbang,whichwasfollowedbycompletefailureoftheengineroomlightingexceptthetransitionallighting.Almostimmediately,themainpropulsionmotors’outputpowerdroppeddowntounder5MWandthemotorsstoppedapproximately16secondslaterwhenallthegeneratorsshutdown.

Theemergencygeneratorstartedautomaticallyandrestoredlightingandotheressentialsupplies.ThethirdengineerfromtheoffgoingwatchrantoinvestigateandsoondiscoveredthickblacksmokecomingfromtheaftMSBroom.AlertingtheotherengineersintheECRwithhisportableultrahighfrequencyradio,heclosedthewatertightdoorbetweentheengineroomandthespacewhichledtotheaftmainswitchboardroom.Healsopreparedafirehoseandlaiditattheentrancetothewatertightdoor.SeveralsmokeandheatdetectionsensorsfromtheaftHFandtheaftMSBroomswereactivated.

Ataround0430,thebridgeteammobilisedtheassessmentparty,whichcomprisedsixseniorrepresentativesfromthedeck,engineandhoteldepartments.Thedeckandenginefireparties,togetherwiththeboundarycoolingparty(atotalof26personnel)stoodby,alongwithallthehotelmanagerswhowerespecificallytaskedtodealwithpassengerqueries.Nopassengerorgeneralcrewannouncementwasmade.The‘notundercommand’lightswereswitchedonandtheSpanishcoastguardwasinformed.

5

Figure2

Power converter

Power converter

Tf11kv 2 x 1.5kv

HF Aft

GTG1 GTG2 DG1 DG2 DG3 DG4

HF Fwd

Pod 1 Pod 3 Pod 2 Pod 4

Power converter

Power converter

Bus tie interconnecting

breaker

Tf11kv 2 x 1.5kv

Tf11kv 2 x 1.5kv

Tf11kv 2 x 1.5kv

Highvoltageelectricalnetwork

Figure1

Propulsionsystemandharmonicfilter

6

By0439,thesecondelectro-technicalofficerandathirdengineer,bothwearingbreathingapparatusandcarryingcarbondioxideportablefireextinguishersandathermalimagingcamera,werereadytocarryoutaninspectionofthescene.TheyenteredtheaftMSBroomandmadetheirwayintotheHFroom,stoppingjustafterenteringthedoorway(Figure 4).Theyconfirmedthatthespacewasfilledwiththickblacksmoke;buttherewasnofireand,usingtheirthermalimagingcameras,theydidnotdetectanyhotspots.TwoHi-Fogglassbulbs(Figure 5),oneintheaftHFroomandanotherintheaftMSBroomhadrupturedandtherewasapproximately10mmofwateronthedecksofbothcompartments(Figure 6).

ThecrewattemptedtoshutofftheHi-Fogwatersupplyusingthemanualshut-offcocklocatedoutsidetheaftMSBroom;buttheywereunsuccessfulasthehandleshearedwhentheytriedtoforceit.TheHi-Fogsystemwasthenswitchedoffatthecentralcontrolstation,andat0452extractionfanswerestartedtoclearthesmoke.

By0455threedieselgeneratorshadbeenstartedandconnectedtotheforwardMSB;theaftMSBwaskeptisolatedbydisconnectingthebustiebreakersbetweenthetwoswitchboards(Figure 2).By0523QM2wasunderwayusingpods2and4,andthevesselberthedatBarcelonajustbefore0900.RepresentativesofConverteam,themanufactureroftheHFandpropulsiondrive,andLloyd’sRegister(Europe,MiddleEastandAsia)(LR)theclassificationsocietyforthevessel,carriedoutadetailedassessmentoncethevesselwasalongside.Theyconcludedthat,afterphysicallyremovingthecircuitbreakerbetweentheMSBandtheHF,itwassafetoputtheaftMSBbackon-line.LRimposedaconditionofclassonthevessel,toremainuntiltheaftHFissuewasrepaired.Ataroundmidnight,thevesselsailedfromBarcelona.

Figure3

PositionofQM2atthetimeoftheaccident

ReproducedfromAdmiraltyChart 1704bypermissionoftheControllerofHMSOandtheUKHydrographicOffice

Barcelona

Positionofaccident

QM

2’strack

7

Locationofharmonicfilter

Figure4

Doors

Aftharmonicfilter

Switchboardroom

8

Figure5

Hi-fogglassbulbintheaftmainswitchboardroom

Figure6

Waterintheaftharmonicfilterandmainswitchboardrooms

Crossfloodingduct

DamageddoorwithA-60insultation

9

1.4 DAMAGE

ThedamageintheaftHFroomwasextensive.MostoftheoccupantsofthesixcrewcabinslocateddirectlyabovetheaftHFroomheardthenoiseoftheblastanddescribedthesoundasa‘loudbang’.Therewasnodamageinsidetheircabins.Panelsoneithersidesoftherank11.3cubiclewerebadlydistortedandcoveredwithsoot.Panelsfortherank4cubiclewerealsobulgedout.Theflooranddeckheadwerecoveredwithsootanddielectricoilwasfoundallovertherank11.3HFsection,includingtheareaunderthecapacitorsandontheinsideofthetoppaneloftheenclosure.Onecapacitorwasfoundtohavelifteduparound60cmfromitsnormalposition.Itsbottomcoverhadbentoutwardsandblownoutatitsweldedjoint.Ithadwrencheditselffreefromitsfoundationbolts,breakingtheconnectiontothecapacitorelementsinside.Allthecapacitorsfittedinthesamerowasthefailedonehadsuffereddamageontheirterminals.Thecasingofanothercapacitorwasfoundtohavebulgedseverely(Figure 7 and Figure 8).

The‘A-60’ratedsteeldoortothecompartmentwasfoundforcedoutthroughitsframeandtheadjoiningsteeldoorfortheMSBroomwasalsobuckledandsplit.AsteeldoorattheinboardentrancetotheaftMSBroomandlocatedapproximately20mawayfromthesiteoftheexplosionwasforcedoffitshinges.Thestiffenersonthebulkheadofthecompartmentwerebuckledandthesteelcoverplateonthecross-floodingductbetweentheHFandMSBroomswasblownoutintotheMSBroom.Thepolythenecoveringonafireextinguisher,whichwaslocatedapproximately2mawayfromthefailedcapacitor,wasfoundsinged.ThecornersofallthreehighvoltagebusbarsthatfedintotheaftHFhadbeenmelted(Figure 9).

Figure7

Failedcapacitor

Capacitorterminals

Capacitorconnectionbusbars

Failedcapacitor

10

Figure8

Topviewofbulgedcapacitor

120m

m

70mm

160mm

Figure9

Evidenceofarcingontheharmonicfilterbusbars

10mm

11

1.5 VESSEL MANAGEMENT

QM2conductedseatrialsinSeptemberandagaininNovember2003.ThevesselwasformallyhandedovertoCunardLine(adivisionoftheCarnivalCorporation)inDecember2003,commencinghermaidenvoyageon12January2004.From2004to2007technicalmanagementwascarriedoutbyPrincessCruisesInternational,LosAngeles,whichwasalsoadivisionoftheCarnivalCorporation.InNovember2007technicalmanagementwastransferredtoCarnivalUKbasedinSouthampton.

Twotechnicalsuperintendentslookedafterthevessel’sday-to-daymechanicalandelectricalrequirementsrespectively.Allroutinerequestsfromthevesselforsparepartswereco-ordinatedandapprovedbytheappropriatesuperintendent.Thevessel’sAmosComputerisedMaintenanceManagementSystemkeptarunningrecordofsparepartsusageandalsohadaminimumbalancefunctiontomaintainastockofcriticalspareparts.Itdidnothavethefunctionalitytoidentifytrendsforabnormalconsumptionofspareparts.AminimumofonesparecapacitorforeachofthetwoHFrankswasrequiredtobekeptonboard.

1.6 ELECTRICAL SYSTEM

1.6.1 Power generation and distribution

QM2hadatotalpowerproductioncapacityof135MVAat11kV(60Hz)alternatingcurrent(AC).Twogasturbinedrivengenerators(GTG)suppliedtheaftMSBandfourdieselenginedrivengenerators(DGs)suppliedtheforwardMSB.AtthetimeoftheaccidentthreeDGsweresharingthepowerrequirement.OneGTGwasoutoforder.

Innormaloperation,theMSBswerealwaysconnectedtoeachotherthroughthetwobustiecircuitbreakers.Theauxiliarymachinerywassuppliedat690V,withtheexceptionoftheairconditioningcompressorsandbowthrusters,whichwereratedat11kV.Themainpropulsionmotorswereofsynchronoustype,suppliedthroughstepdowntransformersandpowerconverters.Eachmotorconsistedoftwoindependentsetsofwindings(halfmotors)operatingwithinafrequencyrangeof0to15.8Hz(0–137RPM)andvoltagerangeof0to2830V,whichvariedinlinearproportiontothefrequency.

1.6.2 Propulsion transformers and power converters

Thepropulsiontransformerssteppeddownthevoltagefrom11kVto1510V.Eachhadadeltaconnectedprimarywindingandtwosecondarywindings:onestarwoundandtheotherdeltawound.Thedeltaandstarconnectionsgeneratedaphasedifferencebetweentheirvoltageoutputsof30electricaldegrees.

Therewereeightpowerconverters,oneforeachhalfmotor,withoneconnectedtotheoutputofeachsecondarycoilofthetransformer.Theconverterconsistedofanetworkbridge,whichrectifiedthe1510VACtoadirectcurrent(DC);aDClink,whichincludedaninductorcoilof5.5mHdesignedtodampsurgesandeliminatecurrenttransients;andamotorbridgewhichinvertedtheDCsupplyintoanACwaveformofvariablefrequencyandvoltage.Boththenetworkandmotorbridgeswerethyristorcontrolledandsuppliedthesynchronousmotorsatafrequencytoprovidetherequiredpropellerspeed.Theelectricalphaseshiftingachievedbythedelta-startransformersecondarywindingoutput,combinedwiththefullwave

12

rectificationprocessresultedin4pulsesperphaseand12pulsesforthe3phasesupplytothemotor.Thepowerconverterwasthereforecalleda12pulseconverter(Figure 10)andwasselectedbecauseofitslowerlevelofharmonicdistortioncomparedwithothertypesofconverters.

A‘Buchholz’gasactuatedpressuredetectionrelay,withaninversetimecharacteristic,monitoredchangesinthevapourpressureinsidethetransformeroiltank.Itwassettoraiseanalarmanddisconnectthetransformerelectricallyifafaultoccurredthatcausedtheoilvapourpressuretorise.Theoilinthepropulsiontransformerswastestedregularlyforthepresenceofdissolvedgasestodetectarcingorpartialdischargeandprovideanindicationoftheconditionofthetransformer.

1.6.3 Main circuit breakers and protection devices

AllthecircuitbreakersandtheirprotectionrelaysweresuppliedbyAseaBrownBoveri(ABB)Sace.EachHFhaditsowncircuitbreakeroftypeHD4/Cwhichhadavoltageratingof12kVandacurrentratingof1600Awithabreakingcapacityof

Figure10

Powerconvertersforpropulsionmotors

13

50kA.Inadditiontoovercurrentandshortcircuitprotection,thebreakerhadanundervoltageprotectiontrip.ThecircuitbreakercouldalsobetrippedbyoverloadcurrentsensorsintheHFitself.TheseweresuppliedandfittedtotheABBbreakersbyConverteam.DeteriorationofthecapacitorsintheHFwasmonitoredbymeasuringthecurrentimbalancebetweenthecapacitorsineachofthethreephases.Discussedinmoredetaillaterinthereport,detectionofanunbalancedcurrentbetweenthecapacitorswasalsodesignedtotriptherelevantHFcircuitbreaker.

Thereweretwobustieinterconnectingbreakers,oneoneachMSBandratedat12kV,3600Awithabreakingcapacityof50kA.Thetiebreakershadshortcircuit,overcurrent,andovervoltageprotectiontrips,butdidnothaveanundervoltagetripfunction.Immediatelyaftertheaccident,thebustiebreakerintheforwardMSBwasfoundtripped.Thesecondbustiebreakerwasfoundintheclosedposition.

AlltheDGsupplybreakerswereratedat11kVand1000A.Thegeneratorswereprotectedbytworelaysknownas‘SynpholD’and‘Ref542’withtheovercurrenttripfunctionbeingduplicatedinbothrelays.Inaddition,therewereseveralinstanttripfunctionstoprotectgeneratorsagainstinternalfaults.

Incaseofseriousfaultsintheconnectedloads,theprotectionrelayswereconfiguredtotripthebustieinterconnectorclosesttothegenerators.Ifthefaultdidnotclearbytrippingthebustie,thegeneratorbreakersthemselveswouldtrip.Theprotectionsystemalsomonitoredovercurrent,negativesequence(phaseimbalance),under/overfrequencyandovervoltageparameters.Imbalanceornegativesequencingwasdetectedwhenanyconnectedloadwasopencircuitedinonephasecausinganasymmetricphasefault(knownassinglephasing).Thealarmindicatingnegativesequencingwasprovidedbytherelay‘SynpholD’.

Theprotectionrelayswerecapableofstoringarecordofwhyeachtriphadoccurred.However,theoptionforstoringhistoricaldataconcerningblackoutswasnotchosenatbuildandtheinformationwhichcouldhaveidentifiedwhythegeneratorsshutdownwasnotrecorded.

1.6.4 Selectivity study

Aselectivitystudy,alsoknownasadiscriminationstudy,wascarriedoutduringthedesignphaseforQM2aspartofLR’srequirementsforplanapproval.Itspurposewastodemonstratethattheprotectiverelaysforcircuitbreakersthroughoutthenetworkhadbeensetsuchthatifafaultoccurredinonepartofthenetwork,thecircuitbreakerclosesttothefaultwouldopenfirsttoisolatethefaultandprotecttherestofthenetwork.TheselectivitystudyforQM2wasapprovedbyLRinApril2003.Theprotectionsettingsofallthe11kVcircuitbreakersweretestedbythesecondarycurrentinjectionmethodduringadrydockingperiodinOctober2008.

Immediatelyaftertheaccident,theMAIBrequestedthatCarnivalUKcheckthesettingsontheprotectiverelaysoftheHF,interconnectingbustieandgeneratorbreakerswiththeassistanceofthesystemmanufacturers,ABB.AlthoughABBwastaskedtocarryoutthisjob,ithadnotbeencarriedoutbythetimethisreportwasbeingfinalised.

14

1.7 AUTOMATION AND POWER MANAGEMENT

1.7.1 Integrated automation system

TheIntegratedAutomationSystem(IAS)wasprovidedbyValmarineAS,NorwayandwasbasedonitsDamaticXDsystem.Alocalareanetworkofcomputerspermittedtheship’screwtomonitorthemajorityofship’smachineryfromstationslocatedaroundtheshipandtocontrolthemfromcertainlocations,suchastheECRandwheelhouseworkstations.Italsoprovidedthemachineryalarmsystemforthevesselthroughfouralarmstations.

Thefiredetectionandalarmsystemwasindependent;howeveritprovidedaninputtotheIASindicatingthedeckonwhichafiredetectionsensorhadbeenactivated.Twofirealarms,onefromtheaccommodationandtheotherfromtheengineroom,appearedontheIASapproximately30minutesbeforetheaccident.Therewerenocorrespondingalarmsonthefiredetectionsystempanel.AttherequestoftheMAIBtheship’screwinvestigatedthesourceofthisfirealarmandestablishedittobespurious,duetoawiringdefectontheIAS.

1.7.2 Alarm sampling sequence and history

Theexecutioncyclesforthealarmhandlingstationswereat400msintervalsforeverythingrelatedto11kVsystemsandforthosewhichwerepartofthepowermanagementsystem(PMS).Lesscriticalalarmsweremonitoredat1100msintervalsandallotherbinaryalarms,notrelatedtothePMS,weresampledat900msintervals.Thealarminput-output(IO)cardatthealarmprocessingstationwouldcyclethroughthealarmchannelsandholdeachalarminabuffer,allocatingthemallwiththesametimestamp.Thereforethetimestampindicatedonthealarmprintoutwasnotalwaystheexacttimethatthealarmwastriggered.

Inthe10minutesduringandimmediatelyaftertheexplosiontherewerenearly500alarmsregisteredontheIAS.Inthemidnightto0400hourswatchon23September,atotalof468lineswereprintedontheECRalarmprinter,ofwhich235werecriticalornon-criticalalarms.Theremainderwererecordsofthealarmsbeingacknowledged.

ItwasnotpossibletoestablishwhethertheaftHFcircuitbreakertrippedduetoanoverloadineitherrank,orduetoanimbalanceinitsrank4sectionastheAISdidnotdifferentiatebetweenthetwotypesofalarmsandrecordeditasan‘overload/unbalance’.Itisknown,however,thatwithin300msto500msofthealarm,thecircuitbreakeropened.Almostsimultaneouslyorjustbeforethecircuitbreakeropened,therewereseveral‘IO-FAULT’alarms(indicationoflossofreactivepower)atbothhighvoltageswitchboardsandgenerators.Therewerealsoseveral‘DISCREPANCY’alarms(indicationthattheswitchboardhaddetectedalossofonephase)atseveralbusbarsinthe690Vcircuit.NoundervoltagealarmsineitherthehighorlowvoltagecircuitswereregisteredbytheIAS.

1.7.3 Propulsion system alarm log

Thepropulsionsystemhaditsownmonitoringsystem,providedbyConverteam,calledP1200,whichcommunicatedimportantalarmstotheIAS.Atapproximately0348thealarm‘halfdrivealarmlamp’forpropulsionmotorno.3,halfdriveno.2cameupontheP1200system.Thesamealarmreappearedataround0356,

15

0405and0406.Thisalarmindicatedthatafaultwasdetectedinthisparticularhalfdriveandwasintendedtobeaprecursortothemorespecificalarmswhichwouldfollow.WhileallthealarmsontheP1200systemwereavailabletoengineroomwatchkeepers,theIASwasconsideredtobetheprimaryalarmsystem.

ImmediatelyaftertheHFcircuitbreakertrippedataround0425,alarmsactivatedindicatingproblemswithallofthepropulsionmotorconvertersandexcitationsystems.ThepropulsionsystemP1200alarmlogindicatedthatallthefourpropulsionmotorsregisteredundervoltagealarmsimmediatelyaftertheHFbreakertripped.However,thesewereveryshorttermandtheactualvoltagelevelswerenotrecordedbytheP1200systemortransferredtotheIAS.Themotorsthemselvescontinuedtorununderreducedpowerforapproximately16secondsaftertheundervoltagealarmsuntilthegeneratorsthemselvesshutdown(Figures 11aand11b).AnannotatedrecordofalarmsfromtheIASandfromtheP1200systemforpropulsionisavailableatAnnex A.

1.7.4 Power management system

Thepowermanagementsystem(PMS)wasafunctionoftheIAS.Itcontrolledthestart,stop,autosynchronisationandloadsharingfunctionsofthegenerators.However,itwasnotdesignedtohaveanyinputfromtheprotectionrelaysofgeneratormaincircuitbreakers,anddidnotreducepropulsionpowerorreactinanywaytothefailureofharmonicfilters.

1.8 HARMONICS

1.8.1 Harmonic distortion

WhenanACelectricalloaddrawsnon-sinusoidalornon-linearcurrents,ittendstodistortthewaveformofthesupplyvoltage.Theswitchingactionofthyristorsinthepowerconvertersresultsinnon-sinusoidalcurrentsbeingdrawnfromthegenerators.Whilethesupplyoriginallydeliversa‘clean’sinusoidalvoltageatthefundamentalfrequencyof60Hzthepowerconverters,indrawingadistortedcurrent,causethesupplyvoltagefromthegeneratorstodistort.Thisgeneratesvoltagesattheharmonicsofthefundamentalfrequency,whichinturnaffectalltheconnectedloadsregardlessofwhethertheyarelinearornon-linear.Inmarineandoffshoreinstallations,electricvariablespeeddrivesarethemainsourceofharmonicdistortiontocurrentandvoltagewaveforms.

1.8.2 Harmonic distortion in marine systems

Powerconvertersproduceharmonicsatfrequenciesaccordingtotherelationshipnp±1wherenisapositiveintegerandprepresentsthenumberofpulsesinthepowerconverter.Therefore,forthe12-pulseconvertersfittedonQM2thepredominantharmonicswereatthemultiples11,13,23,25,35,37andsoonofthefundamentalfrequency(60Hz).Inaland-basedgenerationsystem,thedistortionofcurrentduetonon-linearloadsdoesnotresultinsignificantvoltagedistortionatsourcebecausetheseloadsareaminorfractionofthetotalpowergenerationcapacity.Consequently,theeffectsremainlocaltothenon-linearload.Onanelectricallypropelledvessel,suchasQM2,thepropulsionmotorsconsumemorethan70%ofthetotalgeneratedpowerandtheresultingvoltagedistortionismoresignificant.Theimpedanceofamarinegeneratorisalsonormallyquitehighcomparedtothatoftheutility’stransformer.Thisresultsinalargervoltagedistortionatthesource

16

0

5

10

15

20

25

30

35

4023.09.2010

04:24:48

23.09.2010

04:25:06

23.09.2010

04:25:10

23.09.2010

04:25:24

23.09.2010

04:25:26

23.09.2010

04:25:30

23.09.2010

04:25:33

23.09.2010

04:25:35

23.09.2010

04:25:37

23.09.2010

04:25:42

23.09.2010

04:25:44

1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610

Generators’poweroutput

Figure11a

0

200

400

600

800

1000

1200

1400

1600

1800

23.09.2010

04:24:49

23.09.2010

04:24:57

23.09.2010

04:24:58

23.09.2010

04:24:59

23.09.2010

04:25:12

23.09.2010

04:25:13

23.09.2010

04:25:14

23.09.2010

04:25:16

23.09.2010

04:25:17

23.09.2010

04:25:18

23.09.2010

04:25:19

23.09.2010

04:25:23

23.09.2010

04:25:27

23.09.2010

04:25:31

23.09.2010

04:25:34

23.09.2010

04:25:37

23.09.2010

04:25:40

23.09.2010

04:25:43

23.09.2010

04:25:46

126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144

Variationofvoltageatpropulsionmotorno.1halfdrivemotorno.1immediatelyaftercapacitorexplosion

Figure11b

90voltsrise

23.09.2010

04:25:27

126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144

23.09.2010

04:25:26

1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610

Volts

MW

17

whenharmoniccurrentsaredrawnbysubstantialnon-linearloadssuchasthemainpropulsionmotorpowerconverters.Asmoregeneratorsareaddedtoincreasethepowergenerated,theyalsohavetheeffectofloweringtheoverallimpedance,reducingtheamountofharmonicdistortion.

1.8.3 The harmful effects of harmonics

Excessiveharmonicdistortionofcurrentandvoltagecancauseheatinginthewindingsoftransformers,generatorsandinductionmotors,whichcouldpotentiallyresultinfire.Someoftheothermorecommonandunpredictableeffectsofexcessiveharmonicdistortionare:

• Disruptionintheoperationofuninterruptiblepowersupplies(UPS)

• Spurioustrippingorfailureofsensitiveelectronicandcomputerequipment,measurementandprotectionrelays

• Voltageresonancesleadingtotransientovervoltageandovercurrentfailuresintheelectricalnetwork

• Electromagneticinterference(EMI)resultingindisruptiontocommunicationequipment

• Malfunctionofcircuitbreakersandfuses.

1.8.4 Total harmonic distortion

Totalharmonicdistortion(THD)ofvoltageandcurrentistheratiousedtodescribethedistortionintheelectricalpowergenerationanddistributionsystem.Itiscalculatedbytheratiooftherootmeansquare(RMS)valueoftheharmoniccontenttotheRMSvalueofthefundamental.Itisnormallyexpressedasapercentage,calculatedusingtheexpression:

where

Vh=RMSamplitudeofvoltageatharmonicorderh

V1=RMSamplitudeofthefundamentalvoltage.

LR’srulesonharmonicdistortionofvoltagestate:

Unless specified otherwise, the total harmonic distortion (THD) of the voltage waveform at any a.c switchboard or section-board is not to exceed 8 per cent of the fundamental for all frequencies up to 50 times the supply frequency and no voltage at a frequency above 25 times supply frequency is to exceed 1.5 per cent of the fundamental of the supply voltage.

Allotherclassificationsocietiesplacealimitof5%onTHDofvoltage(THDv).

T H D = h=2

2

h

8

1001

18

TheInstitutionofElectricalandElectronicEngineers’(IEEE)RecommendedPracticeforElectricalInstallationsonShipboard(IEEEStandard45-2002),states:

A dedicated propulsion bus should normally have a voltage total harmonic distortion of no more than 8%. If this limit is exceeded in the dedicated propulsion bus, it should be verified by documentation or testing that malfunction or overheating of components does not occur. A non-dedicated main generation/distribution bus should not exceed a voltage total harmonic distortion of 5%, and no single voltage harmonic should exceed 3%.

IEC60034-1,2004,RotatingElectricalMachines-Part1:RatingandPerformance,requiresthattheTHDvforsynchronousmotorsabove300kWoutputshouldnotexceed5%.Itdoesnotspecifydistortionlevelsforindividualharmonics.

1.8.5 QM2 sea trials and system modelling

ConverteamcarriedoutsimulationsofQM2’selectricalsystemin2002andcalculatedtheTHDvwithoneandtwoHFsinthecircuitanddifferentnumbersofgeneratorsonload.Thesimulationpredictedtheworstcasewouldbe7.6%THDv.Seatrialswereperformedin2003toensurethatTHDvwaswithin8%inbothhighandlowvoltagesectionsoftheelectricnetworkonboard.THDvwasmeasureduptothe49thharmonicunderseveraldifferentpowerconditionsrangingfromtwotosixgeneratorson-lineandthemaximumspeedpossibleineachconfiguration.TheworstcasewasrecordedwiththecombinationofoneHFwithtwoDGs;THDvatthe11kVbusbarwasrecordedas3.4%,andatthe690Vbusbaras6.5%.Notrialsorsimulationswerecarriedoutwithouttheharmonicfiltersconnectedtothesystem.NotrialswerecarriedoutwiththreeDGsandoneHF,thecombinationbeingusedatthetimeoftheaccident.

Harmonicdistortionwasnotroutinelymeasuredinserviceasthecrewwerenotawarethattheyhadtheappropriatemeasuringequipmentonboard.Aftertheaccident,thecrewfoundtheequipmentandusedittomeasuretheTHDvonthevessel.TheirreportconcludedthatTHDvwasgenerallylessthanthatcalculatedbyConverteamduringtheseatrials,althoughtheyreportedthatthe35thand37thharmonicsexceededLR’srequirementsof1.5%forthoseharmonicsabovethe25thharmonicorder.

TheMAIBcommissionedaspecialistpowerqualitytestingandmonitoringcompany,HarmonicSolutionsCo.UK,tocarryoutTHDvmeasurementswhileQM2wasonpassageduringtheperiod8to11December2010.

Table 1 showsthecomparisonofthemeasurementsrecordedinthelatertestswiththoserecordedduringtheseatrialsin2003whenasingleharmonicfilterwasincircuitwithfourDGsandoneGTGgeneratorsupplyingtheload.

19

Condition MAIN CIRCUIT BREAKERS Comments

4 x DG

+

1 x GTG

(one HF in use)

TP1HT

11Kv

TP1F

690V

TP5F

690V

PE80

400V

PE81

400V

PEL8

208V

2003

THDv2.2% 1.8% 6.1% 2.7% 2.3% 2.2% Exact loading

unknown.

2010 THDv 5.2% 2.9% 8.44% 3.26% 3.71% 2.7%

2010 11kV measurement at

forward HF circuit breaker.

Table 1:ComparisonofthelevelsoftotalharmonicdistortionmeasuredduringseatrialsandMAIBtests.(TP1HT,TP1F,TP5F,PE80,PE81andPEL8arenamesofmaincircuitbreakerssupplyingspecificlocationsintheelectricalnetwork.)

Initsreportofthepowerqualitytests,HarmonicSolutionsstated:

In conclusion, no evidence of direct or contributory factors in the failure of the aft harmonic filter capacitor(s) due to excessive voltage distortion, voltage spikes or other mains disturbances was found during the voyage.

Amonthaftertheaccident,ConverteamcarriedoutasimulatedstudyonharmonicdistortionlevelsexpectedwithoutanyHFinuse.Byextrapolatingthegraphforthecasewithnofiltersinuse,theTHDvwaspredictedtoexceed22%at70%speed.ThisestimationwassubsequentlyconfirmedbyConverteamwhentheycalculatedtheamountofTHDvinthisconfiguration(Figures 12a, 12b and Figure 13).Initsconclusion,theConverteamstudystated:

This study highlights the necessity to use one filter or to operate at slow speed with no filter to keep the harmonic distortion level under 8%. Additional measurements on board should be done on board to check the harmonic level with the LV [low voltage] pollution. [sic]

20

Simulationofexpectedtotalharmonicdistortionofvoltagewithoneharmonicfilterinuse

Figure12a

Figure12b

Simulationofexpectedtotalharmonicdistortionofvoltagewithoutharmonicfilters

3DG,0GTG

21

1.9 HARMONIC FILTERS

1.9.1 Harmonic mitigation

Thereareseveralmethodsusedtocountertheeffectsofharmonicdistortioninmarinepowersystems,including:

• activeorpassivefilters

• increasingthenumberofpulsesinpowerconvertersbyusingmultiplephaseshiftedsecondarywindingsinpropulsionmotorsupplytransformers

• installinggeneratorswithalargesub-transientreactance.

Thepredominantharmonicsthatareexpectedtooccurintheelectricalpowerconversionsystemarecalculatedatthedesignstage.TheHFsinQM2wereofthepassivefiltertype,consistingofatunedcircuitofcapacitorsandinductorsprovidingalowimpedancepathtothepredominantharmonics,intheelectricalnetwork.Thefrequencytowhichthefilterwastunediscalledtheresonantfrequencyofthesystemandisgivenbytherelationship:

fr=1/(2π(LC))

(wherefrisresonantfrequencyinhertz;LisinductanceinhenriesandCisthecapacitanceinfarads)

0 10 20 30 40 500

5

10

15THDu = 22.0943 %

%

0 0.005 0.01 0.015-2

-1

0

1

2x 104

Figure13

Simulationofexpectedtotalharmonicdistortionofvoltagewiththreedieselgeneratorsandat70%propulsionpoweroutput

22

TheharmonicfiltersonQM2weresuppliedbyConverteam,formerlypartofAlstomPowerConversion,France.EachHFconsistedoftwosub-sectionstunedtoresonantfrequenciesequivalenttothe11.3rdand4thharmonics,andreferredtoonboardthevesselasrank11.3andrank4respectively.Therewere15capacitorsinrank4and12inrank11.3.Thecapacitorsforeachrankwereconnecteddirectlytothethree-phase11kVmainssupplywiththeirterminalsconnectedinacircuitconfigurationknownasadoublestartermination(Figure14).The11.3rankincludedagroupofinductors,withatotalinductanceof0.507mHandabankofcapacitorswithatotalcapacitanceof108.8µF.Aresistorbankwasalsoconnectedinparalleltotheinductorstolimittheamountofin-rushcurrentintocapacitorswhentheHFwasstartedup.

Figure14

Rank11.3ofharmonicfilters

23

Althoughthe4thharmonicisnonexistentina12pulseconverter,rank4wasincludedintheHFonQM2tocountertheexcitationoflowerorderresonantfrequenciesandalsotomitigateanyharmonicsfromnon-linearlowvoltageloads.TheexactdetailsofallthelowvoltageloadswerenotavailabletoConverteamwhenthefilterwasbeingdesigned,andadditionalmarginswereincludedinrank4tomitigateanyunexpectedharmonicdistortionfromthelowvoltagenetwork.Implementingfiltersattworanksalsodistributedthereactivepowerrequirementofthenetworkacrossthetworanks.Asthecapacitorsrepresentedalargereactivecomponentoftheelectricalload,theship’screwhadtoensurethattheharmonicfilterswerealwaysswitchedonafterstartingthepropulsionmotorsandswitchedoffbeforestoppingthem.

OneHFcouldbenominatedasthepriorityfilterandtheothercouldbesettoswitchinoroutautomaticallyasrequired.Theswitching-inthresholdwasbasedonthepowerdemandofthepropellermotors,andthereforewhiletherunningfilterwouldremainon-lineuntilitwasmanuallyswitchedoff,theotherfilterwouldcutinandoutdependingonthenumberofgeneratorsinuseandhencethepowerbeingdemanded.TheswitchinglogicwasdesignedtokeepbothHFsrunningifmorethanfourgeneratorswererequiredtosupplytheelectricalload.

TheaftHFwasselectedastherunningfilterwhenthevesseldepartedSouthamptonon19September.TheforwardHFremainedonstandbyandwasonlyputonloadtwice,forbriefperiods,during21September.Twodaysaftertheaccident,thetotalrunninghoursoftheforwardHFwasnotedas34419.TheaftHFhadbeenusedfor24282hours.

1.9.2 Acceptance tests

FactoryacceptancetestsfortheharmonicfilterswerecompletedinJuly2002inthepresenceofLR.Aspartofthesetests,theimbalancealarmandtripsettings,alongwiththeirrespectivetimedelays,wereverifiedbyinjectingacurrentintotherelaysconnectedtothesecondarywindingoftheimbalancecurrenttransformer.ProceduresforcarryingoutharbouracceptancetestsontheharmonicfiltersweredevelopedbytheshipbuildingsectionofCarnival;buttherewerenoinstallationandcommissioningrecordsavailable.

1.9.3 Maintenance manual and safety management system

Converteam’smanualfortheHFcontainedamaintenanceschedulewhichrequiredtheprotectiondevicestobecheckedevery12months.Itdidnotspecifyhowthechecksweretobecarriedoutandcontainedonlythefollowing:

Each 12 months

Check the protections (see main switchboards)

24

ThemanualalsocontainedatableentitledFailure modes analysis(Figure15).ThisThisanalysisdidnotincludethefailureoftheimbalancecurrentprotectionsystem.ItalsocontainedareferencetooverpressuredetectionintheHFs,afeaturewhichwasnotpresentintheHFsonQM2.

Thevessel’ssafetymanagementsystemhadnotidentifiedtheHFasacriticalpieceofequipmentunderthedefinition1providedundersection10.3oftheISMCode.

1 The Company should identify equipment and technical systems the sudden operational failure of which may result in hazardous situations.

Figure15

Failuremodesanalysissectioninmanufacturer’smaintenancemanualforharmonicfilters

25

1.10 CAPACITORS

1.10.1 Design, construction and manufacturing

ThecapacitorsweremanufacturedbyVishayElectronic(Vishay)atBlatnaintheCzechRepublic.Eachcapacitorcan2measuredapproximately93x35x18cmandconsistedof36individualelements(Figures 16a, b, c and d).Anindividualelementhadacapacitanceofapproximately12µFandagroupofninesuchelementsconnectedinparallelhadacapacitanceof108.8µF.Foursuchgroupsofninewereconnectedinseriesachievingatotalcapacitanceof27.2µFforeachcan3.Thecapacitorelementsweremadeupoftwoaluminiumfoilsseparatedbyaninsulatingpolypropylenelayer.TheentireassemblywaswrappedininsulatingpaperandimmersedindielectricoilJarylecC101,whichfilledthecan(AnnexB);theoilandthepolypropylenemadeupthedielectricmediumforthecapacitor.Thecapacitorassemblywasratedat8242V.Itwasnotfittedwithanyinternalfuses,pressuremonitoringorreliefdevices.

TheconstructionandtestingstandardsthatwereusedbyVishaywere:

• IEC60871-1ShuntcapacitorsforACpowersystemshavingaratedvoltageabove1000V–Part1:General;and,

• IEC60871-2ShuntcapacitorsforACpowersystemshavingaratedvoltageabove1000V–Part2:Endurancetesting.

Undernormaloperatingconditions,Vishayestimatedthateachcapacitorshouldhaveaworkinglifeofaround20years.

Thetemperatureratingofthecapacitorswas‘-15B’4whichmeantthattheminimumtemperatureatwhichthecapacitorcouldoperatesatisfactorilywas-15ºC;Bindicatedthatthemaximumambientoperatingtemperaturewaslimitedto45ºC,withthehighestmeanoveranyperiodof24hbeing35ºC.InDecember2010,whilethevesselwasinCaribbeanwaters,surfacetemperaturemeasurements,usingwax-filledstickers,werecarriedoutoncapacitorsinbothranksoftheforwardHF.Themaximumrecordedsurfacetemperaturewas49ºConarank4capacitorand46ºConrank11.3.Ameasurementofthetemperatureonacapacitorinrank11.3inthesamepositionastheonewhichfailedon23September,wasrecordedaslessthan44ºC,whichwastheminimumthewax-basedsensorwascapableofmeasuring.ThehightemperaturealarmforcoolingairinsidetheHFenclosurewassetat47ºCwitha‘high High’alarmsettingof50ºC.ThemaximumtemperatureoftheairintheforwardHFduringthetestperiodwasmeasuredat36ºC.

2 Can–thetermusedtodescribetheexternalcasingofacapacitor.3 Whencapacitorsareconnectedinparallel,thetotalcapacitanceofthegroupisgivenbytherelationshipC=c1+c2+…+cnwherec1…cnarecapacitancesofindividualcapacitorsandCisthecombinedcapacitance.Whenconnectedinseriestherelationshipis1/C=1/c1+1/c2+…+1/cn

4 InaccordancewithIEC60871-1clause4.1c

26

Capacitorusedinharmonicfilters

Figure16a Figure16b

Internalelements

Blockdiagram Singlecapacitorelement

Figure16c Figure16d

Exploded

Bulged

93cm

18cm

35cm

27

IEC60871-1statesthatwheninductiveelementsareincludedinserieswithcapacitorstomitigatetheeffectsofharmonics,thevoltageatthecapacitorterminalswouldexceedtheexpectedvoltageatthecapacitor.Therefore,suchcapacitorsshouldberatedtowithstandtheincreasedvoltage.Converteam’sspecificationtoVishayforthecapacitorsdidnotmentionthisfactorspecifically,butachievedasimilareffectbyrequiringtheratedvoltageofthecapacitorstobeanamountequaltothesumofthefundamentalvoltageatthecapacitorbankandalltheharmonicvoltagesuptothe30thharmonicorder.

ThecapacitormanufacturingprocesswasnotsubjecttoanyLRapprovalprocedures,andthesociety’srulesatthetimedidnothaveanyrulesregardingtheconstructionorfittingofcapacitors.TherewerenorequirementsinLR’srulesforcapacitorstobefittedwithprotectionormonitoringdevicesandConverteamdidnotincludeanyinitsspecification.However,Vishayprovidedthecurrentimbalancedetectionsystemasstandard.

Shortlyaftertheaccident,Converteam’ssupplierqualityassurancedepartmentcarriedoutanauditofVishay’sconstructionprocessagainstIEC60871-1.Nodeficienciesinthecapacitordesignandconstructionprocesswererecorded.

1.10.2 Test of failed capacitors by Vishay

AllthecapacitorsfromRank11.3thatwereinuseatthetimeoftheaccident,includingtheexplodedandbulgedones,werereturnedtoVishay’sBlatnafacility.BoththefailedandbulgedcapacitorelementswereexaminedbyVishaystaff.Intheirsubsequentreport,theyidentifiedthatthetwomostcommonreasonsforseverereductionincapacitorlife,wereexposuretofrequenttransientvoltagesandincreasedoperatingtemperatures.Vishaywasunabletoformanyconclusionsastothecauseforfailureduetotheseveredisintegrationandfusingtogetheroftheelementsintheexplodedcapacitor.Vishayconcludedfromitsexaminationofthebulgedcapacitoranditselements,thatthedefectsobservedontheelementsmusthaveoccurredoveralongerperiodoftime.Intryingtoestablishtheprobablecauseoffailure,thereportstated:

‘Another theory could be a defect on parts of the safety circuit, the failing of an element in a capacitor cannot be recognized. Due to the increased voltage on the sound groups flashover will happen in these groups after some time of operation. So this capacitor will end with a shortage.’[sic]

Thereportwentontostatethatifadefectivecapacitorwentundetectedbyafailedsafetycircuit,itwouldsufferfrominternalheatingasitdrewcurrent,resultinginthepolypropylenefilmswellingupandeventuallyrippingoffthecontactsontheelements.Thiswouldcauseanelectricarctodevelopatthebrokenconnections,whichinturnwouldcausethedielectricoiltovaporise,increasingtheinternalpressureand,ultimately,thecatastrophicfailureofthecapacitor.ThereportofVishay’sexaminationisatAnnex C.

28

1.10.3 Test of failed capacitors commissioned by MAIB

TheMAIBcommissionedERATechnologyLtdtocarryoutanindependentexaminationofthetwodamagedcapacitorsandoneintactcapacitorfromRank11.3.Itsmajorfindingswereasfollows:

• Excessive currents leave characteristic signs of overheating damage. No such signs were observed in any of the elements inspected.

• When a capacitive element fails, it almost inevitably fails short circuit.

• One of the roots of an element failure was traced to the junction of the edge of the foil and a crease in the electrode film. Such creases are natural stress raisers and should be avoided as much as is practical(Figure17).

• The fact that the unit did fail catastrophically indicates that either there was a system side problem overstressing the capacitor or that the capacitive elements could not perform to their stated rating.[sic]

Crease

Foiledge

Figure17

Creaseoncapacitorelement

29

Anelementfromthebulgedcapacitorwasinspectedandverysmallroundholes,thelargestofwhichwasapproximately0.5mmdiameter,werefoundbetweentwolayers(Figure18).Withreferencetotheseholes,thereportstated:

‘This type of damage is typically associated with transient overvoltage. However, it is not possible to say, from the physical evidence whether or not the transient over voltage was generated by disturbances [in the supply] or as a result of the prior failure of other elements in the capacitor.’

Thereportconcluded:

‘… it is probable that the incident was initiated by the failure of a single capacitor element and that the failure initiated the progressive failure of the whole unit …’

Holesburntbetweenlayers

Figure18

Holesincapacitorelementfrombulgedcapacitor

30

1.10.4 Overvoltage in the electrical network

Inthefirstyearofservice,QM2hadseveralissuesrelatedtoovervoltagesintheelectricalnetwork.Voltagefluctuationwasrecordedtentimesinoneparticularday,withthehighestvoltagelevelreaching13.4kV,nearly22%morethantheratedvoltage.On9September2010,bothanchorwindlassmotordrivesweredamagedduetoovervoltageinthesupplyfromthemainswitchboard.Thevesselalsoblackedoutduringthisevent.

IEC60871-1statesthatacapacitorwouldexperiencethemaximumovervoltagewhenitisswitchedon.Thefirstpeakofthistransientovervoltageisexpectedtobeashighas2√2timestheappliedRMSvalueofthevoltage,foramaximumdurationofhalfacycle.Thestandardalsorequiresthatthecapacitorbecapableof1000switchingoperationsinayear.

LR’srulesallowpermanentvariationofvoltageupto+6%and-10%intheelectricalnetwork.Transientvariationsofupto20%oftheratedsupplyvoltage,witharecoverytimeof1.5sarealsopermitted.

1.10.5 Dielectric oil test

Sixdaysaftertheaccident,approximately30mlofdielectricoilwascollectedfromthedeckoftheaftHFenclosure.Forcomparison,afurther190mlwascollectedfromasealedcapacitorwhenitwasopenedupforexaminationbyERATechnology.Thesampleswereanalysedbyaspecialistlaboratory,NynasNaphthenics,anditsfindingsaresummarisedasfollows:

• Thermaldegradation,orageingofJarylecC101andpaperinsulationleadstotheformationofgases.

• Localisedoverheatingcancausethegasformationtobecomecapableofcarryingacharge.Thisprocesscanaccelerateintheresultantelectricfieldcausingfurtherionization.Duetotheself-healingpropertiesoftheoil,theionisationprocessissometimeshalted,thuspreventingfurtherdamage.However,solidssuchaspolypropyleneandpaperwhichmakeuptheinsulationinthedielectricmediumdonothaveself-healingproperties.

• Moistureconcentrationinbothoilsamples(fromexposedandsealedcapacitors)wasfoundtobewellabovethetypicalvalues(40mg/g)reportedbythesupplierofdielectricfluid.Asthemoistureincreases,voltagebreakdownthresholdsarelowered.

• Furtherwatermoleculesareproducedwhenpaperdegrades,increasingtheoverallmoisturecontent.

• AlthoughtheflashpointofJarlylecC101isnormally144oC,thegasesformedduringthebreakdownoftheliquidandsolidpartsofthedielectricmediumlowertheoverallflashpoint,makingthemixtureflammableatroomtemperature.

• Acetylenewaspresentintheoilsamplefromtheexplodedcapacitor,indicatingahighprobabilityofinternalarcingthroughthedielectricmedium.

31

Thereportstated:

The generation of gases during a partial discharge, sparking or arcing, is very rapid and if the system is a closed system, the high pressures generated may compromise the containment by rupturing or even exploding. Further those gases have a high content of hydrogen and light hydrocarbon gases which themselves are flammable and explosive in the presence of oxygen or air.

1.10.6 Supply and returns history

ThefirstrecordedfailureofacapacitoronQM2wasinJanuary2006.Sincethen,Vishayhassupplied11replacementcapacitorstothevessel:2forrank4and9forrank11.3;nosparesweresuppliedatdeliveryin2003.SevencapacitorswerereturnedfromthevesseltoVishay,ofwhichonewasfoundtohaveadefectiveinternalelement,fivehadsustainedmechanicaldamageandonehadanoverheatedcontact.Atthetimeoftheaccidenttherewasonesparecapacitoronboard,whichwasforrank4.

1.10.7 Maintenance and failure history

Whilethevesselwasinservice,capacitorreplacementwasgenerallytriggeredbyanimbalancealarmorastheresultofavisualinspectionidentifyingthatthecasinghadbulgedordielectricfluidwasleaking.Theusualpracticeuponreceivinganimbalancealarmwasforthedutyengineertoalertthechiefelectricalofficer,whowouldthenvisittheappropriateHFcompartmentandcarryoutavisualexaminationandcheckforanysmellofdielectricoil.Ifthecausecouldnotbeestablishedbyvisualexamination,thecrewwouldisolatetheHFconcernedandidentifythecapacitorthathadcausedthealarmbydisconnectingthecapacitorsineachphaseandmeasuringthetotalcapacitance.Oncethedefectivephasehadbeenidentified,eachcapacitorinthatphasewouldbedisconnectedandmeasuredindividuallyuntilthefailedunitwasfound.Itwasdifficulttogainaccesstoeachcapacitorandthecrewwouldoftenhavetoshiftallthecapacitorsalongthefoundationrailsandinsertthereplacementoneattheend.Theserialnumbersofdamagedcapacitorswerenotrecorded.

AtotaloffivecapacitorswerereplacedintheforwardHF.Ofthese,itwasrecordedthatthreewerefromrank11.3;butitwasnotknownwhichranktheothertwocapacitorscamefrom.Whenthefailuresfirstbegantooccurinearly2006,crewhadtotakecapacitorsfromtheaftHFtouseintheforwardHFastheonlyspareoneonboardwasdamagedduringfitting.ThevesselthenoperatedwithouttheaftHFforseveralweeksuntilthesparecapacitorsweredelivered.

SixcapacitorswerereplacedintheaftHF,withthefirstonefailinginrank4duringJuly2006.Theremainingfivewereallfromrank11.3.Themaintenancemanagementsystemdidnotrecordthereasonswhythesecapacitorswerereplaced.However,ofthefivecapacitorsreplacedinrank11.3oftheaftHF,itwaslaterfoundthatfourwerechangedafterroutinechecksconductedduringdrydockingperiods.Duringthedrydockingperiodin2006Converteam,workingwithVishay,replacedtwocapacitorsinrank11.3oftheaftHF.Onewasfoundtobeleakingandtheotherhadbentconnections.ThecapacitancevaluesofthedamagedcapacitorswerenotrecordedandtheywerenotreturnedtoVishayforfurtheranalysis.

32

ConverteamcheckedallthecapacitorsinbothharmonicfiltersinOctober2008whilethevesselwasindrydock.Twocapacitorswerefoundtobedefective,withcapacitancereadingsof36.8µFand36.9µF.Thesereadingsshouldhaveactivatedtheimbalancealarm,butthecorrespondingalarmwasnottriggered.ConverteamreporteditsfindingsaboutthefailedcapacitorstoCarnivalinadocumentwhichsummarisedallofthemanytasksthathadbeencarriedoutindrydock.Thedocument(Figure 19)alsoindicatedthattheimbalancedetectionsystemhadnotbeentested.

1.10.8 Classification society survey records

TheaftHFwaslastsurveyedinNovember2006andtheforwardHFinJuly2010underthe5-yearlycycleofcontinuoussurveyofmachinery(CSM).TheCSMsurveyconsistedofavisualexaminationoftheharmonicfilterswhilethevesselwasinport.Imbalancealarmsandtripswerenottested.

Althoughthecapacitorswereinsealedcans,thesurveylistedarequirementfora‘Converter and harmonic filter insulation fluid test’.Thecapacitorswerecreditedaspassingthistestinbothsurveys,despiteitbeingimpossibletowithdrawfluidwithoutdamagingthecasing.

1.10.9 Polypropylene vapour

In2007,theclassificationsocietyDetNorskeVeritasAS(DNV)sentacircularaimedat‘manufacturers of frequency convertors for propulsion and thrusters’(Annex D).InthiscircularDNVraisedtheissueofflammablegasesbeingreleasedfrompolypropylenefilmusedincapacitors.Thecircularstated:

Recent knowledge has shown that there is a risk that the film material may release flammable gases to the environment because of overheating or melting. In enclosed cubicles these gases may lead to a hazardous environment that can ignite and cause explosion. Resent experience shows that this may cause danger to personnel and risk for damage to equipment located in the vicinity [sic].

ExtractfromConverteam’sdrydockattendancereporttoCarnivalUKin2008

Figure19

33

1.10.10 Improvements made to capacitor design

Duringthecourseofthisinvestigation,allthecapacitorsintheaftHFonboardQM2werereplaced.AnumberofchangestothedesignofthecapacitorsweremadebyVishay,whichimprovedtherobustnessofthecapacitors.Voltageofeachelementwasreducedby20%andbyusingadifferentgradeofpolypropylenefilmtheelectricalstresswasreducedby5%.Eachcapacitorelementwasindividuallyfusedandpressuresensorswerefittedtodetectinternaloverpressurisation.

1.11 CURRENT IMBALANCE DETECTION SYSTEM

1.11.1 Construction

Thetwoneutralpointsatthedoublestarterminationofthecapacitorcircuitwereconnectedtotheprimarycoilofacurrenttransformer(Figure 20)whichhadacurrentratio10:1(50Aattheprimarywindingand5Aatthesecondarywinding)andwaspartofthemonitoringandprotectionsystem‘EstaSym 3C’suppliedbyVishayElectronicsGmbH,Germany.Therewerenorecordsavailabletoverifythetransformer’sservicehistory.

ThesecondarywindingofthetransformerwasconnectedtoacurrentimbalancedetectionrelayunitwithadisplayfittedonthepaneloftheHFenclosure.Thecurrentimbalancedetectionsystemworkedontheprinciplethatwhenallthecapacitorswereingoodorder,thetwoneutralpointsofthedoublestarterminationwouldbeatasimilarpotential.Consequently,therewouldbeverylittlecurrentflowingacrosstheprimarywindingofthetransformerandthereforeverylittleinducedsecondarycurrentwouldberecordedonthedisplay.Ifacapacitordegraded,thechangeintheoverallcapacitancewouldunbalancethesystemandcauseacurrenttoflowthroughthetransformer.Animbalancealarmwouldbetriggeredifthiscurrentexceeded400mA,andatorabove800mAthemaincircuitbreakeroftheHFwouldtrip,isolatingtheHFfromtheelectricalnetwork.Afullshortcircuitinonegroupofelementsinthecapacitorwascalculatedtodevelopanunbalancedcurrentof1300mA.Bothalarmandtriprelayshadatimedelayof300mstoreducethenumberofspuriousalarmsortripsduetotransienteffects.

Immediatelyaftertheaccident,theimbalancedetectionunitforrank4oftheaftHFindicated800mAandtheequivalentunitonrank11.3(wherethefailuretookplace)showed‘000’(Figure 21).Coolingwaterleakageandcoolingairalarmswerealsoprovidedforeachrank.Thesealarmsdidnotactivateduringtheaccident.Anoverloadalarmwasalsoprovidedbutitwasnotpossibletodeterminefromthealarmrecordsifthisactivatedduringtheaccident.

34

Figure20

Currenttransformerfortheimbalancedetectionsystem

Primary

Secondary

Figure21

Currentimbalanceindicatorsintheaftharmonicfilterroom

35

1.11.2 Test by Converteam

InJanuary2011theprotectionsystemforRank11.3wastestedbyConverteamandwitnessedbyMAIBinspectors.Currentwasinjecteddirectlyintotherelaystosimulateimbalancecurrents.Theywerefoundtobefunctioningcorrectlyandsettingswereverifiedasbeing400mAforthealarmand800mAforthetripfunctions.Theprotectiontransformerwindingswerethencheckedforelectricalcontinuity,andboththeprimaryandsecondarywindingswerefoundtohavefailedinopencircuit.Thetransformer,whichwasasealedunit,wassenttoVishayforanintrusiveexamination.

1.11.3 Examination by Vishay

ThecasingoftheimbalancecurrenttransformerwascutopenbyVishayandwitnessedbyrepresentativesfromMAIBandConverteam.Thetransformeroilwasverydarkinappearanceandcontainedvisiblesoliddebris.Theprimarywindingwasfoundseverelydamaged,withmostofitsinsulationmissing.Thecopperwireinthesecondarywindingwasbrokenatoneplaceandheldtogetherbydamagedinsulation.Thewirehadflattenedandinsulationbrokenwhereithadbeenwoundaroundtheedgesofthetransformer’sironcore(Figure 22).ThecompletereportisatAnnexE.

Figure22

Currenttransformerfortheimbalancedetectionsystemwithitscasingcutopen(inset:secondarycoil)

Primarycoil

Secondarycoil

36

1.11.4 International standard for current transformers

IEC60044-1Instrumenttransformers–Part1:Currenttransformers,statesCurrent transformersintended for both measurement and protection shall comply with all the clauses of this standard.Thestandarddefinesindetailseveralrequirementscoveringtheareasofdesign,testing,accuracyandinsulation.ThecurrenttransformerusedintheEstaSym3CprotectionsystemforharmonicfiltersonQM2wasbuiltin-housebyVishayandwasnotintendedtomeetanyspecificstandard.

Thestandardstated:

Current transformers should not be operated with the secondary winding open-circuited because of the potentially dangerous overvoltages and overheating which can occur.

InFebruary2011,attheMAIB’srequest,ConverteamcarriedoutaverificationauditofVishay’smanufacturingprocessforthecurrentimbalancetransformeragainstIEC60044-1,eventhoughconstructiontothisstandardwasnotinthescopeoftheoriginalrequirementpresentedbyConverteamtoVishay.Ofthe23requirementsthatwerechecked,15didnotcomplywiththestandard.Someofthemostsignificantitemswhichdidnotcomplywere:

5.1.4 Insulation requirement for secondary windings

5.1.5 Inter-turn insulation requirement

8.4 Inter-turn overvoltage test

Converteamalsocarriedoutananalysisofinitialsub-componentinspectionsthatwerecarriedoutbyVishayduringthemanufactureofthecurrentimbalancetransformersforQM2.Fivetransformersub-componentswereidentifiedandthechecksthatwerecarriedoutincludedvisualinspection,mechanicalchecks,electricaltests,chemicalanalysisandverificationofproductdatafromthecomponentsupplier.Postproductionelectricaltestsweresuccessfullycarriedoutonbothwindings.

However,despitetheseshortcomings,Converteam’sconformitycheckssummarised:

In conclusion, we can say that process, inspection and test done by VISHAY is suffisant compared to the use and function of this current transformer [sic].

1.11.5 Monitoring and protection

TheSOLAS5regulationregardingthemonitoringandprotectionofmachinerystates:

‘Where main or auxiliary machinery including pressure vessels or any parts of such machinery are subject to internal pressure and may be subject to dangerous overpressure, means shall be provided where practicable to protect against such excessive pressure.’

5 SOLASconsolidatededition2009,ChapterII-1,PartCRegulation27.2

37

AtechnicalbrochurepublishedbyVishay‘MountingandMaintenanceInstructions,StaticPowerCapacitors,NaturallyAir-Cooled’(Annex F)stated:

Explosion or Fire hazard: Even if monitoring and safety devices exist, the incidence of overloading or an important electrical defect may cause the destruction of the casing and/or the bushings. Another consequence of this may be that the capacitor’s combustible component parts catch fire. This aspect shall be taken into account at the site of erection of the capacitor.

InatechnicalpaperpublishedbyTheInstituteofMarineEngineersin1995titled‘Electricpropulsion–aviewfromaclassificationsociety’6,theauthorsinadiscussiononharmonicfiltersstated:

‘With regard to filters, it is perhaps worth noting that overpressure in capacitors cans may have to be included in the protection arrangements…’

Whiletheauthorsdiscussedthismatterinthepaper,therewasnospecificregulationorclassificationsocietyrulethatrequiredsuchprotectionofcapacitorsinhighvoltageequipment.ThegeneralrequirementinSOLASwasnotinterpretedasbeingapplicabletothecapacitors.

WhentheIASreceivedanimbalanceoroverloadalarmfromanHF,thedutyengineercouldinterrogatethegraphicaluserinterface(GUI)intheECR,whichindicatedtherankoftheHFwhichwasinalarm(Figure23).TheGUIdisplayforboththeoverloadandtheimbalancealarmwascombined,andread‘OVERLOAD/UNBALANCE’.IfthecircuitbreakertotheHFwastripped,itwouldbeindicatedasanadditionalalarmintheIAS,asanelectricalfaultonthebreaker.Therewerenorecordsoftheimbalancealarmsortripsbeingtestedeitheratcommissioning,oratanyotherpointinthelifeofthevessel.

6 J.B.BormanandB.P.SharmanElectricpropulsion–aviewfromaclassificationsociety.InElectric Propulsion: The Effective Solution,TheInstituteofMarineEngineering,October1995

Figure23

Enginecontrolroomdisplayofharmonicfilteroperatingparameters

38

Theimbalanceprotectionrelaysweresettoalarmat400mAandtripat800mA.Thevalueofanyimbalancecurrentthatexceededthesesettingswasshownonthedisplayuntilmanuallyreset.StaffatVishayconsideredittobeextremelyunlikelythatthedisplaywouldindicate000mAinnormalserviceasitwouldindicatethatallthecapacitorshadexactlythesameperformance.Theinstructionmanualdidnotmentionthispoint.

1.11.6 History of imbalance alarms

TherewasnoevidencetoindicatethattheHFbreakershadevertrippedduetoimbalancecurrentsinQM2’sservicehistory.TheimbalancealarmcurrentsdisplayedontheEstaSymdisplayswerenotusuallyrecorded,exceptonrareoccasionswhentheship’screwdiscussedtheseissueswithConverteam.Ahistoricalanalysis(from2004to2010)ofharmonicfilteroverload/imbalancealarmsrevealedthattheaftHFalarmhadbeentriggeredonnineseparateoccasions.TheIASsystemdidnotdisplayorstoreinformationonwhichrankofthefilterhadregisteredanalarmcondition.

Otherrecordsshowedthatanalarm,indicatingproblemswithrank4oftheaftHF,occurredinJuly2006whilethevesselwasen-routetoNewYork.Theship’sstaffisolatedtheHF,carriedoutavisualexaminationand,findingnothinguntowardtheyswitcheditbackon-line.AfterarrivingatNewYork,theymeasuredthecapacitanceofeachindividualcapacitorintherank.Theyfoundthatoneofthemmeasured38.9µF,indicatingthatagroupofnineelementshadstoppedworkingduetothefailureofoneormoreelementsinthatgroup.

InDecember2010,whilethevesselwassailingatnormalservicespeed,thealarmforrank4oftheforwardHFactivated.Oninspection,theimbalancecurrentwas1250mA.Althoughwellinexcessofthetripsettingof800mA,theHFdidnottripduetoawiringfaultintheprotectionsystem.Thecrewstoppedthepropulsionmotors,switchedoffthecircuitbreakerfortheharmonicfilterandincreasedthespeedbackupto50rpmwhilemonitoringtheTHDvusingaportableinstrumentthatwasheldonboard.InthiswaytheywereabletorestorelimitedpropulsionpowerwhilemaintaininganacceptableTHDvof6.2%.Theysubsequentlyreplacedacapacitorinrank4whosecapacitancemeasured38.4µF.Thevesselwasthenbroughtbackuptofullspeed.Theimbalancereadingofrank4returnedto120mA.Theimbalancecurrentinrank11.3remainedat65mAthroughouttheincident.

1.12 ARC-FLASH

1.12.1 Phenomenon of arc-flash

Whenanelectriccurrentflowsthroughairgapsbetweenconductors,anarc-flashissaidtooccur.Anarccanformbetweenphase-to-ground(orneutral),orphase-to-phase,andisaccompaniedbyionisationofthesurroundingair.Whentheairqualityisdegradedwithmoistureorotherimpurities,thepossibilityofanarcstrikingisincreased.Thearccolumntemperaturecanvaryfrom5000Kto20,000Kandtheintenseheatcanvaporisetheconductorsandsurroundingmaterials.Copperinsolidformsublimatesto64,000timesitsvolume,causingfurtherdeteriorationoftheair’sinsulationquality;aphase-to-phaseorphase-to-groundarcingfaultcanescalateintoathree-phasearcingfaultinlessthan1/1000ofa

39

second.Theheatofthearccolumnalsoheatsupthesurroundingair,whichthenmovesintothesurroundingcoolerairwithaspeedexceedingthatofsound,causingashockwaveandexplosivenoise.

Anarc-flashisnotnormallyestablishedbelowaphase-to-phasevoltageof208Vorphase-to-groundvoltageof120V.Athighervoltages,itcancausesevereshockwaves,splatteringofmoltendebris,loudexplosionsduetotherapidlyreleasedvapouraswellasseriousburninjurytoanyoneinthevicinity.Thearchasatendencytomoveawayfromitssource.

TheMaritimeandCoastguardAgency’s(MCA)CodeofSafeWorkingPracticesforMerchantSeamen(COSWP)containssomeguidanceonworkingwithhighvoltagesanddiscussestheappropriateuseofpermitandsanctiontowork.Itdoesnotcontainanyadviceoncontrolmeasurestomitigatethehazardsofarc-flash.

1.12.2 High voltage regulations for enclosures

LR’srulesonswitchgearandcontrolgearassemblieswereonlyappliedtothemainswitchboardsonQM2andwerenotapplicabletotheHFenclosures.Undersection7.16.5.,LR’srulesstate:

For switchgear and control gear assemblies, for rated voltages above 1 kV, arrangements are to be made to protect personnel in the event of gases or vapours escaping under pressure as the result of arcing due to an internal fault. Where personnel may be in the vicinity of the equipment when it is energised, this may be achieved by an assembly that has been tested in accordance with Annex A of IEC 62271-200 and qualified for classification IAC (internal arc classification)

ThemainswitchboardenclosuresweresuppliedbyABBandweretheUnigearC/G12type.Theconstructionconsistedofanextrachamberabovethemaincircuitbreakers,whichwasopentotheatmosphere.Eachswitchgearcompartmentwasfittedwithanarcflapontop,designedtoreleasethepressureincaseofanarc-flash.Thebusbar,circuit-breakerandcablecompartmentswerephysicallyandelectricallysegregatedinthisdesign.

TheenclosurefortheharmonicfilterwasprovidedbyConverteamandwasconstructedtoprovideaningressprotection(IP)of44;thislevelofprotectionwasselectedbyConverteamasanappropriatestandardinordertopreventthecoolingairinsidetheenclosurefromescapingandmeettheshipyard’sspecification.

1.12.3 Test of soot

InDecember2010,asampleofthesootfromthedeckheadandapieceofinsulatingfoamfromacopperpipepassingunderthedeckheadoftheaftharmonicfilterroom,weresentforanalysistoaspecialistlaboratory.Thepurposeofthetestwastoinvestigateifsubstantialamountsofcopperoxidewerepresentinthesoot,whichwouldestablishthatanarc-flashhadtakenplace.Thereportsummarisedthatthesootcomprisedmostlyofcarbon,presumably from burnt organic material which might include oil and polymeric material. Theanalysisrevealediron;zincoraluminium;andafewcopperparticles.Nocopperoxidewasidentified.Agreendepositontheinsidesurfaceoftheinsulationwasreportedasappeared to be copper chloride, possibly the result of a reaction of copper in a marine environment.

40

1.12.4 Expert opinion

TheMinistryofDefence(MOD)hasprocuredanumberofvesselswithhighvoltagepropulsionsystemsandhasstudiedthepotentialrisksfromarc-flashincidentsandhowbesttomitigatethehazards.SpecialistMODstaffreviewedphotographsofdamagetotheaftHFonQM2,andconcludedthatitwashighlylikelythatanarc-flashoccurredduringtheaccident.TheirobservationsarereproducedatAnnex G.

1.13 HI-FOG FIRE SUPPRESSION SYSTEM

1.13.1 Manufacture and design

QM2wasfittedwithawater-mistsystem,knownbyitstradename‘Hi-Fog’, thatwasdesignatedasawater-mistsystemforlocalapplicationfire-fightinginmachineryspacesofcategoryA7.ItwasmanufacturedbyMarioffOy,Finlandandwasinstalledwhenthevesselwasbuilt.

Partsofthesystemwerefittedwithdifferenttypesofactivationmethods,intendedtolimitunwantedactivationandconsequentdamage.Themainmachineryspaceswerefittedwithsprayheadswhichrequiredmanualactivation,achievedbyoperatingasinglebutton.Thecommunicationrooms,wheelhouse,safetycentre,ECR,batteryroom,chartrooms,andpoolroomshadapre-actionsystem.Thisrequiredaflameorsmokesensortotrigger,activatingasolenoidcontrolledvalvewhichallowedwatertoenterthepipesandthenflowthroughthesprayheads.Theaccommodationspaces,includingDeckBwherethemainswitchboardroomsandharmonicfilterroomswerelocated,allhadsprayheadswithglassbulbsthatweredesignedtobreakatanambienttemperatureexceeding57ºC.

TheHi-FogpipingsystemintheMSBandHFroomswasofthe‘wet’type,filledwithfreshwaterat25barspressure.Ifasprayheadwasactivatedthesystempressurewoulddropto15bars,activatingthesprinklerpumpaccumulatorunit.Thisdeliveredapressureof140bars,whichresultedinwaterbeingappliedintheformofafinemist.Water-mistwasnormallyformedabove45barspressure.Dependingonthenumberandlocationofthesprayheadsthathadbeenactivated,andwhethertherewastrappedairintheline,designassumptionsestimatedthatitcouldtakeupto2minutesforthehighpressurewaterpumptocutin.ItwaspossibletodeterminefrommachineryrecordsonQM2thatthehighpressurewaterpumpsstarted6minutesaftertheexplosionoccurred.

7 MachineryspacesofcategoryAarethosespacesandtrunkstosuchspaceswhichcontaineither:

1. internalcombustionmachineryusedformainpropulsion;

2. internalcombustionmachineryusedforpurposesotherthanmainpropulsionwheresuchmachineryhasintheaggregateatotalpoweroutputofnotlessthan375kW;or

3. anyoil-firedboileroroilfuelunit,oranyoil-firedequipmentotherthanboilers,suchasinertgasgenerators,incinerators,etc.

41

1.13.2 Design appraisal

ThedesignappraisalwascarriedoutbyLRandwasconsideredtocomplywiththefollowingrequirements:

• SOLAS 1974, as amended, Chapter II-2/10;12.

• IMO Res. A800(19):IMOResolutionA.800(19)RevisedGuidelinesforapprovalofsprinklersystemsequivalenttothatreferredtoinSOLASRegulationII-2/12.

• MSC/Circ. 913:MaritimeSafetyCommitteecircularMSC/Circ.913.Guidelinesfortheapprovaloffixedwater-basedlocalapplicationfire-fightingsystemsforuseincategoryAmachineryspaces.

• ISO 15371:2000:Shipsandmarinetechnology-Fire-extinguishingsystemsforprotectionofgalleycookingequipment.

• IMO Res.[sic]668:MaritimeSafetyCommitteecircularMSC/Circ.668.AlternativearrangementsforHalonfire-extinguishingsystemsinmachineryspacesandpumproomsCargopumpRooms.

• TheRulesandRegulationsfortheClassificationofShips,Part6,Chapters1and2.

ThedesignappraisaldocumentlistedallthelocationswhereHi-Fog sprayheadsweretobeinstalled,beginningwithdecks13and14downtodeckBunderthesectionheaded‘ACCOMMODATION SPACE Comments’.TheitemisedlistofcompartmentsindeckBdidnotincludetheMSBorHFrooms(Figure 24)whichwerewithinthispartoftheship.Therewasnorecordofthesecompartmentsbeingconsideredseparatelyorinanyotherpartofthedesignappraisal.

Figure24

ItemisedlistingofareasfittedwithHi-fog outlets

42

In2004,MarioffOyconductedteststodemonstratethatitwassafetousetheHi-Fogsysteminhighvoltagecompartments(AnnexH).AtthetimethatQM2wasbuilt,noneoftheclassificationsocieties,includingLR,hadanyexplicitreferenceintheirrulesregardingtheuseoffixedwater-basedlocalapplicationfire-fightingsystemsincompartmentscontaininghighvoltageequipment.

1.13.3 Current regulations

ThecurrentLRRulesunderChapter2(ElectricalEngineering),Section16.3Fixedwater-basedlocalapplicationfire-fightingsystem(FWBLAFF)state:

High voltage equipment and their enclosures are not to be installed in protected areas or adjacent areas.

MostclassificationsocietiesrequirethatelectricalequipmentinareasprotectedbyFWBLAFFaretobecontainedinenclosureswithingressprotection44(IP44).TheFSSCode8referstoMSCCircular1165,whichinturndiscussestheuseofwater-mistsystemsonlyinrelationtocategoryAmachineryspaces.TheonlyguidanceavailableregardingtheuseofFWBLAFFincompartmentswithhighvoltageequipmentisafootnoteinIACSrequirementE20.Itstates:

‘Additional precautions may be required to be taken in respect of high voltage installations.’

TheIMOMaritimeSafetyCommittee’ssub-committeeonfireprotectionagreedseveralrevisionstoMSCCircular913atits54thsessionheldinApril2010.However,therevisionsdidnotincludeanyreferencetotheuseofFWBLAFFinhighvoltagecompartmentsorenclosures.

1.14 POPULARITY OF ELECTRIC PROPULSION AND VARIABLE FREQUENCY DRIVES

AstudycarriedoutbytheMAIBindicatedthatofalloperationalvesselsover100grosstons,1.85%havehighvoltageelectricpropulsionsystems.Ofthevesselswhicharebeingconstructed,4.10%areelectricallypropelled.Variablespeedmotorsarebecomingcommonplaceinnewshipswithelectrically-drivenpropulsion,cargopumpsorotherapplications,benefitingfromthistechnology.Modernliquefiednaturalgasshipspredominantlyusevariablespeedmotorsintheirre-liquefactionplants.Thereare545vesselsinvolvedinoffshoreactivitiesfittedwithelectricpropulsion.

Themajorclassificationsocietieswereaskedtoreporthowmanyvesselstheyhadontheirregistersthatusedhighvoltagepowersystems.DNVreportedthat319vesselswereregisteredwhichusedHVelectricpropulsion,themajorityusingcapacitor-basedharmonicfilters.NipponKijiKyokai(ClassNK)had14vesselsregisteredasbeinginserviceandafurthernineunderconstruction.LRwasunabletoprovidesimilarinformationregardingthenumberofvesselsthatwerepotentiallyatriskfromsimilarproblems.

8 TheInternationalCodeforFireSafetySystems(FSSCode)

43

Atthetimeofpublication,Converteamhadsupplied65vesselswithsynchro-convertersandthemajorityofthemwerefittedwithpassivetunedfiltersusingsimilarcapacitors.CarnivalUKandP&OAustraliaoperatefourvesselswithHFsystemsidenticaltothatofQM2.

1.15 SIMILAR ACCIDENTS

1.15.1 Capacitor failures

ThecircularonthehazardsofpolypropylenevapourwhichDNVdistributedin2007tomanufacturersofpowerconverterswaspromptedbythreeaccidentsonboardoffshoresupportvessels.Inthefirstcaseasmoothingcapacitor,approximately20to30kginweight,fittedintherectifiercircuitofa690Velectricpropulsionsystemexploded,blowingoutthesteeldoorsofitsenclosures.Inasecondincident,acapacitorinapassiveharmonicfilterfailed,resultinginthedisruptionofvariablespeedseawatercoolingpumpsforthelowtemperaturecoolingsystem.Detailedanalysisbythemanufacturersconcludedthatwhenthepassiveharmonicfilterwaslostduetocapacitorfailure,theharmonicdistortionincreasedtoapproximately20%which,inturn,affectedthespeedregulationsystemoftheseawaterpumpmotors,causingthemtoshutdown.Inathirdincident,theharmonicfilterenclosurepanelwasblownoutwhenacapacitorexploded.

1.15.2 Arc-flash accidents

TheIEEEGuideforPerformingArc-FlashHazardCalculations,IEEE1584-2002(©2002IEEE9)containsatableof49arc-flashaccidentsinland-basedinstallations.Itcontainsdetailsofvoltageofequipment,activityundertakenatthetimeoftheaccident,andinjuriessustained.ThistableisreproducedinAnnexI.

InastudycarriedoutbytheMOD,17fatalitieshavebeenreportedonnon-UKsubmarinesasadirectresultofarc-flashincidents.Thestudyalsoexaminedaccidentsonmerchantshipsthatwerelikelytobeattributabletoanarc-flashfault.Thefollowingarc-flashaccidentswereidentified:

• In1990Regent Star,apassengervessel,sufferedanMSBfiredisablingthevesselmid-river.

• In1993,thero-rovesselUnion Rotoruaexperiencedafireinher6.6kVMSBandhadtobetowedtoport.

• In1995thepassengervesselCelebrationhadamajorelectricalfireintheECR.Sun Vista,apassengervessel,sankinMalaccaStraitwhenherswitchboardcaughtfire.

• In2000,thepassengerferryColumbia wasdisabledfollowingafireinherMSB.

• In2002,thepassengervesselStatendamhadanarc-flasheventinamaincircuitbreaker.Thiscausedafirewhichspreadtoothercompartments,requiringthevesseltobetowedtosafety.

9 http://standards.ieee.org/

44

SECTION 1 SECTION 2 - ANALYSIS

2.1 AIM

Thepurposeoftheanalysisistodeterminethecontributorycausesandcircumstancesoftheaccidentasabasisformakingrecommendationstopreventsimilaraccidentsoccurringinthefuture.

2.2 THE ACCIDENT

2.2.1 Explosion

Although‘halfdrivealarmlamp’indicationsappearedontheP1200alarmsystem,thesewerenotreadilyapparenttoQM2engineroomwatchkeepers.Eveniftheyhadbeen,theirsignificancewasnotobvious,anditisconsideredunlikelythatanyofthewatchkeeperswouldhaveinterpretedthemasearlywarningthatacapacitormightfailcatastrophically.Theyonlybecameawareoftheproblemwhentheyheardtheexplosionandsawthevesselblackout.Theyestablishedthelocationoftheexplosionbythethickblackfumesemanatingfromthemainswitchboardroom.TheaftHF‘overload/unbalance’alarmindicationintheECR;thealarmindicatingtheopeningoftheaftHFcircuitbreaker;theexplosion;lowvoltageblackoutfollowedbythestoppingofmainpropulsionmotors;andfinallytheshutdownofthegenerators,happenedwithinafewsecondsofeachother.Therewasnoopportunityforthecrewtointervene,eithertopreventtheexplosionorthesubsequentlossofpower.

Ignitionofdielectricvapour

Evaluationofthefailedcapacitorsestablishedthatconsiderablearcinghadtakenplacebetweenthefoillayers.Thepresenceofacetyleneinthedielectricoilsample,evenaftertheoilwasexposedtoatmosphereforseveraldays,furthercorroboratesthis.Bulgingofthecapacitorcanscouldonlyhavebeenasaresultofinternalpressurisationbyvapourcreatedbythebreakdownofthedielectricinsulationmaterialsbyinternalarcing.Thereductioninflashpointcausedbythemixingofthisflammablevapourwithexplosivegaseslikehydrogenandacetylenewouldhaveincreasedthelikelihoodofthemixturebeingignitedbyoverheatedorsmoulderinginsulationmaterial.Similarly,anarcbetweentheopposingplatesofthecapacitorcouldalsohavecausedignition.ThepredominanceofcarbonfoundinthesootsamplefromtheaftHFroomconfirmsthatburningofthevapourmixturehadtakenplace.

Electricalarc-flash

Theprobableconditionsthatexistedjustbeforetheaccident:oilweepingorsprayingoutfromthefailingcapacitorcasing;11kVvoltageacrossthethreephases;andthesubsequentreleaseofflammablegasesfromthecapacitors,wereidealforanarc-flasheventtotakeplace.Themeltedcornersofthecopperbusbarsindicatethatarcingdidtakeplacebetweenthephases,anditisthereforepossiblethattheexplosivenoiseheardbythecrewmemberswasduetotheshockwavesproducedbytherapidlymovinghotairemanatingfromthearccolumn.However,themajorityofcopperappearedtohavemeltedandre-solidifiedinsteadofsublimatingasinaclassicarc-flashevent,possiblyexplainingwhycopperoxidewasnotdetectedinthesootsamplethatwascollectedfromthedeckhead.Itisalsopossiblethatmuchof

45

thecopperoxidewascontainedwithintheenclosureandwascleanedawaybeforethesamplewastaken.Oneormoresmallerarc-flasheventscouldalsohavetakenplaceinthepastandbeeneitherundetectedorunreported.

Cause

Itismostlikelythattheexplosionwasduetoacombinationofbothevents:ignitionofthevolatiledielectricvapourreleasedfromthecapacitorandanelectricalarc-flash.Whileitiscertainthattheseeventswereinterdependentandoccurredclosetogether,ithasnotbeenpossibletodeterminewhichwasthetrigger.

Irrespectiveofthecauseoftheexplosion,thedamagefollowingitclearlydemonstratedthattheenergyreleasedwassignificant.Itwasextremelyfortunatethattherewasnooneinthevicinitywhentheexplosiontookplaceastheamountofenergyreleasedwaseasilycapableofcausingfatalinjuries.Thisemphasisesthepotentialdangertocrewenteringtheharmonicfilterroom,especiallytoinvestigateanalarm.IftheHFenclosurehadbeenbuilttothesamestandardashighvoltageswitchgear,itwouldhavehadabuilt-inmechanismtoreleasetheexplosivegases,thedamagecausedbytheexplosioncouldhavebeenmitigatedmoreeffectively,andanycrewnearbybetterprotected.Thecaseforuniformapplicationofhighvoltageswitchgearprotectionstandardstoallotherhighvoltageequipmentwherecrewinterventionmayberequiredduringoperationisthereforecompelling.

2.2.2 Sequential blackout

Sequence

Itwasevidentthattheblackoutwassequentialratherthaninstantaneous.Whenthecapacitorliftedupfromthemountingitbrokeitsconnectiontothe11kVlinesupply,therebycausingalossofreactivepowerasindicatedbythe‘IO-FAULT’alarmsatthe11kVbusbarsandgenerators.Thecapacitorbreakingitsconnectionstothebusbarswouldhaveresultedinanopencircuitinoneofthethreephases,andwasmostlikelytohavebeenthecauseofthediscrepancyalarmswhichindicatedthattheswitchboardhaddetectedalossofonephase.Thesingle phasingislikelytohavetriggeredthenegativesequencedetectionrelayofthegeneratorsandwouldexplainthesubsequenttrippingoftheforwardMSBbustiebreakerinaccordancewiththediscriminationsetting.ThiswouldalsoexplainwhythecorrespondingbreakerontheaftMSBremainedclosedevenafterallthegeneratorsshutdown.Whilethisscenarioisconsideredthemostlikelygiventheavailableevidence,itcannotbestatedwithcertaintybecausethebreakershadnotbeenconfiguredtorecordwhyeachofthemtripped.

Itisalsopossiblethatduringtheaccident,therewasashortcircuitorarcflashbetweentwophaseswhichcouldexplainthevoltagedipcausedatthepropulsionnetworkbridgeshownbythealarmsontheP1200system.However,itisnotclearwhytheundervoltagealarmdidnotappearattheIAS.Although,theexplosionandthefailureofelectriclightsoccurredalmostsimultaneously,thegeneratorscontinuedtomaintainmainvoltageforapproximately16secondsaftertheevent,asseeninFigures 11aand11b.

Thesediscreteevents,occurringoverseveralseconds,establishthattheblackoutwassequential,startingatthelowvoltagesideofthenetwork,subsequentlyaffectingthehighvoltagesideandfinallyresultinginalltheDGsshuttingdown.

46

Causeofblackout

Withouttheinformationfromeachofthebreakers,itwasnotpossibletoestablishexactlywhythegeneratorsshutdown.ThealarmsequenceduringtheincidentindicatesthattheHFcircuitbreakeropenedfirstinresponsetothecatastrophiceventwithinrank11.3,suggestingthatitsdiscriminationsettingwascorrect.However,astheyhaveyettobeverified,thiscannotbeconfirmed.

Acommoncauseforblackoutisalargevariationofvoltagewithinthenetworkwhenasignificantproportionoftheelectricalloadissuddenlyappliedorabruptlydisconnected.Fromthepropulsionsystemalarmlog,itisevidentthatallthepropulsionmotors’networkbridgesregisteredlowvoltagealarms,althougheachtimetheyappeartohaverecoveredtonormaloperatingvoltage.Surprisingly,therewasnoindicationoflowvoltageontheIASanditisthereforenotclearwhythegeneratorsshutdown.ItislikelythatthehighvoltagenetworkwasunabletorecoverfromtheinstabilitycausedduetothedisruptionswithintheaftHF.

Itishighlylikelythatjustbeforetheaccident,thetwocapacitorsintheaftHFhaddegradedtosuchanextentthattheabilityofthe11.3rankHFtoabsorbharmonicswouldhavebeenseverelycompromised(seeTable 2 showninsection2.3.3).ItfollowsthattheTHDvjustbeforetheHFfailedwouldhavebeensignificantlyhigh(Figures 12 and13),perhapscausingthestartoftheelectricalinstabilityasindicatedbythefirstalarmononeofthehalfdrivesofpropulsionmotorno.3,around36minutesbeforetheaccident.

Asthevesselwaswellawayfromtrafficandnotincongestedorshallowwaters,thelossofpowerfor30minutesdidnotcauseanynavigationaldifficulties.However,losingcontrolofalargecruiselinerduetoanelectricalblackout,with3823peopleonboard,isaseriousconcern.Thisaccidentdemonstrateshowelectricalinstabilitycancauseunpredictableandpotentiallydisastrousconsequencesinmarinehighvoltageelectricalnetworks.Itisthereforenecessarytoconsiderhowsuchtransienteventscanbemonitoredandrecordedtounderstandtheexactnatureandcauseofelectricalinstabilitiesandthebestwaytomitigatethem.

2.3 HARMONIC DISTORTION OF CURRENT AND VOLTAGE

2.3.1 Awareness

Onconventionalvesselswithveryfewnon-linearloads,harmonicdistortionofcurrentandvoltagehasnottraditionallybeenanissueofconcern.However,electricpropulsionwithvariablespeedACmotorsisrapidlybecomingthepreferredmethodofpropulsiononseveraltypesofmarinevessels.VariablespeedACmotorsarealsobecomingmorecommonasprime-moversinvariousauxiliarymachines.Theassociatedproblemswithharmonicdistortionarethereforeincreasing.Itisimportantthatships’crewsgainathoroughunderstandingoftheissueofharmonicdistortion,sothattheyarebetterabletoappreciatetheimportanceoftheharmonicmitigationequipmentonboardandtaketimelyactionifsuchequipmentfailsordeteriorates.

2.3.2 Simulations and trials

AlthoughthelikelyTHDvwascalculatedatQM2’sdesignstagein2002andmeasuredduringthevessel’sseatrialsin2003,theeffectoflosingbothharmonicfilterswasnotconsidered.ItmaybearguedthatQM2wasneverintendedtooperate

47

withoutanHFandcouldmaintainherharmonicdistortionlevelswithinacceptablelimitswhilemaintainingservicespeedwithoneHF;thereforeitwasnotnecessarytomodelthecaseofthevesseloperatingwithouteitherHF.Nevertheless,duetothedelayinthesupplyofspares,thereweremanyoccasionswhenthevesselhadonlyoneHF.AswasdemonstratedinDecember2010,theoneremainingHFcouldhavefailedatanytime,leavingthevesselwithnomitigationagainstharmonicdistortion.Moreover,astherearenorequirementsfromclassificationsocietiesregardingredundancyinharmonicfilters,manysmallervesselsmayonlybefittedwithoneHF,andbeoperatinginservicewithnoguidanceontheeffectonships’electricalsystemsshoulditfail.

ThesimulationstudyconductedbyConverteamestablishedthattheTHDvwouldhavereached22%hadthepropulsionplantcontinuedtooperateat70%poweroutputaftertheaccident.Itwasfortunatethattheundervoltageinthenetworkbridgeofthepropulsionconverterscausedthepoweroutputtoreducetolowlevels;otherwisetheconsequencesofoperatingathighlevelsofTHDvcouldhavebeensevere.

InDecember2010,whenQM2developedadefectontheforwardfilter,itwasonlytheincorrectwiringintheprotectionsystemthatpreventedthecircuitbreakerfromtripping,thusavoidinganotherpotentialblackout.Thevesselwasapproachingportatthetimeandthepotentialconsequencescouldhavebeenveryserious.However,thehighimbalancecurrentof1250mAthatwasrecordedatrank4oftheforwardHFwasindicativeofacapacitorinanadvancedstageofdegradation,anditwasalsoveryfortunatethatthedegradedcapacitordidnotfailcatastrophically.Asthecrewhadaccesstotherecentlycompletedtheoreticalmodellingdata,aswellasaninstrumentwithwhichtomeasuretheharmonicdistortion,theywereabletomanagethesituationwellandmakethenecessaryrepairswithoutcompromisingthesafetyofthevessel,thepassengersorcrew.

2.3.3 Monitoring and in-service verification

ThemeasurementsofTHDvthatweremadeduringtheseatrialsin2003demonstratedthatitwaspossibletomaintainthemwithinthe8%marginsthatwererequiredbyLR.However,nomeasurementswerecarriedoutwiththreeDGsandoneHFinuse,theoperatingconfigurationjustbeforetheaccident.Whileitwouldbeimpracticaltoexpecttheseatrialstocoverallthepossiblecombinationsofgenerators,harmonicfilters,poweroutput,networkconfigurationandmeasurementpoints,itwouldbesensibletoverifytheharmonicdistortionlevelsinthehighestriskandoperatingconfigurationsusedinservice.

ThecomparisonmadeinTable 1betweentheTHDvmeasurementsof2003and2010demonstratesanoverallincreaseinTHDvlevelsatallthemeasuredpoints.AsTHDvinthenetworkshouldnotincreaseunlessthenetworkimpedanceshavechanged,thereasonforthisincreaseinharmonicdistortionmustbeattributedtothedifferenceinelectricalloadingconditionsbetweenthetwomeasurements.ThisillustratesthatTHDvisnotstaticandwillchangeinoperation,furtherreinforcingthebenefitofcontinuous,oratleastperiodicchecks.

DuetotheinternalcircuitryofQM2’sHFcapacitors,ashortcircuitinoneelementinagroupofninewouldresultintheshortcircuitoftheentiregroup,whichwouldcausethecapacitanceoftheremainingthreegroupstoriseby33%.Ifallfourcapacitorcansinonephasesufferedthesamedegradation,theoverallcapacitance

48

ofthatphasewouldhavebeen145µF,resultinginthede-tuningoftheHFinonephaseandresultantharmonicpollution(Table 2).Iftheharmonicdistortionhadbeencontinuously,orevenonlyperiodicallymonitoredonboard,thechangesinTHDvcouldhavebeeneasilydetectedandpreventiveactionstakenbeforethecapacitorfailedcatastrophically.

Capacitance(µF) Harmonic order Possible conditions

108.8 11.3 Allelementsingoodcondition

127.0 10.4 Oneelementeachshortedintwocans;twogoodcans.

136.0 10.1 Oneelementeachshortedinthethreecans;onegoodcan.

145.0 9.7 Oneelementshortedineachofthefourcans.

190.0 8.5 Threegroupsshortedinonecan;threegoodcans.

Table 2:Illustrationshowingthevariationoftunedharmonicorderwithinternaldegradationofcapacitorsinrank11.3oftheharmonicfilter.ThevaluesofharmonicorderarecalculatedbyMAIBusingtherelationshipdiscussedinSection1.8.1assumingthecapacitancechangesinonephaseonly.

Duringthe3dayswhenMAIBevaluatedthepowerqualityonQM2,theaftHFwasnotavailableandonlytheforwardHFwasinuse.Ithadafunctionalcurrentimbalancedetectorand,astherewerenoalarms,itcanbeassumedthatthecapacitorsinbothranksoftheforwardHFwereinsatisfactorycondition,andtheTHDvlevelswouldhavebeenmaintainedwithinacceptablelimits.However,thepowerqualityofthevesselduringthetimepriortotheaccidentwhentheaftharmonicfilterwasinuse,wouldhavebeendifferent.Astheimbalancedetectorforrank11.3wasdefective,andthecapacitorshaddegradedwithoutbeingnoticed,theunitwouldhavebecomede-tunedanditiscertainthattheaftHFwouldnothavebeenaseffectiveastheforwardone.

Theovervoltageproblemsthatweredocumentedduringthefirstyearofthevessel’sservice,andagainasrecentlyas2weeksbeforetheaccident,wereindicativethatovervoltageconditionsexistedintheelectricalnetwork.Theholesfoundononeofthecapacitorelementsweretypicalsymptomsofovervoltagedamage.Thiscouldhaveoccurredduringtheaccident,orevenearlierinservice;withoutcontinuousmonitoring,transientovervoltageishardtorecord,quantifyoranalyse.

ThelessfrequentusageoftheaftHF,reflectedbyitssignificantlylowerrunninghourscomparedtotheforwardone,couldperhapsbeattributedtoitsunsatisfactoryperformance.Itiscommon,whentwomachinesareprovidedforthesamepurpose,thateventhoughbothworkacceptably,oneismoreeffectivethantheotherandispreferredbytheoperators.ItisquitepossiblethatthisoccurredwiththetwoHFs,andtheaftunitwasincreasinglyleftasthestand-by,cuttinginonlytoassisttheforwardHFandrarelyusedonitsown.Hadtheharmonicdistortionmeasurement

49

equipmentthatwasprovidedtothevesselbeenused,itwouldhavegiventhecrewsomeinsightintothepowerqualityandthecomparativeeffectivenessofthetwoHFsonboard.

Regularmonitoringofpowerqualityusingapre-determinedpatternofpropulsionmotorloadingwithacompleterecordofoperationalparameterswouldhelpensurethattheharmonicdistortionlevelsonboardarecloselymonitoredasthevesselanditsequipmentageandoperatingconfigurationschange.Anon-linemonitoringsystemthatrecordsalltheparametersandcanbetriggeredtomakespecificrecordingsoftransientvoltagespikesorresonances,wouldbeinvaluableinassessingtheongoingqualityofpower.Itwouldalsobeaveryusefultooltoinvestigatetherootcauseofaccidentscausedbyanomaliesintheelectricalnetworkandtoidentifyincipientfaultsinthesesystems.Land-basedutilitiesmonitortheirpowerqualityasamatterofroutine.Inamarinevesselwhereharmonicdistortionhasthepotentialtodisruptitselectricalnetwork,theneedforpowerqualitysurveillanceisevenmoresignificant.

2.4 CAPACITOR FAILURES

2.4.1 Initiation of failure

Construction,designandrating

QM2’sHFcapacitorsweremanufacturedbyVishay,oneoftheleadingsuppliersofthisproductwithanestablishedglobalsupplychain.Converteam’sauditsofVishay’sprocesseshadnotrevealedanydeficiencies,andestablishedthatthemanufacturingandtestingprocessadheredcloselytoIEC60871parts1and2.TheindependenttestscarriedoutonbehalfofMAIBdidnotrevealanymajorflawsinconstruction,exceptthecreasingonthecapacitorelementfoilinonecapacitorelement.Nevertheless,theoveralldesignandconstructionofthecapacitorwasacceptableandmetConverteam’sspecification.

Thecapacitors’voltageratingof8242Vwas30%inexcessoftheexpectedvoltageacrossthecapacitorsconnectedintheirstarconfiguration.FromexaminationofthespecificationitisconsideredthatVishayhadexceededtherequirementfromConverteamtoconsidertheharmonicvoltagesuptothethirtiethharmonicinadditiontothefundamentalfrequency.Therefore,itishighlyunlikelythatthecapacitorwasunder-ratedbydesign,evenwhenconsideringtheincreasedvoltagesduetoinductiveeffects.Whereswitchingtransientovervoltageisconcerned,LRrules,whichallowa20%increaseforaperiodof6to7secondsdonotmatchtheequivalentIECrequirementwhichallowsforamuchlargertransientvoltagelastinghalfacycleor1/120ofasecond(considering60Hzfundamentalfrequency).AstherequirementsofIEC6087pertainspecificallytohighvoltagecapacitorsandtheLRrulesaremoregeneral,itwouldbelogicalinthelongertermforLRtoreconsidertheirrulesontransientovervoltageswhentheyspecificallyapplytocapacitors.

ThemaximumtemperaturerecordedonthesurfaceofoneoftheforwardHFcapacitorcanswas49ºC,duringwinterconditions;therefore,highertemperatureswerelikelytooccurduringtropicalweather.However,thecirculatingairtemperatureintheforwardfilterasindicatedinFigure23 waswellwithinthepermittedvalue.Assumingthatthecoolingsystemhadsufficientcapacitytomaintaintheambienttemperaturebelow45ºCevenundertropicalconditions,itisunlikelythatthedegradationwascausedbyhighambienttemperatures.Theeffectofthealarm

50

thresholdsbeingsettoohighat47ºCwasnotthoughttoaddsignificantlytotheriskofahighambienttemperature.Thelong-termeffectsofthehighersurfacetemperaturesonthecapacitorcanswaslessclearandwouldmeritfurthermonitoringandconsideration.

Switchingfrequency

TheIECstandard’srequirementforcapacitorstowithstand1000switchingcyclesinayear(anaverageof2.7aday),isbasedonanexampleofaland-basedinstallationwheretheoperationpatternexhibitsminimalvariationonadailybasis.OnavessellikeQM2,thathasawidelyvaryingoperatingpattern,itcouldbenecessarytovarypropulsionspeedquitefrequently,requiringthestandbyharmonicfiltertobeswitchedinandoutseveraltimesduringtheday.Eventhoughitwasoutofserviceforsometime,the10,000hoursdifferenceinrunninghoursbetweenthefiltersindicatesthattheaftHFwaspredominantlyusedasthesecondfilterandthereforesubjecttomoreswitchingoperationsthantheforwardone.ItisthereforeconsideredthatbothHFscouldhaveexperiencedmoreswitchingcyclesthanexpectedinaland-basedinstallation,withtheaftHFbeingmoreatrisk.

Whilethestandardsandspecificationsforland-basedHVequipmentandinstallationsprovidevaluableguidance,itmustbeacceptedthattheconditionsandoperatingpatternsinmarineinstallationscandiffersubstantially.Itisthereforeessentialthattheeffectsofthesedifferencesareunderstoodandthatdesignmarginsareincreasedaccordingly.

Summary

ThecapacitormanufacturingprocesssatisfiedthecriteriaoftheIECstandardandmetConverteam’sspecification.Howeveritislikelythatthecapacitorsstartedtodeterioratefarsoonerthantheirexpectedlifetimeof20yearsduetotheoperatingconditionsbeingharsherthanexpected.Theinitialdegradationofthecapacitorwaslikelytohavebeencausedbyoneorbothofthefollowing:

• beingsubjectedtovoltagesinexcessoftheirdesignrating

• beingexposedtofrequentvoltagetransientsduetoincreasednumberofswitchingcycles

Failureinitiationduetominormanufacturinganomaliessuchastheexistenceofstressraisersonthecapacitorelements,thoughlesslikely,cannotbecompletelyruledout.

2.4.2 Progression to catastrophic failure

Onceinitiated,thedamageonthesolidcomponentsinthedielectricmediumwouldhavebecomeaweakspotandthemostlikelylocationtosufferfurtherarcing.Althoughthedielectricoilhadself-healingpropertiesandcouldabsorbsomeofthedamagedonebypartialdischargeorarcing,thedeteriorationofthesolidinsulationwouldhavebeenpermanent.Theprocesswouldhavecontinueduntiloneoftheelementsinagroupofeightsufferedashortcircuit,therebyshortingthegroupandincreasingthevoltageacrosstheremaininggroupsby33%.Acompleteshortcircuitofonegroupwouldhavedevelopedanimbalancecurrentof1300mA,farinexcessofthetripcurrentofthecurrentimbalancedetector.Iftheimbalancedetectorhad

51

beenfunctional,theaftHFbreakershouldhavetrippedandtakentheHFoff-line;thecapacitordamagewouldhavebeendetectedlongbeforeitreachedthecriticalpointwhereanexplosionwouldoccur.

Asthedeteriorationprogressed,thevoltageacrossthelastgroupofremainingcapacitorelementswouldhaveincreasedtoamaximumof400%oftheratedvoltageleadingtoheavyarcingandrapidvaporisationofthedielectricoilandthepolypropylenefilm.Therewasnowaytoreleasethevapour,andtheinternalpressurewouldhaveincreaseduntilthecapacitorcasingrupturedattheweldedjointatthebase.Thepressurisedoilandvapourwouldhaveescapeddownwardswithsubstantialvelocity,resultingintheentirecanliftingup,breakingfreefromitsfoundation,disconnectingitselffromitsbusbaranddamagingneighbouringcapacitorsinthephasegroup.

TheSOLASrequirementformachinerysystemsthatarenormallyunderpressuretohavepressurerelievingarrangementscouldbeinterpretedtoincludeonlythosesystemswhichcontainafluidunderpressure.However,somesystemscouldbepressurisedunderabnormaloperatingconditions,asillustratedbythisaccident.Ananalogyisthewaterjacketofahighpressureaircoolerinanaircompressor,whichisrequiredtobeprovidedwithaburstingdisk,incasepressurisedairleaksintothewaterside.ItisimperativethatequivalentmeansareprovidedinHVcomponents,eithertorelievetheexcesspressure;warntheoperatorwithalarms;orshutdownthesystemtopreventfurtherpressurisation.Theinherenthazardofsuddenanduncontrolledreleaseofpressureenergyfromelectricaldevicessuchascapacitorsneedstoberecognisedandaddressedasamatterofpriority.

2.4.3 Design changes in new capacitors

Someofthechangesmadetothedesignofthecapacitorsthatwerefittedaftertheaccident-especiallythechangeintheconfigurationofelementgroupingsresultinginthedecreaseofvoltageacrossindividualelementsby20%,andthethickerpolypropylenefilmwithabettergradientofelectricalstrength-appeartobeanaturalreactionofanymanufacturertomaketheirproductmorerobustwhiletherootcauseoffailureremaineduncertain.Thefittingofinternalfusesandpressuresensorsrecognisesthenonfailsafenatureofthecurrentimbalancetransformerandaugmentstheprotectionprovidedbytheimbalancedetectionsystem.

Ifthecapacitorelementswereindividuallyfused,thedegradedelementswouldhavebeenisolatedandthewholeunitwouldhavecontinuedtofunctionforalongerperiod.Nevertheless,similarfailuresonotherunitscouldeventuallyleadtoprogressivelyincreasingvoltagesacrossthehealthyunits,eventuallyleadingtoacatastrophicfailurewithsimilarconsequences.Thedecisiontofitpressuresensorsonthetransformeroiltankrecognisedtheriskofarcingandinternalover-pressurisationbytheoilvapour.Itwasunfortunatethatthesamereasoningdidnotextendtotheprotectionofcapacitors,eventhoughthecapacitorinformationbrochurebyVishay,aswellasacademicpapersonthesubject,clearlyidentifiedtheserisks.ThisaccidentdemonstratestheimportanceofdesigninginsafetyfeaturesinHVelectricaldevices.

52

2.4.4 Maintenance and replacement history

ThemaintenancehistoryfortheHFswassparseandcontainedinsufficientdetailsofthefailuremode,serialnumbersoffailedunits,ortherankstheywerefittedin.However,itwaspossibletodeterminethatatleastsixcapacitorshadbeenreplacedduetointernalfailureofcapacitorelements.Despitesucharelativelylargenumberoffailures,therewerenoattemptstoanalysethecause.Thecrewacceptedtherateoffailureasoneoftheunavoidablefeaturesofthenewtechnology,anddidnotquestionitfurther.Thefrequentmechanicaldamagesufferedbythecapacitorsduringtransitpossiblymaskedthefactthat,onaverage,onecapacitorwasbeingreplacedeachyearduetointernaldegradation.

Technicalmanagersdidnotrecognisethistrendasthecapacitorswerejustafewcomponentsamongmanythousands,andsowereunabletotakeanypreventativeaction.Theywerenotaidedbytheirmaintenancesystem,whichdidnotanalysetherateoffailureoralertthemtotheunusuallyhighconsumptionofreplacementparts.Incontrasttothetransformers,therewasnofacilitytotesttheconditionofthecapacitor’sdielectricfluidand,despitethisbeingaconditionoftheCSMsurvey,theimpossibilityofthistaskwasnotrecognisedbyeitherthecreworLR.AsHFshadnotbeenincludedinthelistofcriticalequipmentonQM2,anotheropportunitytorecogniseandactuponthefrequentfailureswaslost.NeitherConverteam,theoriginalequipmentsupplier,norVishay,thecapacitormanufacturer,identifiedthehighconsumptionofcapacitorsonboardQM2.

Componentfailurecanoftenbeasymptomofanunderlyingproblemwiththeequipmentorsystem.Shipmanagersandcrewshouldbemorealerttothis,particularlywithnewtechnology.Maintenancemanagementandassociatedparts’requisitionsystemsshouldbeusedtorecordcomponentfailuresinsufficientdetailtoallowmoremeaningfulanalysisandgiveanearlywarningtopreventmoreseriousproblems.

2.4.5 Current imbalance detection system

Thecapacitorexplodedbecausetheinoperativeimbalancedetectionsystemcouldnotidentifythedeteriorationofthecapacitors.Thefailureoftheimbalancesystem’scurrenttransformerremainedundetectedforwhatcouldhavebeenseveralyears.Itiscertainthatthissystemwasnotworkingin2008whenConverteamdetectedtwodefectivecapacitorsduringaroutinecheckindrydockbecausenoimbalancealarmswererecordedbytheIASsystematthecorrespondingtime.Furtherexaminationofthemaintenancehistoryestablishedthat,ofthefivecapacitorsreplacedinrank11.3,fourtookplaceindrydockasaresultofroutinechecks,ratherthanbecauseofanimbalancecurrentalarm.Althoughthewindingsofthecurrentimbalancetransformerweretestedduringmanufacture,subsequenttestsofthesystemwerebysecondarycurrentinjection,bypassingthewindings.AstheIASdidnotspecificallyregisterwhichrankoftheHFhaddevelopedanimbalancecurrent,itwasnotpossibletoconfirmifthecurrentimbalancetransformersonrank11.3hadeverworkedinservice.

ItisconcerningthatnoneofConverteam,theship’sengineersandCarnival’stechnicalmanagementteamquestionedwhythecurrentimbalancedetectionsystemhadnotregisteredanalarmwhentwocapacitorswerefounddegradedduringroutinechecksinOctober2008.AlthoughConverteam’sinspectionreportindicatedthattheprotectionsystemshadnotbeentested,noquestionswereraised.

53

Eveniftheprotectionsystemshadbeentested,thiswouldprobablyhavebeenbysecondarycurrentinjection,asdoneduringthefactoryacceptancetest.Thismethodwouldhavebypassedthecurrenttransformerandanopencircuitfaultinatransformerwindingwouldhavegoneunnoticed.EventhoughanannualtestoftheprotectionsystemwasrequiredbyConverteam,itisdisconcertingthattherewasnorecordofthishavingbeendone.

AlthoughtherewasnorequirementonVishayforthecurrentimbalancetransformertoconformtoIEC60044-1asithadnotbeenspecificallyrequestedbyConverteam,itisneverthelessconsideredtheappropriaterecognisedstandardformeasurementandprotectiontransformers.Itisunfortunatethat,whenauditedagainstIEC60044-1aftertheaccident,15of23requirementswerenotmet.Theseshortcomingswerelikelytohavecontributedtotheprematurefailureofthetransformer.Inaddition,therewasnoverificationoftheHFprotectionsystemduringthefactoryacceptancetests.Whiletheproductionofcapacitorswasstrictlycontrolledandcarriedoutinaccordancewiththeapplicablestandards,thetransformer,attheheartofthemonitoringandprotectionsystem,wasconstructedandputintoservicewithoutthesamediligence.LR,whoserepresentativeswerepresentatthefactoryacceptancetest,acceptedasuperficialtestoftheprotectionsystem,whichdidnotincludeacheckofthetransformer.

AlthoughthecurrentimbalancedetectionwastheonlyprotectionsystemfortheHFs,ithadnoback-upanddidnotfailsafe.Theonlypossibleindicationofafailedprotectionsystemwouldhavebeena000mAreadingontheimbalancecurrentdisplay.However,sinceneithertheinstructionmanualnormaintenancesystemmentionedthis,andthata‘good’readingwouldhavebeenafew10sofmA,itwashighlyimprobablethatthecrewwouldhaveappreciatedthesignificanceofthissubtledistinction.Protectionsystemsforcriticalequipment,especiallywhentherearenoalternativeorback-upsystems,mustbefailsafe.Theyshouldalsobetestedatregularintervalstoverifythatallthesub-componentsinthesystemarefunctional.Greater,andmorecareful,considerationoftheprotectionsystemsprovidedformitigatingthefailureofHVequipment,isrequired.

2.5 HIGH VOLTAGE ENCLOSURES

2.5.1 Protection

Therewasevidencetosupportthatanarc-flashhadtakenplaceduringthisaccidentonboardQM2.Consideringtherecurrentproblemswiththevessel’sdamagedandleakingcapacitors,itisalsopossiblethatoneormoresucheventsmightalsohavetakenplaceinthepast.

Inthedesignofelectricalequipmentforthemarineindustry,insufficientconsiderationisgiventoitsabilitytowithstandanarc-flashevent.Therequirementofclassificationsocietiesforprotectionagainstarc-flashislimitedtohighvoltagemainswitchboardsonthepremisethattheriskofanarc-flasheventinjuringacrewmemberismoreprevalentinaswitchboard,wheremanualoperationofcircuitbreakersmaysometimesbenecessary.However,aswasthepracticeonQM2,theHFroomwasenteredroutinelybythecrewtoinspecttheHFcomponents.TheyalsotendedtoentertheroomwhentheHFalarmhadactivated,andtheHFequipmentwasthereforeinitsmostdangerouscondition.Thevesseloperatedwithadefectiveprotectionsystemandincorrectlywiredtripcircuits;itisthereforevery

54

fortunatethatanexplosiondidnottakeplacewhilesomeonewasinsidetheHFroom.Thisaccidentdemonstratesthatitisnolongertenabletorestrictarcresistantmeasurestomainswitchboardsalone.

2.5.2 Awareness of arc-flash

AlthoughtheCOSWPcovershighvoltageworkpermitandsanction-to-testprocedures,thereisnomentionofthehazardsofarc-flash.Awarenessofarc-flashhazardsneedstoimprovethroughoutthemarineindustrysothatdesigners,builders,owners,operatorsandengineersunderstandtheproblemsandthepotentialriskreductionmeasuresavailabletoreducethehazardtoaslowasisreasonablypracticable.Itisimportantthatthehazardsofarc-flashandthepersonalprotectiveequipmentwhichcouldhelppreventinjurywhenworkingnearliveelectricalequipmentbeincorporatedintotheCOSWPattheearliestopportunity.

2.6 ALARM MANAGEMENT

Duringthewatchbeforetheaccident,thedutyengineeracceptedapproximatelyonealarmeveryminute.Itishighlylikelythatthenumberofalarmsduringthebusyhoursofthedaywouldhavebeenevenhigher.Thepurposeofanalarmistoalertthewatchkeepertoananomalysothatappropriatecorrectiveactionsmaybetaken.However,ifthealarmsappearasfrequentlyasoneeveryminute,itwouldbealmostimpossibleforthewatchkeepertodealwiththemeffectively.Halfanhourbeforetheaccident,thedutyengineerhadacceptedtwofirealarmswithouttakinganyfurtheractionandwithoutactuallyknowingatthetimethatthesewerefalsealarms.

AlthoughduringthisaccidenttherewerenoalarmsontheIAStowarnthewatchkeeperoftheimpendingexplosionandblackout,aseriesof‘halfdrivelampalarms’begantoappearontheP1200systemstarting36minutesbeforetheaccident.ThefrequencyofalarmsontheIASataroundoneeveryminute,inadditiontoalarmsfromtheP1200systemismostlikelytohaveoverwhelmedthewatchkeeper,anditisnotsurprisingthatthepropulsionmotoralarmswerenotactedupon.Therefore,itisimperativethatshipmanagers,inconsultationwiththeclasssocietyconcerned,carefullyreviewmachineryalarmstomakesurethatcrewarewarnedaboutmajorequipmentfailuresandthatalarmsareprioritisedtofocusontheareasmostcriticaltomaintainingthesafetyoftheship.

2.7 WATER-MIST IN HIGH VOLTAGE COMPARTMENTS

ItwasapparentthatthedesignappraisalprocessfortheHi-FogsystemdidnotincludetheMSBandHFrooms;thesecompartmentswerenotincludedintheappraisaldocument.Whereasseveralcriticallocationssuchaswheelhouse,communicationroomandECRwerefittedwithapre-activationsystem,andthemachineryspacerequiredmanualinterventiontoreleasewater,theMSBandHFenclosureswerefittedwiththemostbasic‘wet’pipesystemasusedintheaccommodation,whichreleasedwaterassoonasthesprinklerbulbruptured.Itisunlikelythatthistypeofsystem,withtheriskofapressurisedpipeleakinginserviceandsprayingwaterontothehighvoltageenclosuresandequipment,wouldhavebeenselectedifthesecompartmentshadbeenincludedintheappraisalprocess.

AlthoughtheHFenclosuressatisfiedLR’srequirementtomeetIP44standards,thishadbeendoneinordertoprovideaneffectivemeansofcontainingthecoolingairandmeettheshipyard’sspecificationratherthanasanovertmeansof

55

protectionagainstwatermist.TheHFenclosurewasseverelydisruptedassoonastheexplosionoccurredandwasunabletomaintainprotectiontoIP44standardthereafter.

AlltheIMOreferencedocumentsagainstwhichtheappraisalwascarriedout,pertainedtomachineryspacesofcategoryA;itisunlikelythatthesuitabilityofusingFWBLAFFsystemsinhighvoltageareaswasthoroughlyconsideredordiscussed.

Therewasnoevidencetosuggestthatthewaterspray,whichwassustainedfor6minutes,orthesubsequentwater-mist,interferedwiththehighvoltageequipment.Theshiphadsufferedacompleteblackoutofallsystemswithinlessthan20secondsoftheexplosion,andtheelectricalnetworkwasdeadwiththepossibleexceptionofstoredenergyincomponentsduetocapacitiveeffect.Itwasfortunatethatthetwoengineerswhoenteredthecompartmentimmediatelyaftertheblackout,whileconsiderablewaterwassloshingaboutonthedeck,didnotcomeintocontactwithanychargedcomponents.Theconsequenceswouldalmostcertainlyhavebeenfatal.

AlthoughtestsconductedbyMarioffafterQM2wasdelivered,demonstratedthattheHi-Fogsystemwassafeforuseinahighvoltageenvironment,thereisnorecordthatthesetestresultshavebeenendorsedbytheIMOorIACS.ThereislittleornoguidanceonthissubjectintheFSSCodeorclassrules.LR’scurrentrulesareconfusing,explicitlyprohibitingtheinstallationofhighvoltageequipmentorenclosuresinareasprotectedbyFWBLAFFsystemsinonepartyetallowingFWBLAFFsystemsinareascontainingelectricalequipmentwithIP44ratedenclosures.Itisthereforenecessaryfortheclassrulestobereviewed,withtheaimofremovingsuchinconsistenciesandensuringthatinstallationsareproperlyconsidered.TheFSSCodemayalsoneedtobeamendedinduecoursetoincludeappropriateguidelinesfortheuseofFWBLAFFsystemsonhighvoltageequipmentandenclosures.

56

SECTION 3 - CONCLUSIONS

3.1 SAFETY ISSUES DIRECTLY CONTRIBUTING TO THE ACCIDENT WHICH HAVE RESULTED IN RECOMMENDATIONS

1. Itislikelythattheinitialdegradationofthecapacitorwasduetooneorbothoftwoanomalies:beingsubjectedtovoltagesinexcessoftheirdesignrating,orbeingexposedtofrequentvoltagetransientsduetoincreasednumberofswitchingcycles.Instancesoffailureinitiationduetominormanufacturinganomalies,thoughlesslikely,cannotbecompletelyruledout.[2.4.1]

2. Certainengineeringsystemscouldbepressurisedunderabnormaloperatingconditions.Theinherenthazardofinternalpressurisationofharmonicfiltercapacitors,andthesuddenanduncontrolledreleaseofpressureenergyfromthemwasnotconsidered.[2.4.2]

3. Thecapacitorexplosioncouldhavebeenpreventedifthecurrentimbalance-basedprotectionsystemwasfunctional.Theprotectionsystemwasnotdesignedtofailsafely;itispossiblethatthefailureofitstransformerremainedundetectedforseveralyears.Thereisnoevidenceoftheprotectionsystembeingtestedduringtheservicelifeofthevessel.[2.4.5]

4. ThefirstpossibleindicationofthedevelopingaccidentwasavailableattheP1200propulsionmonitoringsystemaround36minutesbeforetheaccident.ThesheervolumeofalarmsfromtheIASataroundoneeveryminute,inadditiontoalarmsfromtheP1200system,ismostlikelytohaveoverwhelmedthewatchkeeperanditisnotsurprisingthatthepropulsionmotoralarmswerenotactedupon.[2.6]

3.2 OTHER SAFETY ISSUES IDENTIFIED DURING THE INVESTIGATION ALSO LEADING TO RECOMMENDATIONS

1. Thisaccidenthighlightsthedangerstothecrewwhenenteringtheharmonicfilterroom,especiallytoinvestigateanalarm.Iftheharmonicfilterenclosurewasbuilttothesamestandardsashighvoltageswitchgear,thedamagecausedbytheexplosioncouldhavebeenmitigatedmoreeffectively.Thecaseforuniformapplicationofhighvoltageswitchgearprotectionstandardstoallotherhighvoltageequipment,wherecrewinterventionmayberequiredduringoperation,isthereforecompelling.[2.2.1]

2. Losingcontrolofalargecruiselinerduetoanelectricalblackout,with3823peopleonboard,isaseriousconcern.Thisaccidentdemonstrateshowharmonicdistortioncanleadtoelectricalinstabilityandcauseunpredictableandpotentiallydisastrousconsequencesinmarinehighvoltageelectricalnetworks[2.2.2]

3. AsvariablespeedACmotorsarebecomingmorecommonforpropulsionaswellasforauxiliarymachineryprimemovers,ships’crewwillbeexposedtovarioustypesofharmonicmitigationequipment.Itisimportantthatships’crewsgainathoroughunderstandingoftheissueofharmonicdistortionandharmonicmitigationequipment,sothattheyarebetterabletoappreciatetheimportanceoftheequipmentonboardandtaketimelyactionifsuchequipmentfailsordeteriorates.[2.3.1]

57

4. InDecember2010,whenQM2’sforwardHFalsofailed,thecrewhadaccesstomodellingdataontheexpectedleveloftotalharmonicdistortionofvoltagewhenallharmonicfiltersfail,andaninstrumentwithwhichtomeasuretheharmonicdistortionunderthesecircumstances.Theywerethereforeabletomanagethesituationwellwithoutcompromisingthesafetyofthevesselorherpassengersandcrew.[2.3.2]

5. Inavesselwhereelectricalinstabilityhasthepotentialtodisruptitselectricalnetwork,possiblyleadingtoablackoutandlossofcontrolinrestrictedwaters,theneedforpowerqualitysurveillanceissignificant.Regularmonitoringofpowerquality,usingapre-determinedpatternofpropulsionmotorloadingwithassociatedmotoroperatingparameters,wouldhelpensurethatthehealthofelectricalequipmentonboardiscloselymonitoredasthevesselanditsequipmentagesandusagepatternschange.[2.3.3]

6. AlthoughQM2’scurrentimbalancedetectionwastheonlyprotectionsystemfortheharmonicfilters,ithadnoback-upandwasnotfailsafe.Protectionsystemsofcriticalequipment,especiallywhentherearenoalternativeorback-upsystems,mustfailsafe.Theyshouldalsobetestedatregularintervalstoverifythatallthesub-componentsinthesystemarefunctional.[2.4.5]

7. Awarenessofarc-flashhazardsneedstobesignificantlyincreasedthroughoutthemarineindustry,sothatdesigners,builders,owners,operatorsandengineersunderstandthehazard,risksandthepotentialriskreductionmeasuresavailabletoreducethehazardtoaslowasisreasonablypracticable.AlthoughtheCOSWPcovershighvoltageworkpermitandsanction-to-testprocedures,itdoesnotmentionthehazardsofarc-flash.[2.5.2]

8. Thereislittleornoguidanceregardingtheuseoffixedwater-basedlocalapplicationfire-fightingsystemsincompartmentswithhighvoltageequipment.LR’srulesonthesubjectprovideconflictingguidance.[2.7]

9. ThefailuretoidentifythetrendofhighconsumptionofcapacitorsonboardQM2wasamajorcontributoryfactorinthisaccident.Componentfailurecanoftenbeasymptomofanunderlyingproblemwithanequipmentorsystem.Shipmanagersandcrewshouldbemorealerttothis,particularlywithnewtechnology.[2.4.4]

58

SECTION 4 - ACTION TAKEN

TheMarine Accident Investigation Branchhas:

• InDecember2010publishedasafetybulletin,informingtheindustryoftheaccidentandprovidingguidanceoncheckstodetectimpendingcapacitorfailures(Annex J).

• Issuedaflyertotheshippingindustrywiththisreport,whichdetailsthelessonslearntfromtheaccident(Annex K).

Carnival PLChas:

• IncludedharmonicfiltersinitslistofcriticalequipmentforQM2,andhasensuredthatproceduresexistforregulartestingoftheirprotectionsystems.

• Developedandimplementedproceduresfordealingwithharmonicfilterimbalancealarmsandenteringharmonicfilterroomsafteranalarmhasactivated.

• ReplacedallthecapacitorsinQM2’saftharmonicfilter.

Converteamhas:

• Issuedaservicebulletinalertingitscustomerstothepotentialforcatastrophicfailureofitscapacitorsandthecircumstancesthatcouldleadtothis.

• ReplacedthecapacitorsinQM2’saftharmonicfilterwithanimprovedandsaferdesign.

• Carriedoutaqualityauditofthecapacitormanufacturer.

Lloyd’s Register (Europe, Middle East and Asia)has:

• Progressedwithexistingworktoreviewitsrulestorecogniseandmitigatethehazardofarc-flashassociatedwithharmonicfiltersfittedinhighvoltageelectricnetworks.

• ChangedtheContinuousSurveyofMachineryrequirementstoremovetheneedtotestsamplesofdielectricfluidfromcapacitorcans.

59

SECTION 5 - RECOMMENDATIONS

Lloyd’s Register (Europe, Middle East and Asia)isrecommendedto makeasubmissiontoIACStodevelopaunifiedrequirementto:

2011/149 Improvethestandardsofprotectionthatarerequiredagainstharmonicdistortionandcomponentfailureinvesselsoperatinghighvoltagenetworks,toensure:

• thereisarequirementinallnew-buildvesselsthatmaybeaffectedbyharmonicdistortionofcurrentandvoltagethat:

Intheeventthatallharmonicmitigationsystemsfail,informationisprovidedonboardtodescribethemaximumextentofharmonicdistortionthatcanbeexpected.

Guidanceisprovidedsothatcrewcantakeeffectiveactiontokeeppowerandpropulsionequipmentoperating(atanappropriatepoweroutput)ifharmonicmitigationequipmentdegradesorfails.

• On-linemonitoringofharmonicdistortionofvoltageisrequiredfornewbuildvesselsand,forexistingvessels,thereisperiodicmonitoringtodetectchangeordegradationofharmonicdistortionlevels.

• Specificrequirementsaredevelopedtodetectandmitigateagainstthefailureofhigh-energystoragedevicessuchascapacitors.

2011/150 Reviewtherequirementsfortheenclosureofhighvoltagesystemstoensurethatthedegreeofprotectionisconsistentforallequipmentwherecrewinterventioncouldberequiredandthehazardfromarc-flashexists.

2011/151 Introduceaspecificrequirementensuringthatwherethefailureofanequipmentormachinerymayleadtoseriousdamagetothevessel,orinjurytopersonnel,itsprotectionsystemmustbeofa‘failsafe’type.

Lloyd’s Register (Europe, Middle East and Asia)isalsorecommendedto:

2011/152 Reviewandclarifyitsrulesontheinstallationoffixedwater-basedlocalapplicationfire-fightingsystemsincompartmentscontaininghighvoltagesystemsand,throughIACS,proposetheappropriateamendmentstoincorporatethisguidanceintheFSSCode.

The Maritime and Coastguard Agencyisrecommendedto:

2011/153 Usingthisreportandtheaccompanyingsafetyflyerasabasis,publishamarineguidancenoticetoraiseawarenessofthepotentialhazardsofexcessiveharmonicdistortionofcurrentandvoltage.

2011/154 ReviewandupdatetheCodeofSafeWorkingPracticesforMerchantSeamen(COSWP)toprovidemoredetailedinformationonthehazardsassociatedwithhighvoltageequipment,includingarc-flash.

60

Carnival UKisrecommendedto:

2011/155 Improvethestandardsofprotectionagainsttheeffectsofharmonicdistortionandcomponentfailureby:

• Instigatingaprogrammeofmodellingorotherappropriatemeanstodevelopsafevesseloperatingparametersandprocedurestobeusedintheeventofharmonicfilterfailure.

• EnsuringthatRMS Queen Mary 2’smaintenancesystemidentifiesallcriticalhighvoltagesystemprotectiondevices,andcontainsproceduresforperiodiccheckstoconfirmthattheyfunctioncorrectly.

• Implementingamethodofidentifyingandanalysingunexpectedlyhighratesofcomponentfailuresinharmonicfilterequipmentandotherhighvoltagesystems.

2011/156 ReviewthemachineryalarmsystemsfittedtoRMS Queen Mary 2inordertoidentifythosealarmswhichindicatefailureconditionsthatcouldsignificantlyaffectthesafetyofthevessel.Indoingso,actionshouldbetakentoprioritisesuchalarmsaboveothersthatrelatetothemoregeneraloperationoftheship,sothatoperatorscanmorereadilyrecognisecomplexsystemfailuresandrespondappropriately.

Marine Accident Investigation BranchDecember 2011

Safetyrecommendationsshallinnocasecreateapresumptionofblameorliability

Marin

e Accid

ent R

epo

rt