Fatality in the elevator trunk on board OOCL Kuala Lumpur, 8.5 nautical miles south-east of Port Botany, New South Wales, on 3 June 2018

During the afternoon and evening of 2 June 2018, the 280 m, 5,888 TEU^[1] fully cellular container ship OOCL Kuala Lumpur (Figure 1) was stopped and drifting about 20 NM^[2] south-east of Port Botany, New South Wales. Weather had deteriorated with winds in excess of 40 knots, and the ship’s arrival time into Port Botany had been pushed back because of disruptions to port operations. The officer of the watch (OOW) recorded in the ship’s bridge log that the ship was rolling easily to moderately in about 30 knot winds from the south and 4 to 5 metre seas from the south-east. The main engine was on short notice and the ship’s engineers maintained watches.

There had been problems with a refrigerated cargo container not maintaining temperature and from about 1800^[3] the electro-technical officer (ETO) and fitter had been on deck attending to the container. At about 2145, the ETO contacted the chief engineer to update him on the work and seek advice. Together they attended the container and by 2230 the repair was complete. They returned to the ship’s accommodation and completed paperwork recording the work, some of which was passed to the master for forwarding to shore management.

Figure 1: OOCL Kuala Lumpur

Source: Owen Foley, Shipspotting.com

Just before 0400 on 3 June, the second engineer^[4] left his cabin to go to the engine room to commence his engineering watch and found the elevator to be inoperative. It was stopped on the third deck, the lowest level of its travel. It was usual to position the elevator at this level and lock it out when there was a fault with it or rough weather meant it was advisable not to use it. During the watch handover from the third engineer, the second engineer was informed that the lift was faulty. He decided he would discuss the fault and its repair during the scheduled morning toolbox meeting.

In Port Botany, pilotage operations resumed at 0700 on 3 June and OOCL Kuala Lumpur’s master was notified that pilot boarding time was 1000 that morning. At 0800, the OOW began preparing for standby and manoeuvring.

At about the same time, the master and chief engineer were making their way to breakfast. They called the elevator so as to go to the mess room several decks below. The elevator did not respond to the call so they used the stairs. In the mess room they met the ETO and discussed the unserviceable elevator. The ETO advised that he was aware of the fault—the elevator cage doors were not closing because the drive chain sprocket had come adrift and would require refitting. He stated that he would make preparations to repair the fault and discuss with the chief engineer after breakfast.

Elevator maintenance

The fourth engineer had taken the engineering watch at 0800 and was preparing the machinery for manoeuvring. In the engine control room (ECR), the daily work toolbox discussion was held, led by the second engineer. Also present were the chief, fourth and fifth engineers, the fitter and the ETO. During this meeting, among other tasks, the elevator fault was discussed. The ETO said he knew of and understood the fault and would complete the repair with the fitter. He then went about completing the required paperwork, including an electrical work permit (EWP) and a hazard identification and risk assessment form.

The chief engineer authorised the EWP at 0820. The requirements of the task were discussed and the ETO showed the chief engineer the chain drive sprocket and explained the repair. They discussed how the work was to be completed, agreeing that the ETO would isolate the elevator and access the elevator cage top (Figure 2) through the engine room second deck elevator entrance door, and the fitter would complete the repair. The ETO undertook to notify the chief engineer when the repair work was complete and testing would proceed. The ETO and fitter went to do the work and the chief engineer turned his attention to the imminent main engine movements.

Figure 2: Elevator cage top from entrance door (forward)

Source: Singapore Transport Safety Investigation Bureau; Worksafe Victoria and ATSB

The EWP required that warning notices were placed on all decks and elevator doors, and that a public address announcement was made informing all crew members that the elevator was out of service and was not to be used. During the ATSB investigation, no evidence was provided to show that these precautions were put in place. The master and the OOW were aware that the work would take place but were not informed that it was underway.

At 0836, the main engine was tested ahead and astern, followed by steering gear checks. Passage to the pilot boarding ground (7.5 NM to the north-west) resumed at 0845. By 0900, the ship had a speed of just over 8 knots and was on a northerly heading. Winds were south-westerly at about 20 knots, with seas about 2.5 m from the south-east. The weather and movement of the ship in the following sea were not considered sufficiently hazardous to prevent the elevator work from continuing.

For the elevator work, the ETO isolated the electrical power supply in the elevator machinery room, returned to the engine room and opened the second deck elevator access door. The elevator cage top was about 1 m above the second deck and this provided relatively easy access to the cage top and the cage door drive mechanism which was to be repaired. The ETO activated the local emergency stop and set the control switch from ‘AUTO’ to ‘MANUAL’ on the cage top operating panel (see the section titled Elevator in Context).

The fitter then went about the repair. A replacement key was fabricated for the chain drive sprocket and together these were fitted in place on the drive shaft and the chain fitted. The repair took about 10 minutes. The ETO satisfied himself that the repair was complete and that the elevator could be tested before being brought back into service.

At about 0915, the ETO returned to the ECR to speak with the chief engineer. The chief engineer recalled that the ETO advised that he intended to restore electrical power and test the elevator from inside the elevator cage. This would entail driving the cage up and down between floors and ensuring that the cage doors operated correctly and consistently at each level.

Elevator testing

The ETO went to the elevator machinery room and de-isolated the machinery. He then returned to the second deck elevator landing and gave instructions to the fitter to close the door behind him. He then climbed onto the top of the elevator cage. The fitter last saw the ETO standing at the back of the cage, atop the elevator cage emergency escape door and behind the operating panel, facing the fitter. He recalled that the emergency stop button was depressed and the elevator control selector switch was in ‘MANUAL’. As instructed, the fitter closed the door.

Soon thereafter, the fitter heard the lift operate, noticed the up and down indicating lamps activate briefly and the landing door handle move. This was followed by impact noises (thuds) and continuous clicking. In response to the unusual sounds, he attempted to open the access door. However, the landing door interlock mechanism was now engaged and he was unable to open it.

At 0930, in the ECR, the chief engineer decided to check on the progress of the elevator work and went into the engine room. He went to the elevator landing and saw the fitter attempting to open the door. The fitter explained about the noises he had heard and that he was concerned. The chief engineer then attempted to open the door. After some effort the door opened. Inside, he could see that the upper section of the door frame and the door closer were damaged.

The chief engineer looked into the elevator shaft and saw the ETO hanging, unresponsive, head-down, from the bottom of the elevator cage, about half a metre above the doorway. He was caught between the cage and the forward bulkhead.

Accident response

The chief engineer hurried to the ECR to raise the alarm and summon help. The fourth engineer called the bridge and asked that the elevator shaft emergency escape door (on the wheelhouse top) be opened as this would activate the escape door micro-switch and prevent movement of the elevator.

At 0936, they activated a manual call point which triggered the general alarm and alerted all crew to the unfolding emergency. The chief engineer reported to the master and at 0937 the master contacted Sydney vessel traffic service (VTS) seeking urgent medical assistance. VTS contacted the Ambulance Service of New South Wales for assistance and also went about making arrangements to get paramedics to the ship. The harbour master, container terminal management, and other authorities were also notified.

On board, the cage was stopped midway between the second and upper decks. Many of the ship’s crew had mustered at the upper deck elevator entrance door and it was opened to allow access to the top of the cage. The chief mate, fourth engineer and fitter entered the lift trunking and climbed down onto the cage. They activated the emergency stop, opened the cage escape door and entered the cage. The cage sliding doors were closed, with one panel showing signs of damage. The ETO could not be seen and they went about removing one of the door panels to gain access to him.

Meanwhile, ashore, soon after being notified, a VTS officer went to the adjacent pilot office and informed the duty pilot of the accident. The duty pilot was in the office performing administrative duties (such as taking bookings and making pilot allocations) to assist the rostered pilot and was not required to pilot ships during this time. However, the rostered pilot was in the midst of guiding a ship out of port and had been scheduled to transfer from that ship to OOCL Kuala Lumpur at 1000 to bring it into port. Once notified of the accident and the need to get OOCL Kuala Lumpur into port for medical assistance, the duty pilot quickly prepared to attend the ship and conduct the pilotage. He gathered his things, proceeded to the wharf and boarded the waiting pilot launch. At 0944 the pilot boat left the wharf.

At 1015, the pilot boat was alongside OOCL Kuala Lumpur and the duty pilot boarded the ship. Once on board and on the bridge he obtained an update of the emergency and notified VTS. At this stage the ETO was still trapped. Discussions were held regarding the most suitable option for boarding medical staff. The heavy weather restricted access for a helicopter and also limited the suitable locations for personnel to board from a boat. The decision was taken to bring the ship in as far as the swing basin off Brotherson Dock,^[5] create a lee, and have the medical staff board from the pilot launch. The duty pilot took the con^[6] while the master and OOW were busy with communications and on board happenings.

The pilot boat departed OOCL Kuala Lumpur, proceeded to the outbound ship and embarked the rostered pilot at 1026. After discussions between the two pilots, it was agreed that the rostered pilot would return to port in the pilot boat. There he would assist the embarkation of an emergency response team (paramedics and rescue personnel) and return to OOCL Kuala Lumpur with them.

At 1033, two harbour tugs were approaching the ship as it was passing Henry Head at a speed of 10.3 knots. Discussions between the two pilots and VTS had agreed to also use a third tug which was available and at 1035 this tug departed the tug den in Brotherson Dock.

At about this time, the ETO was freed and taken into the elevator cage. The cage was manually moved to the upper deck where the ETO was moved to the ship’s hospital. At 1042, the first tug was made fast centre lead aft while the second tug approached to tie-up on the port shoulder.

Ashore, emergency services personnel including paramedics were assembled. They boarded the pilot launch and at 1049 departed. Meanwhile, the second tug had been made fast on OOCL Kuala Lumpur’s port shoulder and the third tug was alongside. At this time, the duty pilot guided the ship in toward Brotherson dock, washed off speed, and commenced swinging the bow to port to bring the ship round with the starboard side towards the intended berth. At about 1050, as the ship swung round, the pilot launch came alongside and the emergency services personnel and the rostered pilot boarded.

Once on board, at about 1054, the paramedics were directed to the ETO and the rostered pilot proceeded to the bridge. At 1100, the pilot launch departed the ship as it was manoeuvred into dock. At 1118, the first line was ashore.

The paramedics provided what assistance they could but at 1135 the ETO was declared deceased. OOCL Kuala Lumpur was all fast alongside Brotherson Dock 7 at 1148.

Post-accident

Authorities boarded the ship at Port Botany and commenced investigation of the accident. Cargo operations commenced at 1518,

At 0118 on 6 June, OOCL Kuala Lumpur departed Port Botany bound for Melbourne, Victoria. The elevator remained out of service. On 8 June, while alongside in Melbourne, an inspection of the elevator cage top electrical and control equipment was completed by the Principal Engineer of Worksafe Victoria. Close visual and physical inspection of the cage top operating panel buttons did not reveal any faults or indicate that the buttons may have malfunctioned.

From Melbourne, the ship continued its voyage until arrival into Singapore on 23 June. During this port call, the vessel manager, Synergy Marine, had arranged for the elevator to be serviced and brought back into use by the elevator manufacturer. Marine Safety Investigators from the Singapore Transport Safety Investigation Bureau attended and reported their observations of the elevator to the ATSB.

Damaged components were repaired and refitted to the elevator cage and the second deck landing door. The elevator was recommissioned after verification of operation in ‘MANUAL’ and ‘AUTO’ modes. An annual safety inspection was completed, a certificate issued and the elevator declared in good working order. No operational malfunctions were reported during inspection, repair and testing of the elevator.

__________

1. TEU – Twenty-foot Equivalent Unit, a standard shipping container. The nominal size of container ships in TEU refers to the number of standard containers that it can carry.
2. A nautical mile of 1,852 m.
3. All times in this report are local time, Eastern Standard Time – UTC + 10 hours
4. OOCL Kuala Lumpur’s engineering personnel consisted of chief, second, third and fourth engineers, electro-technical officer, cadet (fifth) engineer, a fitter and three motormen.
5. OOCL Kuala Lumpur was originally scheduled to berth at number 7 Brotherson Dock.
6. Conduct of the ship’s passage means directing the navigation and movement of the ship.

OOCL Kuala Lumpur

At the time of the accident, OOCL Kuala Lumpur was registered in Singapore, owned by Grace Ocean (Singapore), managed by Synergy Marine (Singapore) and classed with ClassNK (Nippon Kaiji Kyokai).

OOCL Kuala Lumpur had a complement of 23 Indian nationals, including 3 trainees and a supernumerary. All were qualified for the positions which they held.

The master joined the ship as chief mate in January 2018 and was promoted to master after one voyage, about 2 months before the accident. OOCL Kuala Lumpur was his first command. He held a Deck Officer Class 1 (Master) certificate of competency from Singapore (obtained in 2016) and had worked with Synergy Marine for 9 years.

The chief engineer held a Singapore Class 1 Marine Engineer’s certificate of competency obtained in 2017 after earlier completing a Bachelor of Engineering (Mechanical) in India. This was his first ship as chief engineer and his third time on board OOCL Kuala Lumpur; previous trips had been as second engineer. He joined the ship about 4 months prior to the accident and had worked for Synergy Marine for 6 years.

The electro-technical officer (ETO) first went to sea in 2013 and had worked with Synergy Marine since 2014 as a trainee and then as a qualified electrical officer. In 2018 he obtained an Indian certificate of competency as electro-technical officer and joined OOCL Kuala Lumpur in this capacity in February 2018. All the ETO’s sea service had been on container ships.

Safety management system

General

Elevator maintenance was considered by Synergy Marine as hazardous and thus required close attention to ensure a safe system of work. The Synergy Marine safety management system (SMS) included procedures, guidance and forms relevant to completion of unplanned elevator maintenance such as being undertaken on 3 June. In particular, the system included hazard identification and risk assessment and permit to work (PtW) documents.

Health and safety manual

The Synergy Marine Health and Safety Manual included a chapter on Permit to Work. One section of this chapter was devoted to Elevator Maintenance. The information provided included descriptions and illustrations of the hazards involved. Prominent in these pages were the dangers of being trapped by the moving elevator car, electrocution and falling from height. This information was repeated in the opening pages of the Electrical Work Permit book.

Hazard identification and risk assessment

Hazard identification and a risk assessment were required for new or unfamiliar tasks. The form consisted of two pages, and could be expanded as needed. Activity steps were listed and a table identified the hazard, consequence, control and recovery measures in place for each step. The risk for each step was then assessed and residual risk determined.

Forms completed for recent elevator maintenance were all similar in content, with each identified hazard having its review date updated to that of the form completion (Appendix A). In all, seven hazards and control measures were identified. Of these, the hazard of ‘sudden uncontrolled movement’ had control measures of:

• ensure the local emergency stop button is activated
• isolate and lock out the main breaker
• tag out.

The likelihood of this event was adjudged remote and the residual risk very low. The highest residual risk level for any of the identified activity steps was assessed as ‘medium’ and no activity step included any additional control measures to reduce the level of risk.

Electrical work permit

The Synergy Marine Electrical Work Permit (EWP) system included permit books, each of which contained guidance and permit forms. Opening pages (17 in all) of each book contained guidance on the use of the permit to work system for electrical work, including examples. Of the guidance pages, nine pages were devoted to ‘Elevator Maintenance’. This section repeated the information provided in the Health and Safety Manual and further included a table of ‘Risk Assessment Considerations for Elevator Maintenance’. This table identified risks for different elevator related maintenance areas.

The remainder of the book contained blank EWP forms for use. The EWP form comprised two pages divided into general administrative detail and a line item list of ‘Additional Precautions’ to be completed (Appendix B). The administrative information included things such as description of the work, isolations details and permit authorities.

The ‘Additional Precautions’ section included 35 line items specific to the task being undertaken. Of these, 11 items related to all electrical jobs regardless of task content and 7 were related to high voltage (more than 650 V) tasks. The remaining 17 line items were to be completed specifically for elevator jobs, including 6 line items for ‘Additional checks when working on top of cage’.

All electrical jobs required:

• a risk assessment to be carried out or an existing risk assessment to be reviewed
• isolations or precautions to be in place to prevent accidental operation of the equipment
• that communications were tested
• a tool box meeting to be completed.

The significant portion of the EWP book and form devoted to elevator work (more than half of the risk mitigation line items to be checked) indicated that Synergy Marine considered this work to be of high inherent (residual) risk. The EWP form elevator-specific check items highlighted risk barriers to be in place for any work on the elevator (see the section titled Elevator work precautions, below).

Elevator

OOCL Kuala Lumpur is fitted with an Ushio Reinetsu, single wrap, traction geared type elevator rated to carry 6 persons or 500 kg. The elevator operates within a hoistway 39 m in height servicing 8 levels from the third deck (engine room) to the navigation bridge deck level (Figure 3).

The operation of the elevator, including all associated safety interlocks, is controlled by a micro‑processor based programmable controller. This system contained no stored memory capacity. Therefore, disruptions to the control logic due to operation of protection devices or power loss resulted in reset of the system logic. That is, all call requests outstanding at the time of the interruption were reset and not stored.

The elevator machinery and control unit are located in the elevator machinery room located on E deck, 2 decks below the navigation bridge and about 25 m above the third deck level. When there is no electrical power supply to the elevator, the elevator cage can be raised or lowered by fitting a provided hand-wheel to the electric drive motor. When the traction machine brake is released, the hand-wheel can be turned in either direction to move the elevator car up or down.

Figure 3: Elevator hoistway arrangement and location of accident

Source: Kowa Marine Service and ATSB

Latched push button ‘EMERGENCY STOP’ switches are fitted inside and on top of the cage. When activated, all elevator motion ceases and an emergency stop indicator lamp on the control panel in the elevator machinery room is illuminated. When the switches are reset, the elevator control system reactivates.

The elevator installation has two escape doors—in the cage top and from the elevator hoistway (on the navigation bridge top). These doors have micro‑switches fitted which detect when they are opened. Once operated, the escape door switch circuit requires manual reset in the elevator machinery room. The elevator cage will remain in its current location and will not operate until the escape door is closed and the circuit has been reset.

Micro-switches are also fitted to the cage and landing doors. Although the cage door is motorised and driven via a chain and sprocket, the landing doors are conventionally hinged and manually operated. In order to prevent access to the open lift shaft, the landing door also has an interlock mechanism that only permits it to be opened when the elevator is adjacent to the landing.

Operation

Normal (automatic) operation

Under normal operating conditions, the elevator will respond automatically to floor and cage operating panel floor call request inputs. Should any of the protection devices activate (emergency stop or door open) or there is a loss of power (blackout), the cage will stop moving and the call request queue is reset. The elevator cage will remain stationary until power is restored, or the protection device is reset, and a new floor request order is received.

Manual operation

The elevator can be operated in ‘MANUAL’ mode from the operating panel on top of the elevator cage. In ‘MANUAL’ mode, all operating signals come from the cage-top operating panel. This panel contains six control buttons (Figure 2):

• ‘AUTO’—‘MANUAL’ rotary switch
• latching ‘EMERGENCY STOP’ button
• four ‘push and hold to run’ buttons:
  • ‘CAGE UP’
  • ‘CAGE DOWN’
  • ‘DOOR OPEN’
  • ‘DOOR CLOSE’.

Manual operation of the cage doors requires the emergency interlocks (emergency stops and escape doors) to be reset. To manually drive the cage up or down using the push buttons requires that the interlocks are reset and that the cage and landing doors are all closed.

If power is lost, an emergency stop is activated, or a door opens, the elevator stops and remains in its current location. When the power is restored, the emergency stop reset and all doors closed, control reverts to the push buttons. Any calls for the elevator from floor panels or the cage internal panel have no effect—the calls do not queue and are not stored by the control system logic.

If control is changed from ‘MANUAL’ to ‘AUTO’ the system remains in its current state, with the cage stopped, until a call request is made. The system will then respond and move the cage to the requested deck.

Maintenance

Based on the elevator manufacturer’s guidance, OOCL Kuala Lumpur’s planned maintenance system included regular monthly, 3-monthly and annual checks.

The monthly maintenance routine included checks of equipment which was located in the elevator hoistway and outside the elevator cage. This included checks of the wire rope, the cage and counterweight guides, and the guide rail lubrication.

The 3-monthly checks included the monthly checks plus more comprehensive inspections of the entire elevator system, including in the hoistway and outside the cage. The annual check included the monthly and 3-monthly items plus additional component securing and system control checks.

It was usual that these maintenance routines included driving the elevator from the cage top.

Maintenance records showed that four routine elevator tasks (one 3-monthly and three monthly checks) had been completed since the ETO joined the vessel. Evidence was provided to show that risk assessments had been completed for at least the three most recent tasks, including the 3-monthly check. Crew members testified to having assisted the ETO to complete recent elevator checks during which the ETO operated the elevator, in ‘MANUAL’ mode, from the cage top.

Elevator maintenance by shore-based service companies

Records showed that OOCL Kuala Lumpur’s elevator had undergone inspection and repair by shore-based elevator repair companies in July and September 2016 and October 2017. These services included operational tests of the elevator, including all safety devices.

Elevator work precautions

Elevator maintenance presents risks to those completing the work. Work within the elevator hoistway and on the cage top is particularly hazardous and guidance is provided to increase awareness of the risks and advise suitable mitigators to put in place.

Elevator operating manual

The elevator manufacturer’s operation manual provided a section on cautions for inspection or maintenance. General guidance included advice to:

• use a work permit
• post warning signs at each entrance door
• ensure alarms are operable before commencing work
• not work alone
• ensure good communications.

The operating manual then provided specific advice for work on the cage top. This advice included:

• ‘AUTO’—‘MANUAL’ switch to be in the ‘MANUAL’ position
• ‘EMERGENCY STOP’ to be engaged
• manually operate the elevator after releasing the emergency stop.

Electrical work permit

The precautions listed in the Synergy Marine electrical work permit (EWP) expanded upon those in the operating manual. In addition to the EWP requirements for all electrical jobs, specific requirements for elevator maintenance included:

• the officer of the watch, on the bridge, was to be informed
• an announcement was to be made on the public address system
• notices were to be placed on all decks and doors indicating the elevator was out of service
• communications between the elevator machine room and the top of cage were to have been tested
• an assisting person was to be nominated and was to remain in eye contact at all times
• all alarms and trips were to be tested prior to maintenance
• the work was to be supervised by a senior engineering officer.

Additional checks for when working on top of the cage included:

• the power was to be isolated
• the top of the cage was to be accessed by the elevator cage escape hatch only
• elevator control was to be changed from ‘AUTO’ to ‘MANUAL’
• the cage top ‘EMERGENCY STOP’ switch was to be activated
• the ‘EMERGENCY STOP’ was to be released only when required to operate the elevator
• persons were to stand in the ‘Safe Zone’ at all times (atop the closed elevator cage escape hatch (Figure 2)).

Once maintenance was completed, the power to the elevator was to be isolated and the escape hatch opened before changing control from ‘MANUAL’ to ‘AUTO’ and exiting the cage top. Opening the hatch required the escape reset to be pushed in the elevator machinery room. The control system would then power-up and the elevator return to normal operation.

The EWP precautions ensured that control of the elevator remained with the person on top of the cage and until they were clear. This ensured that the elevator would not move without their knowledge and direction.

Industry guidance

The United Kingdom Maritime and Coastguard Agency (MCA) publication Code of safe working practices for merchant seafarers (COSWP) is a widely referenced nautical publication which provides best practice guidance for improving health and safety on board ships. In respect to the maintenance and testing of elevators, COSWP advised that:

• the work is to be completed by competent persons only, with practical and theoretical knowledge, experience and understanding of the plant being worked on
• appropriate isolations must be in place
• a risk assessment is required—safe work procedures are to be drawn up and followed
• no person should work alone
• appropriate signage must be prominently displayed
• barriers must be in place to protect open doorways.

COSWP mentioned that the most important single factor in minimising risk of accidents was the avoidance of misunderstandings between personnel.

Further, the British Standard Code of practice for safe working on lifts (BS 7255:2012) provides useful guidance on safe practices when working in and around elevators. This includes advice in relation to accessing and exiting the elevator cage top.

Additionally, more targeted and specific operational guidance can be sought from elevator service organisations which provide services to the ship and company. This complements advice available from the manufacturer of the specific elevator installation in use on board.

Inspections and approvals

Post-accident inspections

Inspections of the elevator, associated equipment and machinery and the ship were completed by the ATSB and other authorities in the immediate aftermath of the accident. Subsequently, prior to recommissioning of the elevator in Singapore on 23 June, additional inspections by elevator experts, including the manufacturer, were completed. No evidence of faulty control equipment or operation was found during any of the inspections.

Flag – Singapore

The flag Administration advised that they do not have any specific regulatory requirements related to ship elevators. However Singapore advised that, under the ISM Code, the shipping company is responsible to ensure that any equipment and installation on board is inspected and maintained in good working condition. That is, the company is responsible to ensure the elevator is maintained as per the manufacturer’s requirements and is covered under the ship’s planned maintenance system (PMS) and, therefore, is maintained and safe for use.

The vessel was inspected by flag^[7] twice during the preceding five years with only one observation, related to the operation of tank valves.

In addition to this, the vessel was inspected by Port State Control (PSC)^[8] regularly during the preceding five years with no deficiencies found which related to elevator inspection and maintenance.

Classification – ClassNK (Nippon Kaiji Kyokai)

A classification society is a non-governmental organization that establishes and maintains technical standards for the construction and operation of ships and offshore structures. Classification is to verify the strength, integrity, function and reliability of a ship’s structure and systems in order to maintain essential services on board. Classification societies aim to achieve this through the development and application of their own rules and by verifying compliance with international and/or national statutory regulations on behalf of flag Administrations.

OOCL Kuala Lumpur’s classification society, ClassNK, advised the ATSB that there were no international rules or regulations relating to ship elevators. However, some Administrations issue their own rules for elevators. ClassNK also advised that registration of shipboard installations with a classification society is at the owner’s request and it is not mandatory to register installations such as an elevator. It is then the owner’s responsibility to maintain the ship’s elevator in accordance with the manufacturer’s instructions. If an elevator is registered with ClassNK, it will be included in the ship’s register of equipment and machinery and subjected to periodic survey.

OOCL Kuala Lumpur’s elevator was not registered with ClassNK as a surveyable item.

Previous elevator accidents

Elevator accidents continue to occur around the world and result in about one fatality per year. The ATSB last conducted such an investigation in 2007.^[9] Since that time, more than 10 fatal ship elevator accidents have been reported internationally.^[10]

Many of these accidents involved the failure to apply existing safety management procedures and/or identified safety barriers that have proven effective in reducing the risks associated with elevator maintenance. These include procedures related to communications, supervision and machinery isolation/lockout. Furthermore, the injured person was often working alone and riding the elevator cage.

__________

7. Flag State Inspections (FSI) are used by flag States to ensure satisfactory standards are being maintained on board vessels flying their flag.
8. Port State Control (PSC) is an internationally agreed programme for the inspection of foreign ships in other national ports. If a ship is found to have deficiencies, it may be detained until the issue is resolved.
9. ATSB marine occurrence investigation report number 235, Crew member fatality on board British Mallard, 27 January 2007—available at www.atsb.gov.au/marine/
10. See IMO website for further information—https://gisis.imo.org/Public/

Introduction

On 3 June 2018, OOCL Kuala Lumpur’s electro-technical officer (ETO) was conducting testing of the ship’s personnel elevator after completion of mechanical repairs. While on top of the cage, the ETO became trapped between the moving cage and the bulkhead, and was fatally injured.

OOCL Kuala Lumpur’s safety management system (SMS) required that detailed planning and preparation, including multiple safety checks and barriers, were implemented prior to conducting elevator maintenance. This included the need to complete a risk assessment, an electrical work permit and a toolbox meeting before commencing the work. The ETO was the most appropriate person on board to complete this task as he had electrical qualifications and previous experience working on the elevator.

This analysis will examine the circumstances around how the ETO became trapped and will include a review of the guidance and procedural preparations and assessment of the elevator maintenance task.

The accident

After completion of mechanical repairs, the ETO notified the chief engineer of his intention to test the elevator. He then returned to the second deck elevator landing to provide a final brief to the fitter. The elevator cage top was positioned at a convenient access height above the second deck level (about 1 m) and a similar distance below the top plate of the landing door frame.

At this stage, the elevator control was isolated via the safety interlocks provided by the landing door being open, the cage top emergency stop being activated, and the control switch set to ‘MANUAL’. In this position, it was possible to de‑activate the emergency stop and manually operate the cage door using the control panel pushbuttons, without the need to drive the elevator up and down or climb on top of the cage.

However, the ETO was last observed on top of the elevator cage, standing in the safe zone, looking forward, with the elevator control in ‘MANUAL’ and the cage top emergency stop engaged. When the fitter closed the second deck elevator landing door, the door open interlock was reset and full elevator control reverted to the cage top operating box if the emergency stop was de‑activated. In this position, at this time, control of the elevator resided with the ETO.

From here, it was possible for the ETO to safely observe the operation of the elevator and sliding doors. The sliding door cams and position-sensing micro‑switches were visible and he could manually open and close the doors using the push-and-hold door buttons on the control box. With all doors closed and all interlocks reset, he was also able to drive the elevator up and down using the push-and-hold buttons on the control box. The buttons only worked while depressed and as soon as released, all motion stopped.

After the accident, the ETO was found on the forward side of the elevator, toward the port side, in an inverted position. The top plate of the second deck landing door frame was found damaged and bent upwards with the door position micro‑switch dislocated and the door closer damaged (Figure 4). This indicated, that, at some stage after the second deck elevator access door was closed, the ETO moved away from the cage top safe zone to a position that exposed him to a crush hazard beyond the side of the cage. It was not possible to determine the reason for this re‑positioning.

The elevator travelled several metres vertically from its original location until the cage bottom was about 0.5 m above the second deck doorway top plate. The push-and-hold design of the manual control buttons meant that if the ETO had been driving the cage manually, it should have stopped once he was struck and his finger was removed from the button.

Figure 4: Accident location and damage to second deck elevator landing door frame

Source: Synergy Marine, Worksafe Victoria and ATSB

Inspections and tests completed after the accident, including those by the elevator manufacturer during repair and recommissioning, found no fault with the elevator control system and equipment, in ‘AUTO’ or ‘MANUAL’. Therefore, for the cage to have continued for some distance from where the ETO was struck, the control must have been in ‘AUTO’ and the elevator movement was the result of a floor call request. It is likely that the elevator stopped when one of the door sensing micro‑switches was dislocated and indicated to the control system that a door had opened.

As the specific actions of the ETO on top of the elevator cage were not witnessed or communicated, it was not possible to determine why automatic control of the elevator was selected contrary to maintenance requirements.

Safety barrier implementation

This accident highlights that safety measures identified on the Electrical Work Permit (EWP) and in the risk assessment should be taken at all times. If not, any person conducting elevator maintenance, especially on the cage top, is exposed to significant risk. The elevator must remain under the control of the person(s) on top of the cage at all times, up to and until they have safely exited the cage top and the hoistway.

Warning signs and announcements

The EWP form included a list of checks to be filled for maintenance on elevators in addition to those for all electrical work. The first two items on this list were:

• notify the bridge and have a public address announcement made
• place notices for elevator maintenance on all decks and doors.

For the work to be completed on 3 June, these prominent risk barriers were annotated as being in place but the evidence showed that they were not. Amongst other evidence, when ATSB investigators attended the ship on 4 June, warning notices were not universally in place. Furthermore, interview testimony was that although the bridge team were aware that elevator maintenance would be undertaken, they had not been notified that it had started or when the work would be completed. Consequently, no public address announcement in respect to the elevator was made. No explanation for this could be determined.

Systems of safe work rely upon adherence to notices and announcements to ensure the effectiveness of the safety net placed around a task. Although announcements and warning signs are not sufficient safeguards alone, they are important in making persons whose actions may affect the safety of a task aware that this task is taking place.

Had these barriers been put in place, the likelihood of an inadvertent request for the elevator, and subsequent unexpected movement, would have been much reduced.

Supervision and other electrical work permit precautions

In addition to the warning announcement and notices mentioned above, the EWP also listed other precautions several of which were either not in place or not completely implemented. This included:

• A senior engineering person was to be identified to supervise the work. This would have allowed third party technical scrutiny of the work plan and provided an opportunity to change the way in which the task was to be completed.
• An attendant person was to be nominated and was directed to remain in eye contact with the person conducting the task. This meant a second person would observe the worker and might therefore be able to warn of dangers or impulsive actions.
• Entry to, and exit from, the cage top was to be via the elevator cage escape hatch only, with the hatch being opened before control was changed from ‘MANUAL’ to ‘AUTO’. This would have ensured that persons were clear of the cage top before control was changed to ‘AUTO’ and power was restored to the elevator.

Prior to commencing the work, the chief engineer had discussed the job with the ETO during the morning, been present during the tool box meeting, had approved the daily work plan and the risk assessment, accepted the EWP role of supervising engineer, and had authorised and signed the permit. Subsequently, from his station in the machinery control room he would have been aware that no warning announcement was made. Furthermore, the worksite was only a short distance away, on the same deck, and the chief engineer could have readily determined if all permit conditions were in place. At this time, the work could have been stopped and the entire process and plan been re-assessed.

Later, the ETO correctly notified the chief engineer that he was going to test the elevator, after the repair had been completed. At this time, the intentions of the ETO and the details of what he was planning to do should have been clearly conveyed to and understood by the chief engineer. However, in testimony, the chief engineer stated that they discussed the testing but he did not expect that the ETO would do so by driving the elevator from the cage top.

As a consequence, opportunities were missed—initially to correct errors in not following the EWP requirements and then for final scrutiny and advice—which may have altered the actions taken or the intentions of the ETO to test the elevator. Had the EWP barriers been fully implemented and this level of oversight provided, the task might not have progressed to the point of testing which involved the ETO driving the elevator from the cage top.

Considerations

Although the exact motivation and actions of the ETO could not be determined, several possible influences were present at the time. Port calls are busy times for the ship’s personnel and there would be limited time available for the ETO to complete maintenance other than that related to the cargo and cargo operations. Possible motivations for completing the elevator maintenance at this time include logistical and time considerations, such as:

• the elevator is an important part of the ship’s equipment and would be heavily utilised during the port stay
• the ship was to receive a harbour pilot on board at 1000 that morning—this was a busy time for engineering staff and, for the ETO to be ready for manoeuvring, meant that the repair would need to be completed before this time
• the pilot boarding point was through a gunport door at the second deck level, into the engine room; it was then 8 decks to the navigation bridge, a climb of about 30 m—having the elevator available would be beneficial and reflect positively on the ship
• the repair was straightforward and only required about 10 minutes to complete—that is, the short time available was considered sufficient to complete the job
• the ETO was familiar with the machinery and had completed several maintenance tasks, including driving the elevator from the cage top, since joining the ship
• placing and removing notices on all decks and doors may take longer than the task itself.

Although these considerations are acknowledged, this accident illustrates the importance of following documented procedures and safe working practices. Working from the top of an elevator cage is recognised as being high risk and all identified precautions should be followed and put in place for all elevator maintenance.

For any task that is performed on multiple occasions without any adverse consequence, there is the potential for an individual’s perception of risk (or expectancy of a problem) to decrease. The individual can become more confident doing the task, and in some cases incorrectly perceive the situation is under control. Although there was insufficient evidence to determine if an incorrect perception of risk contributed to this accident, it is important to always follow documented procedures and safe working practices, even when the operation is considered safe.

From the evidence available, the following findings are made with respect to the fatality which occurred on board the container ship OOCL Kuala Lumpur about 8.5 NM south-east of Port Botany, New South Wales on 3 June 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• While riding atop the elevator cage, the electro-technical officer (ETO) became trapped between the moving cage and the bulkhead, and was fatally injured. The reasons the ETO was in this position and became trapped could not be determined.
• After the second deck door was closed, the elevator control must have been set to ‘AUTO’, the cage top emergency stop must have been released and the ETO moved to a position that exposed him to a crush hazard.
• Crew members were not informed that the elevator work was being conducted and warning signs were not in place indicating the elevator was out of service. This allowed an elevator call request to be made while the work was underway and the ETO was on the cage top.
• Other safety management system procedural requirements, in particular supervision and communications, were not fully complied with. Had the procedures been followed, it is likely that the work would have been stopped and the plans modified. This would then have reduced the risks to which the workers were exposed.

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Synergy Marine—ship manager

Synergy Marine (manager of OOCL Kuala Lumpur) notified the ATSB that the following proactive safety actions had been taken.

• A company audit into the understanding and use of the permit to work (PTW) system was conducted on board OOCL Kuala Lumpur. Compliance was checked and training in the PTW system was provided.
• An extensive programme of education, training and review of elevator‑related processes and procedures was widely implemented within the company and fleet. This included a company-wide co-ordinated ‘Safety Stand Down’ (suspend work and meet) discussion of the accident, targeted management and elevator technical and maintenance personnel training and distribution of safety alerts and circulars.
• The company safety management system was amended to
  • require shore management approval prior to any maintenance which involves working outside the elevator cage
  • include increased detail regarding elevator maintenance hazards
  • outline elevator maintenance personnel responsibilities
  • describe safety requirements for elevator maintenance
  • provide detail specific to working safely on top of the elevator cage including procedures for accessing and exiting the cage top (referencing standard BS 7255:2012 Code of practice for safe working on lifts).
• All company vessel elevators (existing and new) were assessed for compliance with British and European standards for car top control stations and safe entry and exit. A programme of modification has been implemented to ensure non-compliant elevators meet the standards.

Sources of information

The sources of information during the investigation included:

• the master and crew of OOCL Kuala Lumpur
• the Port Authority of New South Wales
• Synergy Marine
• Ushio Reinetsu (elevator manufacturer)
• ClassNK
• the Australian Maritime Safety Authority
• Maritime and Port Authority of Singapore (MPA)
• Transport Safety Investigation Bureau (TSIB), Ministry of Transport, Singapore
• Worksafe Victoria.

References

Maritime and Coastguard Agency (MCA) 2018, Code of Safe Working Practices for Merchant Seafarers, MCA, Southampton, UK. Available at www.gov.uk/transport/maritime-safety

Schager, B 2008, Human Error in the Maritime Industry, Vinnova and Bengt Schager, Halmstad, Sweden.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the master, chief engineer and involved crew members of OOCL Kuala Lumpur; Synergy Marine, Maritime and Port Authority of Singapore, Transport Safety Investigation Bureau (TSIB), Ministry of Transport, Singapore, the Australian Maritime Safety Authority and the Port Authority of New South Wales.

Submissions were received from Synergy Marine, Maritime and Port Authority of Singapore, Transport Safety Investigation Bureau (TSIB), Ministry of Transport, Singapore, the Australian Maritime Safety Authority and the Port Authority of New South Wales. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendix A – Hazard identification and risk assessment form for elevator maintenance on 3 June 2018

Page 1

Hazard identification and risk assessment form page 2:

Appendix B – Synergy Group Electrical work permit

Page 1:

Synergy Group Electrical work permit page 2:

Ship details