Why did the Carnival Splendor go dark?

How could an  fire in one of two engine rooms do sufficient damage to the electrical distribution system on the Carnival Splendor to completely disable the ship?   The answer isn’t obvious. The Carnival Splendor is diesel electric powered, which is to say, instead of the ship’s engines connecting to the propellers by shafts, each of her two propellers is driven by an electric motor.   Diesel engines connected to generators provide the power to drive the propellers, as well as to make the ice cubes, heat the hot tubs, and provide all the other electricity needed by this small city at sea.

According to Carnival, the ship has a forward and an aft engine room with three engines in each.  Each engine room is connected to a switchboard.  As reported in USA Today:  A generator for an engine caught fire in the aft engine room 6 a.m. Monday, damaging a switchboard and “preventing the transmission of electricity to other machinery, including the propulsion motors,” said Carnival spokeswoman Joyce Oliva.

Why would a fire in the aft engine room knock out power distributed from the forward engine room?   The fire appears to have revealed  a significant design flaw somewhere in the system.   It will be interesting to see what the US Coast Guard and the Panamanian authorities discover.

Comments

Why did the Carnival Splendor go dark? — 64 Comments

  1. Well now this is all very interesting. While Joyce Olivia is busy spinning to reduce the incident the Brit CD is running loose mouthed with inappropriate tweets or whatever. It appears there is more than one design flaw involved here, one in management, one in the ships. Note ships because the same problem must exist in all the ships of that class (Conquest) which are in several of the Carnival Group’s individual Cruise Lines. One would suspect the incident and damage is considerably more than Ms. Olivia has announced. Thanks to that Brit.CD all hands now know what ALPHA TEAM means, still true that “Loose lips sink ships”.
    No worries, finally retirement is enjoyable!!!
    Good Watch.

  2. I had designed and constructed main switchboards for different ship when working for Klockner Moeller compagny ; the fault had left the ship adrift there is no way it should happen, I am curious to see the main swbd. drawing ;there should be a tie breaker between swbd. to be able to work independatly ( as per lloyds register )

  3. I am from Canada in Québec province ;how can i see this report. The way i had seen the marine switchboard constructed made me very worry for the safety aboard ship; maybe somebody can provide informations

  4. Thanks to Captain Boucher and Francois Clermont for their comments. The industry consensus is that a fire in the aft engine room should not have taken out power to the entire ship.

  5. The report that Captain Boucher is referring to will take several months to prepare. The report will probably be issued by Panama, which, as the flag state is taking the lead in the investigation. The US NTSB (National Transportation Safety Board)and the US Coast Guard will also be involved.

    There is an interesting brochure by SAM Electronics – Diesel Electric Propulsion System for Cruise Liner “Costa Victoria” The Carnival Splendor was based on a Costa design and has the same six engine lay-out in fore and aft engine rooms as the Costa Victoria, though the Splendor is a larger and newer ship. The diagrams show a breaker between the two switchboards.

    It will be interesting to find out what happened on the Splendor.

  6. In the Costa Victoria brochure they also talk about availability designed ” any disturbance in the machinery will cause least possible effect on ship’s speed and passenger comfort…” guess not!

  7. Which is why everyone is scratching their heads. A crankcase fire in the #5 diesel engine shouldn’t have taken out the entire ship’s power.

  8. Recalling the original report the word was that the initial fire was extinguished. After some time period there was a ‘reflash’. Now is it possible that human intervention caused that ‘reflash’ by someone in the engine rooms closing that breaker between the two switchboards, which should have dropped out of the circuit as designed, right. In turn this resulted in an overload and complete collapse of the electrical power system. Being a Master and not an Electrical engineer this may sound funny to you guys – still is that a possibility?
    Good Watch.

  9. Until we know more, everything is speculation.

    When I heard that it was a crankcase fire and that there was a “reflash” my first thought was that the fire had been “suppressed” in the crankcase and then someone opened a crankcase door, let in oxygen and the fire “reflashed,” which is not unusual in a crankcase fire, if I am not mistaken.

    Again, all speculation until we have more to work with.

  10. The tie breaker can also be only a non-auto switch it will not trip
    What are the qualifications of the engine room crew you may have only 1 eng. with non qualified assistant. what is the required number of gen in std operation. I had seen 4 gen of 6 required for full propulsion with the tie closed at all time .
    When you have a fault on one of the gen, the assigned breaker only should trip; what is the total interrupting capacity of the system

  11. I am an EE and have been accountable for the design and maintenance of electrical systems in large stationary nuclear plants for almost 40 years. What happened really is an enigma. Also, the NTSB already clearly stated they are in an advisory capacity only so I do not think they intend to issue a report of their own. Until something is published with a lot more detail, it simply will not be possible to determine what really happened. Here are some thoughts about the many things that might have contributed to losing both trains of power.

    -Whenever two true independent trains of electrical power are required (like in a nuclear plant), it is absolutely never acceptable to electrically tie the trains together. The reasons for this apply to any electrical system, nuclear, marine , or otherwise. This is to prevent a fault on one train from effecting the other train. Maybe they had the tie breakers closed. If there was some common mode design or construction error (breaker trip ratings incorrect, breaker fault interrupting ratings too low, tie breakers used as disconnects only with no trip devices, etc.)then a catastrophic fault on one train can also cause damage to the other train.
    -I noticed from the Costa Victoria one line that the two plants are adjacent and separated by a single (fire rated – I assume) bulkhead. Maybe the fire rated cable seals through this bulkhead were faulty and allowed the fire to propogate into the forward compartment.
    -I am not sure where the syncroconverters are located but one way or another the power cables from the forward plant must pass through the rear plant on their way to the propulsion motors. This might explain why there was a loss of all propulsion but does not explain why the forward plant was unable to provide hotel power.

    In other words, with so many possible scenarios, until more is known, there is really no way to diagnose how this event occured. I have enough experience with power distribution systems to know that sooner or later any latent design, equipment, or configuration problem will eventually make itself known, typically at a most inconvenient time, and in a most surprising manner. I also have seen, even with the most stringent controls, system alignments that were not consistent with the design criteria. My guess, the real scenario will surprise all of us. Don’t forget the ecstasy fire where a single heat damaged 230 volt control power panel took out both trains of otherwise uneffected (by the fire)propulsion.

  12. The damage to the Switchboard was due to the high temperature fire raging for a few hours. The fire melted the deck between the engine room and the switchboard on the deck above. With the main switchboard and most wiring severly damaged from fire, electricity could not be transfered anywhere. If there was any failure or breakdown
    (other than the original engine) it was with the fire extinquishing system in the engine room. This fire should have been out in minutes, not hours.

  13. Thanks Barry, for your perspective. Very interesting.

    You make a good point Waterone1. A failure of structural fire protection negates everything. It would be interesting to know how long it was between the reports of the fire and the decision to flood the engine room with CO2. Flooding with CO2 suggests a failure in localized firefighting and takes time to make sure all personnel are out of the engine room.I wonder if the outcome would have been different if Halon was available.

  14. Good day
    I had a theory to propose
    The mains switchboard are located above the gen; if there is a fire in one of the gen. and the carbon smoke was able to contaminate inside main swbd.(do not forget it is a 10 KV system) then arc will flash all over the place including the electronic control system. As i was reading on the power plan layout page 4 it appears to me that the 2 swbd. are always connected.Is there a real manual back up control system ;if not and the computer system is flashed out of commission ;no generator can run without gen. control, load sharing reverse power relay synchrocheck relay and so on .

  15. There is certainly at least one, probably two or more, emergency diesel generators. Typically, they are located in the upper decks somewhere but in any case they would be in spaces very separate from the main plant. Although these are probably big machines, they have very limited capacity relative to the six main generator sets. They cannot begin to carry large loads like propulsion, refrigeration chillers, electric galleys, etc. They are only intended to provide for minimum lighting, communication, fire safety systems, essential ventilation, etc.

    I am sure the sequence of events that led to a loss of all electrical power and extent of damage is known by now. The fact that nothing is being said, in spite of the wide spread interest in how this could have happened, leads me to believe Carnival must have something significant to hide. If not, why are they being so silent? Were vital fire safety systems out of service for some reason when the ship sailed? Did the crew make errors that caused the damage to propagate well beyond the point where it should reasonably have been contained. Did they discover a design shortcoming that also exists on their other ships? I certainly do not know but why else would they continue to be so secretive?

  16. bonjour m.Barry
    I agree with you all the other similar ship are built the same
    with these big customer LLoyds and other tends to accomodate the request they have ; they do want to add $50k on extra security but they are ready to invest millions of dollars for the flash. I dought we will learn the real problem because it will revert back to all other crusing ship. I think there are to many computer for the control /supervision of all parameter of the generator : load sharing ,gouvernor control, synchro, if these fail and there is no real manual system for back up then we can see the result .

  17. ….as per my opinion ships built in Italy at Fincatieri shipbuildings have not enough mechanical/electrical redundancies…and this fire is a very simple example…agaisnt the one built in KMY (Finland) where the concept of redundancy is very well implemented (very similar to military constructions), the switchboards are two and not one, far away from each other dedicated for each engine rooms and linked by bus bar with tie breakers, the Fincantieri standard is a single room where all is fitted in : 11Kv or 6,6 Kv and low voltages!!!!!! Bad design bad concept

  18. Claude Suzette, are you suggesting that the splendor had a single switchboard for all six DG sets, presumably located in the aft DG space? That would really surprise me. With all due respect, I just cannot imagine a 100K+ ton vessel designed for 5000 souls would have the entire medium voltage electrical distribution plant in a single space. I can easily manage sloppy configuration control and out of service fire safety systems contributing to the Splendor event but not all six DGs terminating in a single physical space, not in a marine installation.

  19. Barry, read the November 15 comment from Rick that said:

    “There is an interesting brochure by SAM Electronics – Diesel Electric Propulsion System for Cruise Liner “Costa Victoria” The Carnival Splendor was based on a Costa design and has the same six engine lay-out in fore and aft engine rooms as the Costa Victoria, though the Splendor is a larger and newer ship. The diagrams show a breaker between the two switchboards.”

    The diagram shows that the two switchboards are together in the same compartment.

    In the Carnival Splendor CD’s blog, John Heald reports what was happening on the bridge about five hours after the incident happened.

    “The Guest Services Desk had a line of people saying that their lights were not working and their toilets not flushing. So I went to the Captain who was on the phone still with the command centre and asked him to interrupt the conversation so we could have one that went like this:

    JOHN: CAPTAIN, I AM GOING TO HAVE TO SAY SOMETHING ABOUT THE SERVICES ONBOARD, WE HAVE NO ELEVATORS, NO LIGHTS AND NO POWER AND MOST IMPORTANTLY FOR NOW…………THE TOILETS ARE NOT FLUSHING.
    The Captain looked at me with tired blood shot eyes. Claudio is a handsome man and being an Italian man means he has won the lottery of life. Yet as I stood there looking at him I saw a man who was aging by the second. Obviously being fat and British still made him a thousand times better looking than me though.
    CAPTAIN: LET ME SPEAK TO THE OFFICE, HOLD ON.
    The Captain then related my concerns and asked for permission to do this which of course he got. I will say that even if the beards had said “no, wait and see what happens” I would have respectfully ignored them and done it anyway. I had promised from the start of this that I would tell the truth and I wasn’t going to stop now. But my colleagues in the command center agreed with me but the Captain wanted to do one more thing before I spoke to the guests.

    “CAPTAIN: JOHN, LET ME CHECK WITH THE CHIEF ENGINEER
    The Captain then called on the Walkie Talkie to Chief Engineer Mario.
    CAPTAIN: WHATS THE STORY WITH THE POWER AND THE TOILETS ETC
    There was silence for a moment and then a voice that sounded like he was about to tell someone that a family member had been killed said “Captain, the main switchboard is finished………………. he paused…………… and then his voice cracking with emotion he said words I will never forget. I cannot give you anything………. nothing…………. no engines, no power…………… everything is finished………… finished…………. finished.”
    I will never ever forget the fact that he said the word “finished” three times and each time he said his voice reached new levels of despair. This was his engine room and now it was a dead place, devoid of life and he was taking this very personally indeed.”

    Whatever happened, the result of the fire in the aft engine room was that both switchboards were disabled/”finished”, that is rendered inoperative.

    Obviously, this should not have happened even after mechanical/eletrical problems in one of engine rooms and even if the problem was compounded by human error.

  20. Did somebody know what is the approuval agency !

    As these ship are comming in the us do they comply with US coast guard!

    If we look in page 4 it look like if there is 2 swbd, with 1 tie in each !

  21. I am not an expert or an EE. But I’ve worked at a hydro plant for 25 years and kind of know their systems.
    I wonder if what we are looking at a master panel in the control room with no separate back up system in another compartment. Take out that one master panel and “poof”, no way to control the generators. As quoted from the CD, “Captain, the main switchboard is finished…”

  22. just an example
    I had to quote a main swbd. for small cruising ship
    the owner send us picture of his swbd; it was like 6 X 8 feet total overhall
    since it was to sail in Canada it has to follow Canadian coast guard ; but to follow rules I had to use at least 4 X 16 feet
    they reply it was not intended to sail more than 10 miles from shore and it was approuved like that in the US ???.In thier swbd there was no compartmentalisation all breaker in same box without any partitions , nothing about interrupting capacity and security .
    I had also seen switchboard for supply vessel for off shore drilling ;same thing large box all breaker together without partitions even the generator breaker; no interrupting capacity rules followed ; it loock like the de-regulations had impacted hard.
    Not surprising even crusing ship will not qualified to US coast guard standard
    I will not have any trip aboard these vessel; if something goes wrong hope there are no storm !!

  23. I just looked at the SAM Electronics’s Costa Victoria brochure. I interpreted it as showing two 10KV buses, in separate compartments, each above its associated diesel generator room.

    At the bottom of page 2 the third bullet in the table states “2 Switchboards 10KV…”. Page 3 goes on to state that the main switchboard is located above the diesel generators. The picture at the bottom of page seems to support this.

    From this picture at the bottom of page 3, it appears both synchroconverters are in the same compartment, aft of the aft generator room and above the propulsion motor room. However, this should not comprise the ability to supply hotel and ship service power.

    As expected, there is a tie between the two switchboards (buses) with two breaker isolation. Ideally, the two buses (aft and forward) should not be electrically tied together but with two tie breakers in series a double failure would have to occur to cause a fault on one bus from compromising the other bus.

    I am amazed how this event has completely fallen off the public’s radar screen. The safety of almost 5000 souls was compromised, Carnival is not putting out any information (because they have something to hide IMO), and no one is clamoring to find out what happened.

    If I interpret the Costa Victoria Brochure correctly, I do not think the loss of all power was the result of bad design. So what did cause the problem? I assume there was some initiating event that caused an electrical fault in one of the two buses. Somehow, this fault seemed to propagate to the other bus. The buses are in adjacent compartments so did they not maintain proper compartmentalization (open door, inoperable fire barriers, inoperable ventilation isolation systems, etc.) between the two? Were fire safety systems (suppression, barriers, detection, alarms, ventilation isolation, etc.) inoperable prior to sailing? There was a statement about a catastrophic mechanical failure of one of the diesel engines. Did missiles from this failure penetrate the switchgear above it starting an electrical fire? Did the fire then spreads for any of the reasons above?

    In my opinion the loss of all power, based on my interpretation of the design from the Costa Victoria brochure, was a preventable event. There was some lapse of something that resulted in loss of containment from the aft engine space to the forward space.

    I have to emphasize I have no other knowledge of the event other than what everyone else here has so all my opinions are just that, opinions; and we know the old saying that says something about everyone has an opinion and everyone also has …. .

  24. (CNN) — Carnival Cruise Lines announced five more cancelled sailings Wednesday on the Carnival Splendor to allow more time to repair the ship damaged by fire last month.

    A fire in the engine room on November 8 crippled the ship, stranding passengers off the coast of Mexico for several days without air conditioning or hot showers.

    Departures on January 6, 23 and 30 and February 6 and 13 have been added to cancellations originally stretching through mid-January.

    The ship is now scheduled to return to service on February 20, according to the cruise line.

    “We sincerely apologize to our guests for having to cancel these additional cruises,” said Gerry Cahill, Carnival’s president and CEO.

    “We know this is extremely disappointing for our guests and particularly disheartening for those who already had their vacations cancelled once and are now being affected again,” Cahill said.

    Additional issues were discovered in the process of repairing the ship and Carnival is waiting on parts being manufactured in Europe.

  25. On one line it look like there are 2 tie Breakers but following rules these can be only tie switches only without trip block ; in that case it will not protect from main bus bar fault !

  26. Mr Clermont
    I worked at a shipyard for 10 year as a test engineer. My job wss to startup and test all systems prior to sea trials. One of the tests was testing the reverse power relays. I never had one fail to work. From what I understand if the relay fails to trip, the online generator will try to drive the engine as a motor. It is difficult to even imagine something like this happening, but what would happen if it did?

  27. Something will burst/explode within the generator and the diesel motor .
    One problem i can see is the trend to have all security relays run through the computer even if you have redondancy with several computer the complete system will fail if the remote I/O board is flashed inside the main switchboard ; if you have real manual backup with hardwire selector switch to disable all control point from the computers and transfer to separated security relays and protection , gouvernor control, load sharing unit then electrical staff will be able to restore at least partial power .
    In regard with gouvernor control they are now all electronic and integrated in computer had you seen that ?
    will appreciate any comments
    thanks

  28. Thank you for anserwain my question. I’m not sure about computer driven engines.
    The reason I asked about reverse power relays is I read about the President of Carnival Cruise Line saying the problem was a “cracked crankcase” and I read on another blog the engineroom crew had worked on the engine and was trying to put it in parallel with the on line generators and couldn’t get the automation to work so they tried to do it manually and the bus tie closed when the generator was out of phase.

  29. I believe there is a design flaw,I’d first say in the fire system then heat barriers, equipment locations, electronics tied together and not redundant, etc they crame every space to the hilt,has any or most of this stuff been tested and by whoam. This is a major design flaw and it will get barried. If GM or Ford did this they would be on trial. The fact that there is very little coming out of the people involved says alot. These ships are built like Rv,s in the USA . Cheap jjunkkkk!!!

  30. Let me offer some thoughts about some of the new comments above:

    A typical DG governor, in years gone by, was solely an elctro-hydraulic unit that directly controlled the racks (the mechanical linkage controlling the injectors). The unit developed hydraulic pressure directly by a small internal pump driven by the diesel itself. This hydraulic pressure not only provided the energy to drive the racks open or closed, but the pressure was also the speed signal as it is proportional to rpm. An external electrical signal was used to adjust the speed/load setpoint to which it tried to control for a given pressure. A more up to date arrangement still uses the same or very similar hydraulic unit but also uses a digital based electronic system to tell it what to control to. The electronic device uses electronic speed sensors (in lieu of hydraulic pressure)and, for many reasons, provides for much more precise speed/load control. The hydraulic unit also acts as a self contained backup if the electronics fail. I do not have experience with new state of the art engine systems but I suspect they use a similar arrangement; off engine digital electronic brains and an on engines actuator (probably hydraulic) that implements the digital decision making and acts as a backup if the electronics fail.

    With respect to synchronizing (paralleling to an already running system), reverse power relays cannot prevent the breaker from closing out of phase. Reverse power relays are only intended to prevent “motoring” the machine and the breaker must be already closed if this happens. This can occur if, for some reason, the fuel oil supply is lost to the engine so the generator becomes a motor driving the engine.

    Catastrophic mechanical damage can occur if the breaker closes substantially out of phase. However, there are relays, typically called “synchronizing relays”, that are designed to assure a safe paralleling experience. Synchronizing is done either manually or automatically. Generally, automatic is considered the safest. Even when done manually, there always a “synch check relay” of some kind assuring the operator cannot screw up too badly.

    Now some thoughts about the real world. Synchronizing devices are designed conservatively because the effects of synching out of phase can be so catastrophic. In my experience, it is not a rare event to see synch devices unnecessarily prevent closing the breaker because they are so sensitive. As a result, operators will simply manually synch without the protection of the overly sensitive relays. Although this usually does not result in a problem, intentional protective design features are not used and this is a setup for human error. It is also a scenario that should never be tolerated in any plant that has a critical function.

    I cannot imagine a state of the art modern plant, like aboard the Splendor, did not have a fully automatic computer controlled system for synchronizing the machines. However, many minor issues, can prevent the computer from working and might even make the computer think the phase is 180 degrees from where it actually is (e.g. inadvertently rolled potential leads). There should be redundant synch check functions to make sure the computer does make a wrong decision but the backup system might use the same sensors or be manually bypassed because it is over sensitive and prevented synching in the past.

    I certainly do not know what caused the engine failure or even if the engine failure was primary or secondary to the event. I do know, without doubt, if the event was caused by an attempt to parallel a machine that went terribly wrong, it went wrong, not because a reverse power relay did not work properly, but because of human error.

  31. very interresting!
    can it be as i mentionned earlier if the computer system do not work ;or I/O allocated for this generator not working and there a no real manual back up system with all the proper protection relays as mentionned above to prevent incorrect synchro. then when they connect the remaining generator to the bus the overwelming power of the 5 other with the addition of all electric motor running at that time is more than enough to dismantle the generator.
    Did somebody had done interrupting capacity system analysis ; the breakers may not have enough interrupting capacity to handle a large fault ( breaker will try to open but will weld in place during opening )

  32. When a circuit breakers is not rated to interrupt the available fault current, the result is typically an arc that cannot be extinguished, resulting in a lot of melted and charred metal, sometimes accompanied by an explosion as the rapidly heated air explosively expands. I have seen the result of this type of failure and it is as ugly as it gets.

    Synching an “incoming generator” to a “running” system, is a very common event. Utilities regularly synch large machines to what is considered an “infinite” bus. As long as the breaker is closed with a very close to zero degree phase angle, this represents no problem. Just before closing the breaker, the operator will set the rpm to be slightly higher than system frequency (“slow in the fast direction”). This causes the phase angle to slowly drift into and then out of phase. When the phase angle is just a few degrees away from approaching zero, he will close the breaker. Therefore, when the breaker is closed, the rpm is forced to instantly drop to system frequency. The small amount of fuel oil or steam, that was causing the rpm to be slightly higher than system frequency, now drives electrical energy out of the machine. In other words, the generator picks up a little electrical load the instant the breaker is closed so it does not motorize. The operator then bumps the throttle up a little to assure the machine is stable with some small but reasonable electrical load on it. I have synchronized generators driven by 1,000,000 HP steam turbines and it is an easy task, but one that must be done carefully as a good operator never ever depends on automatic systems to mitigate a mistake.

    If the Splendor event was caused by a synchronizing error, it was certainly the result of many failures, not just a single problem. For example, an operator might have manually closed the breaker at the wrong time but was not protected against this event because of a cultural tolerance for out of service equipment (such as synch check relays, the computer, etc.). I do not know what happened but I am confident many barriers that had to be bypassed for a catastrophic such as the Splendor event to occur. It was certainly not an act of god and not a single equipment or human failure. These events never are anymore than it was the fault of the iceberg that the Titanic struck for being in the wrong place at the wrong time.

    The mechanical forces created by closing the breaker out of synch are huge when the incoming machine is small, relative to the total generation on the bus. In essence, enormous magnetic forces will instantly be imposed on the rotor that will try to instantly accelerate it to a synchronized position. I did not see it but I know of a 150 MVA generator that ended up significantly out of synch – the forces tore it apart, including shearing the common shaft.

  33. Have a look on Coast Guard notice for fire related problems on ”Carnival Splendor”.
    very alarming but not surprising; if electrical equipment was designed the same, all these ship are disaster waiting to happen.

  34. Gentlemen,thank you for the wealth of information. I guest we’ll have to wait for the report of the investigating organization.
    Being a retired operating engineer I just have to ask myself, “WHAT HAPPENED.”

  35. Over two months have passed and the silence about what happened aboard the Splendor is deafening. I think any reasonable person has to come to the conclusion Carnival has a lot to hide.

    Please see the U.S. Coast Guard safety alert in the following link.

    http://www.marinelink.com/news/inoperative-failures336547.aspx

    This is really disturbing to me because multiple failures were present in a recently inspected vital safety system on a relatively new vessel. This is not a case of a single unexpected failure in the CO2 system. It is a case where many issues concurrently existed in the CO2 system and each of these issues had a consequential adverse impact on the operability of the system. The root cause analysis (if one is even done) of the failure of the CO2 system would probably reveal some very significant systemic (administrative & cultural) issues.

    It is not reasonable to assume that the CO2 system is unique and is the only system in this condition. The same management/work culture that allowed the CO2 system to remain inoperable affects everything aboard the vessel. What statement does this make about the overall safety of all cruise ships? What statement does this make about the effectiveness of the regulating bodies (e.g. the Coast Guard) to effectively regulate and protect the safety of the public? What can one conclude about every cruise ship now at sea?

    I certainly never have been and am not now a “white knuckle flyer”. However, the double failure of the cruise line and the regulators to assure a vital safety system is operable is certainly going to force me to re-evaluate the safety of taking a cruise.

    Please understand my perspective of how to run a safe (and reliable) engineering plant is from almost 40 years in the nuclear power industry. However, I see no material difference in the nuclear industry’s very real accountability to assure the health and safety of the public and the cruise industry’s accountability to assure the health and safety of almost 5000 passengers and crew. Even without an accident, if we found a “safety related” system in the same condition as that reported by the Coast Guard for the CO2 system, we would make international news, almost instantly have federal inspection teams on site, be subject to huge fines, and be forced into audits that could ultimately cost a few hundred million dollars to successfully deal with.

    Why is the press and public now so silent about a problem that potentially effects the safety of thousands of people traveling on cruise ships right now?

  36. Barry;

    This is all speculation and I cannot guarantee accuracy. Obviously the Cruise Director was under enormous stress. Kudos to him and the crew.

    I tried to run a time line from the Cruise Director’s blog. It’s difficult. He wrote that the CO2 was released around 8:15am, over two hours into the crisis. The Marinelink.com site mentions 5 hours. Two hours sounds much more realistic to me.

    2 hours of unrestricted burning would tax even the most stringent of safety systems, let alone a 5 hour burn. Ergo, the CO2 failure (in this case) was irrelevant to the original emergency, but certainly significant and disconcerting. I wonder what might have happened if the CO2 had been deployed immediately?

    My time line estimate shows that the ship was totally incapacitated (maybe even permanently) less than an hour into the emergency, and perhaps as quickly as 10 minutes! Why? From his later posts I believe (but can’t prove) the Cruise Director rode the elevator to the bridge at approx. 6:07am. If he hadn’t, his alarm clock wouldn’t have been working, either. He mentions the power was out and the ship was dead in the water at 7:00am. Inference suggests that the ship was totally immobilized between the hours of 6 and 7.

    6:00am is a logical time to be bringing on more generation capacity as the guests wake up and the crew prepares to serve those guests. 5 minutes later was the fire alarm. The posts above point to a generator phase conflict as being a potential cause of the emergency. Sounds reasonable.

    The truly scary part of the whole scenario is twofold. How did such a “safe” ship die so completely so quickly? A torpedo may not have been so effective. And, as you mentioned, “Why is the press and public now so silent about a problem that potentially effects the safety of thousands of people traveling on cruise ships right now”? I’m with you, it makes a person think!

    It was indeed extremely fortunate for everyone on board that the ship was near land and help. Imagine if that ship was 2,000 miles out into the Pacific bound for Tahiti…

  37. Carnival Splendor is underway from Long Beach to San Francisco 1/22/11 approx. 1:45PM PST. Information taken from the cruise director’s blog on Facebook and
    http://marinetraffic.com

    One poster claimed a generator and two alternators need to be replaced. I cannot confirm that.

  38. The Cruise Director is scheduled to arrive at pier 35 in San Francisco on February 12 to accompany the ship out on sea trials on February 14 and then on to Long Beach, arriving on February 19 apparently ready to take on passengers for the scheduled February 20 sailing.
    THe press and or public simply are not following this saga, perhaps because it appeared that it was a “harmless” incident, with no potemtial for harming passengers or crew. If an equivalent accident occured on an airplane, all hell would have broken loose. Where are the US investgative bodies that should be monitoring and reporting on this incident?

  39. 25 January 2011
    A Very Big Airplane Helps a Very Big Cruise Ship Get a Very Big Engine Change

    But now it’s time to make the ship new again. It will cost $56 million and take 4 to 6 weeks, but in the end the Carnival Splendor will get a new diesel engine and two alternators. The new motor arrived via a gigantic Antonov An-124 that landed on Saturday at San Francisco International The package weighted 106 tons.

  40. “Carnival Splendor is brought back to San Francisco for an engine replacement.”

    Entire photo set: http://www.flickr.com/photos/daver6/sets/72157625893480692/with/5434837535/

    “Here we are at ground zero. This was the center of the problem, this drive shaft and the counter balance arms were what the pistons of the engine connected to before it so catastrophically failed.” Photo: http://www.flickr.com/photos/daver6/5434837535/in/set-72157625893480692/

  41. So one of the engines had a castatrophic failure and had to be replaced. Do you think this was the original problem or the result of some other problem such as out of phase generator?

  42. Great photos, Rick. Thanks.

    It appears to be a crankcase explosion which caused a fire which spread and did all the damage. What still doesn’t make sense is that crankcase explosions are nothing new on marine diesel engines. (A crankcase explosion on the Reina del Pacifico in 1947 killed 28 men.) There are or should be means of monitoring and preventing the sort of fire and/or explosion that appears to have crippled the Carnival Splendor. Oil mist detectors and explosion doors, among other devices, should have contained the problem. Obviously something went very badly wrong.

  43. Maybe it was more of a seizure or breakage in the engine rather than an explosion. A stuck piston due to failure of the oiling system. Didn’t the QE2 lose the Echo engine to that cause. Looking at the pics I don’t see evidence of an explosion in the engine space. Dirt looks undisturbed, debris isn’t present.

    Perhaps the engine failed, then the generators went out of phase and ruined two of them and the control system and wiring. Could a generator, brought online out of phase break an engine?

  44. Also on the flikr photos, you can select the original large size. In this case they are very large sharp pics you can scan thru and see lot of detail in the engine room. Papers on the wall, wiring, ropes hanging. All of it looks relatively unscathed.

  45. Without knowing any more of than we know now, it could have been some other sort of engine problem. Crankcase explosions are just the most common failure. The bearings typically overheat and cause an explosion in the oil mist in the crankcase. In the days before explosion doors, the explosion would blow off the crankcase doors, flooding the crankcase with oxygen resulting in a second much larger ignition of oxygen and oil mist that could sink the ship. It could be than an explosion in the crankcase may have resulted in a severed fuel line causing the fire when the fuel hit the red hot metal on the engine.

    All just speculation until we know more.

    Diesel engines coupled with gensets can be seriously damaged when run for long periods at low loads but I have never heard of an engine being damaged by an out of phase generator, but that may just demonstrate the limits of my knowledge of diesel electric plants.

  46. “Carnival Splendor Resumes Service – Cause of Fire Remains Unexplained”

    http://articles.maritimepropulsion.com/article/Carnival-Splendor-Resumes-Service-e28093-Cause-of-Fire-Remains-Unexplained37006.aspx

    “The fire in the aft engine-room spread extensively by all accounts, suggesting that a thin spread of oil from #5 diesel, thrown out with explosive force over a wide area, had to be dealt with; an outcome typical of an un-contained crankcase explosion. If this much is true, statistics from a leading classification society add credibility.

    “Carnival Splendor has a diesel-electric propulsion system with medium-speed diesel engines (in separate engine rooms) as prime movers. According to an eleven-year analysis of crankcase explosions in its classed fleet from 1990, Lloyds Register recorded that 85% of a total of 143 such incidents in that period occurred in that type of diesel engine (the small remainder in two-stroke engines). Lloyds Register found the causes were due to bearings (39 per cent), pistons (47 per cent) and others (14 per cent).

    “It may be that the engine-room fire aboard Carnival Splendor last November was caused by a crankcase explosion through over-heating or mechanical failure of one of the internals mentioned above within #5 diesel engine, but we shall have to wait and see. Place your bets!”

  47. In my opinion, much more important than the direct cause of the event (the initiating failure), are the following three questions:

    1 – Why did whatever failed fail? Inadequate maintenance? A latent material defect? Improper operating practices? Acts of God just do not cause these events.

    2 – Why did the damage result in the loss of both independent trains of propulsion and hotel power?

    3 – What is the extent of condition and extent of cause relative to the answers to the two previous questions? This applies not only to the Splendor but every ship out there.

  48. Those are excellent questions. I would only add, Why did the primary fighting system, the CO2 system also fail completely and how was that related, if at all, to your question #1?

  49. co2 system fail for several raison
    1 arm actionning CO2 valve fell down when action small bolt joining them fall down

    2 CO2 system pushbutton panel were reversed port and starboard

    3 when they switch manually valve to inject CO2 it was leaking at several joint
    it is on Coastguard inspection report

  50. I was out on the ocean at the time, within 50 miles of where this ship was disabled. That same morning an unidentified missile was seen emerging from the sea, presumably from a submarine, about 20 miles southwest of San Diego. The missile veered slightly south and west as it rose. Many others on my vessel witnessed this. Later that same day the reports started about the disabled cruise ship. My initial thought is still the best theory (in my mind): a Chinese submarine tested an EMP weapon on this unsuspecting cruise ship, and it was hugely successful. There has been a cover-up so as not to panic the maritime community and general public.

  51. another cruse ship in Italy
    first reports an electrical problem then it run aground near the Giglio island and then roll on side
    i think cruse ship are not safe
    curious to have more info