Alarm Fatigue and the Missed Engineering Alarm

Applicability depends on flag state, class society, yacht size and GT, machinery notation, whether machinery spaces are periodically unattended, the alarm system fitted, SMS requirements, and whether alarm repeats are transferred to the bridge, engineers' cabins, mobile devices, or shore support.

The MPV Everest fire is not a yacht casualty, but it is highly relevant to large-yacht engineering and ETO teams because the initiating chain is familiar: a routine fuel transfer, a manual operating mode, a tank alarm, an integrated automation system, fatigue, and an emergency response that exposed documentation, training, communication, and system-design weaknesses.

The lesson is not simply "someone missed an alarm." That is too shallow. The useful lesson is that alarms only work as safety barriers when the whole chain works: system design, alarm priority, watchkeeping, operator workload, crew competence, emergency communications, documentation, and realistic drills.

On a yacht, the same pattern could sit behind a fuel-transfer overflow, bilge alarm, battery-space smoke event, generator lube-oil alarm, shore-power converter alarm, chilled-water plant fault, or high-level tank alarm that has become background noise.

MPV Everest was a Bahamas-registered, 145 m multi-purpose vessel on charter to the Australian Antarctic Division. On 5 April 2021, it was returning from Mawson Station, Antarctica toward Hobart with 37 crew and 72 Australian Antarctic Division staff on board.

That context matters. The vessel was not close to normal shore support. It was operating in the Southern Ocean, a remote and demanding environment where rescue options, weather, fatigue, and emergency preparedness all carry more weight. A machinery-space fire in that area is not just an engineering problem; it can become a whole-vessel survival problem.

The ship had separate port and starboard engine rooms. That redundancy later helped the vessel restore power and propulsion using the starboard machinery after the port engine room was badly damaged. But redundancy did not prevent the fire from developing.

On the morning of the fire, the chief engineer started a manual fuel transfer to top up the port fuel oil settling tank. The transfer was started through the ship's integrated automation system from the engine control room.

The port settling tank had level monitoring and alarm arrangements. Its high-level signal was set at 85 percent of tank capacity. At 90 percent, fuel was intended to overflow into the port fuel oil drain tank through an overflow arrangement. The vessel also had automated fuel-transfer logic available: in automatic mode, the system could start transfer at a lower tank level and stop before the tank reached the high-level region.

In this event, the transfer was done manually. The transfer pump continued running while the chief engineer left the engine control room and worked elsewhere. The ATSB found that the manual transfer was not monitored effectively.

Recorded integrated automation system data showed the port settling tank reached its 85 percent high-level signal at about 1002. At about 1018, the port drain tank level began increasing, indicating the settling tank had reached the overflow point. The drain tank then continued to fill.

The important technical detail is the route the fuel eventually took. The port settling tank air pipe terminated inside the port engine room exhaust ventilation casing. Fuel overflowing from that air pipe entered the ventilation casing and then the port engine room below. The ATSB found fuel residue and liquid fuel in areas consistent with that path.

At about 1058, people on board saw flames coming from louvres in the port engine room exhaust ventilation casing. Smoke and flame detectors in the port engine room activated moments later, and the water mist fixed fire-extinguishing system activated automatically in the affected area.

The fire was eventually contained and extinguished, but it took about 2.5 hours. The port engine room suffered substantial damage. Most power generation equipment and machinery in that space was rendered inoperable. No injuries or sea pollution were reported. The vessel diverted to Fremantle and arrived about a week later.

The causal chain had several connected layers.

First, manual operation bypassed a safer automated behaviour. The automated transfer mode was designed to stop transfer before the tank reached the high-level region. Manual transfer placed more reliance on human monitoring.

Second, the transfer was not watched closely enough. The ATSB found the chief engineer was experiencing fatigue at a level known to adversely affect performance, and probably had a lapse in attention. That allowed the fuel transfer to continue unchecked.

Third, alarm effectiveness was reduced. The report identified inappropriate engineering watchkeeping practices and characteristics of the integrated automation system as factors that reduced the effectiveness of tank alarms leading up to the overflow. In plain terms, the system produced information, but the information did not create timely control of the hazard.

Fourth, the physical design made the overflow dangerous. The settling tank air pipe termination was located inside the engine room exhaust ventilation casing. When fuel overflowed there, it was introduced into a casing connected down into the engine room. That design became part of the fire path.

Fifth, ignition probably occurred when the overflowing fuel or vapour met an ignition source. The ATSB considered ignition by electrostatic discharge more likely than hot-surface ignition, although both were considered.

Sixth, emergency response was complicated by preparedness issues. The report identified that engine-room fire drills had not been practised, crew were unfamiliar with aspects of the water mist fixed fire-extinguishing system, and documentation contained incorrect or inconsistent information about the system. The ship's UHF emergency radio system also failed unexpectedly when electrical power to the port engine room and adjacent spaces was isolated during the response.

This is why the case is important: the fire was not caused by one simple missed alert. It was a system accident involving operation, fatigue, alarm design, physical design, emergency equipment, training, documentation, and management oversight.

Alarm fatigue does not always mean thousands of nuisance alarms. It can also mean that alarms are not operationally sharp enough to change behaviour.

In the MPV Everest case, the tank level information existed. The relevant question is why it did not stop the hazard developing. For yacht teams, that question is more useful than asking who should be blamed.

A yacht alarm system can fail operationally even when it is technically functioning. Typical patterns include:

• High-level alarms that appear on a screen but do not wake or escalate to the right person.
• Repeated nuisance alarms that train crew to acknowledge first and investigate later.
• Alarm text that names a sensor but not the consequence.
• Manual operations with no named person responsible for watching the trend.
• Alarm histories that cannot show who acknowledged what and when.
• Mobile or cabin alerts that do not distinguish between low-priority noise and a serious developing hazard.

The practical issue is response design. If an alarm does not create ownership, urgency, and a known action, it is just information.

A superyacht may not have MPV Everest's exact fuel-system layout, but the operational pattern is common.

Examples:

• A fuel transfer is started during a busy guest day and not assigned to one named watchkeeper.
• A bilge alarm repeats often enough that crew assume it is a sensor issue.
• A shore-power converter alarm is acknowledged because the lights are still on.
• A battery-space smoke alert is treated as a local fault until CCTV confirms haze.
• A high-level greywater or blackwater alarm is cleared during turnaround without checking whether the pump logic actually recovered.

In each case, the investigation should ask:

• Was the system in automatic or manual mode?
• Who owned the operation at that moment?
• What alarm appeared, where, and to whom?
• Was trend information visible?
• Was there a pre-defined stop point?
• Did the alarm escalate when not acted on?
• Can the event history prove the answer?

1. Control Manual Operations

Manual transfer, bypass, override, reset, and temporary operation should have named ownership. If a fuel, bilge, ballast, greywater, battery, or shore-power action is started manually, someone should be assigned to monitor it until the system is returned to a safe state.

The record should show:

• Who started the operation.
• Why manual mode was used.
• What stop condition applies.
• What alarm or trend is being watched.
• When the operation ended.

2. Make High-Consequence Alarms Escalate

High-consequence alarms should not sit in the same behavioural category as low-value nuisance alerts. They need escalation rules.

For example:

• First alarm appears at the HMI and engineers' station.
• Unacknowledged alarm repeats to the duty engineer.
• Continued abnormal trend escalates to the chief engineer.
• Critical state repeats to bridge or captain where appropriate.
• Inhibited alarm requires reason, approver, expiry time, and compensating measure.

3. Review Alarm Text And Priority

Alarm wording should be operational. "Tank level high" is less useful than an alarm structure that tells crew which tank, what operation is running, what consequence is possible, and what immediate action is expected.

Technical teams should review:

• Alarm priority.
• Alarm grouping.
• Nuisance alarm frequency.
• Acknowledgement history.
• Escalation route.
• Trend visibility.
• Whether the alarm gives enough information to act.

4. Use Trend Screens During Active Transfers

A single alarm point is not enough during active operations. Trend screens show whether the situation is stabilising or worsening.

For yacht fuel transfer, battery charging, shore-power loading, tank pumping, and HVAC plant operation, crew should be able to see whether the system is moving toward a stop point before the alarm becomes critical.

5. Drill The Real Fire System

MPV Everest showed why emergency drills must match the actual installed system. If the yacht has water mist, CO2, Novec, aerosol, foam, local application, or battery-space suppression, crew need to understand the real system, not a generic fire response.

Drills should test:

• Activation method.
• Protected space.
• Ventilation shutdown.
• Fuel quick closing valves.
• Electrical isolation consequences.
• Re-entry restrictions.
• Communications after power isolation.
• Documentation accuracy.

6. Test Emergency Communications After Isolation

The MPV Everest response was complicated when UHF communications were lost after electrical isolation. Yacht teams should test whether radios, repeaters, Wi-Fi calling, DECT phones, crew apps, CCTV, and bridge-to-engineering communications survive the isolation actions used during fire, flooding, or blackout response.

Do not assume communications remain available because handheld radios work on a normal day.

If a yacht has a missed-alarm or alarm-response incident, preserve evidence before resets and vendor intervention.

Minimum evidence:

• Alarm history export with timestamps and acknowledgement records.
• Trend data for the tank, sensor, pump, charger, generator, converter, or plant involved.
• HMI screenshots showing alarm priority and display context.
• Engineers' call, mobile alert, or bridge repeat logs.
• Manual operation record or watchkeeping log.
• CCTV, VDR, bridge audio, or access-control data where relevant and lawful.
• Inhibited, disabled, shelved, or bypassed alarm register.
• Maintenance records for the sensor, controller, pump, and alarm panel.
• System clock and time-zone settings.
• Crew interviews taken before group discussion reshapes recollection.

Good corrective action should change the onboard system, not just remind crew to pay attention.

Useful actions include:

• Add a manual-operation permit or log for fuel, tanks, batteries, shore power, and critical plant.
• Rebuild alarm priority around consequence.
• Remove or fix nuisance alarms.
• Add escalation for high-consequence unacknowledged alarms.
• Add trend pages to active transfer procedures.
• Update response cards for fuel transfer, bilge, battery, PMS, shore power, and fire alarms.
• Test emergency communications after isolation actions.
• Run a realistic engine-room or technical-space fire drill using the actual suppression system.
• Audit technical documentation against the installed system.
• Verify alarm changes with a test, not a meeting note.