Commodore Clipper: The Alarm Reset 7 Times

The detection system on Commodore Clipper did everything it was built to do, and the fire still had seventeen minutes before anyone believed it. Sixteen smoke sensors on the main vehicle deck activated 81 times between 02:42:36 and 02:49:12 on 16 June 2010. The bridge and engine control room silenced the alarm 11 times and reset it 7 times, both officers reading it as a detector fault. Then the system stopped working altogether.

This is the clearest documented case in the ro-ro record of a fire found on time and disbelieved — and the MAIB report that records it, 24/2011, is unusually precise about the seconds. It matters to anyone specifying detection because the failure was not sensitivity, coverage or response time. It was credibility: what a crew does with an alarm they have decided is probably wrong.

The ship, the cargo and the connection that failed

• Commodore Clipper — Bahamas flag, IMO 9201750, ro-ro passenger, 14,000 GT, 129.14 m, owned by Condor Limited and managed by Condor Marine Services, classed with DNV.
• On the overnight St Helier (Jersey) → Portsmouth leg with 62 passengers and 39 crew, the vehicle decks near capacity with unaccompanied freight.
• Of 77 trailers loaded, 24 were refrigerated units carrying pre-packed Jersey Royal potatoes. Too many reefers for the open upper deck (deck 5), where diesel fridge units can run, so those that could take ship's power were struck down to the enclosed main deck (deck 3) and plugged into the ship's 400 V supply.
• The reefer cables were made up on board by the ship's electrician and electrical fitter — a task transferred from shore to the crew on 1 May 2006 — using plugs and cable ordered direct from commercial suppliers.
• The plugs were 'StarTop' type (Mennekes), rated 440 V / 32 A, IP44, with insulation-displacement (IDC) terminals that cut through insulation instead of requiring stripped wire and tightened screws. The cable cores used were the largest size those IDC terminals could accept. Class required IP55 sockets on the vehicle deck; the ship's plugs and sockets were all the lesser IP44 — an oversight.

The fire started in one of those plugs. The MAIB's electrical examination found the brown-phase termination inside the plug on trailer CRF459 had worked loose, raising resistance in that phase and producing heating and arcing; the terminal partially melted, with strands welded to what was left of it, against a terminal melting point the manufacturer gave as 900–925°C. The decisive detail for anyone who protects a circuit: at a loose high-resistance joint the fault current stays at the normal load — about 25 A — so the ship's 32 A breaker never saw anything wrong. The report's first conclusion says so plainly: the protection devices 'met the classification society's requirements and were functioning correctly. However, they were not capable of detecting the fault in the reefer cable.'

The seventeen minutes

The instruments saw it first, and each time a human looked, the evidence pointed away from fire. At 02:37 the picture from CCTV camera 7 on the port side began to haze and the deck lighting diffused; an earth fault then showed at the bus-tie breaker and the third engineer heard it open. At 02:41 camera 6 on the centreline darkened. At 02:42:36 sensor D24 alarmed on both the bridge and in the engine control room, with the sensors either side of it following within 30 seconds.

The third engineer had smelled no smoke, suspected a faulty component, and silenced the alarm a further six times over the next three minutes before resetting the system at 02:45:42. It reactivated. The second officer silenced it at 02:46:20 and reset it too — by then ten sensors down the port side, from midships aft to the stern ramp, had detected smoke. At 02:49:12 the fire detection system ceased to function: 6 minutes 54 seconds after the first alarm, after 16 sensors, 81 activations, 11 silences and 7 resets.

The confirmation that should have taken two minutes took ten. The lookout sent to check the deck knew his portable VHF was unreliable and feared being trapped without a way to call for help, so he detoured to the deck 7 restaurant, found the night stewards could smell smoke, and returned to the bridge at 02:48. The second officer sent him down again at about 02:50; over the next seven minutes eight of his radio calls came back distorted and unreadable. The electrical fitter, sent to check the sensors, was beaten back by smoke and went to the ECR instead — he and the third engineer then isolated the reefer power supplies.

By 02:54 the CCTV cameras had lost all visibility to smoke. What finally broke the interpretation was the chief engineer smelling smoke the moment he opened his cabin door; he went to the bridge, concluded a fire was more likely than a fault, and at 02:59:20 the lookout telephoned confirmation. The crew alert went at 03:01, the general emergency signal immediately after, and drenching started in section 4 with the first deck water-leakage alarms at about 03:06.

Why the crew read it as a fault — and why that is not a training failure

Because everything they could check said 'no fire', and the system's own behaviour argued for a defect. The MAIB is careful here: both officers 'responded to the fire alarm very quickly' but 'both initially interpreted it as being due to a technical fault, delaying the response to the fire'. The report notes the detection system had no particular history of spurious alarms — so this was not a crew worn down by nuisance activations.

It was a single event in which the smell test failed (the third engineer, decks below, smelled nothing), the visual test failed (the second officer looked at the CCTV and saw no fire — the haze read as a picture problem), the radio failed, and the alarm's spread across sixteen sensors was read as the signature of a system fault rather than of smoke moving down a deck. The one correct inference available — that sixteen sensors firing in sequence is how a real fire looks — required trusting the instrument over three human checks that all came back negative.

What the delay cost

The fire was never extinguished on board. The crew contained it with the deck drenching system and boundary cooling from above but could not put it out; fire damage to unprotected cables and pipework in the main vehicle deck disrupted systems, affecting the ship's ability to manoeuvre and to contain the fire. Cargo debris — potatoes from the damaged trailers — blocked the vehicle deck drains, so drench water accumulated, the ship listed to port, and firefighting had to be suspended while the list reduced, because no tools or information were available to assess the entrained water's effect on stability.

Close to Portsmouth, berthing was significantly delayed by ineffective co-ordination between shore agencies and by equipment defects. Once alongside, high cargo density and the ship's design limited access both to fight the fire and to land the passengers, and trailers had to be towed off before the fire could be extinguished. The last of the 62 passengers disembarked nearly 20 hours after the fire started. There were no injuries — the outcome that keeps this a 'less serious marine casualty' — and the trailers' curtain-sides and cargo packaging, which had no fire-resistance requirement at all, 'burnt readily'.

What it argues for

An alarm should arrive with its own evidence. Three design conclusions follow directly from this sequence, and none of them is about sensitivity. First, corroboration: sixteen smoke sensors activating in a spatial sequence is data a system can interpret and present as 'spreading source, port side, midships to stern' rather than as 81 identical activations a crew must interpret. Second, a second modality: the deck was hazing on CCTV five minutes before the first alarm and the bus-tie breaker had already earthed — signals that existed and were never correlated.

A thermal or gas channel alongside smoke gives an officer a reason to believe rather than another thing to silence. Third, protect the circuit the breaker cannot: a loose IDC termination drawing normal load current is invisible to overcurrent protection by definition, so on a deck full of powered reefers the only thing that will find it early is something watching temperature at the connection. For the operator, the cheap version of all three is a procedure the MAIB effectively wrote for them — treat a vehicle-deck alarm as fire until proven otherwise, and never reset a system that keeps reactivating.

What it means for owners, class and underwriters

For the owner: reefer sockets are a live ignition source on an enclosed deck, cable assembly moved in-house is a quality-control risk nobody surveys, and an IP rating specified by class can be quietly wrong for years — the Clipper's sockets were IP44 where IP55 was required. For class: the protection was compliant and the fire still happened, which is the argument for looking at connection condition rather than breaker curves. For the underwriter: this is a 2010 ro-pax with 24 powered reefers on an enclosed deck and a 17-minute credibility gap, and the loss ran to a fire that could not be extinguished afloat, a 20-hour passenger detention and a list the master could not calculate. The fire-detection system did not fail here. The interface between the system and the people did — and that is a specifiable thing.

Sources

• 1. MAIB Report No 24/2011, 'Report on the investigation of the fire on the main vehicle deck of Commodore Clipper while on passage to Portsmouth, 16 June 2010' (published November 2011), read in full: synopsis; §1.1 particulars (Bahamas flag, IMO 9201750, DNV, 14,000 GT, 129.14 m, Condor Limited / Condor Marine Services, 62 passengers and 39 crew, position 50°18.87'N 001°29.76'W, deck 3 special category space, no injuries); §1.2–1.3 (77 trailers, 24 reefers, Jersey Royal potatoes, reefers struck down to deck 3 for ship's power); §1.4.1–1.4.5 (CCTV hazing 02:37, earth fault at the bus-tie breaker, alarm 02:42:36, 11 silences, 7 resets, system ceased 02:49:12, 16 sensors / 81 activations, lookout's unreliable VHF, visibility lost 02:54, confirmation 02:59:20, general emergency 03:01, drenching section 4, leakage alarms ~03:06).
• 2. MAIB 24/2011 §1.12.3–1.12.4, 'Electrical examination' and 'Reefer cables': 400 V supply through 250 A and 125 A breakers, three phases and an earth, no transformers or neutral; class-required IP55 sockets overlooked, IP44 fitted; ABB 'System pro M' 32 A K-characteristic breaker tripping at 84 A, 77 A then 70 A on test; x-ray of the CRF459 plug showing metal globules; Mennekes 'StarTop' plug, 440 V / 32 A, IP44, IDC terminals, cores at the maximum size the terminals accept; brown-phase termination loose, raising resistance, heating and arcing; terminal melting point 900–925°C; fault current limited to the ~25 A load so the supply breaker would not trip; cable make-up transferred to the crew on 1 May 2006; first StarTop plugs ordered April 2009, second batch May 2010.
• 3. MAIB 24/2011 §3.1–3.3, Conclusions: protection devices compliant and functioning but 'not capable of detecting the fault in the reefer cable'; high cargo density restricting crew and firefighter movement; attacking through the stern ramp ventilating the fire; no tools or information to assess entrained water's effect on stability; blocked deck drains and the port list; both officers interpreting the alarm as a technical fault and delaying the response; no regulatory requirement for a vehicle-deck drencher to extinguish a fire; no fire-resistance requirement for road-trailer construction materials, the CRF459 curtain-side and packaging being 'easy to ignite' and burning readily.
• 4. MAIB Safety Bulletin 3/2010 (issued July 2010) — urgent recommendation to operators of vessels carrying refrigerated trailer units on the risk of reefer power supply cables overheating; MAIB flyer to ro-ro vessel operators and the ports industry (Annexes E and F of the report).
• 5. MAIB 24/2011 synopsis: the Chief Inspector's letter to the IMO Secretary-General asking that this report and those into Al Salaam Boccaccio 98, Und Adriyatik, Lisco Gloria and Pearl of Scandinavia be reviewed to improve fire protection standards on ro-ro passenger vessels built before 1 July 2010.
• 6. Companion RoRoSAFE analyses — 'Lisco Gloria: The Drencher That Gave No Water' (detection worked, suppression failed), 'What a False Alarm Costs a Master at Sea' (the credibility argument this case evidences) and 'Stena Europe: The Hot Spot Nobody Found' (the other MAIB case where the instrument available answered the wrong question).