Steering Gear Safety — Stored Energy, Isolation and Enclosed Space Entry

1. What makes a steering gear dangerous

A steering gear has three separate hazards, and they are quite different from each other.

It is a machine that moves a large mass with a large force, without warning. The rudder may weigh tens of tonnes, and the gear moves it through 70° of travel in under half a minute. The tiller, the rams and the crossheads all move during that, and they move fast.

It is controlled from somewhere else. The person in the steering flat is not the person who starts the gear. The bridge can move the rudder at any moment, and an auto-pilot can move it without anyone touching anything at all. The auto-pilot correcting for a small course deviation will put the rudder over while an engineer is working beside it.

It is a hydraulic machine holding oil at high pressure. Pressures up to 190 bar are normal, and a hydraulic leak at that pressure is not a drip — it is a jet that will penetrate skin.

There is also a fourth hazard that follows from the other three: the gear is in a compartment that fills with oil when it fails. The failure described in Chapter 11 puts the entire oil charge on the floor in seconds, and it does it while the gear is destroying itself. Anyone in the compartment at that moment is standing on a slippery floor next to a machine swinging from side to side.

2. The moving machinery

Moving parts of steering gears should be guarded to avoid injury to personnel.

That is the rule (Chapter 1), and it is met by fixed guards over the parts that can be reached. The parts that need guarding are all described earlier in this volume:

• The rams and their crossheads (Chapter 3 and Chapter 4) — the crosshead travels along the guide beam, and it will take a hand or an arm with it.
• The tiller and the Rapson slide (Chapter 3) — the tiller swings through its arc, and the swivel block or codpiece slides along it. The point where the slide meets the tiller is a crushing point, and it is the most dangerous part of the gear.
• The rudder quadrant on an all-electric gear (Chapter 7) — the quadrant teeth and the driving pinion form a nip that will pull a hand in.
• The flexible couplings and the pump shafts — rotating machinery with no guard is a hazard in itself.

The rudder itself is outside the compartment and is a hazard in its own right. It is large, it is heavy, and it moves without warning. The deck department should be informed before the rudder is tested, so that there are no obstructions in its way (Chapter 9). A boat rope, a mooring line or a person working over the stern is an obstruction, and the rudder does not know it is there.

Never put a hand on a moving ram, crosshead or tiller to feel for wear. The clearances and the wear are measured with gauges and callipers (Chapter 2 and Chapter 10), and that is the only way they should be assessed. A hand placed on a moving part to feel for slack is a hand in a machine.

3. Working in the steering flat while the gear is live

The dangerous situation is not a moving gear; it is a gear that might move.

Before any work is done in the steering flat, the control must be transferred to local, the bridge must be informed, and the gear must be immobilised.

The reason is that the bridge has a legitimate reason to move the rudder at any moment, and will do so without knowing that anybody is in the flat. The transfer to local control is what removes the bridge's ability to move the gear, and it is why the rules require it to be possible to disconnect any bridge control system from within the steering gear room (Chapter 1).

The auto-pilot is the particular hazard. An auto-pilot corrects for course deviations continuously, and it does not need anybody to touch anything. A gear left on auto-pilot with an engineer working beside it will move, and there is no warning. Before any work, the auto-pilot is off, the control is local, and the isolation procedure has been carried out.

The three-monthly drill is also a hazard in the same way (Chapter 9), and it is worth noting: a drill moves the rudder from hard over to hard over several times, and it must be conducted with nobody in the way of the moving parts, and with the deck department informed.

4. Safe isolation

The isolation procedure itself is set out in Chapter 9. It is a safety procedure rather than an administrative one, and it is worth being explicit about what it is for, because every step of it prevents something specific.

The first step is to take the standby pump out of auto. That is the one hazard the rest of the procedure does not cover. An automatically started pump starts itself, on a signal, at any moment, and it does not know that anybody is working inside the machine. It is also the step most likely to be forgotten, because it is done on a control panel rather than on the machine itself.

Then the electricity is isolated, and the isolation is proved. Stopping the motor is not isolation — somebody can start it again. The breaker, the local panel and the permit are what make the isolation real and recorded, and the permit is what stops somebody closing the breaker while work is in progress.

Then the hydraulics are isolated. Even with the pumps off, oil trapped in the cylinders is holding the rudder under pressure, and opening a pipe on a pressurised system is how people are injured. The isolating valves are shut, and the pressure is released before anything is opened.

And then everybody else is told. The bridge must know that moving the wheel will do nothing, and the warning board must tell anybody who comes into the compartment that the gear is out of service. A warning board is not a decoration; it is the only thing that protects a second person from the first person's isolation.

The permit is not released until the work is finished, the guards are back, the valves are set for running and everybody is clear. The last part matters as much as the first: a gear that is started with somebody still inside the valve chest is a fatal accident.

5. High-pressure hydraulic oil

The hydraulic system works at pressures between 80 and 190 bar (Chapter 11), and at those pressures a leak is a cutting tool.

Never search for a hydraulic leak with a bare hand. A pinhole leak in a high-pressure line produces a jet of oil that is invisible at close range and that will penetrate skin, injecting oil into the tissue. The injury is serious and needs immediate medical treatment. The correct method is to pass a piece of card or paper along the line and look for the mark it leaves.

The oil is discharged in a matter of seconds if a pipe or a flange fails (Chapter 11). That is the failure mode described in detail in the previous chapter, and from a safety point of view the point is this: there is no warning and no time to react. Nobody stands beside a pressurised pipe joint in a working steering gear unless they have to.

Oil on the deck is a hazard in its own right. The failure in Chapter 11 is described as having been made worse by oil on the deck, hampering the people trying to rectify it. In a compartment that can fill with oil in seconds, the floor must be kept clear and any spill cleaned up at once.

Hot oil is a burn hazard. Hydraulic oil in a working system reaches 60 °C and above, and it does not cool quickly. Any work on a pipe or a component that has just been drained needs the same caution as work on any hot surface.

The oil is also a slipping hazard at the best of times. A steering gear compartment with a slightly oily floor is a compartment where a fall onto the moving machinery is easy.

6. Air in the system

Air in a hydraulic system is a fault (Chapter 7 and Chapter 10), and it is also a hazard.

Air being compressible gives incorrect balance between units, time lags and irregular operation, which can be dangerous.

The danger is specific and worth spelling out. A system with air in it can move unexpectedly. The air compresses and stores energy, and it releases that energy as a movement. A rudder that is being held by a column of oil is held firmly; a rudder that is being held by oil with air in it can move suddenly when the pressure changes, and it can move when the control has not been moved.

A large quantity of air giving faulty steering may mean the only course is to empty and recharge the system (Chapter 7). That is a job to be done properly, with the procedures in Chapter 10, and not improvised.

The safety practice that follows is simple: after any work on the hydraulic system, the system is purged properly before the gear is put back into service. The gear must not be put back on the bridge's control with air still in it.

7. The rudder, the ship's side, and the propeller

Work on the rudder itself has hazards that are not present in the steering flat.

The rudder moves through 70° of travel, and its trailing edge sweeps through the water at a considerable speed. Nobody is in the water near a rudder that might move, and nobody is on a staging beside it.

The propeller is close to the rudder, and the propeller is the reason the rudder works. Any work near the rudder in dock has to consider the propeller and the shaft, and any work near either has to consider whether the shaft can turn.

The jumping stopper and the rudder stops are the parts that take the rudder's travel (Chapter 2), and they are under load when the rudder is hard over. Nobody puts a hand between the rudder and its stop.

Work over the side is subject to the ship's permit-to-work system, and the rudder is no exception. The rudder's size and weight make the consequences of a fall or a slip more serious than most work over the side, not less.

8. Lifting the rudder

Lifting the rudder is the most hazardous maintenance operation on the whole system. The procedure itself is in Chapter 10; what follows is why it is dangerous.

The jack position is the first hazard. A rudder is plating over an internal frame, and the plating will not carry a point load. A jack placed under the frame lifts the rudder; a jack placed under the plating crushes it. A rudder supported on crushed plating can shift, and a rudder that shifts while it is up on jacks is a rudder that comes down.

The second hazard is the weight itself. A rudder weighs many tonnes and, once it is off its bearings, it is held only by the jacks and the lifting arrangement. Nobody is underneath it, and nobody stands where they would be if it fell. The written sequence is followed, the makers' instructions are to hand, and the operation is done by people who have done it before. Getting the sequence wrong is how a rudder drops and breaks the shoe piece.

The third hazard is the gear still being connected. The steering gear must be isolated and immobilised first, and the tiller and the jumping stopper removed before the lifting starts (Chapter 10). A rudder being jacked up with the tiller still attached to the gear is a rudder that is trying to turn the whole steering gear.

9. Hot work on the stock and the pintle

Repairing the pintle cone involves welding on a highly stressed component (Chapter 10), and it brings its own hazards.

The procedure involves preheating, automatic welding, and stress relieving at 500 to 600 °C (Chapter 10). Two of those three steps involve the component being very hot.

The fire risk in a steering gear compartment is real. The compartment contains hydraulic oil, grease, paint and oily rags, and hot work is a source of ignition. The ship's hot work permit applies, the area is cleaned and protected, a fire watch is posted, and the work is finished and the area checked afterwards.

The stress relief at 500 to 600 °C is a controlled heating operation, not a fire, and it requires the component to be insulated and the temperature monitored. It is done to a procedure.

And the component being welded is the rudder stock's pintle — a highly stressed part with no spare. The safety point and the engineering point coincide here: the repair is done to the approved procedure by people qualified to do it, because the alternative is a pintle that fails.

10. The rules that exist for safety

Several of the requirements in Chapter 1 are safety requirements, and it is worth naming them as such rather than leaving them filed under "other requirements". Their wording is in Chapter 1; what follows is why each of them is there.

The guarding of moving parts is the most direct of them. It exists because the tiller, the slide, the crossheads and the quadrant will take a hand.

The independence of the gear's services — steam, hydraulic and electric leads serving the gear and nothing else — is a safety requirement in a less obvious way. A shared supply can be taken away by somebody else's failure, and a steering gear that loses its hydraulics because a deck winch tripped a breaker is a safety matter, not just an inconvenience.

The 100 per cent overload allowance on electric leads and fuses is the same idea applied to protection. The gear's supply is sized to carry the current of a motor pulling a jammed gear, so that the protection does not operate and leave the ship unable to steer.

The non-freezing hydraulic fluid is a cold-weather safety requirement. Fluid that has thickened cannot transmit movement, and a ship whose bridge control has frozen is a ship that cannot be steered from the bridge (Chapter 7).

The requirement for a clear view from the steering position, and for the wheel, the tell-tale indicators and the rudder movement to correspond in the correct amount and in the correct direction for the ship's head, is a safety requirement because a helmsman will believe an indicator that is lying. It is why the pre-departure test checks the indicator against the actual rudder position (Chapter 9).

And the whole of the emergency steering provision — the after steering position, the local control, the alternative power supply and the drills — is a safety requirement. A ship that cannot be steered in an emergency is a ship that will have one.

11. The working practices that follow

Gathered together, the practices are:

• Never work on a live steering gear. Take the standby out of auto, stop and isolate the pumps, obtain the permit, shut the isolating valves, inform the bridge and display the board — in that order, every time.
• Never assume the gear will not move. The auto-pilot moves it without anybody touching anything.
• Never put a hand on a moving part. Use gauges and callipers.
• Never search for a hydraulic leak with a bare hand. Use a card.
• Never put a hand between the rudder and its stops, or between the slide and the tiller.
• Keep the deck clear of oil. The compartment has to be workable when things go wrong.
• Purge the system properly after any hydraulic work, before the gear goes back on the bridge's control.
• Inform the deck department before any rudder movement, and check that nothing is in the way.
• Follow the written sequence for lifting the rudder, with the makers' instructions to hand and nobody underneath.
• Treat hot work on the stock and pintle as hot work, with the permit, the fire watch and the temperature control.
• Never defeat a protection. A relief valve adjusted to stop it lifting, a low level alarm silenced, an isolating arrangement disabled — each of these is a protection converted into a hazard.
• Never restart the gear with somebody inside it. The permit is released when everybody is clear and the guards are back.

12. Why these hazards are worth understanding

Every other chapter in this volume describes machinery that is designed to keep the ship safe. This one describes the machinery's effect on the people who work on it, and the two are connected more closely than they look.

The steering gear is dangerous because it is powerful, and it is powerful because it has to be. The rudder has to go hard over in under half a minute at full speed, and that requirement is what produces the forces that make the compartment hazardous. The hazard is not a design fault; it is the other side of the capability.

The gear is dangerous because it is controlled from a distance, and it is controlled from a distance because that is where the ship is steered from. The same arrangement that lets the bridge steer the ship is what lets the bridge move the gear while somebody is working in it.

And the gear is dangerous because its failure is violent, and its failure is violent because it holds a large amount of energy in a small volume of oil. The 190 bar that makes the gear compact is the 190 bar that makes a leak a cutting tool.

The practices in this chapter are therefore not precautions added to the engineering. They are the discipline that the engineering requires, and they are the reason the engineer working in a steering flat has to know not only how the gear works but what it will do.