Blackout · drifting · anchors
A generator let go on sea trials — and the anchors needed the power that was gone
Generator failure, engine room fire, full blackout, a ship drifting with winches that could not be run — and a published cause three years upstream.
Source of record
UK Marine Accident Investigation Branch (MAIB) — Report 10/2026 — Kommandor Susan
Occurrence 25 January 2025 · report published 6 May 2026
Read the official reportWhat the investigator found
At 1305 on 25 January 2025 the site investigation vessel Kommandor Susan suffered a catastrophic failure of a diesel generator engine while conducting sea trials in the Firth of Forth, Scotland. The failure caused an engine room fire and a complete power blackout. The crew extinguished the fire and mustered safely. The vessel lost propulsion and began drifting eastwards. Attempts to deploy anchors were unsuccessful because the anchor winches required electrical power to operate. The vessel was eventually returned to Leith with limited propulsion restored.
- Use of non-genuine engine components during a major overhaul in 2019.
- Approval of extended service intervals, which assumed the use of genuine components.
- A shortfall in oversight and contractor assurance by the vessel owner during the overhaul, which allowed the non-genuine components to be installed.
The teardown
Everything below this line is our reading of the published record — a Chief Engineer's interpretation, not a finding of the investigating authority.
The failure was six years old before it happened
Read the safety issues in order and the sequence is not mechanical, it is administrative. Parts went in during an overhaul. Service intervals were extended on the assumption that those parts were the maker's. Nobody reconciled the two. The engine then ran, correctly by its own maintenance plan, on a schedule that no longer matched what was inside it. That is not a maintenance failure at the point of work — it is a records failure that made the maintenance plan quietly untrue.
Extended intervals are a bet on the parts you actually fitted
Every extended-interval approval carries a condition, and the condition is almost always about components and condition monitoring. In practice the approval lands in one system, the purchase order lands in another, and the invoice with the part number on it lands in a third. Six months later nobody in the chain can answer the only question that matters: is the assumption behind this interval still true on this engine? A superintendent asking that question ashore gets an answer in an afternoon. On a ship, with three disconnected records, it can be unanswerable.
The second failure is the one that turns an incident into a casualty
The engine failure was survivable. The ship drifting was survivable. What removed the last option was that the anchor winches needed electrical power — so the recovery action assumed the very service that had just been lost. Every ship carries a handful of these dependencies, and they are almost never written down as dependencies. They are written down as separate equipment.
Ashore this is a Tuesday; at sea it is a casualty
A shore plant with a failed generator loses production, calls the maker, and works through the week. The same failure at sea removes propulsion, steering, firefighting margin and — as here — the anchors, all at once, at the moment the ship needs them, with the nearest specialist a flight and a visa away. The engineering is not harder at sea. The consequences are simply not separable.
Which record already held the warning
A maintenance interval whose approval conditions are no longer verifiable
Lives in
The planned maintenance plan, against purchase and overhaul records
Would have shown
That the interval rested on an assumption about components which no record on board could confirm — flaggable the day the parts were received, not after the failure.
Non-genuine or unconfirmed-origin parts fitted to critical machinery
Lives in
Spares receipts, requisitions and overhaul contractor reports
Would have shown
A critical-equipment job closed against a part with no traceable maker origin — an open question on the job, not a closed job.
Contractor work on critical machinery closed without an owner's assurance step
Lives in
The overhaul work package and its sign-off trail
Would have shown
A major overhaul completed with no independent verification recorded, which is the condition the investigator named.
Recovery equipment that depends on the service most likely to be lost
Lives in
The blackout recovery procedure and the emergency switchboard load list
Would have shown
Anchor winches drawing on main power in a scenario written around losing main power — visible on paper long before it is visible on a drifting ship.
What a maintenance system should be doing
- Bind every extended interval to the evidence its approval assumed, and reopen the interval automatically when that evidence cannot be produced.
- Make part origin a required field on critical-equipment jobs, so a job cannot close clean against an unverifiable component.
- Treat contractor overhauls as jobs requiring an owner assurance step, recorded at the point of work, not a certificate filed afterwards.
- Model the blackout recovery chain as dependencies, and flag any recovery action that needs the service being recovered.
Method
- — Only published official investigations. Report number and link on every case.
- — The investigator's findings are quoted as theirs; our reading is labelled as ours.
- — No vessel the author has attended, ever — no exceptions, no de-identified exceptions.
- — Every case ends the same way: which record already held the signal, and what would have shown.