The UK Marine Accident Investigation Branch interim report on a fatal lift‑shaft incident aboard a P&O Cruises vessel reads like a checklist of what can go wrong when teams skip disciplined isolation. If you manage shipboard competence and permits in SeaEmploy.com, this case gives you real-world proof: procedures only protect people when supervision and verification make them real.
The interim findings focus on three linked failures: no electrical isolation, interlocks that re‑enabled operation when doors shut, and a “stored call” that triggered lift movement at the worst possible moment. The result: a technician entered the shaft and the lift restarted.
P&O Cruises accident: what the MAIB interim report says happened
In its interim report (issued January 2026), MAIB describes a fatal accident on the Bermuda‑registered passenger vessel Arvia at about 05:52 UTC on 26 October 2025. An electrical technician suffered fatal injuries inside a passenger lift shaft while the ship sailed from Southampton toward Santa Cruz, Tenerife (the ship later diverted to A Coruña).
The report places the accident 75 nautical miles north‑west of Cape Finisterre, in Passenger Lift 14, in the shaft between decks 12 and 14. The ship carried 6,980 people onboard at the time (5,299 passengers and 1,681 crew).
The sequence of events inside the lift system
Repair work took place overnight. After the repairs, the electrical technician and the staff electro‑technical officer (SETO) tested the lift from inside the car. They stopped the lift on deck 11, and the technician went to deck 12 to open the lift shaft doors and inspect the top of the car.
A defect blocked him. The door release key on deck 12 did not operate, so he moved up to deck 14 and opened the shaft doors there (the report notes that the ship has no deck 13). He then entered the lift shaft from deck 14.
At roughly the same time, the SETO left the lift car on deck 11 to join him on deck 14, and the lift car and lift shaft doors on deck 11 closed automatically. The shaft doors on deck 14 also closed behind the technician after he entered.
Once those doors closed, the lift “automatically reactivated and moved up,” crushing the technician between the lift car and the side of the lift shaft. At 06:02 the crew declared a medical emergency, and at 06:07 the ship’s doctor declared the technician deceased. The ship diverted to A Coruña, where emergency services recovered the body.
Electrical isolation did not happen, and that decision mattered
MAIB’s first and most direct finding states it plainly: the lift was not electrically isolated at the time of the accident. That single fact sets the conditions for everything that followed, because the system still had the ability to restart.
This point maps directly to lockout/tagout fundamentals: isolation means you separate equipment from its energy source, secure it against reconnection, and verify the safe state before you put anyone in a danger zone. OSHA’s hazardous energy standard, for example, also calls out “stored or residual energy” and demands that teams render it safe after lockout/tagout. Even if you operate under different flag-state rules, the principle stays the same.
HSE guidance on interlocking makes another crucial point that applies here in plain language: control-circuit features do not replace isolation. Interlocks help, but they do not serve as “isolators,” and crews still need a safe system of work built around positive isolation and verification.
Lockout tagout on ships: why “locked off” and “key control” saves lives
Safe-isolation guidance also stresses physical control of the isolating device. Electrical Safety First describes locking off the point of isolation with a safety lock, keeping the key under the control of the person doing the work (or an electrically authorised person), and using multi-lock arrangements when several people work on the same system. That approach prevents a “well-meaning” re-energisation that turns fatal in seconds.
On a cruise ship, this translates into practice, not slogans: one nominated isolation authority, clear lock custody, a visible lockout/tagout point that matches the lift’s energy path, and a strict rule that nobody enters the shaft until the team proves isolation.
Interlocks and stored call signals explain why the lift moved
Interlocks work as part of a safety circuit. When doors close and lock correctly, they complete the circuit and allow normal operation. A lift-industry safety note describes how a landing door lock can activate a door safety switch that connects in series to the central safety circuit; when the switch activates, the circuit reads “closed and safe for the lift to operate.”
Another lift technology reference describes door interlocks as a safety mechanism that ensures the car cannot move unless doors stay securely closed, and that doors stay locked while the cabin moves. That protection helps passengers and technicians—but only when nobody places themselves inside the shaft while the system remains able to restart.
MAIB’s interim findings link the door closures to lift restart: when the lift car and shaft doors on deck 11 and the shaft door on deck 14 closed, the interlocks that had prevented operation became re‑enabled. Then a stored lift call signal—a command already registered in the controller—caused the lift to travel upward.
That “stored call” detail matters because modern controllers can keep call data in memory until the system serves it. A technical reference describing elevator call registration explains that a controller can store call data in memory and then output it so the car moves to the requested floor. In other words, your lift can “remember” a request even if you temporarily stop it.
Supervision and competence management: the hidden layer behind the hardware
MAIB states that the ongoing investigation will examine manufacturer safety guidance, the documented safe system of work, supervision and safety oversight, and the actions of the crew involved. That scope signals an important truth: equipment rarely kills on its own. Systems fail when people treat safeguards as substitutes for isolation, or when supervisors fail to challenge shortcuts.
Competence management sits right in the middle. Lift work combines electrical risk, mechanical trapping hazards, and “unexpected movement” risk. A shipboard competence matrix needs more than a certificate number; it needs task-based authorisation that defines exactly who can isolate, who can verify, who can enter the shaft, and who must supervise.
What to learn and apply onboard right now
The fatal mistake in this P&O Cruises accident did not involve one dramatic action. It involved a chain of normalised decisions: testing a repaired lift without electrical isolation, entering the shaft while interlocks could re-enable, and leaving the system vulnerable to a stored call that could drive movement. MAIB records that exact chain in its initial findings, and every ship operator should treat it as a live warning.
Start with hard controls. Build a lift-specific LOTO method that forces positive isolation, lock custody, verification, and call management (clear stored calls and confirm inspection mode states) before somebody opens a shaft door. Tie that method to supervision: no lone-entry into the shaft, and no “I’ll be quick” exceptions.
Then audit competence the way you audit critical machinery: not by paperwork completion, but by observed job performance. Track authorisations, refresher training, and supervisor sign-off in your safety system—whether you run that workflow through SeaEmploy or another platform—and link it to real permits and real isolations. Finally, keep the primary sources in your toolbox: the MAIB interim report (PDF) and the MAIB current investigations page provide the most reliable updates.
