Ferries and Passenger Vessels: Keeping Uptime While Staying Compliant (IMO FAL, SOLAS)

On a scheduled service, maintenance is not judged by the number of work orders closed. It is judged by one question asked on the bridge every morning: will the ship sail on time? A ferry running six to ten rotations a day, or loading 800 people and 200 vehicles in forty minutes, enjoys none of the slack a tramp cargo ship has. Passenger vessel maintenance is a balancing act between near-total availability and a regulatory framework — SOLAS, the ISM Code, the IMO FAL Convention — that tolerates no shortcuts.

Passenger operations add three pressures on top of the cargo trade. Commercial: a cancelled sailing is not postponed, it is lost, and it is paid for twice, in refunded tickets and in reputation. Human: what is on board is not containers but people, some with reduced mobility, whose exact number and identity must be known at every moment. Regulatory: life-saving appliances, fire detection, crew drills and the registration of persons on board are dated, inspectable and enforceable obligations.

This article sets out how to hold all three: a preventive programme that fits fifteen-minute windows, a clear hierarchy of sailing-critical equipment, tooled compliance, handover that loses nothing, and indicators that speak to operations as much as to the engine room.

The passenger equation: no plan B

A lost rotation is never recovered

On a coastal or island service with tight turnarounds, the logic inverts: the schedule is built to the minute, berth slots are shared with other operators, and tides and port windows are not negotiable. A forty-minute defect alongside does not cost forty minutes — it shifts the whole day, kills the last rotation and leaves passengers on the quay.

That asymmetry must shape maintenance policy. On a cargo ship you reason in terms of the cost of the job; on a ferry, in terms of the cost of unavailability: the price of a duplicate spare becomes trivial next to the value of a cancelled sailing in peak season.

Brand image is an asset under maintenance

On a passenger ship, failures are not invisible: air conditioning down on a crowded deck in August, out-of-service toilets, a stuck lift. None endangers anyone, but all generate online reviews and claims. The maintenance perimeter therefore covers everything the passenger sees and feels, and that must appear in the planned maintenance system alongside the auxiliaries.

Safety of life changes the scale of risk

After an incident, the investigation will not only address the failure itself but the operator's ability to demonstrate control of the ship: maintenance plans up to date, drills carried out, numbers on board known, certificates valid. The ISM Code requires exactly this in section 10 — a documented system for the maintenance of the ship and equipment, with inspections at appropriate intervals and the handling of non-conformities.

Maintenance windows measured in minutes

Map the available time before planning anything

The classic first mistake is to import onto a ferry a plan designed for a deep-sea vessel, with three- and four-hour jobs: they are never done, and endless deferral destroys the credibility of the whole system. Instead, make an honest inventory of the windows actually available in a typical operating cycle.

• Between two rotations: 10 to 30 minutes, one person, no heavy isolation, no enclosed-space entry. Rounds, readings, greasing, functional tests and visual checks belong here.
• Traffic trough: 1 to 3 hours, machinery available on one engine, partial isolation possible on a redundant auxiliary.
• Overnight alongside: 6 to 10 hours — the real working window, constrained by noise limits in urban ports and by night-shift availability.
• Scheduled off-service day: weekly or monthly depending on the route, reserved for work requiring a cold ship.
• Drydocking and refit: the only window for hull, shaft lines, thrusters and major overhauls.

This typology becomes the skeleton of the plan: every preventive task carries a window tag, and the system only offers the team what is achievable in the time it actually has. That is the founding principle of a planned maintenance programme that works: feasibility beats theoretical completeness.

Break preventive work into atomic tasks

A four-hour service on a generator fits into no turnaround window. It can be broken into eight self-contained twenty- to thirty-minute operations, each with its own restart point and completion check. Splitting makes the task executable and removes the all-or-nothing effect where an interrupted job leaves equipment half-stripped at sailing time.

1. Every fragment must end in a safe, reversible state. If the next rotation forces you to reassemble everything, the split is wrong.
2. Every fragment carries its own tool and parts list. A twenty-minute window evaporates in five if the engineer walks to the store looking for a gasket.
3. Every fragment is traceable individually. On a two-crew ship, whoever takes over must instantly see where the sequence stands.

Protect the long windows

Nights alongside are rapidly colonised by corrective work, and heavy preventive work ends up never being done. The counter-measure is to ring-fence a weekly volume of hours for preventive maintenance, arbitrated at operations level rather than left to the ship, then measure how well it is respected. It is also the gateway to a condition-based approach: oil analysis, vibration measurement, thermography. These cost almost no downtime and let you trigger the heavy intervention at a time you choose.

The equipment whose failure cancels a sailing

One category of equipment stands apart: items whose failure does not degrade the service but stops it. Building that list with the master and the chief engineer, then applying a reinforced preventive regime to it, is the highest-return action in the entire system.

Equipment	Operational impact of a failure	Preventive counter-measure
Main propulsion (engine, gearbox, shaft line, CP propeller)	Immediate cancellation or reduced speed, cascading across the day	Oil analysis and vibration monitoring, parameter logging every watch, wear parts replaced on running hours
Bow or azimuth thruster	Manoeuvring impossible in tight ports: call cancelled or tug imposed	Functional test before every departure, hydraulic power pack and shaft seal checks
Ramps, visors and access doors	Vehicle loading impossible: the sailing is cancelled even with propulsion available	Weekly hydraulic checks, limit switch and interlock verification, emergency control tests
Steering gear and emergency steering	Departure prohibited; near-certain detention at port State control	Pre-departure tests as required by SOLAS, hydraulic level and leak checks, emergency system testing
Stabilisers and anti-roll systems	Degraded comfort and complaints; operational limitation in heavy weather	Actuator and power unit checks before each season, deploy and retract tests at fixed intervals
HVAC in passenger spaces	Severe discomfort in hot weather, sometimes closure of a deck to the public	Filter and coil cleaning on running hours, refrigerant leak testing, redundancy on critical zones
Toilets, sewage treatment and potable water	Sanitary blocks closed, health risk, MARPOL Annex IV non-conformity	Scheduled descaling, transfer pump monitoring, wear-part stock, chlorination control
Ticketing, access control and passenger information	Manual boarding, turnaround doubled, degraded counting, safety announcements not broadcastable	Redundant readers and amplifiers, tested fallback procedure, offline synchronisation of passenger lists
Lifts and accessibility equipment	Passengers with reduced mobility cannot be carried: refused boarding, legal exposure	Periodic servicing contract, emergency lowering tests, stock of control boards
Life-saving appliances and evacuation systems	Reduction of the authorised number of passengers, or prohibition to sail	Weekly and monthly inspections, annual servicing at approved stations, expiry tracking
Fire detection and fire-fighting systems	Immediate detention; major risk to life, aggravated on vehicle decks	Rolling zone-by-zone detector testing, fire pump and emergency fire pump tests, fire door checks

This table is not universal: every route, every ship and every port has its own weak points. Rebuild it for your operation by reviewing the last six months of delays with your officers: a shore linkspan or a bilge pump often weighs more than a major machinery item. The Equipment module then lets you embed that criticality in the vessel's asset tree.

Safety and compliance: the non-negotiable base

Life-saving appliances and drills

SOLAS chapter III governs life-saving appliances and their operational readiness. Regulation 20 imposes inspection and maintenance at defined intervals: weekly checks, monthly inspections using a checklist, annual servicing of liferafts, inflatable lifejackets and launching appliances at approved stations, and thorough five-yearly overhaul of on-load release gear. On passenger ships, regulation 19 additionally imposes an abandon ship drill and a fire drill every week, against a monthly interval on most cargo ships.

On top of that comes the passenger muster. Since the amendments in force from 1 January 2020, the muster of newly embarked passengers must take place before departure or immediately upon departure, rather than within twenty-four hours of embarkation. For a short-sea operator, that imposes an organisation built around each rotation, with safety briefings delivered and their delivery recorded.

These obligations are recurring, short and numerous, and a shared spreadsheet holds up only until the first absence or crew change. Managing them as periodic tasks inside a planned maintenance system, with automatic alerts and time-stamped evidence of completion, removes that fragility.

Fire detection and containment

Fire risk is aggravated by occupancy density and by vehicles, combustion and electric alike, on the vehicle decks. SOLAS chapter II-2 requires detection, alarm, fixed extinguishing systems, and control of fire doors and ventilation. Four findings recur at inspection: detectors not tested zone by zone over a full cycle, fire doors wedged open, seized fire dampers, untraced emergency fire pump tests. All four should appear in the preventive plan, with evidence of completion per zone rather than a single global tick.

Passenger lists, FAL Form 6 and counting persons on board

The IMO FAL Convention (Convention on Facilitation of International Maritime Traffic, 1965) standardises the documents a ship exchanges with port authorities. Among the standardised forms, FAL Form 6 is the Passenger List: it identifies the ship (name, type, IMO number, call sign), the voyage, the port and date of arrival or departure, and for each passenger the family name and given names, nationality, date and place of birth, type and number of identity document, and the ports of embarkation and disembarkation. Since 1 January 2024, electronic exchange of this data through a maritime single window has become mandatory under the FAL Convention, ending the tolerance for paper lists handed over at the gangway.

This FAL requirement — customs and border in nature — must not be confused with the safety obligation arising from SOLAS. Chapter III, regulation 27, requires that all persons on board be counted prior to departure and that their details be recorded; persons who have declared a need for special care or assistance in an emergency must be identified, and that information communicated to the master before departure. In the European Union, Directive 98/41/EC reinforces this with data transmission to a single point and a designated passenger registrar within the company; other flag and coastal States apply comparable schemes, so international operators should verify both flag and port State requirements.

Two distinct logics therefore coexist on board, and confusing them is a classic source of non-conformity:

• Counting: exactly how many persons are on board when the lines are let go, crew included. This is safety data; it drives search and rescue response and evacuation sizing.
• Nominal registration: who is on board, with the required identity details. This is the data that feeds FAL Form 6, border checks and, after a casualty, the search for individuals.

The Smart Sailors Passengers module was designed around this dual requirement: generating the list in FAL Form 6 format, keeping the head count current, handling declared assistance needs and retaining a time-stamped record for every sailing. The offline capability of the mobile app matters here: counting depends neither on network coverage at the gangway nor on Wi-Fi deep in the ship.

Certificates and surveys

A passenger ship accumulates an unusual number of statutory documents: Passenger Ship Safety Certificate, radio certificates, ISM and ISPS documentation, MARPOL certificates, approvals of liferaft servicing stations and lift certifications. Each has its own expiry, survey window and issuer; losing the validity of a single one immobilises the ship. The Certificates module centralises these deadlines by vessel and by fleet, with advance reminders, so surveys are scheduled inside the maintenance windows already identified.

Key takeaways — Three obligations must be handled separately and traced distinctly. (1) Maintenance and inspection of life-saving appliances and fire detection at the intervals set by SOLAS chapters III and II-2, with weekly abandon ship and fire drills. (2) Registration of persons on board under SOLAS III/27: counting before departure and identification of persons needing assistance, communicated to the master. (3) The passenger list in IMO FAL Form 6 format, transmitted electronically through the maritime single window since 1 January 2024. Failing on any one of those three lines is enough to turn a routine call into a detention.

The traceability required after an incident

After an incident, the timeline becomes the central exhibit. The flag Administration, the underwriter and the investigator always ask the same questions: when was this equipment last checked, and by whom? What defect had been reported, and what was done about it? How many persons were on board? Who had declared a need for assistance?

An organisation forced to reconstruct those answers from handwritten notebooks and officers' recollections starts at a serious disadvantage, even when it has done good work. Three principles cover the essentials:

• Capture at the moment of the act, by the person performing it, not at the end of the week by the second engineer transcribing scattered notes.
• Immutable time-stamping and identification: a corrected record must retain evidence of its correction, as in a digital engine room logbook designed for audit.
• Chaining defect → decision → intervention → verification. A defect reported and then left without documented follow-up is more damaging than one never reported.

Ship-shore organisation and handover between rotating crews

Most ferries operate with two or three crews, and operational incidents rarely stem from a lack of competence: they are born at the seam between crews. A defect noticed on Friday evening, judged minor and never written down, leaves with the crew going home and reappears three weeks later as a blocking failure.

Handover must therefore rest not on a ten-minute conversation at the gangway but on a shared, current picture of the ship. The joining crew must find, without having to ask: overdue tasks and why, equipment running in a degraded mode, jobs in progress and their stopping point, parts on order, and the month's regulatory deadlines. A shared dashboard does this far better than a folder left in the mess room.

The division of responsibility that works best is simple: the ship owns execution and observation, the office owns arbitration and supply. That assumes a common database and synchronisation that tolerates loss of connectivity. On passenger ships, certificate tracking deserves particular attention: crowd management and crisis management qualifications must remain valid across the whole crew list, hotel staff included.

Critical spares: the duplicate that saves the season

On a scheduled service, lead time is the main enemy. A ramp position sensor, a bow thruster control card or a stabiliser actuator can carry eight to fourteen weeks of manufacturer lead time. Ordering only after the failure means accepting several weeks out of service, generally at the worst point in the year.

The method is to cross two axes: operational criticality (does the failure cancel a sailing?) and lead time. Items combining high criticality with long lead time justify a safety stock on board or in a port store, even with zero turnover: that is an insurance investment, not inventory in the accounting sense. High-criticality items with short lead time are handled through framework agreements with a supplier commitment; everything else runs on reorder points.

Two refinements matter across a fleet. Pooling: on sister ships, one precisely located shared set of spares beats three partial, vaguely tracked stocks. Inventory discipline: a part that exists but cannot be found is equivalent to a part that does not exist. The principles in our guide to MRO stock management apply directly, and the Inventory module triggers replenishment on thresholds without an email chain.

KPIs that actually matter on a passenger service

Classic maintenance indicators — preventive completion rate, MTBF, MTTR — remain useful, but they do not speak to an operations director. On a scheduled service, four indicators bridge the engine room and the commercial side.

• Sailing reliability: sailings completed against sailings scheduled, with a clear split of causes (technical, weather, port, commercial). This is the headline figure for the board.
• Delay minutes attributable to technical causes: monthly total of departure delay minutes whose root cause is a defect or an intervention. Divided by the number of rotations, it directly measures maintenance performance.
• Maintenance window compliance: the share of ring-fenced hours actually spent on preventive work. A collapsing rate predicts a rise in failures two to three months ahead.
• Regulatory deadline compliance: drills on time, life-saving appliance inspections current, certificates without drift. It must stay at 100 %; any lower value is an alarm, not a trend.

What Smart Sailors brings to a passenger vessel operator

Smart Sailors is a maritime CMMS designed by seafarers, in service on more than 400 vessels, with an offline mobile app. Three modules cover the core of the need described here.

• Maintenance: preventive work split into short tasks, tagged by execution window, triggered by date or running hours, with time-stamped evidence of completion and history per item of equipment.
• Passengers: lists in IMO FAL Form 6 format, counting of persons on board, management of declared assistance needs, archiving by sailing — built to satisfy both the FAL logic and the SOLAS III/27 requirement.
• Certificates: tracking of statutory documents and survey windows, advance alerts, consolidated fleet-wide view.

The full 12-module overview and pricing are available online, with a 30-day free trial.

FAQ

What is the difference between FAL Form 6 and registration of persons on board under SOLAS?

FAL Form 6 is the Passenger List standardised by the IMO FAL Convention: a facilitation document for port, customs and border authorities. The registration required by SOLAS chapter III, regulation 27, is a safety measure: all persons on board counted prior to departure, their details recorded, and persons declaring a need for assistance identified and reported to the master before departure. The two obligations overlap in part but do not replace each other.

How do you plan preventive maintenance when port calls last twenty minutes?

By abandoning long tasks. List the windows genuinely available — between rotations, traffic troughs, nights alongside, off-service days, drydocking — then break every preventive operation into self-contained fragments sized for the target window, each ending in a safe and reversible state. The system then only offers tasks compatible with the time available, which mechanically raises the completion rate.

Which drills are mandatory on a passenger ship and how often?

SOLAS chapter III requires an abandon ship drill and a fire drill every week on passenger ships, against a monthly interval on most cargo ships. The muster of newly embarked passengers must take place before departure or immediately upon departure, following the amendments in force since 1 January 2020. Other drills are organised according to the company safety management system and flag State requirements.

Should every critical spare on a ferry be held in duplicate?

No. Duplicate stock is justified where two criteria intersect: operational criticality and lead time. A part whose failure cancels a sailing and whose manufacturer lead time exceeds several weeks deserves a dedicated spare, even with no turnover. A critical part available within forty-eight hours is better handled through a framework agreement with a supplier commitment.

Which indicator should be monitored first on a scheduled service?

Delay minutes attributable to technical causes, per rotation. It translates maintenance performance into the language of operations, and makes it possible to argue calmly for an investment in spares or preventive hours. It pairs well with sailing reliability and with maintenance window compliance.

Conclusion

Keeping a passenger vessel available is not about doing more maintenance. It is about doing it in the right format, at the right moment and on the right equipment. Three decisions structure the rest: splitting preventive work so it fits the operating windows; identifying the items whose failure cancels a sailing and applying a reinforced regime to them; and treating compliance — SOLAS chapters III and II-2, FAL Form 6, certificates — as a tooled flow of deadlines rather than a sprint before inspection.

Do you run a scheduled service or a fleet of passenger vessels? Book a demonstration tailored to your operation, or start a 30-day free trial to test the splitting of your preventive plan and the generation of your FAL Form 6 lists on a real rotation.