Are DPOs overconfident in the technology?
Dealing with a drive-off
by Captain Glenn FIander AFNI
The reliability of modern Dynamic Positioning systems is extremely high. As a result, DP Operators (DPOs) seldom have to deal with major problems. Is this resulting in an overconfidence in the DP system by the DPOs, to the extent that they are not as prepared as they could be to deal with problems?
Today, DP vessels are used for a wide variety of applications. Some examples:
- Offshore supply vessels located in close proximity to installations, perhaps with hoses connected for liquid/bulk cargo transfer. DP has to hold position within the limitations of the hoses/crane outreach.
- Instead of supply operations, perhaps in close proximity to a platform with divers or ROV deployed. Holding station within limitations of the diver/ROV umbilicals.
- Vessel positioned next to a platform with a walk to work gangway deployed, and personnel transiting to and from the platform.
Holding station within the limitations of the gangway. - Vessel laying power or fibre optic cable. Unlike the previous examples, there is no platform collision risk, unless the cable lay operation takes place near a platform. The cable lay vessel still has to maintain station within the length/tension limits of the cable.
The vast majority of DP operations include potential for vessel/asset damage due to DP system failure or incorrect DPO response to DP
system failures.
The challenge facing the DPO is that:
- DP problems are often instant and may require rapid decisionmaking;
- Making instant decisions is very easy;
- Making the correct decision is much more difficult.
Let’s take a look at one specific type of operation (Tandem Offshore Loading) in more detail:
For tandem operations conducted offshore in Canada and in the North Sea, there is usually 70 to 80 metres separation between the FPSOs (Floating Production Storage & Offloading) / FSUs (Floating Storage Units) and the shuttle tankers. For tandem loading operations in Brazil, the vessels may be up to 150 metres apart.
In figure 2, below, the vessel and the FPSO are in close proximity, just 72 metres apart. The shuttle tanker is connected via a hose, carrying 6,000 to 7,000 m3 of crude per hour at maximum rate, and a hawser (weak link 300 tonnes). To protect the hose, the shorter hawser would take the load, should the tanker lose position control and move away from the FPSO.
Figure 3, below, shows our FPSO moored to, and weathervaning around, a turret, permitting the FPSO to keep its heading into the prevailing environment. FPSOs/FSUs may or may not have heading control. Some FPSOs are spread moored with a fixed heading. The aim of the DP system is to weathervane the tanker, while keeping the bow of the tanker within the sector shown, ideally in line with the FPSO and at the optimal distance. Getting outside the operational area risks collision with the FPSO and/or damage to the hose/hawser.
Offshore loading, like any DP operation, has many things that can go wrong. The type of failures experienced can vary from operation to operation. Let’s look at just one possibility: a failure that causes full thrust to be produced by the main propeller, causing a ‘drive-off’ of the shuttle tanker towards the Floating Production, Storage and Offloading installation (FPSO). This is one of the most serious failures that can occur during an offshore loading operation – maybe the most serious, with the possible consequence of collision, if action is not taken in a timely manner. It is most often due to main propeller failure or a position reference system failure. The following is a brief overview of the process that the DPO might follow to react to the drive-off and avoid a collision. Keep in mind that this is just one of many failures that a DPO must be prepared to deal with.
Evaluation of potential drive-off:
- DPO detects tanker movement. Is it a drive-off? Vessel movement could be normal vessel movement on DP.
- A drive-off is suspected. What might be causing it? Drive-offs have occurred due to propulsion, position reference, software/hardware or DP sensor issues.
- Check thruster displays on the DP system for thrust indications.
The first indication of a drive-off is likely to be abnormal thrust indication on the DP thruster displays, along with a possible increase in thruster/generator (noise/vibration). In simulated drive-offs the first DP alarms occurred 9 to 12 seconds after the drive-off commenced. - Thrust indication on the DP console could be due to faulty feedback signal. Cross check and confirm thruster setting on thruster control panel displays.
- What is the vessel speed? Is it increasing? Which direction is the vessel moving? (The drive-off might be away from the FPSO.) Check DP system speed displays, position reference system displays, doppler speed log, if fitted.
- What is the distance to the FPSO? Check DP system for bow to stern distance. Confirm distance using position reference system displays ie Artemis (or XPR 100), DARPS (likely x 2). Depending on the vessel, RADius/ Fanbeam as well (if fitted).
- Are there any DP alarms sounding? There could be a dozen or more from start of failure to point of collision. In a simulated drive-off on one shuttle tanker, there were 12 drive-off related alarms over two minutes 44 seconds, from start of failure to collision. Some tankers have a specific drive-off alarm, appearing in the centre of the DP console display. This can indicate an actual drive-off, but has also been seen to occur due to a jump in position references with no drive-off occurring.
The DPO has to be instantly aware of what all the alarms mean. As we will see below, there is often no time to learn the meaning of the alarms when they are displayed in a failure situation.
Reacting to a drive-off: what next?
The DPO determines that a drive-off is occurring due to a main propeller that has failed to full ahead. The DPO has to take action. There is no one solution that covers all situations and there are multiple variables to consider.
- How much cargo is onboard (displacement)? The heavier the vessel, the more difficult it is to stop or manoeuvre.
- Is the tanker single or twin screw? With twin screw, the second propeller can run astern to slow forward motion – but will probably not be able to stop it, as astern thrust will be less than the thrust of the propeller that has failed to full ahead. The second propeller will also provide a means of surge control if the DPO decides to stop the failed propeller (see overleaf).
- Is the tanker fitted with azimuth thrusters? The azimuths can run astern to slow forward motion. Depending on the number fitted, they may provide enough thrust to slow and stop the vessel by counteracting the main propeller thrust. Again, they also provide a means of surge control if the failed propeller is stopped.
- How responsive are the thrusters/propellers to joystick/manual commands, if DPO decides to select manual control (see below)?
The following options for dealing with the drive-off are presented in no particular order. Depending on the circumstances, the DPO may decide on an alternate solution.
OPTION 1
The DPO determines that there is enough time/distance available to stop the vessel if pitch control of the main propeller is restored (Figure 4, below left). Astern pitch is commanded to stop the tanker within the separation distance to FPSO stern, using either the manual thruster controls or joystick. Control might be restored when switching from DP to joystick/manual control, or through quick intervention by the engineers.
Alternatively, the DPO may decide to shut down the failed propeller (emergency stop) and use the other main propeller/azimuth thrusters to stop the tanker within the separation distance to FPSO stern using either the manual thruster controls or joystick.
OPTION 2
This is a variation of Option #1. The DPO is unsure if the vessel can be stopped before there is a collision with the FPSO. In this case, the vessel is stopped while changing heading to turn the tanker’s bow away from the stern of the FPSO (Figure 5, below right), using either the manual thruster controls or joystick. The normal loading distance for the simulation shown in Figure 5 is 72m.
OPTION 3
The DPO determines that it is unlikely the vessel can be stopped before collision. Instead, the failed propeller is kept running. No attempt is made to stop the tanker, and the vessel’s momentum is used to advantage. The tanker passes to port or starboard of the FPSO.
The normal loading distance for the simulation shown in Figure 6 is 72m. No action was taken until vessel was at 45m from the FPSO. Manual thruster control was used to manoeuvre around the FPSO. Joystick control was unlikely to be successful at the distance where avoiding action was taken.
Additional factors affecting reaction
- Reduced visibility in fog or at night may reduce the DPO’s situational awareness.
- There may be a supply vessel conducting cargo operations at the FPSO, perhaps blocking one of the possible escape routes when using option #3.
- The FPSO and shuttle tanker may not be in alignment at the time of the failure. This may reduce the passing/turning options to one side, depending on where the tanker is situated.
- For most of a tandem loading operation, there is a hose and hawser running between the FPSO/FSU and the shuttle tanker, excepting some operations that have hawser only. Part of the emergency process would be activation of the emergency shut down system (ESD). This stops the crude supply pumps, closing valves and disconnecting the hawser and hose in 42 to 45 seconds. Activation would be a task for the 2nd DPO on watch.
- For safety purposes, crew in the vicinity of the hose/hawser have to be notified before any ESD is activated.
- On some tankers, ESD activation is automatic if the tanker reaches operational alarm limits. Damaging or parting a hose pumping up to 7,000 m3 of crude oil per hour is not desirable. The hawser used in these examples has a weak link that breaks at 300 tonnes. Should the hawser be placed under strain, a force of up to 300 tonnes could have an impact on the manoeuvrability of the tanker. The DPO must verify hose/hawser disconnection before any manoeuvre can take place.
- It will be necessary to communicate with the FPSO regarding the emergency situation. This is a task for the 2nd DPO on watch – but it is a key part of the process.
- Advise the Master, if not already present on the bridge.
- Communicate with the engine room, regarding the failed propeller.
To successfully deal with a drive-off or suspected drive-off, ideally the DPO:
- Is focused on the DP system and the DP operation.
- Closely monitors the operation of the DP system (at all times) while at the DP desk.
- Is prepared (as far as practicable) to deal with any failures that may occur.
- Understands the meaning of any alarms that may occur and knows how to respond to them.
- Minimises distractions when at the DP desk. This means not performing duties other than DP (i.e. radio communications, radar watch, etc.), not engaging in conversations other than those related to the DP operation, and not being distracted due to ongoing activity on the bridge.
- Is aware of the manoeuvring capabilities of the vessel and practised in the use of all systems used to manoeuvre the vessel.
- Is not fatigued. The DPO is well rested and shares DP duties during the DP watch. ie does not spend excessive time on DP desk.
Once again:
- DP problems are often instant and may require rapid decision making;
- Making instant decisions is very easy;
- Making the correct decision is much more difficult.
Reaction times
How much time does the DPO have to analyse and react to the driveoff described above? Figure 7, below, provides us with some real world numbers.
This information is sourced from a paper written by Jan Erik Vinnem and Jayantha P. Liyanage from the University of Stavanger, Norway. The paper ‘Human-Technical Interface of Collision Risk Under Dynamic Conditions: An Exploratory Learning Case from the North Sea’ was published in the International Journal of Technology and Human Interaction, Volume 4, Issue 1.
The data in figure 7 is sourced from actual DP incidents and shows that in a drive-off scenario similar to that described above, a DPO has minimal time to analyse the situation, make a decision and react. In general, reaction to a drive-off needs to occur within 30 and 45 seconds of the incident occurring to avoid a collision, and in less than 60 seconds, in the case of a near miss.
For comparison, I conducted a simulated version of the drive-off incident illustrated in Figure 6. The tanker started at 72m from the FPSO. I decided to take action only when the tanker reached 45m from the FPSO (the inner limit of the permissible operational sector). At the point where I initiated recovery action, 106 seconds had elapsed since the drive-off began, and the tanker was moving at 0.7 knots. Delaying my response to this point meant that aggressive manoeuvring was required. I went hard over on the rudder and 100% on all the thrusters (bow to port/stern to starboard) to turn and avoid the FPSO. Then hard over the other way, and thrusters 100% in the opposite direction, to avoid the tanker stern colliding with the FPSO.
From Figure 6 we can see that the manoeuvre was certainly a near miss. From the start, I had the benefit of knowing exactly what the fault was, at what point I was going to react and how I was going to react. These luxuries are not available to a DPO on a real tanker. In the real world, the delay in responding would likely have resulted in a collision. Without prior knowledge of the failure, there would probably have been a collision in the simulated world as well.
I ran the simulation a second time and took no avoiding action. Collision occurred 160 seconds after drive-off commencement at a speed of 0.9 knots.
"DP problems are often instant and may require rapid decision-making. Making instant decisions is very easy. Making the correct decision is much more difficult."
These are tight timelines for a successful response to the DP failure, and there are serious consequences if the response is not correct. The same can be said for many other types of DP operations.
A routine job – until it’s not
Over the years I have heard/read a number of statements such as: ‘The job of a DPO is 95% boredom and 5% blind panic’. There have been variations in the percentages used, and never any data to back them up. The statement implies that the majority of DP operations are routine. Major DP failures don’t happen very often and many DPOs can go their entire career without ever having to deal with a major incident.
The statement is not meant to imply that DPOs panic when faced with a problem. Perhaps it would be better to describe the response as alarm, anxiety or nervousness.
Why does this panic/alarm/anxiety/nervousness occur?
- Situations occur and the DPO isn’t sure what to do.
- The DPO hasn’t properly prepared for failures and doesn’t know what to do.
| Case | Vessel-to-Vessel initial physical distance (meters) |
Time (seconds) taken for DPO to take action (after drive-off commenced) | Consequence | Time to collision (seconds) |
| 1 | 75 | 100 | Collision | 120 |
| 2 | 70 | 80 | Collision | 140 |
| 3 | 80 | 50 | Collision | 130 |
| 4 | 75 | 30 | No Collision | - |
| 5 | 70 | Probably 40 | No Collision | - |
- Failures occur and the DPO can’t determine what has gone wrong.
- The DPO may not understand what the alarms mean – they have never seen the problem before.
The result could be decisions that are made in haste, and the possibility that incidents will become more serious than they might otherwise be.
Likewise, the statement is not meant to indicate that all DPOs are bored – a state that could also be described as lack of concern or apathy. I have taken part in DP operations where fellow DPOs have been heard to say ‘this is boring’. I have also been on DP operations where the DPO is so engaged with conducting the routine of the operation (not failures) that such a statement would not even be contemplated.
Why do boredom/lack of concern/apathy occur?
- Long periods of inactivity. After connection has been made, the offshore loading operation described above takes about 20 hours to transfer a full load of crude oil. During that time, the DPO’s primary task when at the DP desk is to sit and monitor the DP system, at times having to take action should the tanker’s bow approach the edge of or get outside the operational sector.
- Major problems occur relatively infrequently, if ever. In Eastern Canada, FPSO operations started in 2000. Since then, I am aware of one incident where a tanker has had a drive-off towards a FPSO.
(More details in ‘Incident 2 (Shuttle Tanker)’ below.) One such incident in 23 years doesn’t exactly leave DPOs in the region on guard for another such occurrence.
Consequences of boredom/lack of concern/apathy
- The DPO is more easily distracted by ongoing activity on the bridge.
- Starts performing duties other than DP (ie radio communications).
- Engages in conversations other than those related to the DP operation.
- Mind wanders and the DPO isn’t paying attention. Mind wanders to other things (home, leave, etc.).
- Decides to check their cell phone.
- Things get missed. If not paying close attention, the DPO might be delayed in noticing the propeller failing to full at the start of a driveoff. Given the time constraints mentioned above, this delay could result in a collision.
- The DPO is not as alert as they could be.
While I’m not aware of any incidents where there was any indication that the DPO panicked, the bored DPO is another matter. There was a DP incident where the DPO was in a relaxed state (perhaps bored), as shown in the re-enactment in Figure 8. The DPO’s foot touched the DP Standby button twice within four seconds. This resulted in the DP system being switched to standby during an offshore loading operation.
The incident was reported to IMCA and published in the 2015 DP Station Keeping Review 2015 (IMCA M233, Incident #1510, page 19).
Incident reports
The following reports outline two similar situations, with two different reactions from the DPOs:
INCIDENT 1 (SHUTTLE TANKER)
- Vessel was set up for DP Class 2 operation, with two bow tunnels, two stern tunnels and two main propellers.
- Half blackout caused loss of one bow and one stern tunnel and one main propeller.
- Shortly after, the remaining bow and stern tunnels failed due to problems with the Uninterruptible Power Supply (UPS) providing power for thruster control signals. The UPS was receiving power from the switchboard that had blacked out (wiring not connected properly and/or faulty batteries).
- The tanker remained on DP with 1 propeller online and the engine at full astern.
- With only one propeller online, the tanker had no possibility of DP control. The DP system continued attempts to maintain control.
- At 149 metres from the FPSO, with hawser taut, the DP commanded full ahead on the engine.
- At 37m from the FPSO, the Master took joystick control of the vessel.
- Collision with the FPSO took place at 2.4 knots, with a total incident time of 4 min. 50 sec.
There was not much time here to analyse and react. The investigation report indicated that speed was too high, and the Master took joystick control at 37m, too late to avoid collision.
There was possibly an overconfidence in the ability of the DP system to control the situation.
INCIDENT 2 (SHUTTLE TANKER)
- A single screw tanker loading under DP control was moving slowly towards the FPSO due to a software fault.
- Crew were unsure why the vessel was moving. There were alarms, but the DP system does not have a specific alarm which indicates that there is a fault in the software.
- On reaching 45m from the FPSO (normal loading 70m), the DP system commanded full astern.
- At 70m from the FPSO, the DP system commanded full ahead on the main propeller.
- This caused concern, as it could have indicated drive-off towards the FPSO.
- Control was switched to manual and the tanker moved clear of the FPSO.
Here, the Master indicated that he was unsure what the DP was doing. There was no confidence in the performance of the DP system and manual control was selected.
Are DPOs overconfident in the technology?
If being prepared for failures and being able to successfully deal with them is a measure, then for some DPOs the answer is no – they are not overconfident. All DPOs are not getting it wrong. Incident 2 above, is an example. A review of DP incidents will find many more examples of DPOs successfully dealing with emergency situations.
However, that same review will show situations where DPOs are not so successful. For many of those, the answer is possibly yes. Overconfidence in the DP system, in ‘Incident 1 (Shuttle Tanker)’ above, was a possible contributing factor.
For the majority of DPOs, who never face a major failure, we do not know the confidence level.
Only if they are involved in a DP incident, will we know how the remainder (and majority) of DPOs will perform.
Where time is no object
Here is an incident with no time constraints, no doubt about what the fault is, and no urgent need to react to the fault. The incident was reported to IMCA and published in the 2018 DP Station Keeping Review 2018 (IMCA M248, pages 21 & 22).
INCIDENT (SUPPLY VESSEL)
- Cargo operations with vessel meeting Class 2 requirements.
- The vessel had the redundancy required to handle the worst case failure.
- Blow on situation, due to SE crane not being available (see Figure 9).
- One of the two stern azimuths failed. The failure was not worse than the designed worst case failure and the vessel maintained position.
- With only one azimuth remaining on the stern, redundancy was lost.
- As redundancy had been lost, operations were suspended and the plan was to move outside the 500m zone for investigation of the problem.
- The DPO switched from auto DP to manual control, and the vessel became unable to maintain its position. Light contact was made with the platform before vessel control was regained.
- IMCA Review: ‘This decision was incorrect and the DPO had a lack of knowledge regarding how the system should perform. Had DP control been maintained, the vessel could have been manoeuvred away from the platform without harm.’
Exactly what happened to cause the contact with the platform is unclear. From other such reported incidents, I come up with the following possibilities:
- The switch was made to manual control and the DPO did not apply sufficient thrust to counteract the environment. Information on thrust required to hold position/heading, would have been displayed on the DP console, before manual control was selected.
- Thrust was applied, even momentarily, in the wrong direction. DPO was not aware of control orientation (ie which direction to push the levers).
- Switch over procedure was incorrect. The DPO thought that they were in control at a particular bridge station, when they were not.
This led to a loss of time to obtain control and apply thrust. - When auto DP was deselected, thruster setpoints would have gone to zero (as noted in the report). Any delay in applying thrust manually would cause the vessel to move towards the platform.
Why the decision was made to switch to manual control is unknown. That aside, any of the four possibilities listed above (there may be more) could have been overcome with some planning, practice on switchover procedures and practice holding station using the manual controls.
Does overconfidence in the DP system play a role here? The vast majority of DP operations run without problems. Is confidence in the DP so high that some DPOs don’t bother to practise/are not required to practise switching to and controlling the vessel manually?
Overcoming overconfidence
Some possible actions to mitigate any overconfidence in the system that DPOs may have:
- Emphasise the issues with becoming overconfident in the technology during initial induction/simulation and refresher/revalidation training. I am not sure how the training centres currently deal with this. Possibly an addition/change to learning objectives might be required.
- During training, review as many DP incidents as possible. This is a component of the current DP simulation, refresher and revalidation courses, and a component of the new CPD training requirements.
- Conduct practical refresher training to permit DPOs to practice dealing with DP failures. This is part of simulation/refresher/revalidation course training, but nothing is done after that. The shuttle tanker industry requires that DPOs do mandatory theory/practical training every 2.5 years. They get to practise failures such as the drive-off that I described. They get to see all the variables and just how little time they have to achieve a successful conclusion. This is information that they likely will never need to use in practice, but that it is essential for them to have.
On a final note, in the drive-off scenario described, the problem started with the tanker 72m from the FPSO. The supply vessel in Figure 1 is no more than 10 to 15m away from the rig, possibly giving much less time to analyse and react to a DP problem that could have the vessel moving towards the rig than a shuttle tanker drive-off. DPOs should be confident in the technology. It does work well. They should also be prepared in the event that it does fail.