Design has Consequences

There is an old saying that it is better to seek forgiveness than ask permission.?I sometimes wonder if that is the standard dynamic positioning (DP) design philosophy.?Normal industry operation is back to front, ships are specified, designed, equipment ordered, and then midway through the construction, the design is checked with a DP failure mode and effect analysis (FMEA).?With the detailed design set, the equipment installed, and most of the construction completed, it is not a good time to find major DP flaws, but it is not a rare result.?Late in the project, it is difficult and expensive to fix major flaws, and operational work-arounds are often preferred to systematic solutions.?This adds expense and usually reduces the safety and reliability of the vessel’s DP operations.

Why does this happen??It’s not that there aren’t clear standards and guidance available for DP vessels.?In fact, there is lots of clear guidance and standards available for everything in a potential vessel.?There are far more than anyone can read & keep fresh in memory, and that is part of the problem.?Because there are many competing requirements of various importance, some of the DP requirements may not be met.?Designers need to get the big things right, such as do not sink, and comply with the majority of the specifications, so issues that could be fundamental to later DP operation can be missed.?They check things themselves, but can’t be experts in everything and may overlook DP problems.?Most designers want to do a good job and they want to feel that they have done a good job, but they usually don’t feel the need, have the time, or have the budget for another set of eyes to check smaller specialist concerns that they assume will be caught by class.

On the other hand, class tends to review the vessel with an eye towards meeting main class and tends to examine additional class requirements later.?Something that is defined clearly enough for main class may not be defined well enough for the specialist departments until later.?Class cannot afford to check documents multiple times and maintain a tight budget, so DP concerns are usually first raised by the DP FMEA process.?They sometimes come up later when DP specific documents are approved, if the fault is major and the DP FMEA is obviously wrong.?Main class has so many vital concerns that DP design flaws are often uncaught unless they are caught by the FMEA engineer.?The reasons for this are explained in a previous article (Class aren’t DP Gatekeepers).

Both the designers, the shipyard, and the approvers have limited time and budget to achieve the project goals, so DP sanity checks need to be designed into the process.?Having a dedicated pair of DP expert eyes earlier in the project can certainly help.?Ideally, this should be the man who will do the FMEA.?A dedicated DP specialist should look at the specification and initial concept for initial DP problems and identify potential problems to avoid in the more detailed design.?Depending on the design process and project complexity, there could be intermediate verification steps or just final FMEA and trials.?While many shipyards and designers are conscientious and do a good job, some vessel owners find it a worthwhile investment to review the design with an independent consultant to avoid problems.?This should be used as a check rather than replacement for designer or shipyard responsibility.?A simpler solution is to require the designer or shipyard to consult with a trusted DP consulting company during design.

Vendors can be another problem.?In an increasingly legalistic and standardized world, vendors are less forthcoming about design features and less flexible.?Some features can be hidden and expected DP features unavailable despite specification, because the vendor likes to standardize on main class design and does not like the class required specialization.?Hidden protections might shutdown equipment when it’s most needed, or fail to shutdown when required.?A DP expert might have to fight with the same vendor representatives in project after project to get the contracted and required DP protections that are not standard for main class.?A DP expert can warn the designer of the expected problem with the vendor, as he has encountered it across vessels, yards, and designs.

On the other hand, sometimes the equipment innovations are not real.?A vendor might be pressured to exaggerate the capabilities of their equipment in order for their customer (shipyard/designer) to meet contract specifications.?A typical exaggeration might be thrust output or capability plots.?These exaggerations make the real redundant operating capability of the vessel different from the expected capability and may cause a DP incident.?Unless people are used to skeptically examining information and aware of what is normal, or used to properly testing such information, it might not be caught until critical.?Common power buses that are supposed to be extraordinarily reliable despite lacking extraordinary protections are another common example.

These concerns lead us to one of the fundamental design problems.?Each vessel or series of vessels is an ala carte selection of customer chosen equipment that is designed to work with anything and loosely integrated together enough to function.?This provides vendor flexibility and customer responsiveness but lacks the reliability, operator usability, and fault tolerance of a system where all the vital functions were part of a carefully designed, fully integrated system.?Perhaps, this is mostly the fault of customers who want to choose.?Perhaps, it is the fear of being vulnerable to the failings of a single vendor.?Or perhaps, the advantages have not yet been sufficiently demonstrated by a major vendor capable of delivering a fully integrated vessel system.?Considerable improvements in system reliability and safety await the application of deep system design that is too expensive for one-off, patchwork design vessels.?One-off vessels cannot be designed economically from first principles, but vessels that are properly designed that way should have considerable operating advantages over normal vessels.?Perhaps, the constant innovation and improvement of equipment make the piecemeal design worthwhile.?Even so, the standard integrations can be improved by cooperation between vendors to make the overall designs more fault tolerant, and considerable improvement in operator interface is often possible.?It is easier to make systems that work than to make systems that are also more fault tolerant and easier to operate.

If the complete design process cannot be implemented, at least common faults that are forbidden by class rules need to be covered by every vessel’s design.?The designers have lower awareness of these common errors.?If they did, the errors wouldn’t be common, but they are documented in the various competing industry guidelines.?The DP consultant sees them in vessel after vessel, so he is in a good position to catch these faults in time for easy correction, if involved in the project early enough.?Examples include thrusters that don’t automatically shut down when they fail towards full thrust (class requirement), poorly designed safety equipment or settings that shut down more than one set of redundant equipment in a non-emergency (OK from one viewpoint but unacceptable for DP or overall safety), and all vital equipment dependent on a single supply (power, control, network) whether singular, combined, or backed-up.?These and many, many more are regularly experienced, documented, and corrected on many vessels.?They are so common and well documented that you would expect class to have caught on by now.?For example, the MTS DP Vessel Design Philosophy Guidelines are excellent and available for free from dynamic-positioning.com, and IMCA is glad to sell you similar documents.?There is a lot there but it all boils down to keeping systems as simple, isolated, and fault tolerant as possible.?Monuments of overdesign and ill-considered redundancy and protections are often the problem, but underdesign and lack of redundancy and protections are also common.

This brings us to a major weakness in design oversight.?A skilled designer might think that they are better putting their money into their design than having it sanity checked and might choose to not only forgo such checks but to also save money by getting a cheap FMEA, trials, & Ops manual from a friendly and cooperative supplier.?It makes some economic sense but has the obvious effect that common problems are not found and are inherited by the owner and the operators.?No one wants others to die because they saved some money, but many are willing to roll the dice.?It also transfers the blame, as the designer did theoretically hire someone to check the design and it was approved by class.?This is an excuse but it is one we encounter commonly in the industry.?It is doubtful that this transparent lack of real due diligence would survive the inquiry of law after a terrible incident, but some people will take their chances, or feel forced too.?Designers, consultants, and class are morally and legally responsible for the work and the consequences of the work that they perform, and must demonstrate competence and due diligence in their work, but recourse to law is expensive and slow.

Some countries, such as Canada and the United States, restrict engineering practice by law and require that design, approvals, FMEAs, and FMEA trials only be performed by registered professional engineers (local equivalent may vary, but are different from stationary or ship’s engineers).?Non-engineers, such as questionably certified DP practitioners, are restricted from performing such services, except under the supervision and oversight of a registered professional engineer.?Registered professional engineers are held to a higher standard of competence in their area of expertise, required to demonstrate regular professional development and practice, trained in engineering ethics and law, and held to a higher standard of practice.?Complaints about or concerns with a registered professional engineer, or unqualified interloper performing engineering services, can be addressed without the expense and delay of the courts through the engineering societies that regulate the practice of engineering.?Each professional engineering society is legally mandated to be responsible for the practice of professional engineering in its area whether imported to local projects or exported from their area.?Whether the practitioner is registered or not these engineering societies have authority over all legally defined engineering performed in or for their area, from training programs to practice, and can discipline those involved.?They ensure that people who perform professional engineering tasks, such as design, FMEAs and some test programs, are properly trained and experienced to perform work that can affect the public.

Why isn’t this tool used??Perhaps because so many of those involved in the marine industry are from countries without these protections, such as the UK whose CEng is not equivalent.?Whatever the reason, the marine industry has failed to take advantage of these protections and may not be aware of them.?Marine industry bodies tend to look inward but, like class, Engineering Societies are a useful tool for avoiding and resolving problems in the areas where they apply.

To take a philosophical detour, Aristotle argues that virtues are the result of good habits rather than of concentrated thought.?In Kahneman terms, the intuitive System 1 thinking rather than the analytic System 2.?The Enlightenment process has emphasized System 2 over System 1, but many of our processes depend on properly trained System 1 thought working right.?As a result of this emphasis of intellect over intellect plus experience, we live in a young man’s world where it is assumed that you can know everything and think everything out.?Experience knows better and the “Grey Hairs” used to protect the young from this folly.?If you don’t even know or govern yourself and your desires, how is it possible to know and govern everything else??Wouldn’t complexity and opacity exist outside of you as well??The Wild still remains in the design.?It is not possible to be smart enough to do everything.

Good practice is based on good habits as well as good knowledge.?Practices can be improved but first you have to truly understand them.?If you do not understand them and instead represent them with strawman models, then you need to back off and re-examine the situation.?Logical analysis is insufficient when vital pieces are non-obvious.?Rationalists (which I usually am) need to take the time to discover and explore spaces of doubt to avoid error.?Intuitives (which I sometimes am) need to take the time to ground their models in reality by testing them with logic and evidence.?Everyone needs to express their opinions, so they can avoid errors by having friends take them apart.?Consultants need to be able to perform this role inoffensively, inexpensively, quickly, and respectfully enough that they can be trusted as a valuable resource rather than a dangerous, forced requirement.

Safety factors and good practices exist for a reason.?Not everything is knowable and predictable and not everything that is known is remembered in a useful way or at all.?Things can be improved and constantly need re-improved but are never perfected.?As the second law of thermodynamics tells us, all systems degrade and some energy is always wasted.?In this reality, zero DP incidents can only be achieved by getting rid of all DP vessels, but improvements can be made and must be maintained by constant effort, if economically practical.?Engineering is the practice of providing a good enough solution in a good enough time and at a good enough price.?Perfection is expensive and takes forever but we should not stop seeking improvement and maintaining old gains.?Short sighted thinking or the image of an ideal solution are both dangers to good practice.?Both reflect replacing complex and opaque reality with beautiful models that create increased danger – whether with false feelings of safety or counterproductive plans.?Most engineers are aware of the problems of datamining and overfitting a model that doesn’t work in the real world.?Curiosity, doubt, and simplicity are system protections – especially when coupled with experience.?Utilizing an experienced subject matter expert is a necessary step in due diligence.?Use one properly to escape not just the unknown, but the things you know that ain’t so.??

In a way, the DP expert’s knowledge is a bit of a cheat.?He doesn’t have to consider all the design factors, just the DP ones.?He has experience from many more DP projects with different processes and experiences to draw on.?It’s not that the DP consultant is smarter, he just has a different point of reference and a tighter focus.?The designer could do the same thing, if he didn’t have to do everything else as well.?The different focus and experience can be a useful tool.?An honest and professional DP expert isn’t a professional threat, he is a resource to be used to avoid bumps on the road to successfully completing the project.?Like class societies, check sheets, and automated tools, he is a tool that can help ease the cognitive load and verify the designer’s process.?In the future, developed automated tools may do this and submit the checked design data in a form where it can be more efficiently checked and approved.

The overall design approval system needs improved if we are to protect designers, class societies, and their customers from the downward pressure of market forces.?In the meantime, use of DP consultants can provide improved protection by checking the vessel design, from vessel concept to FMEA and trials, to ensure safe and reliable DP operation.?It is especially important to check the initial DP concept of the vessel.?The final line of defense is always a detailed, practical trials program to hunt for hidden weaknesses, instead of encountering them later during critical operations in the field.?Problems should be identified early in the design process when they can be easily addressed.?DP consultants probably need to become better at providing inexpensive and responsive advice early in the design process.