DPOs aren’t Elevator Operators

The single most important redundancy element in a dynamic positioning (DP) system is the dynamic positioning operator (DPO).?It’s a shame that many DP vessels don’t have any.?Sure, they have certified DPOs and DP systems but many can’t do what is required.?DP systems have become so reliable that some vessel operators and clients have forgotten the purpose of the DPO, and DPOs themselves are less capable of identifying and correcting vessel system errors before they become critical.?We are not the only industry where high reliability leaves many operators unprepared for fundamental failure modes that used to be common and that were easily corrected by operators in the past.??

This is dangerous because, while DP systems are increasingly reliable, they are not actually redundant by themselves, and still depend on the human operator to take timely corrective action to keep them operating correctly, or to take manual control and maintain position, if DP control fails completely.?At a certain point, a system can become more reliable than the person who is supposed to correct it, but the design assumption is still that the DPO is intimately familiar with control system faults and sitting on the edge of his seat - ready to spring into action.?This was truer when operators had to regularly correct DP system faults, but as the systems became more and more reliable, we increasingly encounter the bored-person-in-the-control-loop problem.?This is where the operator is so used to the system being reliable that they have difficulty recognising early fault indications and responding properly.

Some people propose regular simulator testing for this, and it is a partial solution, but it also introduces problems.?Simulator training is highly effective in the aircraft industry because the control & display layouts and the software and response of a particular plane model is all the same.?The pilots are trained to scan the common displays and reach for the common controls to obtain a common response.?A pilot that is going to operate a different model of aircraft needs to be trained on the simulator for it - no matter how good he is on another one.?Being used to a slightly different control or display layout or a different response has caused numerous accidents in the airline industry and they have learned not to take the chance.?In the marine industry, almost none of the controls and indication layouts are standard and they vary widely from vessel to vessel.?Even equipment from the same manufacturer changes over time, with hardware model and with software updates.?Equally importantly, vessel propulsion and especially vessel response varies widely.?Marine simulators are a good start for learning basics but drilled response needs to be vessel specific.?Training on the vessel produces better results.

This doesn’t have to be difficult.?When I was training operators for a naval program, one of the first things we did was control and display familiarization, where the operator would stand in place with his eyes closed and find controls until reliable.?The next step was to go somewhere else and draw them from memory and discuss possible dangers to operation (display and control limitations, potential traps leading to misoperation, and how to work around them).?Of course, the operators were trained to always look and make deliberate double checked actions, but this helped ensure reliable operation and confirmed to the operator that what they did was important.?We then trained for normal and emergency operation on the equipment itself.?During normal operation, we would discuss what-if scenarios (You see X, what might be happening, how do you confirm which option, and respond?).?I used to see normal DPOs keep each other sharp like this and it needs to be encouraged.

I am also a believer in giving operators time to “play” with equipment to get a feel for the whole system and its functions.?The increased familiarity pays off when something goes wrong.?For example, DPOs who only ever operate the independent joystick system during annual trials are not libel to be skilled with it, despite it being a fundamental part of their job.?Similarly, I used to see 15 minutes DPO check sheets to get the new DPOs constantly checking important variables and maintain the habit in the experienced hands, but have not seen them for over a decade.?The secret purpose of the sheets was to keep the DPO engaged in and thinking about the system despite it not needing his direct input.?It was an artificial task to aid the DPOs in being ready to anticipate, catch, and correct problems.?Instead, I find some vessel DP desks are set up to look pretty rather than detect problems and that needs to be changed.?The position trace contains valuable information about system operation, but the position display needs to be zoomed in to see it.?The zoomed in vessel representation of the vessel looks stubby and less professional, but good operators can watch that trace and see some developing control problems.?The DP control station needs to include monitoring related systems, as well as the DP control system, as many failure modes cannot be diagnosed without that information, so DPOs need to constantly scan related systems and know exactly where to look to quickly confirm the type of problem.?Taking time to absorb the unique responses of their vessel is very valuable.?Generic simulators are a poor reflection of actual vessel systems.

Of course, the DPOs don’t get to simulate faults during regular operations, so annual trials is an important reminder of what some failure modes look like.?Failure to maintain position or heading due to a runaway thruster may indicate regular training or design changes are needed to manage what used to be a common fault.?Failure to maintain position after the failure of the DP system is usually due to unfamiliarity with the IJS and DPOs need to be regularly drilled on this.?I think every DPO should demonstrate it weekly, but this is much easier in workboats than on rigs, as they have more safe time to allow drills.?I was saddened and angered by the lack of reference to the independent joystick in the documentary “Last Breath”.?Perhaps it did not work but maintaining vessel control after the failure of the vessel of DP control system failure is exactly what it is for.?Too many DPOs can’t do this.?A DPO who can’t, isn’t really a DPO, as he cannot perform a crucial expected function.?Some problems, such as a DP control system’s automatic position reference weighting walking a rig away from its position and the accurate position reference, are design problems (I prefer redundant weighting and DPO decision, or a better balance of reference sensors, over a known design fault).

“Fire, floods, and drive-offs, onboard the --------,

You never know what you might find, behind each and every door,

…

I went back to the DP Room, just to have a little peak,

There was three DPOs, sitting there sound asleep,”

- “Life” - A pretty good song written by a driller about his rig and employing stereotypes for fun

DPOs are still vital to vessel redundancy and the staffing and culture needs to reflect this.?DPOs are not available for other work when they are on the DP desk and they are not doing nothing, they are a vital but less used part of the system.?The reduced action is the problem and the DPOs need supported by a culture that reinforces their importance and keeps them ready for action.?They should be system and vessel experts, not replaceable cogs that an operator is forced to employ.?They are often safety critical redundancy elements that need to be able to respond immediately in a crisis rather than an underutilized resource that can be employed to accomplish other tasks and distracted from their primary function.?Their actions can save millions of dollars, but they suffer the disadvantage of being almost invisible when they do their job right, and only their failures being visible.??

Zero tolerance is counterproductive, as you cannot learn from problems that were supposedly the fault of a bad apple, and thus never really happened.?Avoiding bad news is also counterproductive.?Some people are unsuitable for DPO work and systems need to identify them and redirect them to more suitable tasks before they do damage.?Unfortunately, even the best men make mistakes or have bad luck.?Good systems recognize this and adapt to minimize their probability.?Certification and training should not be mistaken as ensuring human suitability, but they can help.?Book learning and simulator experience are not the same as ingrained, active vessel understanding.??

In the old days, chief engineers used to create tasks just so the junior engineers got used to the normal sound, vibration, and temperature of the equipment.?The real reason for extra sweeping, mopping, polishing, and painting was to develop the ability to detect incipient equipment problems not found by sensors.?Today, such actions are considered inefficient.?The engineers more reliant on sensors and less able to detect what they cannot, but in exchange they get more technological tools.?DPOs also have more technological tools but it is still very important for them to develop a feel for the movement, response, and sounds of their vessel and its interaction with the environment and mission.?This intuitive, vessel specific understanding is valuable and can anticipate growing problems.

Remote micromanaging can be useful for mechanical systems, but it is corrosive for human ones as it undermines real responsibility and initiative.?Some managers, consultants, clients, and industry bodies have a tendency to make this worse by conveying an opinion that DPOs don’t know what they are doing and need more comprehensively managed.?This hostile and dismissive atmosphere can lead to alienation and decision paralysis.?Good people will do their best, but cogs perform sub-optimally and maximize trouble avoidance.?Perhaps the best thing that can be done is using evaluation guidelines and sharing best practices while encouraging DPOs to do this themselves.?Encouraging an active and responsible DP culture might be more important than the procedures.?It is easy to inflict answers but harder to encourage them.?Of course, standards must be maintained but how they are maintained sends a message.

Human systems tend to degrade over time as their success allows other priorities to take precedence until failure becomes a problem.?We can see this process take place over time as a cycle.?For example, the tighter marine guidelines, which were created as the result of a disaster, are eroded and removed because the companies argue that they know how to manage their risks, have more at stake, and have better visibility than regulators, until another disaster occurs again and the cycle restarts.?I remember a friend being very unhappy when one of the major rules from the Ocean Ranger was discarded.?We have probably seen presentations where a company purposefully short-circuited safety systems for “efficiency” and got away unharmed, but we also know of the disasters where others were less lucky.?Feeling safe increases tolerance of danger.?This erosive thinking is a dangerous path and applies as much to DP culture as to its other guidelines.??

Degradation of safe operation is a dangerous and very human path that is enabled by short-term human & system thinking.?It is most dangerous when failure is rare but can be costly.?This is the problem faced by DPOs.?DP culture and guidelines need to be constantly renewed and refocused.?And both are needed.?We cannot ignore that the mission is the purpose of the vessel, but degradation of safe DP operation is a real process that operators need to be aware of and guard against in themselves and others.?Many people are all too willing to take chances that they would not allow others to take, so that might be a good reminder.?The illusion of understanding can be dangerous, and guidelines have a protective purpose.?It is difficult to apply universal DP guidelines to the DP industry, as some operations are very low risk and some are very high, so a vessel’s DP culture needs to be able to appropriately adjust practices to different risk levels.

One oil company recognized that there were a lot of problems with safe and reliable DP vessel operation and spent a lot of time identifying and correcting vessel problems, improving procedures, and working with the crews.?They solved operation problems and demonstrated a commitment to safe DP operation to the crews.?Their results were excellent.?I personally suspected that showing up in person to demonstrate that commitment was an important factor in their success.?When they had to stop visiting, due to budget constraints, the program was less successful despite continuing to resolve operational risks and discuss things remotely.?The results were still very good but something non-mechanical was missing.?I expected this result due to other work studies I had heard of.?For example, a factory wanted to improve its operations and brought in lighting consultants who carefully discussed what they were doing with the workers and what they hoped to achieve with each change.?Every time they adjusted the lighting up or down, operations improved.?Eventually, the lighting engineers figured out that it was the reinforcement of the importance of the work and workers before each change that made the difference.?Human-machine systems are affected by very human factors.

If you are a vessel operator, it is worth reviewing how your corporate culture and policies help encourage and maintain this protection.?DPOs should already know their value but need to encourage and keep each other sharp, and operators need to do the same.?A DPO is more than just a captain.?The crew need to be able to identify and fix problems to maintain their capability, despite slow degradation.?Cogs do what they are told but DPOs have to do what is needed and that requires a sense of responsibility and agency.??

Designers need to focus on making vital information available and easily interpretable by DPOs and engineers.?FMEA practitioners and surveyors need to focus more on this.?E.g. individual thruster power feedbacks are vital to diagnosing some problems and simplified bridge VMS displays may hide fault information vital to DPO decision making.?Designer should work with DP analysts to eliminate design faults early.??

DP FMEAs would be more useful to DPOs if they had a section where they start with indications of problems and help in its diagnosis and correction.?I used to call this a reverse FMEA but it is more like a crew centered, vessel specific, troubleshooting guide.?An abbreviated, vessel specific version of this should be in every DP operations manual.?An FMEA review test could also be a useful tool for crew familiarization with the vessel specific redundancy concept and failure modes.??

DP trials should not be rushed through, they are a practical demonstration and need to be understood and absorbed by the crew.?Trials are not just evaluation, they are also training.?Experienced surveyors are needed to discuss operation and system faults with the crew and help resolve issues.??

While we are at it, the vessel engineers are also DP vital and much of the same thinking applies to them.?A good working relationship is required.?Safe and reliable DP operation is dependent on DPO and engineer operation and interaction, procedures, culture, management, design, and verification.?Both systematic and human factors play an important role in supporting this.??

Customers, which look to use vessels, should look for these signs.?Clients should avoid requiring long detailed lists of requirements be posted at the DP desk and should instead present abbreviated, pithy reminder sheets, as adding to cognitive load can worsen operation.?Simple, useful tools are welcome but unintentionally burdensome ones can be counterproductive.

When elevators where introduced, elevator operators were needed to ensure safe operation and reassure users.?Safe, reliable, automatic systems made the operators unnecessary.?Someday, DP control systems may not require an operator to keep the system safe (perhaps with a holistic, integrated, vessel design rather than current piecemeal construction), but DP control system development seems to have stalled at a convenient, comfortable, and complacent plateau.?DPOs are still vital to safe DP operation, and the consequences of this need to be taken more seriously.?We have been lulled into complacency by the promise of technology and increasing rarity of failures, but we cannot afford to forget that the human operator is still vital.?The DPO is a safety critical element in many DP operations, and the DPO needs properly supported to perform effectively.?The human operator is the intelligent heart of DP system redundancy.?DPOs are closest to pilots, who might do “nothing” for most of the flight, but when corrective action is required, they are vital.?Those also serve, who only stand and wait.