Heading Sensor Vulnerabilities

Introduction:?My redundant dynamic positioning (DP) grounding article is cursed.?I’d done my research, found my lost drawing, and was about to write the article, when IMCA put out an information note on an important concern.?Their concern is valid, so I’m going to look at and explain their warning and delay the grounding article (again).?IMCA’s note points out that DGPS faults don’t just affect the heading output of gyrocompasses (gyros), but also affects combined gyro/motion reference unit (MRU) systems, such as inertial navigation systems (INS).?This is fair, so let’s look at why.

Background:?It’s all the fault of physics.?If you spin a ball on your finger, the surface of the ball is moving fastest midway between the top of the ball and the bottom, because that sticks out furthest from the center of rotation.?The whole ball is turning at the same RPM, or the whole thing would tear itself apart, but a scuff on the middle of the ball has to move a lot faster and travel a lot further, compared to a spot near the top or bottom, in order to keep up.?The same is true for the world turning on its axis.?This makes a difference in artillery and it makes a difference when moving north or south and trying to maintain direction.?It obviously makes a bigger difference as you get nearer to the top or bottom of the ball, as there is a bigger difference in absolute speed as you get nearer the top or bottom (poles).?If you aren’t moving north or south (up or down), then there is no effect, but the faster you move, the more change you experience and the more effect.?This change in planetary surface (or ball) speed affects a gyro and needs compensated when moving to avoid drifting off target.?It’s a bit like stepping onto the side of a moving belt – you veer off with the change in speed.?The same thing happens when speeding north or south, but is gradual and invisible, except to the gyro.??When moving further north or south at a known latitude and speed, an offset needs calculated for the gyro to ensure moving in the right direction, despite the world moving the ship differently.?This is called north speed error correction, and there is a formula for it in your gyro manual, so you don’t need it from me.

Correction:?It’s enough to understand that you need speed, latitude and direction to correct the gyro direction when moving north or south.?The gyro already knows direction, so it just needs to know the vessel speed and latitude.?In the old days, it would get the speed from the speed log transducer and the latitude would be set manually by the crew.?When DGPS came about, it could be used to provide both of the missing pieces of information and the process made automatic.?But DGPSs are not perfect references, and a DGPS fault that generates a wrong latitude, wrong speed, or both will give a wrong correction angle and swing the ship’s heading, if it is automatically controlled.?Loss of the DGPS signal to the gyro or loss of the correction to the DGPS, atmospheric or radio interference, etc. could make the whole thing unstable and counterproductive.?It usually worked, but you had to watch it.?This was fine for manual control.

DP Heading Control:?This tendency towards failure, when the information is wrong, is a major issue for heading control in some areas.?It’s also a position control problem, because heading control is usually dominant, and a safe operation problem, because a small change in heading can easily close the distance when two vessels are operating alongside each other.?One solution was multiple DGPSs, but they have common failure modes, so that doesn’t solve the problem.?Of course, if a vessel is keeping position, then it is not moving, has a speed of zero, and doesn’t need any gyro heading correction.?A DGPS failure can still swing the vessel with a false speed (position jump), so the industry has recommended for decades that automatic north error speed correction be disabled during DP position keeping.?This prevents a DGPS or speed log transducer fault from swinging the heading in one or more gyros.?DP vessels that follow tracks are recommended to enter speed and latitude manually to ensure common faults don’t throw off the heading.

Advice Taken??While IMCA & MTS have been saying this for decades, it has somehow been slow to be applied in the field.?I have been on a number of vessels where the crew did not know to turn off their gyros’ automatic north speed error correction, and there are older vessels where it can’t be done (maybe not many now).?In the main marine industry, automatic north speed error correction is almost always a benefit, but in DP operation, it is a risk that needs eliminated.?This is more work for the crew, but should be a standard part of DP setup.?Unfortunately, crew, who are used to working in marine mode, sometimes fail to operate in DP mode, and there has not been enough reinforcement.??

History of Failure:?The above table shows a sample of some of the known failures resulting from not turning off automatic north speed error correction.?In some cases, a single device fault failed all gyros and their dependent equipment.?The failures were sometimes false high speed due to position jumps, sometimes unstable information that destabilized the gyros, and sometimes loss of information caused the critical failure.?Usually, when the gyros go, it is time to stop working, make safe, and get to a safe area and recover.?None of these failures had to happen.?Following the recommended DP setup would have avoided the problem.?A few seconds to set things up right vs. hours of bother for not doing so.??

Title Picture:?Having looked at these failure modes, it should be clear why the first three systems drawn in the title picture were bad.?The first one has a common DGPS supply to all gyros, and a common speed log reference would have been just as bad.?It can be run in manual, but the common supply still presents a minor common electrical or control risk, which is best avoided.?The second system supplies each gyro information from a different device, which reduces the common electrical and control risks, but the DGPSs have common failures.?The third picture shows an old system that eliminated some of the gyros and replaced them with DGPSs.?The effect of DGPS faults on heading control is even more pronounced with this equipment.?The first two systems can and should be run in manual, but there is no escaping DGPS faults affecting heading control in the third system.

Combined Sensors:?Now that we have covered the physical reality created by a spinning Earth, its effect on gyros, the need for compensation, how that presents a danger to heading control, and how that should be avoided, we are ready to look at the combined sensors, as the same information applies.?Gyros still need speed and latitude information to correct for the moving planet, and are still vulnerable to faulty information and common connections.?Manual entry is still the gold standard, but sometimes designers have been too clever and painted themselves into a corner.??

Combined Systems:?Combined sensor systems normally try to combine multiple sensor types in an attempt to minimize common vulnerabilities.?The previous gyro / dual DGPS shown in system 3 is an early version.?They thought the MRU would help them catch DGPS jumps and some other heuristics would help.?Like INSs, MRUs are made from accelerometers and can detect change in speed (but not speed) and only within a limited tolerance, so this didn’t work out and the product is no longer for sale.?System 4 shows two other examples.?The green one is similar to system 3 but has a gyro to reduce dependency.?The gyro and MRU information can improve fault detection in the DGPS, but making the gyro dependent on the DGPS that it is correcting is a bad idea.?All three parts can interact and the MRU accuracy is limiting.?It is repeated in system 5 with the north speed error correction turned off and interaction limited.?If accuracy was the problem then replacing the MRU and gyro with a high quality INS should solve the problem.?This is better for DGPS jump detection and short loss of DGPS reference, but the INS is updated by the DGPS and incapable of detecting all faults that can corrupt it.?It has a self-reference problem and is still capable of software and hardware faults.?It’s a bigger basket that contains more eggs.?I show a theoretical DGPS/INS without automatic north speed error correction in system 5 and a probably poorly thought out idea of INS independence (drift is a huge problem but how to correct it without creating more vulnerability?).?One proposed solution is a HPR/DGPS/INS, but I have shown the limits of that in a previous article.

Caution:?IMCA isn’t saying everything is bad, and neither am I.?We both recommend caution and careful examination.?Don’t believe the sales hype.?Instead figure out how it really works.?Multiple people saw things that disturbed them enough to put out a warning and convince IMCA that it was needed.?Buyer and operator beware.?Many combined sensor systems can’t have their north speed error correction turned off, or the interaction between the sensors.?This is especially true of the tightly integrated INS solutions.?This is a risk.?The failure of some of these signals, and interactions between failed functions, can cause failures the designers did not foresee.??

Questions:?IMCA doesn’t have answers, because each system can be different, so they propose questions that need answered during design, procurement, and testing.?Having seen the background, these questions make sense.?What happens when the DGPS jumps, drifts, oscillates, slow drifts, freezes, is unstable, fails to communicate, or gives wrong data??What happens when the motion or heading portion of the INS is similarly faulty??We have seen all these in the field, but complex systems can make the interactions harder to determine.?Reducing and hiding risk is not the same as resolving it.?System 3 used to be approved too.?These systems don’t need avoided, but they do need to be seriously examined by experts who aren’t selling them.

Conclusion:?That’s why I think that IMCA is right and this information is worth knowing.? Now, you know some more of the background to make your own decisions with.? Go read IMCA Information Note 1633.

Related Articles:

Gyro Faults?

DGPS Faults