Prioritizing DP Trial Findings

Introduction: I reviewed part of IMCA M190 (annual trials) earlier this year, when it was under revision, but only got partway due to the large list of concerns I generated. Most of these were cleaned up, but I didn’t look at the document again, because I try to keep it simple and apply basic principles to each unique situation. Following expansive rule sets is dangerous if it interferes with thinking. I recently wrote about presenting solutions and IMCA’s note warning people to follow their criteria or else, so I got some private questions. As a result, I looked at the IMCA M190 Rev 3.1 finding classifications and didn’t like what I saw.

Basics: The purpose of a dynamically positioned (DP) vessel is to reliably maintain position (staying still or following a track) to allow other work to be performed. This work is sometimes safety critical and failure can be disastrous, so the needed capability and redundancy should be well defined and regularly checked. This is demonstrated by relatively complete proving trials when new, annual trial checks of continued operation and redundancy, and 5 yearly relatively complete trials (IMO 645 4.4, 5.1). The main purpose of these trials is to demonstrate that the vessel is fit for purpose – it will maintain position control as expected - it works well and maintains the right level of redundancy for operational safety. Working well includes systems (“main focus”), but secretly includes operators (fault detection/correction, IJS, setup, why) and sometimes training. Redundancy includes DP1 independent joystick, DP2 group independence, and DP3 group separation. This includes single failures, some hidden faults, and accidental maloperation. All DP classes should include basic protections and capacity/capability. The results should be clearly discussed and classified.

Problems: The work is often done by the lowest bidder, whose only qualification might be a piece of paper saying he once knew some guidelines long enough to pass a test and hand over money. Worse, the guidelines aren’t always right and can confuse with over complication. Unwise people might think that the paper and guidelines mean something, but they always need checked against the basics. Most trials don’t check static vessel capability, and proving dynamic capability is a much more extensive process. Many of the people that do trials don’t understand systems well, and have difficulty recognizing problems, understanding their severity, and classifying findings as a result. This is all the more difficult if the guidelines are unclear or occasionally wrong, but also require strict adherence. Then there are market distortions such as demands for perfect results leading to no findings, important risks rated low, or findings hidden in a separate document. IMCA M190 was meant to push back against this, but hasn’t changed the market incentives.

Solution 1: When you encounter problems with findings classification, you need to go back to basics and prioritize the interpretations that emphasize maintaining position, as that is the job of the vessel and what is being checked. That is the biggest and most important part of the job, and needs to be of the highest priority. That is what trials should be focused on. Can the vessel maintain position in the expected actual operating circumstances? If not, that is a major finding. Loss, or expected loss, of position is an A. Reduced but not lost and acceptable redundancy, capacity, or capability is a B. So an old fashioned, finding classification would be:

• A = Single Point Failure (SPF), Loss of Position - can’t do the job
• B = SPF or Loss of Position unless noticeable and reliably corrected - capacity to do the job reduced or less reliable or redundant
• C= Nice to have – non-critical improvements, paperwork, class problems, etc.

and

• A = Fix now
• B = Manage Now and Fix soon
• C = Plan to fix

In terms of a trials that I did for a third party earlier this year:

• A – Isn’t Safe. Address immediately
• B – Impedes Operation. Address within 90 days
• C – Poor Practice, improvements, and non-critical rule violation. For consideration

These are simple, understandable criteria to apply.

Solution 2: Note how I did not give a list of examples, but only gave criteria. Trials results aren’t generic and universal, because position keeping criteria and operations aren’t universal. The definition of keeping position varies, so the same test results can be more or less critical depending on the type of vessel and operation it performs. Some vessels need to keep within 2m, some within 50m, some in light conditions, and others in harsh conditions. Classification of findings also depends on the design, crew, training, and maintenance, as they control the likelihood and effect of the fault. Again, the criteria is not losing position, and the interaction of a weakness with these circumstances has a large effect that needs to be understood in order to properly classify findings. It is very important to keep the acceptance criteria simple, because the situations they apply too are very complex and require deep understanding of systems and operations. I’d like to cover examples, but with limited space, let’s look at the IMCA M190 criteria.

M190 Class A Items: In comparison with the simple criteria listed above, IMCA M190 Rv3.1 has a list of twelve Class A criteria to apply. Most of these aren’t new and have existed from the 2011 document, but now IMCA expects them enforced:

1. Single failure causing loss of position/heading despite operating within defined limits. Looks good to me. Note the important “defined limits.” Is that a generic within 3m, 3 deg for 30min after a fault in both calm and defined redundant storm limits? Is that 5m, 5deg, 45 mins? Is it project or vessel specific limits? Does a MODU need to keep with 50m (2% water depth), or within 5m to avoid running over OSVs? The footprint will probably exceed 3 or 5m in many vessels within the applicable redundant storm limits. The enlarged footprint is a potential operating limit that needs defined and managed, but once known that is a B or C, rather than an A, unless it prevents planned operations. Know the criteria and be careful how you apply them.
2. Single failure exceeding DP FMEA worst case failure. I’m cautious of this paperwork violation that doesn’t cause loss of heading/position. Otherwise, this would be the previous item. This is important for proving trials, but a benign fault not covered by the cheap FMEA isn’t an A item for annual trials. You can probably think of some faults not typically covered by FMEAs that can endanger position. It’s important for the crew to know and important to ensure unexpected faults cannot cause loss of position/heading by testing them in worst case conditions for that fault - could be calm, limiting storm from direction X, etc. Violations of the redundancy concept need proven safe or safe enough. Ships are full of them. Some people don’t recognize unexpected failures and their implications, so this is a worthwhile reminder to make sure, but it goes too far. Not an A, unless it triggers the first criteria.
3. Apparent non-Compliance with IMO MSC 645 or 1580. “No innocent until proven guilty” here. Find me a ship that doesn’t have non-compliances. If it doesn’t allow loss of position/heading, then it is a risk that needs identified and managed, rather than a Class A vessel rejection. For example, DP thrusters are required to have protection against failure to full thrust, but most vessels have main class thrusters that keep running until the DPO stops them. If testing shows DPOs can reliably do this before position is endangered, then it is a B item that must be regularly drilled (very common in the old days). If it isn’t, then it is an A item, because it causes loss of position or heading (first criteria, KISS) - more common today.
4. Apparent non-Compliance with applicable DP or Main Class rules. None of my business. DP trials needs to be focused on DP trials and dangers to position keeping, not wild goose chases. No picking low hanging fruit from an unrelated activity. Focus on the main task. Do you know how much trouble I could cause with this? If it doesn’t endanger heading/position, then it’s a C. If it does, then it’s the first criteria. To misquote misquotes of George Washington, DP trials should be free of foreign entanglements.
5. Pre-existing fault that allows worse-case failure to be exceeded. If it can cause loss of position/heading, then that is the first item. This is just a way of getting there. Not all existing faults are DP critical. Loss of the Port control power supply to a Port thruster could be critical, but loss of one of the two Port supplies might not be. An unworking fanbeam is critical for close-in operation unless there are a number of other healthy relative position sensors, but not critical for a pipeline or cable layer working outside the 500m zone. If the electrical protections haven’t been checked, then that could be a hidden pre-existing fault.
6. Any faulty redundancy alarm for triggering corrective action. A bridge too far. All ships have faulty alarms. They even know about some of them. Ships collect alarms over time. There are often valid procedural backups for many alarms, and related alarms, but the example loss of the only sea water low pressure alarm could be vital. If the time between fault and detection is not proven to allow time to correct before endangering position keeping, then it is an A item and needs corrected. They can still reduce it to a B item by putting a man there to watch the gage (expensive). Too many SWC designs lack adequate remote alarms and monitoring. Good design normally includes related or backup alarms. Most of these aren’t A items, but each needs considered individually.
7. Known reduced thrust or power capacity reducing redundant DP capability. Of course, the reasonable response is to determine what the new redundant capability of the vessel is and if that would be acceptable in its expected work environment (reduced uptime, etc.). If not, then it’s an A. Most vessels don’t know their real redundant capability.
8. Any missing hidden redundancy failure alarm, where testing isn’t reasonable. At a certain point alarms are more a problem than an aid, but some basic alarms/indication, like the monitoring contacts in the diode redundancy modules, aren’t typically used and should be. Detailed maintenance is almost an unreasonable expectation in the offshore, but so are detailed alarms. Some of these alarms are personal opinion and A items must be concrete and defensible. Some of the concerns associated with the previous alarm and fault items apply here.
9. Inadequate DP system or position reference sensors to meet class. In DP annual trials, class isn’t what is important, safe and reliable operation is the focus. If the sensor is need to prevent loss of heading or position after a single fault, then it’s an A item. But there are cases where a relative sensor isn’t going to be used or MRUs aren’t needed. It isn’t about the paper, it’s about the function. They still need flagged for correction, but might not be A items. Sure, they shouldn’t be running on just DGPSs, but until Sonardyne gets SPRINT-Nav approved as a DP sensor, that might be the only applicable sensor for some work.
10. Thruster or rudder failure toward full thrust or swing. You know I am a fan of this, but you also read my earlier discussion. It’s only an A if it can be expected to cause loss of heading or position. It’s a B if adequate protection is demonstrated. There should be automatic protections ensured at the design stage, but main class diverged from DP on this subject in the 1990s, so most ships depend on the crew. They shouldn’t and DP rules say not too, but if we carted off the violators, we would have few ships.
11. Insufficient testing. This is probably an important tool that needs to be used more. Trials are always under time pressure, but without sufficient testing it cannot be claimed that the vessel has demonstrated that it is fit for purpose. Unproven might be an A item and this may sometimes be appropriate. Don’t use this hammer without warning, but it is sometimes needed. Remember testing is to show the vessel works and is redundant. Owners who think that no SPFs is the goal are encouraged to reduce testing to avoid fault detection risk. I have done this as a B item for minor issues and A for big ones.
12. Unproven changes. Of course, you will test what you can, but some of the changes might be untestable because they are poorly documented or pending. Vendors need to finish their work before testing and if they start changing settings afterwards, then everything can be invalidated. I have flagged that to the project manager and in the report on a few projects and sure enough problems were subsequently found. “Why doesn’t X work? I thought you tested it?” “Because they changed it afterwards like I told you.” It’s best to test or retest everything you are suspicious of, but it is questionable to flag them as an A item unless there is good reason to suspect they could cause loss of position/heading capability. On the other hand, you can’t accept large and important unknowns. This could be an A or B depending on what is at risk.

“A” List: While the list of potential A items is long, it mostly comes down to avoiding unacceptable risk of losing position/heading, and if the other items are considered hints of some of the ways it could happen, then this isn’t very different from the traditional interpretation. But if someone uses the information outside that context, and takes each criteria as standalone, because they are outside the trials tradition and following the literal word, then they can and must write many A items. Worse, the code of conduct requires them to apply each criteria, and an information note says they will be punished if they don’t. That was to get the bad apples, but it could cause problems in a low experience environment. Usually, the problem is the other way, people not recognizing SPFs. While most of the A item list is best seen as further examples of the first item, the last two items add considerable value. I written too much and gone on too long to get into the B and C items, but you get the idea.

Back to the Start: I think the person who made the questionable annual trials finding ratings was suffering from trying to do too much in too little time with conflicting knowledge. He had instructions that seem to tell him that everything was an A, but had experience telling him that they weren’t A items, and this caused confusion. In my experience, the vast majority of problems aren’t with unjust A items, but with missing or low rated items, because people did not understand the effect on the systems or operations. It is far easier to apply simple criteria to complex situation than complex criteria to complex situations. Cognitive loading tends to lead complex criteria to simplifying the complex situations that the criteria are being applied to. Remembering the older criteria helps provide context to reduce the conflict, but understanding the redundancy concept, systems, and operations are vital to ensuring expected operation.

Conclusion: The purpose of this article isn’t to blame IMCA for the misuse of their criteria, but to point out the importance of remembering the purpose of those criteria and use them in that context. It could have been expressed better, but it’s hard to predict how people will misinterpret things. People shouldn't make annual trials A items that don't affect safe position keeping operation, and need to think through the potential position keeping effects of each anomaly. This article mostly looked at keeping the criteria simple and clear, but applying the criteria to specific situations by thinking them through wasn’t covered as much. I might do another article with examples.