Errant Notebook Sends Diving Ship Off-Station – HF in Design
5 July 2016
Errant Notebook Sends Diving Ship Off-Station – HF in Design
The Australian National Offshore Petroleum Safety and Environmental Management Authority (NOPSEMA) has recently published a safety alert on a serious incident to a Dynamic Position (DP) vessel that made an uncommanded movement during a diving operation that highlighted a significant design vulnerability.
The Incident
The vessel was conducting diving operations 130m from an oil and gas installation when the uncommanded movement occurred.
The loss of position was caused by a deactivation of the forward/aft automatic positioning function by unintentionally deselecting the ‘surge’ button on the DP console located on the bridge which then deactivated the ‘Auto Position’ mode.
Dynamic Position (DP) Operator’s Control Station – Surge Button Highlighted (Credit: NOPSEMA)
The deselection was thought to have occurred by the placement of a notepad on the side of the console.
The vessel drifted off location by over 40 metres and this drift was initially noticed by a diver when his umbilical started to become taut.
Once the DPO (Dynamic Position Operator) became aware of the excursion, the ‘Auto Position’ mode was reactivated causing the vessel to stop moving and remain in position.
The diver was unharmed. However as NOPSEMA note:
A loss of position during diving could cause diver fatalities if their umbilicals or other equipment becomes entangled or snagged on subsea infrastructure during the excursion. A loss of position whilst working in close proximity to a hydrocarbon facility could also potentially cause a collision, leading to a loss of hydrocarbon containment and subsequent fire or explosion.
The NOPSEMA Investigation and Analysis
NOPSEMA’s investigation identified that the auto DP mode buttons (Surge, Sway and Yaw) were located in the left hand corner of the console next to desk space commonly used for completing DP related checklists and logs. Consequently, these buttons were susceptible to accidental activation by personnel.
Forces on a DP Vessel (Credit: via Rigzone)
The inspectors found that although the incident arose by an accidental and unknowing double press of a button by the DPO, the design of the DP system allowed a human error to escalate this act into a dangerous occurrence by neither requiring any positive confirmation of deactivation of ‘Auto Position’ mode nor providing any alarm that required acknowledgment that ‘Auto Position’ mode had been de-activated.
The situation was exacerbated, and recovery impeded, as deselecting the ‘surge’ button automatically deactivates the excursion alarms in that axis and the DP display was no longer providing useful feedback in terms of the loss of position event as the excursion rings started to track with the vessels movement.
NOPSEMA identified the following key lessons (with our emphasis):
Control system interfaces should be designed to account for foreseeable human error. Adequate control measures to prevent and recover from errors should be in place.
For DP vessels, operators need to ensure that suitable controls are in place to prevent a single inadvertent act from leading to a loss of position.
Double press activation for switches with safety critical functions may not be an adequate barrier to prevent an inadvertent action. More robust methods need to be considered.
DP systems can prevent inadvertent operator selection in several other ways including operation of two separate selection devices and using screen based question pop‐ups.
Monitoring tasks are not a human strength; hence control panel operators are heavily reliant on control systems to provide alerts of any unsafe operational conditions, to allow them to problem solve the issue (which is a human strength). Good control system design should account for this.
Switches with safety critical functions should be positioned to avoid accidental activation/deactivation that could cause an unsafe condition.
Facility operators need to ensure that lessons are learned from previous incidents and any additional controls suitably communicated to the workforce. In this case, the vessel had a similar human error induced loss of position event in 2009.
However, a safety management system that relies heavily on in-service occurrence or hazard reports is one that is abdicating responsibility for proactive equipment, process and procedure risk assessment and design.
…one hallmark of a resilient organisation is that it is prepared not only for its own failures those of which it can learn from others – the more resilient it is, the ‘bigger’ are the lessons it has learnt from others.
In 2001 a helicopter was rotors running during a refuelling on the bow helideck of a DP drillship, the West Navion. As the UK CAAsummarised from the UK AAIBreport:
About five minutes after landing, unknown to the pilot and unnoticed by the ship’s crew, the West Navion’s Dynamic Positioning (DP) system reverted to MANUAL heading control and the ship’s heading started to drift slowly to the right. The wind at that time was westerly at 32 kt with gusts to 42 kt, and, as the ship’s heading drifted, the helicopter was subjected to an increasing crosswind component. At 1254 hrs, some seven minutes after the ship’s heading started to drift, the helicopter toppled over to its right.
AS332L, G-BKZE, Overturned on West Navion (Credit: HMCG)
The co-pilot was seriously injured.
Mathematical analysis of the forces acting on the helicopter indicated that the most significant toppling moments were caused by aerodynamic forces arising from the increasing lateral wind component to which the aircraft was subjected as the ship yawed to the right.
The AAIB investigation identified that like the Australian case there was no alarm of mode change alert to the crew:
Unknown to the crew on the bridge, the ship’s Dynamic Positioning system reverted to manual heading control and the ship’s heading began to drift to the right.
The lack of procedures on the ship to transmit the change in the alert status to the crew of the helicopter, and of any specified procedure available to flight crews concerning action to be taken if control of the ship is lost or degraded whilst on the helideck, denied the pilot an appropriate course of action to ensure the safety of the helicopter.
A serious incident occurred where a diving support vessel’s dynamic positioning (DP) system, designated as IMO class 2 [see IMO MSC Circular 645], failed resulting in the vessel drifting off position while divers were deployed subsea. Investigations have shown that a probable cause of the DP failure was a single fault which caused blocking of the DP system’s internal data communications.
The HSE say:
…where the safety case claims that a dynamic positioning system achieves IMO Class 2 or better the duty holder for the safety case should investigate the communications architecture for the relevant DP system. If the dynamic positioning functions are dependent on a shared communication medium such as a dual data bus network, then the duty holder should ensure that appropriate measures are in place to prevent a single fault causing failure of the DP system.
When the USS John S. McCain crashed in the Pacific, the Navy blamed the destroyer’s crew for the loss of 10 sailors. The truth is the Navy’s flawed technology set the McCain up for disaster
Aerossurance has extensive safety, design, human factors and accident analysis experience. For safety advice you can trust, contact us at: enquiries@aerossurance.com
