DYNAMIC POSITIONING CONFERENCEOCTOBER 9‐11, 2017

RISK

Lessons Learned . . . or Not

Kevin Duffin, Kevin Smith Maritime Assurance & Consulting

10th October 2017

Lessons Learned… or Not

Background

• Old guidance revised– IMCA M103, Feb. 2017– IMCA M166, Apr. 2016– IMCA M190, Mar. 2017– IMCA M245, Aug. 2017

• New guidance created– TECHOP_GEN_01, Sep. 2012– TECHOP_ODP_01_(D), Oct. 2013– TECHOP_ODP_08_(O), Sep. 2014– TECHOP_ODP_11_(D), May 2015– TECHOP_ODP_13_(D), Sep. 2016

• Workshops and Seminars– MTS Europe DP Workshop (2017)– IMCA - Live Short Circuit Testing (2014)– Annual MTS and IMCA conferences

• Guidance produced to make DP operationssafer, surveys more objective and to improveconsistency across the industry

• MAC’s experience would suggest the samemistakes are still being made

• Here, we present some of the more criticalissues from recent trials and assurancework…

Part I – Interpretation of Trials Requirements

Annual DP Test

Introduction – DP Trials throughout Vessel Lifetime

Initial Survey

Supplementary Trials

Revised Annual DP Test

Changes to DP System?

Complete DP Test

5th year FMEA review (latest guidance, drawings review, industry lessons learned) may require that the FMEA be re‐written and so cycle starts again

Year 0

Year 1

Year 5

Y

N

FMEA complete

Year 1 Test Matrix

IMO MSC.1/Circ.1580, 5.1.1.1: “An initial survey which should include acomplete survey of the DP system and FMEA proving trials for DP Classes2 and 3 to ensure full compliance with the applicable parts of theguidelines. Furthermore it should include a complete test of all systemsand components and the ability to keep position after single failuresassociated with the assigned equipment class.”

IMO MSC.1/Circ.1580, 5.1.1.3:“The annual survey should ensure that the DP system has been maintained in accordance with applicable parts of the guidelines and is in good working order. The annual test of all important systems and components should be carried out to document the ability of the DP vessel to keep position after single failures associated with the assigned equipment class and validate the FMEA and Operations Manual.”

Year 2 Test Matrix

Year 3 Test Matrix

Year 4 Test Matrix

Annual DP Test

IMCA M190, 4.11:“… it is accepted that there may be some components of the DP system which, provided their reliability has been proven throughout the year or they do not provide critical redundancy, may after review be subject to a rolling programme of testing such that they are not tested every year.”

FMEA Proving Trials

FMEA Verification

Complete DP Test

Desktop FMEA

Rolling Annual DP Test

IMO MSC.1/Circ.1580, 5.1.1.2: “periodical testing at intervals not exceeding five years to ensure full compliance with the applicable parts of the Guidelines. A complete test should be carried out as required in paragraph 5.1.1.1”.

Interpretation of Initial / 5-Year Survey Requirements

Year 1

Annual DP Test

Supplementary Trials

Revised Annual DP Test

Changes to DP System?

Complete DP Test

Year 0

Year 5

Y

N

FMEA complete

Year 1 Test Matrix

Year 2 Test Matrix

Year 3 Test Matrix

Year 4 Test Matrix

Annual DP Test

Desktop FMEA

Rolling Annual DP Test

Initial SurveyFMEA Proving Trials

FMEA Verification

Complete DP Test

• In the last year MAC have 3 examples of this process being challenged, specifically theinterpretation of 5-yearly periodical survey requirements

Interpretation of Initial / 5-Year Survey Requirements

• Latest revision of MSC.1/Circ.1580 is more explicit and so latest revision of IMCA M190 is more explicit.

• Guidance that precedes this year is not so explicit.• This leads to different interpretations of what constitutes a 5-yearly periodical survey /

trials programme.

TECHOP_ODP_01_(D)_(FMEA TESTING)_Ver2 October 2013: “Phase 1 ‐Proving Trials: …Once it has been established that all the necessaryattributes are present and they provide the DP systems with faulttolerance then this aspect of testing need not be repeated for anotherfive years according to existing guidance.”.

IMCA M190 March 2017 (interpretation of IMO): “The question oftenarises of when or if the FMEA proving trials should be repeated. There issometimes a belief that there is a requirement to carry out FMEAproving trials every five years. This belief perhaps comes frominterpretation of the classification societies’ requirement to carry outmore in‐depth surveys on a five‐yearly basis. Generally speaking, thepurpose of the classification society five‐yearly survey, as well asfunctionally testing the DP system, is to verify the level of redundancywith reference to defined single failures that was established by theFMEA (and proven by trials). This is different from redoing the FMEAproving trials programme”.

IMCA M190 interpretation of IMCA M103 – “The DP annual trialsprogramme should be based on the vessel’s DP FMEA proving trials,cover a period of more than one year and should be repeated after fiveyears”.

MSC 645 – “Initial survey which should include a complete survey of theDP‐system to ensure full compliance with the applicable parts of theguidelines. Further it includes a complete test of all systems andcomponents and the ability to keep position after single failuresassociated with the assigned equipment class”.

Interpretation of Annual Trials Requirements

Year 1 Test Matrix

Year 2 Test Matrix

Year 3 Test Matrix

Year 4 Test Matrix

Annual DP Test

Annual DP Test

Initial Survey

Supplementary Trials

Revised Annual DP Test

Changes to DP System?

Complete DP Test

Year 0

Year 1

Year 5

Y

N

FMEA completeFMEA Verification

Complete DP Test

Desktop FMEA

Rolling Annual DP Test

Interpretation of Annual Trials Requirements

• Pressure from Industry to reduce annual test scopes– Planned maintenance evidence used in lieu of conducting some test steps

• Often the planned maintenance programme is not aligned to the test requirements– Redundancy group tests

• “Can we test only one per year?”– Net throughput / storm testing

• Requires manufacturer support– Insufficient position references tested to demonstrate compliance with Class rules and

industry guidance• Testing relative position references can be difficult

IMCA M103, Rev. 2 June 2016: “The annual DP trial should test allfunctions on which the redundancy concept depends, including networktesting, blackout recovery plans and ESD functions”.

IMCA M103, Rev. 2 April 2016: “The annual DP trial should test allfunctions on which the redundancy concept depends, including networktesting (data storms and throughput test), blackout recovery plans andESD functions”.

IMCA M190, Rev. 1 March 2017: “Tests that are essential to be includedduring the annual trials include the following:• network failures for DP and integrated control systems”.

MTS Annual Trials Gap Analysis September 2014: “If both networks arenot capable of carrying all the traffic the vessel will lose position if onenetwork fails”."Network storms are a potential common mode failure capable ofcausing a drift off. All modern networks are fitted with protectionagainst this type of failure. This protection must be checked periodicallyto confirm it is operational and that alarms to indicate that it isoperating are working”.

Part II – Common Findings from Trials and Assurance Reviews

Legacy Issues and Understanding Fail Safe

• Thrusters failing to uncontrolled rotation.• Witnessed on a DP 3 dive vessel, 2 x DP 3 drilling vessels, 2 x DP 3 semi-submersibles

and a DP 2 pipe-laying vessel

AngleRPM AngleAngleAngleAngleAngleAngleAngleAngle

• Loss of azimuth command signal results in rpm freeze and azimuth rotation to 0° (ahead) = undesired thrust vector!

IMO MSC.1/Circ.1580: “Failure of a thruster system including pitch,azimuth and/or speed control, should not cause an increase in thrustmagnitude or change in thrust direction”.

IMCA M190: “For vessels with variable speed thrusters of provenreliability, it may be acceptable to carry out the control loop wirebreak tests on a rolling programme where all tests are carried out overa five‐year period. Controllable pitch propellers should be testedannually”.

Legacy Issues – Automatic Changeovers and Transfer of Fault

PS 1 PS 2

PS 3

G

M

VFD

G G G

M

VFD

M

VFD

M

VFD

M

VFD

Auto changeover allows azimuth thruster to be restored quickly after failure of PS supply

• Witnessed on a DP 3 pipe-lay vessel

T1 T2

T3

T4 T5

CB A CB B

Legacy Issues – Automatic Changeovers and Transfer of Fault

PS 1 PS 2

PS 3

G

M

VFD

G G G

M

VFD

M

VFD

M

VFD

M

VFDI>> I>>

I>> I>> I>> I>>

I>> I>>

I>>

Blocking signal allows for local isolation of fault

EFU<I>>

U< U<

EFU<I>>

Hardwire interlock prevents both PS 3 feeder breakers being closed

Dedicated protection relays for U<, EF, I>>

T1 T2

T3

T4 T5

CB A CB B

Legacy Issues – Automatic Changeovers and Transfer of Fault

PS 1 PS 2

PS 3M

VFD

G G

M

VFD

M

VFD

M

VFD

M

VFD

PS 1

G G

1. Dead bus condition on PS1

2. Healthy bus condition on PS2

3. PS1 ‐ PS2 CBs open4. PS1 – PS3 CB open

T1 T2

T3

T4 T5

CB A CB B

Legacy Issues – Automatic Changeovers and Transfer of Fault

PS 1 PS 2

PS 3M

VFD

G G

M

VFD

M

VFD

M

VFD

M

VFD

PS 1

G G

1. Dead bus condition on PS1

2. Healthy bus condition on PS2

3. PS1 ‐ PS2 CBs open4. PS1 – PS3 CB open

I>>

I>> I>>

I>>I>>

!

U<U<

U< I>>

I>> I>>U< U<

A single failure in combination witha hidden failure of the CB couldblackout the vessel!

T1 T2

T3

T4 T5

CB A CB B

Legacy Issues – UPS Configurations

• Witnessed on 2 x DP 3 pipe-lay vessels this year • A configuration error that can defeat the redundancy concept

– UPS bypass alarms are a requirement under certain Class rules

Redundancy Group PS Redundancy Group SB

Main

Bypass

PS DP UPS

XX

Legacy Issues – Control Voltage Cross Connections

• Witnessed on a DP 3 pipe-lay vessel this year

Control & relays SWBD PS

Breaker Motors SWBD PS

Control & relays SWBD SB

Breaker Motors SWBD SB

PS Redundancy Group SB Redundancy Group

Class insisted fuse links be removed to protect redundancy

110Vdc control voltage PS

110Vdc control voltage SB

Consumers introduced cross connections regardless

Loss of PS switchboard!

No alarm!

Backups of backups were popular on older vessels

Legacy Issues – Closed Bus System Testing

PS 1 PS 2

PS 3

G

M

VFD

G G G

M

VFD

M

VFD

M

VFD

M

VFD

Load20%

Load0%

Load20%

Load20%

Load100%

Load‐25%

Load‐25%

Crew fearful of conducting “destructive tests”.

• Common occurrence in our DP PSV vessel assurance work

A single failure can result in totalblackout!

Legacy Issues – DP Control System Redundancy• Witnessed on a DP 3 pipe-lay vessel and a DP 3 dive vessel this year• Complex survey configurations directly affecting DP system redundancy

Change supply to Survey UPS

Disable IALA, single antenna and use new subscription corrections for both

F8 – Survey rack backup supplyF9 – Survey coffee machineF10 – Crew movie server Gyro 3 to HPR

VRS 3 to HPR

Conclusions

• All cases presented are representative of issues already well understood within the DP community– Current industry climate is applying pressure to DP vessel assurance.– Many of the issues can be attributed to naivety or lack of appreciation for guidance

and industry standards.– Ambiguity in the guidance can also be a factor.

• MAC is one of many DP consultancies – Are other DP practitioners seeing the same legacy issues?– What is the scale of the problem globally?– Are lessons being learned..?

• How can we move forward with trials programmes that maintain standards and meet everyone’s expectations?

Thanks for your time

Any questions?