Configuration – PRS’ hidden common failure

A vessel was conducting ROV operations in the North Sea in open water, and was believed to be configured as per the ASOG with open bus 2-way split, four thrusters selected into DP control. Position references online were four DGNSS and two Hydro-acoustic all selected into DP system Control.

The first event was an alarm for DGNSS 2 and 3 and the subsequent de-selection from DP control, followed by DGNSS 1 and 4 along with Gyro’s 1 and 2. This was followed by the loss of both Hydro-acoustic position reference to DP control, the vessel was now positioning based on the model.

The ROV was ordered back to the tether management system and the yellow DP alert was activated.

Sea state was around four meters wave height and northerly wind on the bow of the vessel. Potential risk of fast drift-off position was high. Ship’s crane wire was subsea but not connected to the subsea asset. The ROV was clear of any seabed structure.

Fortunately, no property, environment or other damage occurred.

Below is a list of step causes that together led to the incident highlighted above, the figure below shows how the DGNSS was configured prior to failure:

• The correction signal suppliers satellite signal was reported as failed for 1hr 3mins.
• All four of the DGNSS modulators (signal correction modules) were locked onto a single source.
  • Failure of the single correction source led to the loss of DGNSS and prompted the DP Control to reject all four DGNSS PRSs.
• Both Gyros 1 and 2 took automatic updates from the DGNSS for latitude and speed correction.
  • This is not recommended, it is recommended that manual input be used. Section 4.6 Operational Consideration Summary, (IMCA M252).
  • Upon loss of the DGNSS signal into the Gyro, the settings in the Gyro were such that it failed all output signals. If automatic speed and latitude correction is used then the settings need to be configured in such a way that they fail safe, i.e. the output signal is not lost.
• Upon failure of both Gyros 1 and 2, both Hydro-acoustic PRS units were subsequently rejected from DP Control:
  • During the calibration by the Survey team, both Hydro-acoustic systems were connected to Gyros 1 & 2 with auto speed and latitude, instead of Gyro’s 3 & 4 with manual speed and latitude setting. In this way, after satellite primary reference loss, it additionally resulted in the loss of the Hydro-acoustic position references.
  • After the calibration and change of configuration there was no written note, handover or verbal notice given by the involved personnel who were present during calibration. This meant that at the moment of the DP incident the watch keeping DPOs were not aware about such critical system changes and reason for the loss of Hydro-acoustic PRSs.
  • A common mode failure had been introduced.

The following lessons can be taken from this incident:

• For the Hydro-acoustic calibration, the configuration was altered and did not appear to be documented and, as such, was not returned to the fault tolerant configuration.
• Not all stakeholders were party to the fact that the calibration required a configuration change – in this case the DPOs were not informed.
• Check lists did not capture the fact that only one common correction was being used and that the settings for DP Control would reject DGNSS on loss of correction signal (Raw data usage is an option for some DP Control systems). The DGNSS topology needs to be clearly displayed and understood and this can be an area where people instinctively shy away from, due to its perceived complexity.
• The gyros in question were configured in such a way that upon loss of DGNSS latitude and speed signal the gyro output failed, this is dependant upon settings within the Gyro unit.
• It is not recommended that the Gyros take an automatic latitude and speed signal, it is recommended for DP vessels that latitude and speed be entered manually. Reference: Operational consideration summary in IMCA M252, and the note below.