A chain of small failures leads to a major consequence

A DP equipment class 2 vessel was conducting cargo operations alongside an offshore installation.

The vessel was operating in a closed bus configuration with all five thrusters running and two of the three generators online: DG1 at 1665 kW and DG3 at 2600 kW.

Visibility was good, the wind speed was 20 knots from the NE and the vessel was experiencing a 4m swell.

While conducting cargo operations on DP the vessel experienced a partial blackout caused by an unexpected shutdown of generator 3.

When DG3 tripped, the power management system activated thruster load reduction to protect the remaining smaller generator, DG1, from overload, in accordance with the PMS philosophy.

DG 2 (2600kW) was on standby at the time.

The DP Operator attempted manual control via thruster levers. However, the thruster control system was not in command at the active console, leaving thrusters unresponsive even in emergency mode. Due to the loss of manoeuvrability, the vessel made two consecutive impacts with the installation.

The investigation determined that contaminated fuel had been introduced into the fuel system following the transfer of fuel from the sludge tank to the clean drain tank and subsequent filtration back to the day tanks without an appropriate risk assessment or permit to work. The resulting fuel contamination caused generator DG3 to shut down during the operation.

Following the loss of DG3, the power management system reduced thruster load to protect the remaining online generator from overload. At the time of the event, DG2 was available as a standby generator but was not connected to the power system. The resulting configuration provided less resilience than intended following the loss of a single generator.

The investigation further identified that the vessel's operational configuration did not fully reflect the redundancy philosophy described within its DP arrangements. The information available to IMCA does not identify whether a consequence analysis warning had been generated or whether any such warning influenced operational decision-making prior to the event. Vessel operators should ensure that power plant configurations remain consistent with the assumptions documented within the DP FMEA, ASOG and associated decision support tools.

When manual intervention became necessary, personnel were unable to regain propulsion control as intended because the thruster control system was not in command at the active console. This revealed a gap in familiarity with vessel-specific control transfer arrangements and emergency operating modes. Expected recovery actions therefore proved ineffective during a time-critical situation.

Key findings

• Fuel contamination resulted from procedural non-compliance.
  
  
• DP setup was not aligned with intended redundancy arrangements.
  
  
• Knowledge gaps existed regarding vessel-specific propulsion control systems.
  
  
• Emergency actions were delayed or ineffective due to unfamiliarity with control transfer requirements.
  
  
• Existing documentation and training arrangements did not adequately address operational understanding of critical systems.

This event demonstrates how a series of individually manageable failures can combine to defeat multiple layers of protection. Procedural non-compliance introduced fuel contamination into the fuel system, the resulting generator trip exposed weaknesses in the operational configuration, and limitations in system familiarity prevented effective recovery once manoeuvrability was reduced.

The incident reinforces the importance of maintaining DP configurations consistent with FMEA assumptions, ensuring that decision support tools accurately reflect operational risk, and regularly verifying that personnel can effectively operate vessel-specific propulsion and control systems under emergency conditions. Effective familiarisation, configuration management and procedural compliance remain critical barriers to preventing similar occurrences.

This event is fundamentally about:

• failure to maintain intended DP redundancy
  
  
• inadequate understanding of thruster control arrangements
  
  
• configuration management
  
  
• strict fuel management
  
  
• FMEA assumptions not matching operational reality.

• IMCA M103 – Guidelines for the design and operation of dynamically positioned vessels
  
  
• IMCA M117 – Code of practice for the training and experience of key DP personnel
  
  
• IMCA M166 – Guidance on failure modes and effects analysis (FMEA)
  
  
• IMCA M220 – Recommended practice on operational activity planning
  

Additional reference

• IMCA M247 – Guidance to identify DP system components and their failure modes