Watch what you are pressing

1.1   Overview

A DP equipment class 2 vessel was relocating between monopile foundations within an offshore wind farm. Seven of the vessel’s eight thrusters were running, with four of five generators online and the bus ties configured in a ring. Two DGPS systems and one SceneScan were selected to DP control. Visibility was good, with a significant wave height of 1 m, wind speed of 16 knots and a real current of 1.2 knots.

1.2   What happened?

The vessel departed the first foundation in DP Joystick mode and transited through the wind farm towards the next foundation. It stopped outside the 250 m safety zone, changed to Full Auto DP mode and began a slow, controlled approach.

At 10:25 hrs, an alarm sounded on the bridge wing control panel. The Master instructed the DPO to stop the vessel and suspend the approach while the cause was established. Shortly afterwards, the DPO reported that all thrusters had been disconnected from the DP Operator Station. Two attempts to reselect the thrusters were unsuccessful, so the Master assumed manual control and manoeuvred away from the foundation, which was approximately 50 m abeam on the starboard side.

While transiting away from the wind farm, the Master observed that the vessel was operating in Backup Mode and queried this with the bridge team and attending electrician. At 11:04 hrs, the vessel cleared the wind farm boundary safely and the investigation began.

1.3   Findings

Functional tests and diagnostic checks found no fault in the DP system that could explain the loss of thruster control. The bridge alarm was also investigated and determined not to have caused the thruster disconnect.

The investigation noted that the Backup Mode Selector pushbutton was positioned immediately adjacent to the Alarm Acknowledge pushbutton and was not protected against inadvertent activation. Repeated testing showed that selecting the Backup Mode Selector removed thruster control from the DP Operator Station without a preceding alarm or warning, reproducing the conditions experienced during the event. Manual control had been established within 27 seconds of the initial event.

1.4   Conclusion

The investigation concluded that the most probable cause of the event was inadvertent activation of the Backup Mode Selector while the bridge team was responding to an alarm. Its position immediately adjacent to the Alarm Acknowledge pushbutton allowed control of the selected thrusters to be transferred from the DP Operator Station without warning. The bridge team established manual control promptly and manoeuvred the vessel clear of the foundation without further consequence.

A protective cover was fitted over the console buttons, as shown in Figure 1‑1. The Alarm Acknowledge pushbutton remains accessible, while the cover must be lifted before the adjacent controls can be operated. The event demonstrates that confirmation or two-stage activation may not provide sufficient protection where critical controls with significantly different consequences are positioned close together; physical guarding or other engineered barriers should therefore be considered.

New protective cover for the console buttons, requiring a second action (lift cover and press) to be activated

1.5   Primary references

• IMCA M103 – Guidelines for the design and operation of dynamically positioned vessels
  
  
• IMCA M117 – Code of practice for the training and experience of key DP personnel