1 INTRODUCTION

Compared to regular sea-going vessels, DP vessels

have a high risk of getting into accidents due to their

proximity of operations with the installations, even

with a very reliable system. This reliability is achieved

using a significant amount of electronic equipment

due to increased complications in DP vessels. Humans

are at the sharp end, and the chances of making errors

are relatively large. Therefore, the maritime industry

must reduce these risks to make the industry safer and

more efficient.

This paper will review three accidents related to

DP operations. Furthermore, a survey among

experienced DP operators and instructors will be

addressed. Issues regarding human performance,

technological challenges, and organizational handling

will be discussed and compared with the technical

requirements published by Petroleum Safety

Authority of Norway (YA-711) [8] as the codes on

Alerts and Indicators 2009 by IMO only gives basic

provides general design guidance [5].

A triangulated model is used to reflect on the

issues in bridge operations and the alarm handling

process. The three parameters for the triangulated

model are survey results (α), technical requirements

(β), and past (three) accidents (γ) as shown in Figure

Alarm Handling Onboard Vessels Operating in DP Mode

S. Nepal & O.T. Gudmestad

Western Norway University of Applied Sciences, Haugesund, Norway

ABSTRACT: This paper explores concerns regarding the design, implementation, and management of alarms in

DP vessels that, while in operation, need an incredibly high level of accuracy along with high reliability and safe

operations. The Human, Technological, and Organizational factors (HTO) method is primarily used as analysis

tool to find weaknesses in alarm handling during DP operations. The research focuses on results collected from

Dynamic Positioning Operators (DPO) and instructors. Findings from the survey are presented and compared

to the results from past accidents and technical requirements from Petroleum Safety Agency Norway via YA

711. Three accidents from past are referred to picturize the findings from the survey results. Furthermore, the

conclusion is given with recommendations reflecting the findings from the survey. The main findings are an

urgency to establish a centralized marine accident investigation system which enforces learning and

recommendation to make operations safer. In addition, the survey also suggests that prohibition of clients or

limiting their access to the bridge is necessary. Manufacturers could focus on research and development of

alarm prioritization, on structuring and presentation, and profiting by taking feedback from end-users to make

DP operations safer.

http://www.transnav.eu

the International Journal

on Marine Navigation

and Safety of Sea Transportation

Volume 16

Number 1

March 2022

DOI: 10.12716/1001.16.01.05

Figure 1 Triangulation of parameters.

The cause and effect of inefficiency and confusion

on a bridge will be evaluated with the help of Human,

Technology, and Organizational Analysis [9]. HTO

factors comprise potential in system analysis, design,

and improvement. This method reflects on the

foundation of understanding, improvement, and

development of a properly functioning system [10].

Finally, the results will be presented by discussing

findings from the survey. HTO analysis will reveal the

weaknesses of the current alarm system based on

survey results. The revelation of practical issues

occurs because the survey questionnaire focuses on

practical issues during alarm handling while the

vessel is in a DP mode. Hence, the accidents that have

occurred on DP vessels under the operation in a DP

mode will be used to validate the survey results.

2 METHOD

A qualitative approach based on literature review and

survey is adopted as there are little quantitative data

available. An investigative approach is taken in order

to fulfill the purpose of the research [1].

HTO analysis is preferred to analyze the survey

responses due to its simplicity in projection and

understanding of the issues in three vital system

categories. It is unpretentious to segregate any

functioning structure to be implemented in the

human, technology, and organizational division.

Thus, implementing changes or mitigation measures

would be straightforward and effective for impact on

the safety, performance, and efficiency of DP

Operations [10].

In HTO analysis, research is done using the term

humans, pointing towards the operator operating the

DP system, while the organization is the supplier of

the equipment and the shipping company or an

operator/charterer. Finally, the term technology is

aimed to be used for the sensors, equipment, or

instruments, both digital and analog, that aid in the

safe and successful completion of DP operations.

An analysis is done by comparing existing

guidelines (YA 711, [8]) for alarm systems with survey

results. YA 711 has classified alarm design

requirements into the following categories [8].

− General requirements

− Alarm generation

− Alarm structuring

− Alarm prioritization

− Alarm presentation

− Alarm handling

A list of 43 requirements in YA711 [8] for the six

different categories mentioned above is divided into

either human, technology, or organizational

references, as shown in the appendix.

3 SCENARIOS

The main concern about alarm systems today is that

offshore vessels are ineffective in resolving issues

regarding alarm systems with advanced technological

tools. It is essential to examine the fundamental issues

hindering offshore vessels’ resilience towards

accidents caused by alarm systems.

Three past accidents are studied; the first is the

collision of PSV Sjoborg with Statfjord A (2019)

published by Equinor [4], the second the collision

between Big Orange XVIII and Ekofisk 2/4-W (2009)

investigated by [2], and the last the collision of

Samundra Suraksha with Mumbai High North

platform (2005) analyzed by [3]. These scenarios will

be used for the validity of survey results.

A collision occurred between Statfjord A and PSV

Sjoborg on 7th June 2019 while loading and

discharging from the platform that was under a

maintenance stop. Sjoborg was operating in load

reduction mode with a preexisting technical issue, i.e.,

10-15% reduction in thruster power. During

operation, power to two of three bow thrusters was

lost. The vessel drifted against the installation,

resulting in severe material damages to the lifeboat

station and monkey island but with no human or

environmental fatalities [4].

It is seen from the accident investigation report by

PSA that underlying causes resulted in insufficient

thruster power [7]. This could be related to the failure

of, or incorrectly installed components, or disruption

from defective components, which led to network

failure in the blackout safety system (“network

storm”). Furthermore, loss of network frequency

measurement on the main switchboard, activation of

the load-reduction mode with restriction of all

thrusters to 10-15 percent of maximum output,

nonconformity between DP commands and automatic

shutdown of thrusters 1 and 3 [4] occurred before the

collision. Due to the overwhelming amount of error

messages and alarms, Dynamic Positioning Operators

(DPOs) could not take proper action to avoid a

collision even with experienced DP operators.

On 8th June 2009, the well simulation vessel Big

Orange XVIII (5000 tonnes) ran into Ekofisk 2/4W. The

ship lost control after entering the 500-meter safety

zone surrounding the Ekofisk complex [2]. The vessel

with a speed of 9.7kn collided heads-on with

approximately 71MJ collision energy with Ekofisk 2/4

X and 2/4 C [6]. Detailed analysis and calculation of

impact loads is drawn in research performed by

Shengming Zang in “The Mechanics of Ship

Collisions” [12]. Due to severe damage to the jacket

installation, ConocoPhillips decided to shut down the

installation and permanently plug the wells. New ice

class vessels that are built with new standards will

complicate the situation. Design of these vessels can

be seen in Guidelines for Finnish Swedish Ice class by

TRAFICOM [11].

It is seen from the accident investigation report by

ConocoPhillips (2009) that lack of cooperation

between the bridge team and lack of situational

awareness, together with shortcomings in the

decision-making capacity of the bridge team, was the

primary cause of the accident. However, the root

cause of the accident was a distraction by an irrelevant

bridge routine call to the captain within the 500

meters safety zone [2].

The third accident is Samundra Suraksha, a

multipurpose vessel that collided with the Mumbai

High North platform on 27th July 2005 to ensure the

medical evacuation of ship personnel. The vessel

collided with the riser leading to a leak of

hydrocarbons, which eventually led to an explosion

and total loss of both installation and ship (later, 1st

August). On the day of the accident, the vessel had no

preexisting issue in its instruments or its navigational

system and was seaworthy. However, the vessel

experienced challenging weather conditions (35kn

wind, 5m swell and 3kn current) [3].

The collision risk management principles were

insufficiently implemented in the third accident for

in-field vessels’ risk management as mentioned in the

guidance on enforcement [14]. In the case of

Samundra Suraksha, no procedures were established

to manage risks of collision, which governs the overall

approach to identify hazards, assess risk, and establish

an appropriate procedure for the detection, control,

and mitigation. This is reflected by the captain’s

misjudgment (observed that starboard azimuth

thruster pitch was sluggish) while switching the

vessel to manual maneuvering in tough weather

conditions. These actions reflect on a poor

organizational safety culture, where operating policies

were not followed into operations by the DPO. The

pre-entry checklist and procedures following the

operation within the 500m safety zone were ignored.

4 RESULTS OF DATA COLLECTION

The safety culture has been shifting in time with the

evolving concept of quality management (change

management), the approach termed Kaizen

(continuous improvements), emphasis on resilience

organizations, and many other philosophies.

However, the possibility of accidents occurrence

depends on several minor details deep-rooted in the

organizational structure. In order to understand issues

regarding the alarm system present onboard offshore

vessels, the study of relevant guidelines and technical

requirements was done. At the same time, the results

from the survey were evaluated under the umbrella of

the YA 711 technical requirement published by

Petroleum Safety Authority Norway (2001). While

doing so, weaknesses in the current system are

anticipated to be outlined.

A questionnaire for the target group was prepared

to figure out the issues as per the technical

requirements in YA 711, in six distinct categories.

Each category has individual requirements for either

human perspective, technological perspective,

organizational perspective, or any combination of

these three, as shown in Appendix.

Survey results were collected from two target

groups, one being DP operators and the other being

DP instructors. End-user input is expected from DPOs

regarding training methods and information

regarding the preparation of seafarers for DP

operation.

Table 1. List of Participants in Target Group

_______________________________________________

Target Group Questionnaire Interview

_______________________________________________

DPO 40 1

Simulator Instructors 3 1

_______________________________________________

Total Participants 45

_______________________________________________

HTO analysis is used for the categorization of

answers and comparing them with relevant

guidelines. Results from the survey are found to be as

follows:

In general requirements of alarm development and

function, the primary purpose of an alarm system is to

act as a tool for operators to handle critical and

atypical solutions with precision and effectiveness [8].

On the other hand, the survey reflects the

importance of several factors, such as contributors,

that reduce the attention and cognitive ability to

handle alarm systems properly. One of the questions

from the survey was the effect of a client’s presence on

the bridge while working on a DP operation. This

event can be seen as distraction for DPO and hence,

raises the risk of accidents during a DP operation.

Nearly half of the participants agreed to this as shown

in Figure 2.

Figure 2 Main contributors for distraction in the bridge

during operation.

The criticality of distraction on the bridge can also

be seen from the collision between Big Orange XVIII

and Ekofisk 2/4. The captain lost his focus while

fulfilling responsibilities that had no connection with

the vessel maneuvering. The captain enabled autopilot

before taking a phone call. After his return, he could

not figure out why the vessel was not responding to

his input [2]. This fact supports that unwanted events

affect the cognitive ability of DPO, especially when

there is a need for full concentration in operation.

For alarm generation, there were a high number of

technical requirements compared to human or

organizational requirements [8]. The survey found

that it was not allowed to change the alarm

suppression system in many cases, and if allowed, the

alarm suppression systems were used for the wrong

reasons. An example during an interview was that the

alarms were toned down, especially when the clients

were onboard. In addition, it was revealed that there

were several alarms for one variation or deviation

from the preinstalled limit, and this one deviation

affected several functions or positioning parameters.

Alarms were triggered for all the connected systems /

systems associated with the deviated parameter,

which caused “alarm fatigue” to the DPOs.

The alarm generated and displayed on the bridge

of Big Orange XVIII was not effective, as the captain

could not notice the vessel was on autopilot that he

initiated earlier. Thus, the captain did everything else

but disengaging the autopilot before the collision.

In alarm structuring, the primary responsibility

according to YA 711 lies in the technological sector to

provide improved alarm structuring [8]. Provision for

grouping, sorting, and selecting various alarms and

features should be provided per operators’ needs. A

simple overview of alarms that are suppressed,

shelved, or inhibited should also be displayed. The

alarm suppression system and its presentation

method should be understood by the operator in the

overview display. Simultaneously, the operator must

understand the different alarm features, such as

suppression of alarms and alarm filtration. PSA does

not recommend the latter, according to YA 711.

Figure 3 Areas where alarm performance could be

improved.

According to the survey results shown in Figure 3,

the DPOs suggested a necessity for improved

technology for the end-user where alarms are

manufactured according to human-centered design.

These improvements will not just improve the end-

users’ experience but will aid in reducing accidents.

In the collision between Sjoborg and Statfjord A,

after the loss of 2 bow thrusters, the DPO onboard

Sjoborg faced the challenge of keeping the vessel

away from installation while sorting out the relevant

alarms to avoid a collision. The DPOs were struggling

because of overwhelming and numerous alarms in a

short time [4]. This fact supports the finding from the

survey where significant efforts are required to stage a

structured alarm system that could increase the DP

operator's effectiveness and reduce the limitation.

For alarm prioritization, all three parts of HTO

play a role. Firstly, operators should prioritize the

urgent alarms; thus, the operators should use this

feature to be efficient and effective during abnormal

situations. Given that manufacturers would provide a

system that aids alarm prioritization, improving

operators’ focus will severely impact operations.

From an organizational perspective, shipping

companies should develop a strict policy to

implement alarm routines and procedures. Standing

orders from captains on the vessel should be clear and

well-rehearsed in advance. These routines are

constructive as it makes operators familiar and

comfortable with the prioritization procedures that

the system designers have developed.

Figure 4 shows that about 62% of the survey

participants reflected the impracticality or lack of

flexibility to prioritize alarms dedicated to critical

operations. In contrast, 25% were sure that it was

possible to prioritize alarms. Prioritization is critical

as it eliminates human limitations by reducing the

observation parameters to critical alarms only.

Figure 4 Possibility of improvement in Alarm Systems.

In case of the collision between Mumbai High

North and Samundra Suraksha, the captain doubted

the instrument message as “acting sluggish” in his

opinion and switched to manual control once the

medical evacuation was completed [3]. This might be

because of a practical drift [13] in the organization or

lack of procedures or in-field vessel risk management

system. This incident reflects on the importance of

alarms and their effects on the result of an operation.

Ultimately, the DPO’s underestimation of the value of

a working system led to the catastrophe.

For alarm presentation, it is asked from the

manufacturers that the design of an integrated alarm

system installed on a ship must have standard color

codes, symbols, and alarm categorization methods,

which help the operator be precise and effective. A

‘dark screen’ concept should be implemented because

there should be no alarms on the main display when

there are no genuine abnormalities on the ship or

operation.

A necessity for flexibility is seen in Figure 5, when

it came to reducing audio and flashing lights due to

alarms. The majority of the participants said it was

possible to reduce the overwhelming intensity of

alarms both for visual alarms and audio alarms. Thus,

alarm designs without a human-centric approach do

not facilitate effective operator intervention.

Figure 5. Alarm flexibility necessity according to DPO

survey.

Alarm logs from DP vessels are usually long and

deterrent as they use many abbreviations and is like a

maze to navigate through. Sjoborg, before colliding

with Statfjord A, received numerous alarms, which

never pointed to one specific problem but pointed at

all the deviations caused by one problem. Hence, it

was hard for the DPO to pinpoint issues and find a

proper solution. Thus, the alarm presentation is

critical as it helps to save valuable time to avoid

accidents.

In the case of alarm handling, all three parts of

HTO have significant roles. From a human

perspective, operators should acknowledge all alarms

that are triggered. Acknowledge, meaning the

purpose of the alarm is first to be read, and then

understood, and finally accepted. The alarm

philosophy should describe whether an alarm should

be accepted once the operator has read it or after they

have completed an action.

From a technological perspective, a provision for

alarm shelving should be provided so that the

operator can remove standing or nuisance alarms.

Shelving must be kept as a ‘last resort’ for handling

irrelevant nuisance alarms that have not been

successfully filtered or suppressed. A list of shelved

alarms should always be available to the operator.

Manufacturers ought to provide the solution that

supports operators to make a quick and precise

decision. Finally, procedures for the individual person

responsible for monitoring and controlling operations,

including emergencies, have to be readily available

and familiarized.

Escalation of DP incidents has to be prevented by

operator intervention. In several cases, the DPO alone

cannot act independently to prevent an incident.

Thus, it is vital that the onboard crew functions as a

team. As seen in Figure 6, there is a demand for better

cooperation between the bridge and the engine crew.

At times, misunderstandings between bridge and

engine crew might be the cause of the escalation of a

DP incident. Nearly half of the survey participants

said, “it depends on the person in the engine room,”

or calls from the bridge are perceived negatively. A

culture of promoting safety culture, and reporting of

near-miss situations is fundamental for future

development of new technologies and maintaining a

safe working environment.

Figure 6. Crew Behavior for alarm handling.

The alarm system should increase efficiency by

eliminating limitations of an operator; while doing so,

alarm fatigue should also be acknowledged. Alarms

received on the night of 7th June 2019 on Sjoborg were

generated for the first time. The crew did not take the

alarm seriously and were heading towards severe

danger. This may be due to practical drift as nothing

serious happened in the past or due to lack of

operational procedures for alarm handling. Sjoborg

was a DP class 2 vessel and had redundancies, which

gave crew confirmation bias that everything would be

all right. This was improper handling of alarms. A

possibility to mute alarms irrelevant to the DP

operation should be provided, and if not, there will be

distractions leading to increased risk of incidents.

There are lack of routines to come back for feedback

from end users; this practice can be seen from the

survey in Figure 7.

Figure 7. Feedback sessions held by makers with end-users

5 CONCLUSIONS AND SUGGESTIONS

The survey results and previous accidents show that

several improvements can be made in the offshore

industry, especially on DP vessels. Implications are

broad and significant while the industry is expanding

in the field of offshore wind and aquaculture together

with oil and gas. The following conclusions may be

drawn after the research:

Instead of making an individual shipping

company or a maritime cluster resilient, IMO should

take the initiative to centralize the accident

investigation process or take part in accident

investigations to enforce the learnings and

recommendations to the ships under the IMO

umbrella. This will eventually lead to strengthening

the structures for improvement and to come back

strongly after any setbacks. In addition, companies

should work to figure out how to avoid practical drift

so that there is relatedly tight situational coupling

between the designed methods back to the engineered

or applied logic action.

Also, instrument designers and producers should

have a routine to get regular feedback from the end-

users and utilize the technology to record the

performance of their equipment onboard vessels. As a

result, those data and information could be used to

further research and develop alarm systems and

upgrade the existing systems installed. In addition,

manufacturers should focus on making the alarm

systems user-friendly. All abbreviations should be

understandable; if not all, the translation of error

codes should be provided in the help menu and

training manual.

Similarly, the presence of clients on the bridge has

a negative influence, which is one of the major causes

for poor performance of DP operators. In most cases,

clients are provided with separate observatory and

detailed operational information regarding offshore

operations. Unnecessary visits and involvement in the

DP operation should be criticized, prohibited, and in

any case established before starting the operation.

Suggestions like the adaptation of the traffic light

model of alarms are brought forward, similar to the

lighting model of the Activity Specific Operating

Guidelines (ASOG) but in an automatic form with no

human involvement.

Manufacturers, shipping companies, operators,

and charters should define and check the limits of

alarm generations used for the operations and

emphasis on those alarms that have safety

implications; detailed descriptions should be

presented by Fault Mode Effect Analysis (FMEA)/

ASOG for the responsible crew.

Proper training and familiarization of new crew

members towards instruments and alarm panels

should be prioritized. Extra courses regarding alarm

systems and error messages should be part of the

recruitment process as it helps the new crew integrate

with the bridge and engine crew and educately

familiarize them with the operational instruments.

The future recommendation for this research is to

extend the survey to more DP operators and

instructors worldwide to validate current findings or

discover new findings.

The offshore industry is transitioning towards new

fuel solutions in order to keep up with sustainable

development goals. For future research on issues with

alarm systems, it is recommended to perform a

detailed study about the challenges created by

implementing new hybrid fuel sources as hydrogen

and batteries in DP vessels. As technology advances,

there will be an increase in the number of alarms on a

bridge. Thus, measures to avoid alarm fatigue must be

explored to limit human errors and increase the

efficiency of DP operators.

REFERENCES

1. Christensen, L. et al.: Research Methods, Design, and

Analysis. Pearson; 12th edition (2013).

2. ConocoPhillips: Investigation Report “Big Orange

XVIII” Collision with 2/4 W. Stavanger: ConocoPhillips.

(2009).

3. Daley, J.: Mumbai High North Platform Disaster. Proto-

Type. 1, 0, (2013).

4. Equinor ASA: Kollisjon mellom forsyningsskipet sjoborg

og Statfjord A (Report No. A-2019-15 DPN L2). Marine.

Bergen: Equinor. (2019).

5. IMO: CODE ON ALERTS AND INDICATORS. General

Assembly. London: IMO. (2009).

6. Kvitrud, A.: Collisions Between Platforms and Ships in

Norway in the Period 2001-2010. In: OMAE2011. pp.

637–641 , Volume 2: Structures, Safety and Reliability

(2011). https://doi.org/10.1115/OMAE2011-49897.

7. PSA: Investigation of collision between Sjoborg supply

ship and Statfjord A on 7 June 2019. Team T1. Stavanger:

Petroleum Safety Authority. (2019).

8. PSA: Principles for alarm system design. Retrieved

February 2021, from Sintef.no:

https://www.sintef.no/globalassets/project/hfc/document

s/ya-711-principles-for-alarm-systems-design.pdf.

(2001).

9. Roberts, K.H. et al.: Must Accidents Happen? Lessons

from High-Reliability Organizations [and Executive

Commentary]. The Academy of Management Executive

(1993-2005). 15, 3, 70–79 (2001).

10. Tinmannsvik, R.K. et al.: Granskingsmetodikk:

Menneske - teknologi - organisasjon.En kartlegging av

kompetansemiljøer og metoder,

https://www.sintef.no/publikasjoner/publikasjon/126757

8/, last accessed 2022/03/10.

11. TrafiCom: Guidelines for the application of the Finnish-

Swedish Ice Class Rules. Helsinki, Finland. (2019).

12. Zhang, S.: Mechanics of Ship Collisions (MastersThesis).

Technical University of Denmark, Department of Naval

Architecture and Offshore Engineering. Lyngby: DTU.

(1999).

13. Friendly Fire. (2002).

14. SPC/enforcement/177 - Collision risk management -

guidance on enforcement,

https://www.hse.gov.uk/foi/internalops/hid_circs/enforc

ement/spcenf177.htm, last accessed 2022/03/10.