You are on page 1of 10

RULES AND REGULATIONS

This is an extract from Oilfield Seamanship, Dynamic Positioning by


David Bray FNI:

The IMO Guidelines for


Vessels with Dynamic Positioning Systems
This document (MSC/Circ.645) appeared in June 1994, and is intended to apply to
all vessels constructed on or after 1st July 1994. It is an internationally-accepted
set of guidance relating to the redundancy levels in DP vessels. The full content of
the guidelines is contained in an appendix to this book, but some descriptive
comments is made here.

Within the guidelines, Redundancy is described thus; “Redundancy means ability


of a component or system to maintain or restore its function, when a single failure
has occurred. Redundancy can be achieved for instance by installation of multiple
components, systems or alternative means of performing a function”.

This introduces the concept of the “single point failure” mode. The level of
redundancy should allow uninterrupted functioning of the DP capability of the
vessel after the loss of any single system or component within the DP system. The
guidelines base the level of redundancy on three equipment Classes; Classes 1, 2,
and 3. The larger the number the greater the amount of redundanc7 provision.
Again, quoting from the guidelines:

Page 5.3
Dynamic Positioning Rules & Regulations Basic Operator Course
By David Bray

“The equipment classes are defined by their worst case failure modes as follows:

For equipment class 1, loss of position may occur in the event of a single fault.

For equipment class 2, a loss of position is not to occur in the event of a single fault in any
active component or system. Normally static components will not be considered to fail where
adequate protection from damage is demonstrated, and reliability is to the satisfaction of the
Administration.

For equipment class 3, a single failure includes:


Items listed above for class 2, and any normally static component is assumed to fail.
All components in any one watertight compartment, from fire or flooding.
All components in any one fire sub-division, from fire or flooding…”

In basic terms, Equipment Class 1 refers to non-redundant vessels, Class 2 relates to vessels
with full redundancy of systems and equipment, while vessels built or fitted to Equipment
Class 3 are able to withstand the loss of all systems in any one compartment from the effects
of fire or flooding.

Evidence of the standard of redundancy provision in a particular vessel is given in her


FSVAD (Flag State Verification and Acceptance Document) which states which equipment
class she is in compliance with. Further indication of the level of redundancy available in any
vessel is given in the vessel’s Classification Society DP Class notation.

A very relevant question relates to the choice of an appropriate equipment class for any
particular project. Obviously the more dangerous the task the higher should be the level of
redundancy, and equipment class of the vessel hired in. The guidelines state:

“The equipment class of the vessel required for a particular operation should be agreed
between the owner of the vessel and the customer based upon a risk analysis of the
consequence of a loss of position. Else, the Administration or coastal State may decide the
equipment class for the particular operation”.

The above places the onus upon the vessel owner and the client to design the operation around
a safety case, with full risk analysis of the hazards associated. The results of the risk analysis
will indicate the possible consequences of a loss of position keeping capability by the vessel.
The more severe these consequences, the greater the level of redundancy needed. This
paragraph within the guidelines also gives the authorities of the coastal state powers to
override the decision of the client/shipowner if it is intended to use a vessel of inappropriate
equipment class. For example, in the UK sector, the HSE OSD (Health and Safety Executive,
Offshore Safety Division) has the power to suspend any operation which it deems unsafe.

A practical illustration relating to the level of redundancy available relates to the cranebarge
“DB 102”. When built, this vessel complied with standards equivalent to the modern Class 2.
Although full redundancy was available, a number of precautions were always taken when
undertaking heavy lifts s(jackets, topsides, etc.) using DP for all or part of the positioning
solution. Mooring lines were always deployed, either in tension or kept slack. Often tug
assistance would be used where mooring lines could not be effectively deployed. Full reliance
was not placed in the DP capability due to the extreme consequences of a run-off. Upgrading

Page 5.4  Kongsberg Maritime AS Nov 04


Training Rev. 04
Basic Operator Course Rules & Regulations Dynamic Positioning
Training Manual by David Bray

the vessel of full Class3 allowed the vessel to operate effectively and safely using DP alone
for positioning.

The IMCA Guidelines


Originally produced under the auspices of the DPVOA (the DP Vessel Owners Association),
this body has merged with the AODC to become the International Marine Contractor’s
Association (IMCA). The full title of the document is “Guidelines for the Design and
Operation of Dynamically Positioned Vessels”, original issue dated 1991, revised edition
1995.

The guidelines are applicable to all DP vessels, and contain an introductory section relating to
all DP vessel types. Further sections detail guidance relating to specific vessel types, viz;
Diving Support Vessels, Drilling Vessels, Floating Production Units, Accommodation
Vessels, Crane Vessels, Shuttle Tankers, Pipelay Vessels, and Survey and Support Vessels.

Some general remarks are made on the subject of redundancy in the introductory section,
mainly acknowledging the references to Equipment Classes made in the IMO guidelines
already referred to. More s0pecific guidance is found in the sections relating to individual
vessel types. The following extract from these guidelines relates to Diving Support Vessel
redundancy, and is reproduced with the permission of IMCA.
Redundancy
Redundancy to reduce the effect of failure modes and improve safe working limits is
encouraged on all DP DSVs. The following examples are to provide minimum standards and
information on the current practice of some of the most recent DSVs. The amount of
redundancy is a matter for owners and designers to optimise to achieve practical and
economically viable safe working limits.
Thruster Units
The arrangement of thrust units should be such as to provide, as far as practicable, a circular
capability plot for intact and worst case failure situations if the vessel is not to be heading
limited.

For a monohull vessel the thruster arrangement should provide a balanced athwartship
capability (although this may conflict with passage speed requirements) in the intact and
worst case failure conditions.

This has been achieved on some vessels with three thrusters fore and aft, where the centre unit
is capable of being powered from either switchboard. Cross over capabilities of thrusters may
be manual, but automatic transfer is faster and superior, provided that interlocks are installed
to prevent the transfer of a faulty unit.

The thruster should, as far as is practicable, be independent in location, cable routes and
control power so that a power fault, fire or flood would not result in the loss of more than one
thruster. This is unlikely to be totally achievable but the risk of fire and flood is negligible in
some spaces and known to be present in others, e.g. engine rooms, boiler rooms, machinery
spaces etc. It is important that cables are routed such that the designed worst case failure
mode, e.g. a switchboard fault, is no longer the worst case, i.e. where a fire in a machinery
space could fail more thrust units than a switchboard fault because of common cable routing.

Nov 04  Kongsberg Maritime AS Page 5.5


Rev. 04 Training
Dynamic Positioning Rules & Regulations Basic Operator Course
By David Bray

Power Generation
The sudden unexpected failure of one diesel engine must always be a design and operational
consideration, as must a fire in one engine room. The latter failure however will normally
involve a period of time during which some action can be taken. It is this time, for example
between fire detection and halon release, that is relevant on some vessels in the determination
of safe working limits. It is unreasonable to consider a whole engine room and the power it
generates to be instantly lost from a fire. Vessels with independent engine rooms, each
capable of supplying the total DP system power requirement, have a lower risk of position
loss and should therefore have higher allowable safe working limits. It is essential that smoke
from a fire in one engine room cannot be drawn into the other engine room.
Power Management
The power management for complicated, redundant, power generation and thruster systems
with cross over capability has to be automatic and comprehensive. It has also to be redundant
itself or fail safe, e.g. by starting all units and making them available. Designers should ensure
that there is a clear interface between the control exercised by the DP computers and that
exercised by the power management.

Communications between the two is not essential for control, but if this is a feature to
improve, for example, the speed of response to a power demand, failures of this
communication must also be considered when determining safe working limits. The power
management system should be redundant as far as its failure directly affects position keeping.
If its failure modes do not result in loss of power until a change of status takes place,
redundancy is not necessary.

The power management need only operate for the normal DP mode of operation, i.e. with a
common switchboard (bus tie closed) provided this meets with the requirements of 1.1.4 and
the following sub section. If the vessel is designed to operate with the bus ties open while
diving, then a power management system will be needed for each side of the switchboard,
without inter-communication between the systems that is capable of creating a common
failure mode.
Power Distribution
The power distribution arrangement should be set up, for diving work on dynamic
positioning, so that a fault on any switchboard section separated by bus ties should not cause
the loss of the whole switchboard. This must be so for any working combination of generators
and thrusters. To achieve this requirement the bus ties must be set and tested at regular
intervals (e.g. every year) so that they split the bus before any tripping of generators has taken
place on the healthy side of the bus.
Position Control
For diving work using dynamic positioning, the minimum control requirement is for two
automatic, fully redundant control systems providing, on loss of one, a smooth transfer to the
other which would be unnoticed by the divers working near the diving bell. In addition there
should be a joystick facility for manoeuvring which can be separate or an integral part of the
DP control system.

If fire or flood is a realistic failure mode within the DP control location then consideration
should be given to a separate DP control location independent of the main system. Such a fire

Page 5.6  Kongsberg Maritime AS Nov 04


Training Rev. 04
Basic Operator Course Rules & Regulations Dynamic Positioning
Training Manual by David Bray

risk is unlikely to come from within the DP control space, especially if it is continually
manned when working. The location of equipment within the DP control space should
consider fire both above the deck and to cables below the deck. Redundant control units in a
manned space should be physically separated as far as is practicable, and damage to a volume
1m x 1m be considered a possible event, before detecting and extinguishing can be carried
out.

DP control computers located remotely from the DP control console require fire, heat and
water damage protection by means of a suitable fire or smoke detection system, air
conditioning, if the temperature is expected to rise significantly above ambient, and by careful
routing of pipework.

One computer must be uninterrupted by the worst power loss fault possible and be able to
continue operating with associated equipment for at least 30 mins. It is prudent to provide
independent supplies for each computer, with independent battery back up and no cross
connection. Such an arrangement does not increase safe working limits, but it can decrease
the risk of a fault causing loss of the redundant DP control.
Position References
For diving work at least three references should be on line and at least two should be of a
different type. Replumbing a taut wire which is one of the three position references does not
constitute a violation of the above if such action is completed as quickly as is safe and
sensible. Power supplies to position references should not be common and cable routes should
be separated, furthermore no single factor should affect more than one reference so as to
cause a common failure mode….

The three position references selected for use must reflect the circumstances such as deep
water, Shallow water, open water, close to a fixed or moving (moored) installation… The DP
control should be able to identify a fault in a position reference, warn operators, and reject the
suspect sensors.
Environmental Sensors
At least two wind sensors in different locations, with separate supplies and cable routes, are
necessary for comparison. The DP control should be able to identify a faulty unit and warn
operators before a position change takes place.
Vessel Sensors
At least two vertical reference sensors are necessary for comparison. Similarly at least two
gyro compasses, with separate supplies and cable routes, are necessary for reliability. It is also
prudent to provide a third gyro compass so that in the event of a slow loss of heading the
correct gyro can be identified by the operator. The DP control should be able to identify a
faulty unit and warn operators before position degradation takes place. Vessel sensors should
be physically separated so that the redundant unit is unlikely to suffer from the same fire,
flood or mechanical damage event”.

The above extract gives guidance relating to good practice in DSVs. It may happen that more
stringent requirements are necessary, as, for example, in the Norwegian sector, where some
diving operations will be Class 3 working. Here, there is a requirement for three gyros, which
is in excess of that given in the IMCA document.

Nov 04  Kongsberg Maritime AS Page 5.7


Rev. 04 Training
Dynamic Positioning Rules & Regulations Basic Operator Course
By David Bray

The Norwegian Sector


Within the Norwegian sector, rules and regulations are more prescriptive. Although the IMO
guidance referred to above applies, that guidance is superseded by rules and regulations which
are more stringent in many areas. The authorities concerned are:

NMD - The Norwegian Maritime Directorate


NPD - The Norwegian Petroleum Directorate

The relevant rules and regulations are:

The NMD Regulations for Mobile Offshore Units, 1987


The NMD Guidelines and Notes No. 23, 1993
The NMD Guidelines and Notes No. 28
- enclosure A, 1994
- enclosure B, 1994
The NPD Guidelines relating to the Specification and Operation of Dynamically Positioned
Diving Support Vessels, 1983.

The NMD Guidelines and Notes No. 28, enclosure B is a verbatim transcription of the IMO
guidelines referred to earlier, however for vessels built prior to June 1994, the provisions of
enclosure A refer. In these guidelines, reference is made to four “Consequence Classes”,
numbered 0, 1, 2, and 3. As with equipment classes, the higher the number the greater the
level of redundancy. The Norwegian authorities specify criteria which should be referred to
when specifying equipment, or consequence class. For the consequence classes, the criteria
are as follows:

Class 0 Operations where loss of position keeping capability is not considered to endanger
human lives, or cause damage.

Class 1 Operations where loss of position keeping capability may cause damage or pollution
of small consequence.

Class 2 Operations where loss of position keeping capability may cause personnel injury,
pollution, or damage with large economic consequences.

Class 3 Operations where loss of position keeping capability may cause fatal accidents, or
severe pollution or damage with major economic consequences.

The Norwegian interpretation of the IMO equipment classes is worded in a very similar
manner:

Class 1 DP units with equipment class 1 should be used during operations where loss of
position is not considered to endanger human lives, cause significant damage3 or
cause more than minimal pollution.

Class 2 DP units with equipment class 2 should be used during operations where loss of
position could cause personnel injury, pollution or damage with great economic
consequences.

Page 5.8  Kongsberg Maritime AS Nov 04


Training Rev. 04
Basic Operator Course Rules & Regulations Dynamic Positioning
Training Manual by David Bray

Class 3 DP units with equipment class 3 should be used during operations where loss of
position could cause fatal accidents, severe pollution or damage with major
economic consequences.

The difference between the Norwegian approach and the IMO approach is the NMD have
stated specific criteria for the choice of equipment/consequence class, where the IMO
guidelines leave the decision up to the client and shipowner based upon a risk assessment. A
formal risk assessment is necessary within the Norwegian scheme also, as the criteria listed
above are very subjective and subject to wide differences in interpretation.

Evidence of the standard of redundancy provision in a particular vessel is given in her


FSVAD (Flag State Verification and Acceptance Document) which states which equipment
class she is in compliance with. If the vessel is approved by the NMD and approval was prior
to 1994, the equivalent document is the GAD (Government Acceptance Document). A foreign
(i.e. non-Norwegian) vessel wishing for approval may apply to the NMD for a Letter of
Compliance leading to the issue of a NMD – SVA, or Statement on Verification and
Acceptance for her equipment class.

Nov 04  Kongsberg Maritime AS Page 5.9


Rev. 04 Training
Dynamic Positioning Rules & Regulations Basic Operator Course
By David Bray

Equipment Requirements
A brief summary of the requirements for DP equipment, systems and sub-systems relating to
the different class notations is given below:

Subsystem or component Minimum requirements for group designation


IMO Equipment Class 1 2 3
DNV AUT AUTR AUTRO
Class notations LR DP(AM) DP(AA) DP(AAA)
ABS DPS-1 DPS-2 DPS-30
Power Generators and non- redundant redundant, separate
system Prime movers Redundant compartments

Main Switchboard 1 1 with bus tie 2 with normally


open bus-ties in
separate
compartments

Bus Tie Breaker 0 1 2

Distribution system non-redundant redundant redundant, separate


compartments

Power management no yes yes


Thrusters Arrangement of thrusters non-redundant redundant redundant, in
separate
compartments
Control Auto control: no.of control 1 2 2 + 1 in alternative
computers control station

Manual control: joystick yes yes yes


with auto heading

Single levers for each thruster yes yes yes


Sensors Pos.ref. systems 2 3 3, whereof 1 in
alternat. control
station
External Sensors
Wind 1 2 2 (1 of which
VRS 1 2 3 in alternative
Gyro 1 3 3 control
other 1 2 2 station).

UPS 1 2 2 + 1 in separate
compartment
Alternate control station for back-up unit No No Yes

Page 5.10  Kongsberg Maritime AS Nov 04


Training Rev. 04
Basic Operator Course Rules & Regulations Dynamic Positioning
Training Manual by David Bray

NORSOK
The NORSOK (Norsk Sokkels Konkurranseposisjon) Standards are a set of requirements
drawn up by the NORSOK standardisation workgroup and agreed by the Norwegian industry
for the widest possible national and international application. The NORSOK standards
represent the common requirements of the Norwegian oil industry, and replace the many
company standards recently in force. Several oil companies working on the Norwegian
continental shelf have adopted the NORSOK package, and the standards have thus been made
a contractual requirement in connection with current projects. They are the only accepted
standards which tabulate guidelines for types of operation together with locations, listing
NMD Consequence classes appropriate. This guideline tabulation is given below:

OPERATION EQUIPMENT NOTES


CLASS
Drilling 3 Applies to all drilling in hot zones
Production of hydrocarbons 3
Subsea well workover 3 Workover operations entailing
hydrocarbons on deck
Wireline operations on subsea wells 2 With subsea lubricator
Well stimulation 2
Manned subsea operations, 3 For diving inside structures etc.
Manned subsea operations, 2 For diving in open water
Support of diving from light craft. 2 When the light craft is attached to the
support vessel
Unmanned subsea intervention with 2 Inside hot template
ROT
Accommodation Vessel with gangway 3
connection to Installation
Accommodation Vessel outside 500 m 2
safety zone
Well stimulation, platform wells 2
Construction activities in general, 2
inside 500 m safety zone.
Construction activities in general, 1
outside 500 m safety zone

Nov 04  Kongsberg Maritime AS Page 5.11


Rev. 04 Training
Dynamic Positioning Rules & Regulations Basic Operator Course
By David Bray

Consequence Analysis
One of the requirements of the IMO Class 2 and 3 guidelines, is a system of Online
Consequence Analysis to be incorporated in the DP system. This function continually
performs an analysis of the vessel’s ability to maintain its position and heading after a
predefined, worst case failure during operation. Possible consequences are based on the actual
weather conditions, enable thrusters and power plant status. Typical worst case single failures
are:

• failure in the most critical thruster


• failure in one thruster group
• failure in one power bus section

If the consequence of the predefined failure is a loss of position, it is reported to the operator
via the DP alarm system. The Consequence Analysis will run configurations for Class 2
operations, or for Class 3 operations. A typical response would be a warning message
“Consequence Analysis Warning On”. The associated description reads: “Single worst case
failure will cause drift-off”. The analysis function runs every minute, simulating the loss of
one bus, for all buses, one at a time. If one of these simulated breakdowns results in a drift-
off, the warning is activated. Additional information may indicate whether the situation is
thrust-critical or power-critical, together with an indication of which bus, generators and
thrusters are the critical ones. When the analysis indicates that the situation is no longer
critical, the message is replaced by “Consequence Analysis Warning off” which is an
“information” rather than a “warning” message.

Page 5.12  Kongsberg Maritime AS Nov 04


Training Rev. 04