My 2022 MTS DP Conference Paper

Introduction:  This is a copy of my 2022 MTS DP Conference paper with the slides added in.  The slides and text don’t fully line up, as I took a different approach in the presentation.  The presentation is available from MTS.

Warning: This is longer than my usual weekly articles and wasn't edited to be as reader friendly. Beware of walls of text. You will soon see why I added the slides in. Don't worry, I know the two 2023 MTS DP Conference articles were long and this is longer, but I'm going back to short articles after this.

Abstract

In defense of the much abused dynamic positioning operator: DPOs are dedicated, expert, system and vessel positioning operators, who are vital to achieving safe operation despite system faults. They are not interchangeable, underemployed, contractual expense, system watchers that will soon be eliminated by improved technology and can be used for other tasks in the meantime. That second type of thinking endangers the effectiveness and performance of their real role. This paper emphasizes the continued importance and proper support of DPOs.

Abbreviation / Definition

• AI – Artificial Intelligence
• DP – Dynamic Positioning
• DP2 – DP Class 2 vessel (redundant systems)
• DP2ish – Certified as DP2 but not really redundant
• DP3 – DP Class 3 vessel (redundant systems and spaces)
• DP3ish – Certified as DP3 but not really redundant
• DP Ops – DP Operations (manual)
• DPO – Dynamic Positioning control system Operator
• DPE – Dynamic Positioning support Engineer or Electronic technician
• FMEA – Failure Mode and Effects Analysis
• IMCA – International Marine Contractors Association
• MTS – Marine Technology Society, specifically the DP Committee

Introduction

Control systems are good at doing well-defined and predictable tasks reliably, but are far less capable of detecting their own faults or reacting to an unexpected environment. People are less good at the first task, but can excel at the second, so the operator is one of the most important elements in any complex system. The more complex systems become, the more vital the action of the operator, but compared to other industries, DP operators tend to be taken for granted. DPOs are not elevator operators, will not be replaced anytime soon, and their role needs to be better recognized and supported. While all of this is known intellectually, there is considerable economic pressure to reduce expenses.

Problems

The Promise of Technology: It is an age of technological wonders. Machines can accurately model the world and make amazing predictions. The forms and types of measurement, and the variety and reliability of machinery, is commonplace. We have shrunk distance and made fast communication networks that our ancestors could not dream off, let alone expect. Education and health have improved vastly. We have machines that can work on their own, and that will only become more capable. Of course, I am speaking of Ancient Rome. Hype springs eternal.

Present: We have made a lot of improvement since then, and reinvented most of what they had and much more. We still haven’t reached their utopia, despite exceeding most of what they imagined. The hype is always bigger than the reality, but we live, and must operate, in the reality. There are a lot of people paid a lot of money to sell us a glorious future with their new and coming products, but the glorious future is never quite what it seems and always has real limits and trade-offs. Technology can improve those limits and trade-offs, but cannot overrule reality. Hype does. That is its danger. Believed hype distorts how we view reality, and the difference between belief and reality leaves us open to failure.

This Time Is Different: No, it’s not, but there is a wonderful book with that title. It covers 800 years of financial hype and folly. It’s human nature. We still believe in the Christian idea of technological progress invented by monks in the Dark Ages and used to guide the development of Western Society for over a millennium. We have good reason to believe it - the investments paid off. We are objectively better off than most of our ancestors and equipped with better tools. Regardless of this progress, many have been misled by unfounded hype and suffered from scams. Hype is still a problem and a tool. Forewarned is forearmed, but hype is an economic weapon and its use makes reality harder to see.

Expectation vs Reality: We have put a man on the moon, rovers on Mars, sent probes throughout the solar system, have advanced computer control systems, use artificial intelligence (AI), and have autonomous cars and boats, so it can’t be much longer until we have maintenance-free DP vessels that don’t need operators. Aren’t we almost there now? That assumption is based on hype. In reality, the moon shot cost trillions (inflation adjusted), all the rovers and probes were heavily over-designed and ran by large teams but still had a high failure rate, everyone has experienced computers malfunctioning and networks failing, artificial intelligence is incredibly dumb except for very limited dedicated tasks, very few “autonomous” vehicles are actually autonomous, and the most advanced ones (actually autonomous) often fail to hit their undefended, military target. If you are willing to pay more, technology can reduce the need for maintenance, but can’t eliminate it (salesmen may claim otherwise). System operators can be eliminated from simple or no risk systems, but will remain vital to ensuring the safety of complex, safety-critical ones, like most DP operations. Similarly, risk can be almost eliminated from simple systems, but not from complex ones. How can we hope to achieve incident free DP operation, when elevators can’t do the same?

Blinded By Progress: This reality used to be better known. When DP control systems and the related equipment failed regularly, DP operators (DPOs) and engineers (DPEs) were used to the system failures, knew how to detect them, & how to counteract them, and their bosses knew this was a critical task. As the control systems and equipment have become more reliable, the need for this operator corrective action has become less obvious. Paradoxically, this improvement in equipment and system reliability makes each failure more dangerous. There are less of them, but when they occur, they are less expected, less familiar, and less likely to be corrected by DPOs/DPEs. The greater equipment reliability means their bosses are more likely to use lower paid, less qualified people, with less vessel & equipment specific expertise, and to perform less maintenance (snatching risk from the jaws of reliability). The vessels are in competition on price and the cheapest, non-bad vessel is chosen for work, so the bosses are encouraged to cut cost on personnel, maintenance, equipment, and training, while avoiding disaster. Many of these costs are put on the crew through external trainers and certifiers, who compete on price & convenience, and need to cut corners, while trying to avoid disaster. Similarly, many vessel DP documents are provided by low cost, low trouble providers, and are almost generic, sometimes wrong, and often not useful or accessible. The whole process is policed by the owner-selected low cost, low trouble, classification society, and the owner can change class society if needed. Finally, the undertrained, under-supported, low price, and temporary DPO is bored a lot of the time and might be given other work to do while on DP duty. That DPO is then expected to instantly recognize a fault, drop everything, and apply the correct solution within a couple of seconds to avoid a DP incident. That is what DP safety hangs on. We need to support these people better, but improved systems and paperwork make us think we are safe. DP incidents show otherwise.

Paper: Regulations, guidelines, certificates, FMEAs, trials, and DP Ops manuals are another type of technology. These passive benchmarks for the active process can encourage or discourage the above. They are affected by economic pressures and management fashions, just like operations are. They can encourage supporting correct and timely operator intervention by emphasizing the importance of the function, defining the weak points and their correction, detection, and maintenance, defining training, requirements, and encouraging good practice. As paperwork exercises, they cannot ensure it. We already have lots of good rules, regulations, and guidelines – some of them are even enforced. We probably have enough of them that they are counterproductive and might get in the way of understanding the underlying systems and principles of safe operation. The more they bloat, the less they are read, understood, and used, and the more time they take away from systems and operations. Rules and guidelines that are not enforced devalue the ones that are, and owners choose who will enforce them and certify their compliance. As a result, many owners and operators work to completely different standards, but to the same rules, guidelines, and certifications. This helps explain why some certified or approved documents, DPOs, surveyors, and practitioners are ignorant of important basics of how the equipment works and can go wrong. To do a good job, operators need to fill these gaps themselves, but there may not be anything to catch those who don’t, so buyer beware. Paperwork is easy, but people are hard, because they can bend and distort most regulatory systems.

Invisible Hand: Many DP systems fail to recognize that there are conflicting management requirements created by market forces. Management goals for one set of market players and another set can be opposed. Conflicting goals for DP risk management are probably more important for outcome than methodology and rules. As in nature, disguise can be a competitive advantage. Some market players need reliable and safe redundant DP operation, others just need good enough classification or certification to qualify for work. Some specify the first when all they need is the second, and some need the first and end up with the second. Market forces can make it difficult to tell the difference. It is possible to align management goals with performance bonuses for improved certification and actual safe, reliable, redundant DP operation. Some people don’t like spending the time and money, and depend on stricter interpretation to provide it more cheaply. It is impossible to raise the overall standard as many market players already find them restrictive and don’t want their vessels becoming worthless. It is possible to raise to raise the standard for the portion of the market that is risk critical and it is possible for individuals to maintain their own standards – quality is still respected and desired, when it can be perceived.

DPish: There is a lot of difference between actual DP2 and DP2ish, DP3 and DP3ish, and even DP2 and DP3ish. If everyone is lucky, the extra risk is invisible. If they are unlucky, then the crew or equipment are blamed and that particular problem “solved”, while the underlying motivations for the secretly conflicting management goals are usually unaddressed. The vessel client wants as cheap and safe a vessel as possible, while the vessel provider needs to provide a cheap and good enough vessel to make a profit. It is understandable that there might be some conflict over whether good enough is actually safe, due to varying interpretation by each market player. This is further confused by class and consultant’s support of their client’s interpretation, by doing work to each client’s desired standard. No single failures can be interpreted very severely, but most operators assume a comfortable, efficient, acceptable probability. If system experts discover that some of these unspoken assumptions are wrong and the vessel needs improvement, then the owners feel betrayed and picked on, as it was previously class, consultant, & client approved, and is now grandfathered. Technology has improved and industry guidelines can be improved and tightened, but the customer can decide not to include them in FMEA contractual requirements and can control how strictly they are applied. Class societies can tighten their requirements, but this has happened before and vessel owners selected alternate classification societies.

Solutions

Correction Reduction: The problem is economic and mental, but that doesn’t stop people from attempting technical and regulatory solutions. Obviously, it is useful to reduce operator workload with systems that catch and correct obvious problems that control systems are well suited to handling. Experienced engineers, managers, and operators will recognize the limits of such protections, the dangers of each new protection, and the potential of additional protections creating more danger than they eliminate. IMCA guidelines are a little unclear on this. Earlier versions of their guidelines mentioned the importance of operator intervention, but this was so overused by lazy designers that IMCA guidelines now expect potential faults to be designed out, and make minimal reference to operator intervention. It’s no wonder that DPOs are getting worse at it, when the guidelines discourage the most important part of their job. It has gotten to the point that many people don’t understand what the independent joystick is for and cannot use it. Designing out all operator intervention is dangerous and probably impossible, but ignoring the need for DPO or DPE intervention is very dangerous. In contrast, DPO and DPE intervention are a major part of MTS operations guidelines. IMCA is right that any dangerous failure mode that it is safe to eliminate should be eliminated, but MTS is right that there are limits to this and safe operation still depends on timely DPO or engineer intervention. Problems that cannot occur are the easiest solved, but that must be assured. Even the much better designed, tested, and scrutinized nuclear and aircraft industries have to depend on operator intervention. This is probably the primary purpose for an operator and needs better supported. Man and machine is better than either alone.

Simulation: Those problems that cannot be eliminated must be known and their reliable detection and correction practiced until each DPO or DPE can be depended upon to reliably correct the faults before position and heading are lost. This requires considerable vessel specific technical knowledge that should be easily available from the DP FMEA, but often isn’t. I have a strong preference for vessel specific training taking place during annual trials, DP setup, and during low risk operation, but DP simulator training can be useful to maintain generic familiarity and experience with important failure modes and their correction. It is not possible to regularly, safely simulate these on the vessel, so simulators help fill the gap, but it must be remembered that the simulator is importantly different from the vessel, and is not a substitute for vessel specific knowledge and understanding. Each vessel has different control layouts, equipment, failure modes, responses, feel, and sound and these are very important in detecting and correcting faults. In the aircraft industry everything is standardized, and it doesn’t matter how good a pilot you are, getting in a slightly different cockpit or even an identical cockpit with slightly different aircraft response requires hours of successful simulator training before flight. DP simulators can add generic experience, but with every vessel an orphan, it is no substitute for continual training and sharpening on the vessel. This is especially true for the IJS, with which each DPO should regularly demonstrate ability to take control in time to preserve position and maintain position control for the time needed to make safe. Doing this reliably is one of their main purposes.

Mental Simulation: You usually can’t test, but in the best vessels, the DPOs keep each other sharp and the management encourages it. Operators should be able to find controls and displays with their eyes closed, they should be able to draw them from memory and discuss possible dangers to operation (limited information, potential maloperation), and they should always look and make deliberate double checked actions. DPOs should keep each other sharp by quizzing each other on the detection and correction of fault scenarios and operations when not keeping watch. On watch DPOs should be regularly scanning variables and looking for important changes. Those without the discipline could be aided by the old 15min DPO check sheets that force them to regularly consider operational values, vessel behaviour, and trends. It keeps them engaged in and thinking about the system, despite it not needing their direct input, and leaves them ready to anticipate, catch, and correct problems. DPOs need to constantly scan related systems and displays so they can catch or confirm problems with information not available on the DP desk (vessel management, alarm, mission equipment, manual thruster controls, IJS, sensors, cameras, etc.), and need to setup the DP desk so vital information can be quickly scanned including the position trace, carrot, trend screens, etc. Taking time to absorb the unique responses of their vessel, and develop a feel for the movement, response, and sounds of their vessel, and its interaction with the environment and mission, is very valuable. This intuitive, vessel specific understanding can anticipate growing problems. Even when not directly controlling position, the DPO should be an active part of the process. We probably don’t teach this traditional DP operation very well, as it is organic and experience, rather than paper, based. It’s harder to certify attitudes and habits.

Risk Management: In the end, it comes down to people. People design, install, maintain, and operate the technology, and people are deeply integrated into the operation of every system. That can be a good thing that props up poor systems and management, or a bad thing that negates excellent technology and procedures. Industries often start propped up by excellent leadership, and when matured, suffer from unexpected failures despite a clearer understanding of the risks, better technology, and better systems. Replacing leadership with management, and curiosity & concern with requirements, endangers safe operations. The normalization of risk increases risk, and protective requirements can become the cause of problems. The requirements are meant to keep everyone safe, but if they become increasingly onerous and distracting, they can become the focus of safety. But they are not safety, they are tools to achieving it. When the tools are more important than the task, safe operation is endangered and past success can be corrosive. The tools are not the task and there will always be a misalignment of the two.

Support: DPOs are still vital to vessel redundancy and the staffing and culture needs to reflect this. DPOs are not available for other work when they are on the DP desk and they are not doing nothing, they are a vital but less used part of the system. The reduced action is the problem and the DPOs need supported by a culture that reinforces their importance and keeps them ready for action. They should be recognized and encouraged to be system and vessel experts, not replaceable cogs that an operator is forced to employ. They are usually safety critical redundancy elements that need to be able to respond immediately in a crisis rather than an underutilized resource that can be employed to accomplish other tasks and distracted from their primary function. Their actions can save millions of dollars, but they suffer the disadvantage of being almost invisible when they do their job right, and only their failures being visible.

Filtering: Zero tolerance is counterproductive, as you cannot learn from problems that were supposedly the fault of a bad apple, and thus never really happened. Avoiding bad news is also counterproductive. Some people are unsuitable for DPO work and systems need to identify them and redirect them to more suitable tasks before they do damage. Unfortunately, even the best men make mistakes or have bad luck. Good systems recognize this and adapt to minimize their probability. Certification and training should not be mistaken as ensuring human suitability, but they can help. Book learning and simulator experience are not the same as ingrained, active vessel understanding.

Dangers: Remote micromanaging can be useful for mechanical systems, but it is corrosive for human ones, as it undermines real responsibility and initiative. Some managers, consultants, clients, and industry bodies have a tendency to make this worse by conveying an opinion that DPOs don’t know what they are doing and need more comprehensively managed. This hostile and dismissive atmosphere can lead to alienation and decision paralysis. Good people will do their best, but cogs perform sub-optimally and maximize trouble avoidance. Avoiding trouble, rather than doing right, is dangerous for all involved. Perhaps the best thing that can be done is using evaluation guidelines and sharing best practices while encouraging DPOs to do this themselves. Encouraging an active and responsible DP culture might be more important than the procedures and paperwork. It is easy to inflict answers, but harder to encourage them. Of course, standards must be maintained, but how they are maintained sends a message.

Adjustment: Degradation of safe operation is a dangerous and very human path that is enabled by short-term human & system thinking. It is most dangerous when failure is rare but can be costly. This is the problem faced by DPOs. DP culture and procedures need to be constantly renewed and refocused. And both are needed. We cannot ignore that the mission is the purpose of the vessel, but degradation of safe DP operation is a real process that operators need to be aware of and guard against in themselves and others. Many people are all too willing to take chances that they would not allow others to take, so that might be a good reminder. The illusion of understanding can be dangerous, and guidelines have a protective purpose. It is difficult to apply universal DP guidelines to the DP industry, as some operations are very low risk and some are very high, so a vessel’s DP culture needs to be able to appropriately adjust practices to different risk levels.

Examples: One vessel client company recognized that there were a lot of problems with safe and reliable DP vessel operation and spent a lot of time identifying and correcting vessel problems, improving procedures, and working with the crews. They solved operation problems and demonstrated a commitment to safe DP operation to the crews. Their results were excellent. I personally suspected that showing up in person to demonstrate that commitment was an important factor in their success. When they had to stop visiting, due to budget constraints, the program was less successful, despite continuing to resolve operational risks and discuss things remotely. The results were still very good but something non-mechanical was missing. I expected this result due to other work studies I had heard of. For example, a factory wanted to improve its operations and brought in lighting consultants who carefully discussed what they were doing with the workers and what they hoped to achieve with each change. Every time they adjusted the lighting up or down, operations improved. Eventually, the lighting engineers figured out that it was the reinforcement of the importance of the work and workers before each change that made the difference. Human-machine systems are affected by very human factors.

Application

DPOs: DPOs can’t always control their situations, but they can often control themselves. Good habits and attitudes are good servants and need developed. They don’t show up in certification, but are vital to doing work well and consistently. Stay professional, develop your vessel and system understanding, and document everything. You can’t control your luck, but you can reduce risk and defend yourself with documented and witnessed professional competence, practice, and development. When stuck with a bad employer with dangerous practices, raise awareness and encourage good practice. Explain – they may not be aware and most people want to do a good job. If necessary, be willing to look for work elsewhere and prepared for it. Encourage others to do a good job, and accept and acknowledge their encouragement – we are all in it together.

Owner/Operator: If you are a vessel operator, it is worth reviewing how your corporate culture and policies help encourage and maintain this protection. DPOs should already know their value but need to encourage and keep each other sharp, and operators need to do the same. A DPO is more than just a captain or just a technician. The crew need to be able to identify and fix problems to maintain their capability, despite slow degradation. Simple cogs do what they are told, but DPOs have to do what is needed and that requires a sense of pride, responsibility, and agency.

Designers: Designers need to focus on making vital information available and easily interpretable by DPOs and engineers. FMEA engineers and surveyors need to focus more on this. E.g. individual thruster power feedbacks are vital to diagnosing some problems and simplified bridge VMS displays may hide fault information vital to DPO decision making. Designers should work with DP analysts, DPOs, and DPEs to eliminate design faults early. Simplified and exaggerated capability plots are good for sales, but bad for operational safety.

Consultants: DP FMEAs would be more useful to DPOs if they had a section where they start with indications of problems and help in its diagnosis and correction. A crew-centred, vessel specific, troubleshooting guide is needed to improve FMEA usability and application. An abbreviated, vessel specific version of this should be in every DP operations manual. An FMEA review test could also be a useful tool for crew familiarization with the vessel specific redundancy concept and failure modes. DP trials should not be rushed through, they are a practical demonstration and need to be understood and absorbed by the crew. Trials are not just evaluation, they are important training. Experienced surveyors are needed to discuss operation and system faults with the crew and help resolve issues. DP Ops manuals have become horribly generic and need to better reflect the real vessel and crew and encourage good practice. What exactly should a DPO be looking for when he is at the DP desk? The 15 minute data sheets and vessel specific procedures probably need to come back. All these documents need to be crew critiqued, so they become useful. The industry preference for low cost, low value documentation needs to change.

Trainers: It is hard for certification systems to verify the most important human elements of safe DP operation, but they need to be careful to encourage them and discourage unsuitable mind sets. Classroom time and written standards are not well suited to this, but practical one-on-one training is. For this reason, perhaps the most important training is done by DPOs for each other.

DPEs: While we are at it, the vessel engineers are also DP vital and much of the same thinking applies to them. A good working relationship is required. Safe and reliable DP operation is dependent on DPO and DPE operation and interaction, procedures, culture, management, design, and verification. Both systematic and human factors play an important role in supporting this.

Clients: Customers, who look to use DP vessels, should look for these signs. Clients should avoid requiring long detailed lists of requirements be posted at the DP desk and should instead present abbreviated, pithy reminder sheets, as adding to cognitive load can worsen operation. Simple, useful tools are welcome, but unintentionally burdensome ones can be counterproductive. Understanding and contributing to existing organic vessel operations is often more effective than imposing an alien structure. There is more than one way to do things right.

Classification: Class societies are squeezed by their clients and limited in what they can enforce. As their clients select them and can choose another class society, they can only annoy clients so much and must ensure more critical matters, such as vessel integrity, stability, and safety, before they can apply the remaining good will and resources on DP problems. Societies that take a stand on known problems, such as DNV with capability plots, need to be supported if these solutions are going to spread. We need to do a better job of educating everyone, so class isn’t forced to approve substandard documentation.

Guidelines: When thousands of pages of guidelines aren’t doing the job, thousands of additional pages might not be the best solution. Eventually, the quantity of paperwork becomes the problem. Everyone can’t spend all their time reading guidelines and hunting for references that apply. Guidelines will never be complete enough to compete with basic principles, technical knowledge, and operational understanding, and bloated guidelines are not a good substitute for each - although they can act as reminders. If we look at the DP incident reports, we keep having the same basic problems. Maybe the guidelines should be refocused from expansive description to trimmed and focused practical application. Concise principles are easier to read, understand, apply, adhere to, and enforce.

Metaphor Explained

Unlike DP, elevators have been around for thousands of years, but didn’t really become popular until the safety elevator was invented. Before the safety elevator, safe operation was entirely dependent on the people working the elevator, and even after the addition of safeties, it was still a skilled job as elevators were manually controlled. Almost as important, the presence of an elevator operator assured people that the new conveyance was safe, as he rode in it all day and was a skilled professional. The addition of automatic elevator controls, improved safety, and increased public comfort with elevators, spelled the end of the profession. Elevators were safe and easy to operate, so the professional elevator operators disappeared with the old elevators, except where some old shops wanted to maintain old time elegance. Some people see DPOs going the same way, but the systems they control are much more complex and their failures can sometimes have much more on the line. Except for simple vessels doing low risk work, DPOs are probably here to stay. Most are closer to pilots than to elevator operators.

Conclusion

DPOs are not elevator operators. Their tasks are important and need to be properly supported. Where formal structures do not exist, DPOs and their employers need to fill the gaps with good practice. They are not helped by the poor quality of documentation, guidelines, and enforcement from the formal requirements and need to compensate for this. The whole industry is endangered by shortcuts taken to save money on DPOs & DPE functions and their support services, but actual operation is where the work is done and the operators are vital to ensuring it happens safely. DPOs and DPEs perform safety critical functions that need to be recognized, encouraged, and allowed.