106
Sensemaking in Safety Critical and Complex Situations
( including a completely burnt fire subdivision or flooded watertight compartment).
Therefore, when blackout occurred, redundancy took over and the system went back
to normal in a very short time ( in seconds). The incident did not escalate. From the
human operator’s perspective, the crew knew that there was something wrong with
the vessel, they were taken by surprise, but the system r e-adjusted itself back to normal without the crew interference since it was safe by design. In normal ships without
class 3 DP capabilities, it will be slower for the crew to bring back the system alive.
LESSONS LEARNED FROM AUTOMATION AND DP INCIDENTS
Over the period of 2 001–2010, there were 26 collisions recorded between visiting
vessels and facilities in the Norwegian shelf ( Kvitrud, 2011; Oltedal, 2012; Petroleum
Safety Authoritiy Norway, 2011; Vinnem, 2014). The following six of the collisions
are considered high risk and safety critical. These cases demonstrate that there was
some kind of vagueness regarding the state of the vessel ( autopilot/ DP), and then an
emergency situation emerged, the operator tried to intervene, and in most cases their
efforts to stop the ship actually made the outcome worse.
Three of the accidents involved autopilot and one involved DP system. Those
accidents can be categorized as man–machine interface issues and thus related to
human factors issues. The operators did not recognize that the system was active and
could not take over control of the ship The system did not automatically disengage
when overridden.
As we can see, the first accident recorded in the area was in 2004, and the standard was modified in July 2010 ( DNV, 2010) as part of the revision in nautical safety
( Section 6, Steering Control System). There was a time lag of 6 years on which similar mistakes occurred over and over and ended up in collision with the platform.
Since 2010, the design of the console has been improved, the operator can take over
control with one single action.
A DP-related accident took place just recently in 2019, involving a collision between
the Sjoborg supply ship and Statfjord A during loading/ discharging ( Petroleum Safety
Authority Norway, 2019). On 6 June 2019, 22:10, Sjoborg set in position on Statfjord
A and performed discharging fresh water and diesel oil, and loading and unloading
deck cargo. On 7 June, 01:04, alarms on integrated automation system ( IAS) screen
showed warnings: “ FAULT IN B.O.S.S SYSTEM PS” and “ FAULT IN B.O.S.S
SYSTEM SB”. These warnings were disregarded and not perceived as critical by
the officer. From 01:14 to 01:49, a number of DP alarms appeared, were acknowledged but returned. Such alarms were considered “ normal” by the crew during DP
operation. 01:49, DP system changed to move vessel 6 m forward for access to deck
cargo. IAS alarm showed: “ BT1 AUTOSTOP”, DP alarm: “ TUNNEL BOW 1 NOT
READY”. IAS alarm showed: “ BT3 AUTOSTOP”, DP alarm: “ AZIMUTH BOW 3
NOT READY”. About 01:50, Sjoborg lost heading and position. Two of three bow
thrusters dropped out. Vessel drifted toward Statfjord A. First officer attempted to
switch Sjoborg to partly manual positioning. 01:51, Sjoborg hit Statfjord A.
This DP-related incident experienced by Sjoborg is rather different from the one
on OSV A. The system on OSV A detected that the installation was further than its
real location. The vessel then moved to adjust her location. The officer sensed that
Sensemaking in Safety Critical and Complex Situations
( including a completely burnt fire subdivision or flooded watertight compartment).
Therefore, when blackout occurred, redundancy took over and the system went back
to normal in a very short time ( in seconds). The incident did not escalate. From the
human operator’s perspective, the crew knew that there was something wrong with
the vessel, they were taken by surprise, but the system r e-adjusted itself back to normal without the crew interference since it was safe by design. In normal ships without
class 3 DP capabilities, it will be slower for the crew to bring back the system alive.
LESSONS LEARNED FROM AUTOMATION AND DP INCIDENTS
Over the period of 2 001–2010, there were 26 collisions recorded between visiting
vessels and facilities in the Norwegian shelf ( Kvitrud, 2011; Oltedal, 2012; Petroleum
Safety Authoritiy Norway, 2011; Vinnem, 2014). The following six of the collisions
are considered high risk and safety critical. These cases demonstrate that there was
some kind of vagueness regarding the state of the vessel ( autopilot/ DP), and then an
emergency situation emerged, the operator tried to intervene, and in most cases their
efforts to stop the ship actually made the outcome worse.
Three of the accidents involved autopilot and one involved DP system. Those
accidents can be categorized as man–machine interface issues and thus related to
human factors issues. The operators did not recognize that the system was active and
could not take over control of the ship The system did not automatically disengage
when overridden.
As we can see, the first accident recorded in the area was in 2004, and the standard was modified in July 2010 ( DNV, 2010) as part of the revision in nautical safety
( Section 6, Steering Control System). There was a time lag of 6 years on which similar mistakes occurred over and over and ended up in collision with the platform.
Since 2010, the design of the console has been improved, the operator can take over
control with one single action.
A DP-related accident took place just recently in 2019, involving a collision between
the Sjoborg supply ship and Statfjord A during loading/ discharging ( Petroleum Safety
Authority Norway, 2019). On 6 June 2019, 22:10, Sjoborg set in position on Statfjord
A and performed discharging fresh water and diesel oil, and loading and unloading
deck cargo. On 7 June, 01:04, alarms on integrated automation system ( IAS) screen
showed warnings: “ FAULT IN B.O.S.S SYSTEM PS” and “ FAULT IN B.O.S.S
SYSTEM SB”. These warnings were disregarded and not perceived as critical by
the officer. From 01:14 to 01:49, a number of DP alarms appeared, were acknowledged but returned. Such alarms were considered “ normal” by the crew during DP
operation. 01:49, DP system changed to move vessel 6 m forward for access to deck
cargo. IAS alarm showed: “ BT1 AUTOSTOP”, DP alarm: “ TUNNEL BOW 1 NOT
READY”. IAS alarm showed: “ BT3 AUTOSTOP”, DP alarm: “ AZIMUTH BOW 3
NOT READY”. About 01:50, Sjoborg lost heading and position. Two of three bow
thrusters dropped out. Vessel drifted toward Statfjord A. First officer attempted to
switch Sjoborg to partly manual positioning. 01:51, Sjoborg hit Statfjord A.
This DP-related incident experienced by Sjoborg is rather different from the one
on OSV A. The system on OSV A detected that the installation was further than its
real location. The vessel then moved to adjust her location. The officer sensed that