DP2 semi-submersible MODU DP incident

Case narrative:

A DP2 Semi-submersible mobile offshore drilling unit (MODU) was working in field preparing for drilling operations on location. The environmental conditions at the time were benign. Cargo operations were ongoing with a DP2 platform supply vessel alongside.

The vessel experienced a total loss of all online thrusters leading to the MODU starting to drift. The power management system standby started offline generators; however, it could not re-engage thrusters to DP automatically. The supply vessel was ordered to relocate out of the 500m zone, and the crane driver instructed to lower the crane boom to rest.

With no thrusters available the vessel drifted before the DPOs were able to start three previously offline thrusters manually, which were then selected to DP. Subsequently, the Electrical Technical Officer reset a further two thrusters locally allowing them to be selected to DP control. Within 3 minutes a sufficient level of thrusters were online and station keeping was stable. Within 17 minutes, all remaining thrusters were reset and operational. The vessel management team commenced a failure investigation thereafter.

At the time of the event, the vessel was being operated on automatic DP2 mode with 3 of 8 generators and 4 of 8 thrusters online. The main 11kV switchboards were being operated with closed bus tie, each side of the main switchboard powering one forward and one aft thruster as per the proven redundancy concept.

The investigation revealed that, as a result of an incorrect maintenance action, the initiating event was caused by a human factor – an offline generator was accidently connected to one of the main switchboards which resulted in an instant severe power instability, causing a significant active and reactive power demand and subsequent voltage and frequency drop. The generator in question then tripped on its reverse power protection resulting in significant voltage spike as a result of removing the large inductive load from the network.

The large voltage and frequency drop caused the thrusters to phase back. It is not clear from the investigation whether this was a function of the power management system or the fast acting blackout prevention function of the thruster drive (or a combination of both). The subsequent voltage spike caused by the removal of the stopped generator led to the online thrusters tripping offline. Although the investigation did not detail the reason for this, it is assumed that the thruster drives were protecting themselves from internal damage by tripping offline. Most modern thruster drives have sophisticated monitoring and protection systems measuring internal DC voltage and ensuring that this voltage does not increase or decrease beyond limits that would otherwise result in internal component damage.

The lessons:

1. The investigation report highlighted a number of findings and subsequent actions as follows:
   1. Undertake a full review of maintenance procedures on high voltage circuit breakers to ensure that this work is undertaken at suitable windows of opportunity and not during DP operations;
   2. Undertake refresher crew training and review switchboards for any need for additional safety or warning labelling;
   3. Engage with the voltage regulator and thruster drive vendors to ensure their products reacted as would be expected in such an event;
   4. Investigate the ‘locking off’ of the manual close buttons of ‘key’ HV circuit breakers including the permit to work system;
   5. Share lessons learned internally within the vessel owner’s fleet and externally within industry.
2. The investigation report did not consider bus tie position and the overall redundancy concept of the vessel. There are well documented arguments for open or closed bus tie position; however, this event clearly demonstrates the risk of a failure on one redundant group affecting the other redundant group through the common point of the bus tie. It is not inconceivable to assume that had environmental conditions been greater, necessitating more thrusters online at the point of failure, then this failure may have resulted in insufficient thrusters offline available to be selected to DP thus causing a significant delay manually resetting thrusters and a significant drift off.
3. Continuing with the theme of closed bus operations, the investigation report did not discuss the DP FMEA specifically considering the suitability of the overall protection scheme coupled with the power management system and thruster blackout prevention functions, such that a fault cannot be transferred from one redundant group to another.
4. The investigation report detailed the desire to ‘lock off’ manual controls on the switchboard. Careful consideration of such an action is needed to ensure that emergency functionality is not inhibited. For example, manual circuit breaker controls may be required for emergency synchronisation of generators.

This case study demonstrates the risks of undertaking maintenance of critical DP components or systems while undertaking DP operations. The case study also highlights the challenges that exist for vessels operating in closed bus mode, i.e., where the otherwise redundant groups are connected via a common point and the risks presented as a result.

Such factors should be considered at the design stage of DP vessels and fully analysed within the vessel’s DP FMEA, confirming through FMEA proving trials and subsequent DP Annual Trials Programmes.