A recent IMCA Safety Flash focuses on an incident in which, a subsea load close to working divers started moving with no intervention from the crane operator.
The incident
The incident occurred during movement of concrete mattresses using a mattress handling frame and the Main Crane. The frame was held with the vessel crane set-up in Active Heave Compensation (AHC) mode, at approximately 3m above seabed. Divers were in the process of reconnecting the hooks to the mattress handling frame ahead of recovery to deck when the frame was seen to descend to 1m depth above seabed. An “all stop”, followed by a “come up on the crane” command was issued and within 3 seconds of the command the frame was observed to ascend at an unexpected rate back to its original position approx. 3m above seabed without crane operator input on the joystick.
What went wrong
- The crane software design was such that pressing the controller lock when in AHC mode, had an unintended impact on winch motor displacement control. Engaging controller lock caused the load to slowly creep/pay out without joystick input. Disengaging controller lock caused the load to abruptly pay in and return to its original position;
- This software interaction was not amended through update/patching of the software when it was first identified, as it was considered to be controlled sufficiently through a Crane Operating Manual update only;
- There was a failure of the document control process for the Crane Operating Manual, such that obsolete revisions were in circulation and available for use – an incorrect revision of the manual was issued to the new Crane Operator. This revision advised that Controller Lock can be used when in AHC and that the load will remain stationary (subsequent revisions of the Manual highlight that it should not be used in AHC due to it causing abrupt movement);
- The familiarisation process did not trigger a discussion about known operating sensitivities, defects, or differences in the on-board crane systems from those the new operator may be familiar with.
What were the causes?
IMCA’s member drew the following conclusions regarding causes:
- Immediate cause – use of the controller lock function whilst operating in AHC mode;
- Underlying causes:
- Unintended consequences of crane software design which had not been “patched” or updated;
- Incorrect version of the Operating Manual issued to the Crane Operator;
- Familiarisation did not inform Crane Operator not to use the controller lock function.
- Root causes:
- Technical: System / software interaction issue;
- Organisational: Deficiency in document control – resulted in obsolete revisions being in circulation and given to Crane Operator;
- People: Decision making – matter was previously identified but considered to be controlled sufficiently by Crane Manual update only.
Lessons learned
- Proper control of Operating Manual revisions to ensure that the latest revisions are in circulation and available for use, with obsolete revisions removed from service;
- Review and update familiarisation/handover process to include additional items to trigger discussion between new Operators and verifiers about operating sensitivities, known anomalies or system differences;
- Where there is a known mechanical and or procedural gap, ensure it is highlighted and addressed immediately to eliminate the issue. Ensure all on-signing Crane Operators are briefed on the incident, the causal factors and corrective/preventive measures;
- Installation of button flip-cover over Controller Lock function and additional signage to be placed within the Crane Cabin.
