BSEE Alert 524: competence lessons for survey and positioning crews

The alert, and why it lands on the survey desk

BSEE issued a Safety Alert titled “Improvements Needed In Production Safety System Training.” The published notice is short. It signals that the Bureau found shortcomings in how offshore personnel are trained to operate and maintain production safety systems on the US Outer Continental Shelf, with the detail carried in the accompanying alert document. The headline is that the training provision, not the hardware, is where the regulator saw the exposure.

Production safety systems are the shut-in layer of a producing facility – surface and subsurface safety valves, shutdown valves, high- and low-pressure sensors, and the emergency shutdown logic that ties them together – governed under 30 CFR 250 and its Safety and Environmental Management Systems requirements in Subpart S. BSEE safety alerts are advisory rather than enforcement actions, but they map onto what the regulator will look for at the next inspection.

We are a survey and positioning team, not a production one. The reason this alert belongs on the survey manager’s desk is that its underlying theme – a safety-critical system whose training and competence provision has drifted behind the complexity of the equipment – is not a production problem. It is a competence-assurance problem, and the same failure pattern is easy to reproduce in positioning.

Training is not competence: the distinction the alert turns on

The word the alert uses is “training.” The condition it describes is a competence shortfall. These are not the same thing, and every serious assurance framework draws the line in the same place – IMCA’s competence assurance and assessment scheme (the C 002 marine volume and the discipline-specific volumes), IOGP’s competency management guidance, and the training element of API RP 75 that sits under SEMS.

Training is an input: a course attended, a module completed, a certificate with an expiry date. Competence is an output – demonstrated ability to perform a defined task to a defined standard, including under abnormal conditions, assessed by someone qualified to judge it. A training matrix full of green cells tells you people attended things. It tells you very little about whether the watchkeeper on shift at 03:00 will correctly diagnose a degrading reference system and act before the error propagates into the control loop.

Production safety systems expose this gap because they are, by design, dormant. A safety valve that never has to close in anger can sit for years while the crew around it rotates through. The competence that matters is the competence to recognise the abnormal state and respond – exactly what a classroom course and a signed attendance sheet do not evidence. The alert is, in effect, a reminder that a system nobody has to touch is a system whose operators quietly lose the ability to touch it correctly.

The positioning equivalent of a dormant safety system

The survey and positioning analogue of the production shut-in layer is the position integrity chain. On a DP construction or survey vessel that chain runs from the GNSS constellation and correction service, through DGNSS, RTK and PPP receivers, hydroacoustic references (USBL, LBL and sparse LBL), inertial aiding via INS and DVL, into the position comparison and voting logic, and on into the DP control system and its ASOG and CAMO limits under IMCA M 220. On a hydrographic spread the chain terminates in the QC acceptance thresholds that decide whether a line is kept or reflown against the total propagated uncertainty budgets in IHO S-44.

Like the production safety system, this chain mostly behaves. The competence that earns its keep is the competence to act when it does not: a correction link that ages out mid-line, a USBL that starts walking under a thermocline, a reference that fails to reject cleanly and drags the DP position model with it, a datum or projection error introduced during setup that passes every check because nobody re-derived the parameters. Normal-conditions competence is common and cheap to demonstrate. Degraded-conditions competence is rare, harder to build, and precisely what an attendance-based training record fails to capture.

The failure mode is identical across both disciplines. The system is reliable enough that people stop rehearsing the abnormal case, the assurance paperwork keeps returning green, and the gap only becomes visible when the abnormal case finally arrives.

Where competence assurance actually breaks

The value of Alert 524 for a survey function is that it points to a recurring set of failure modes. These are the ones we would audit for first.

1. The matrix becomes the objective

A competence matrix is a management tool, not a management outcome. When the reported KPI becomes “percentage of cells green,” the organisation optimises for green cells rather than for demonstrated ability. A training programme can be fully in place and still leave a competence hole – which is the signature the alert describes. The test is simple and uncomfortable: take a sample of personnel your matrix calls competent, put them in front of a degraded-condition scenario, and count how many diagnose and act correctly. If the pass rate surprises you, the matrix is measuring attendance, not capability.

2. Nobody has assured the assessor

IMCA’s scheme is explicit that assessors and verifiers must themselves be competent, and ideally independent of the person being assessed. In practice the assessor is often the busiest senior surveyor or SDPO aboard, signing off during a handover window with no structured evidence and no time to observe the task under load. An unassured assessor produces unassured competence at scale, and the defect is invisible on paper because every record is signed.

3. Rare, high-consequence tasks fall through

Reference-system changeover, manual position fixing when the primary reference drops, geodetic parameter verification after a projection or datum change, response to a USBL calibration drift – these are infrequent, high-consequence and rarely rehearsed. Competence for common tasks is easy to maintain through repetition. Competence for the rare task decays silently, and incidents cluster there. A competence system that only assesses what people do every day is blind to the tasks most likely to hurt you.

4. Automation quietly deskills the crew

As DP and inertially aided positioning improve, the crew intervenes less, and the manual diagnostic skills atrophy. A well-behaved system masks small faults until they compound. An assurance regime that observes an operator watching a stable screen has evidenced attentiveness, not competence. The human in the loop has to be tested against injected failures, because that is the only condition under which the skill in question is actually exercised.

5. Rotation and freelance churn reset the clock

Rotational and freelance staffing mean the person who was assessed is frequently not the person on shift. A competence record held by the individual is only as good as the validation behind it, and a CV is not validation. For teams that draw heavily on the freelance market, the practical question of how to verify a contract surveyor’s competence before mobilisation is where this alert has the most direct operational bite. The same problem multiplies on a shared deck, where separately contracted parties each bring their own assurance regime and nobody owns the interface – the governance challenge we set out for combined subsea operations run by different contractors.

What to do now

The following steps are testable inside your own function. Each produces evidence an auditor or a client representative can inspect.

• Split training records from competence records in your management system, and report them as two separate metrics. ISO 9001 clause 7.2 and ISO 45001 clause 7.2 both treat competence as demonstrated ability, not attendance. If your monthly return shows a single “training compliance” figure, you are hiding the gap Alert 524 describes.

• Define an explicit safety-critical task list for positioning and survey QC. At minimum: reference-system failover, position comparison and voting alarm response, geodetic setup verification, correction-service loss, and ASOG yellow-and-red response. Assess people against this list, not against a generic course catalogue.

• Assess under degraded conditions, not steady state. Build fault injection into onboard drills – introduce a reference offset, age out a correction feed, force a manual fix, spoof a comparison alarm. Score the diagnostic reasoning and the integrity-decision audit trail, not only the final outcome. A crew that reaches the right answer by luck has not demonstrated competence.

• Name and assure your assessors. Confirm each meets the assessor criteria in IMCA C 002 or your equivalent scheme, check their independence from the people they sign off, and audit a sample of their assessments each quarter. An assessor who has never been calibrated is a single point of failure in your assurance case.

• Close the handover gap. Require a short competence verification at crew change for the safety-critical task list, not a verbal “he’s fine.” The relief watchkeeper either can demonstrate the reference-failover response on the specific spread aboard, or is supervised until they can.

• Track leading indicators, not lagging ones. Useful measures include mean response time to a simulated yellow ASOG alert in drills, the percentage of positioning safety-critical tasks with a current degraded-condition assessment, and the percentage of nominated assessors whose own assurance is in date. These move before an incident does; incident counts move after.

The broader lesson is structural. The offshore industry keeps getting better at building reliable safety-critical systems and, in the same motion, keeps eroding the human competence needed to manage those systems when they degrade. That is as true of the positioning chain as it is of a production shut-in loop. The health of your competence pipeline – including where the next generation of surveyors is actually trained – is part of the same assurance case, not a separate HR concern. Alert 524 is written about production hardware, but the discipline it asks for is one any survey function can adopt without waiting for its own alert.

---

Based on: Improvements Needed In Production Safety System Training