The DP Incidents You Never Hear About: Why Concealment Still Pays

A Drilling Campaign Beside a Platform

A geotechnical drilling campaign had to put boreholes about fifty metres from a producing offshore platform. Fifty metres: at that stand-off there is no buffer worth the name – a vessel that starts moving toward the structure has seconds of margin, not minutes. The vessel that won the work was competent in the open field: thousands of hours of DP drilling over featureless seabed, a clean record, an experienced crew. What it had never done was hold station where a drift-off has consequences measured in something other than re-drilled metres.

Nobody on the client side forced that difference to the surface. The vessel had permission to work beside the platform – the procedural gate of the 500 m zone was duly opened. What nobody had asked was whether it deserved that permission: the scope did not require a demonstration that the DP system met the standard the location demanded. No activity-specific operating guidelines were developed. The document that would have defined – before the first borehole – what degraded status meant this close to a platform, and what the vessel would do about it, simply did not exist. The campaign started on the strength of the vessel’s open-water record.

During the works the vessel lost position more than once. The excursions were brief, and contact with the platform was avoided – by margin, not by design, as the accounts that later surfaced made clear. What reached the client at the time was nothing. The position losses emerged well after the fact, and not through the vessel’s reporting chain; the vessel’s management had preferred to keep them internal. Each event existed physically but never on paper: no incident report, no flash, no entry in anyone’s lessons database.

The epilogue is the part we find genuinely alarming. A year later, the same vessel was put forward for similar near-platform work – and was accepted by the same responsible manager, with the same absence of DP verification. Only the vigilance of colleagues elsewhere in the organisation, who remembered what the paper trail did not record, stopped the repeat before it started. The system had not learned; a person had. That distinction is the subject of this article.

The Physics Is Solved; the Incentives Are Not

It is hard to argue that DP station keeping is an immature discipline. The IMO guidelines for DP vessels date from 1994 (MSC/Circ.645) and were refreshed in 2017 (MSC.1/Circ.1580) on the basis of industry proposals. IMCA M 103 covers the design and operation of DP vessels; IMCA M 220 defines the activity-specific operating guidelines (ASOG) and the critical-activity operating modes that tell a crew, in a table agreed before the job, what to do when redundancy degrades. For diving support, IMCA D 010 has governed DP diving operations for decades. Class societies notate redundancy levels; failure modes and effects analyses are mandatory practice; annual trials verify them.

The organisational side has infrastructure too. IMCA runs a DP event reporting scheme and publishes anonymised station-keeping event bulletins and annual summaries; safety flashes circulate lessons across the membership within weeks. The mechanism for industry-wide learning exists, is free, and is anonymised precisely to lower the cost of contribution.

And yet the same event keeps happening. Read a few years of DP event bulletins and the pattern is unmistakable: a generator trips inside the 500 m zone, a thruster is re-selected before the vessel is in a safe position, a reference system degrades during a critical activity, and a vessel that should have moved away first and investigated second does the opposite. We have written before about why crews override the limits they helped write – the commercial pressure that defeats an ASOG in the moment (the drift-off problem no one wants to discuss). This article is about the layer beneath that: the events that never enter the record at all.

The technical learning loop – FMEA, trials, class, ASOG – functions. Imperfectly: FMEA quality varies widely between vessels, and trials can be walked through as theatre. But it exists and it improves. The organisational learning loop – incident, report, lesson, industry – is open at its first link. A loop that never receives the event cannot learn from it, and no amount of engineering downstream compensates for a broken intake.

Why Silence Is Rational

It is comfortable to file concealment under bad culture, as if it were a moral defect of particular crews. The uncomfortable reading is more useful: under the current commercial structure, concealment is a rational economic strategy, and the industry has arranged things so that honesty is punished at the point of sale.

Consider what a vessel owner faces after a brief position loss with no damage. Reporting it means: a paper record that every future questionnaire asking the question in writing will force him to disclose or lie about; questions from the current client that may pause the campaign; a possible claim history conversation with insurers; and a data point that a competitor’s identical vessel, which quietly had the same event last month, does not carry. The benefit of the report – a lesson that might prevent the next event – accrues to the industry at large, mostly to the owner’s competitors. The cost is private; the benefit is public. Economists have a name for what happens to public goods funded by private sacrifice: they are underprovided.

Note also what the law does not do here. A position loss that ends without damage or injury typically sits below the mandatory casualty-reporting thresholds of flag states. The ISM Code does oblige the crew to report hazardous occurrences – but only as far as the owner’s own safety-management system; the report stops at the company. Where genuine near-miss duties exist – shelf regimes such as Norway or the UK, where an event that could jeopardise an installation is notifiable through the installation’s duty holder – they cut the other way: a vessel that conceals an event beside a platform can leave the client in breach of a duty it does not know it has. In most jurisdictions, though, nothing obliges anyone outside the vessel’s own management system to be told. The event belongs to no industry record unless someone chooses to put it there – which is precisely why the voluntary layer carries the whole weight, and why its economics matter so much.

And the silence is rarely one-sided. A client project manager whose campaign is behind schedule has his own quiet reasons not to formalise an event: a reported incident pauses operations, summons an investigation, and attaches itself to his project’s record. Concealment at its most durable is not a lie told by the vessel to the client – it is a tacit agreement between two parties, each of whom finds the unrecorded version cheaper. Any operator serious about this problem has to start by admitting that half of the incentive structure is its own.

The reporting infrastructure, honest as it is, cannot fix this on its own. IMCA’s DP event scheme and safety flash system are voluntary and anonymised – the right design for lowering the cost of participation, but participation still depends on the owner volunteering. And anonymity protects the bulletin, not the owner’s files: to submit an event, the owner must first record it internally – a record discoverable in litigation and visible to auditors – and in a market where fleets are small and details identifying, anonymisation is a promise, not a guarantee. Nor do the industry’s vetting databases close the gap: OCIMF’s OVID and IMCA’s eCMID give charterers standardised offshore vessel inspection records, but an inspection is a snapshot of condition, not a history of events – a vessel can pass a spotless inspection three weeks after a concealed drift-off.

The consequence is a numerator problem: nobody knows the true DP incident rate. The bulletins document the self-selected sample that owners chose to submit. What fraction of actual events that represents is unknowable by construction – and every practitioner who has stood on a bridge or a back deck long enough has a private list of events that never appeared in any bulletin.

One more mechanism deserves naming. Because reported events are rare and anonymised, each public incident reads as exceptional – an outlier attached to some unusually unlucky vessel. If the full population of events were visible, the industry would see what it actually has: a routine, structural failure rate that demands structural response. Concealment does not just hide individual events; it distorts the industry’s perception of its own risk. And it hides more than hardware failures: a suppressed event also buries what it revealed about the bridge team that handled it – the DPO who re-selected a failed thruster inside the zone, the watch structure that let it happen. In a market already short of experienced DP operators, the competence signal is exactly the one a charterer most needs and least receives.

The Client Side of Concealment

It would be convenient to end the analysis at the vessel owner. But return to the campaign in the opening section and count the gates the client left open.

The scope of work did not make DP verification a precondition for near-platform operations – no requirement for a current FMEA and annual trials evidence, no independent DP audit, no demonstration that the vessel’s redundancy concept matched the consequence of failure at that location. No ASOG was required, so none was written. The contract was silent on incident disclosure, so silence was free. And when the events eventually surfaced through informal channels, they were absorbed as anecdote: no formal lessons entry, no flag in the vendor record, nothing that would outlive the individuals who happened to know.

That last gate is the one that failed a year later. The organisation’s memory of the incidents lived entirely in people – and the person who approved the vessel’s return was not one of the people who remembered, or chose not to be. There is a quieter mechanism at work in that choice: the manager who readmits the vessel is also re-approving his own earlier decision. Flagging the vessel’s history now means conceding that the first approval was made without the verification it needed. Organisations that punish the second admission more than the first mistake teach their managers to defend old decisions instead of correcting them. Institutional memory that depends on who attends the meeting is not memory; it is folklore. The near-repeat was prevented by exactly that folklore – a colleague who spoke up – which is to say it was prevented by luck with a longer timeline.

Here is the honest conclusion an operator has to sit with: concealment succeeds because the client’s own assurance process gives it room to succeed. An owner cannot conceal an event from a client who contractually holds the DP logs. A vessel cannot be readmitted with an unverified DP system if verification is a standing precondition rather than a manager’s judgement call. The owner supplies the silence; the client supplies the vacuum it survives in.

Industries That Engineered Honesty

The instinct at this point is to call for better safety culture. We suggest studying instead the industries that stopped relying on culture and engineered the incentives directly.

Aviation built the reference case. The Aviation Safety Reporting System, running since 1976, is operated not by the regulator but by NASA – a deliberately neutral custodian with nothing to enforce – and filing a confidential report buys the reporter limited immunity from enforcement action for unintentional violations. The design premise is explicit: the information is worth more than the prosecution. Half a century on, the aviation community treats filing not as confession but as routine professional hygiene.

Shipping has a partial analogue in CHIRP Maritime – an independent, confidential reporting programme that investigates and publishes anonymised findings while permanently protecting reporter identity. It works on the same custodian logic as ASRS: separate the learning channel from the punishment channel, and information flows.

The tanker sector solved a different piece of the puzzle with the opposite mechanism. OCIMF’s SIRE programme did not ask owners to volunteer their problems; it made a shared, standardised inspection record a de facto condition of doing business with the major charterers. An owner can decline to participate – and forfeit the market. Disclosure there is not an act of virtue; it is a commercial precondition, priced in by everyone. A SIRE record is still an inspection snapshot – what the tanker sector proved is not event disclosure but the market-access mechanism: participation in a shared record as the price of trading.

The lesson is not that offshore should copy any one of these. It is that every industry that actually learns from its incidents got there the same way: by redesigning who pays for honesty. Either the private cost of reporting is driven toward zero (neutral custodian, confidentiality, immunity), or disclosure is made a condition of market access (shared records that charterers require). Culture followed the incentive design – not the other way around.

What an Operator Can Actually Do

An individual operator cannot rebuild the industry’s reporting economics. It can, however, rearrange them completely within the boundary of its own contracts – and that boundary is exactly where the opening case failed. The mechanics are unglamorous and they work.

Make DP assurance a precondition, not a preference. For any DP operation near an asset, over divers, or with an ROV in the water, the contract should require before mobilisation:

• a current FMEA and evidence of annual DP trials;
• a site-specific DP capability analysis against the location’s environmental envelope;
• an activity-specific operating guidelines document agreed with the client – the same bar we argued for in the ASOG analysis, here made a contractual gate rather than a preference;
• an independent DP audit where the consequence of failure justifies it.

Where a marine warranty surveyor is already engaged for the campaign, extending their scope to witness the DP assurance items costs little and buys an independent pair of eyes. A vessel with an open-water record and no near-asset history is not disqualified by this; it is qualified by it. That is the gate that was open in our case, and the paperwork costs a fraction of the campaign’s standby budget.

Buy the data, not the story. DP vessels log everything, and the record outlives the meeting where nobody mentioned the excursion. Owners will resist open-ended access to DP data logs – their P&I clubs and lawyers have discovery on their minds, and a blanket demand often dies in negotiation. What survives negotiation is narrower and almost as effective: event-triggered access (any change of ASOG status opens the relevant log window to the client), a defined log-retention obligation for the campaign, and a daily report line that states ASOG status changes – or, where the stakes justify it, independent DP performance monitoring for the duration. A trigger keyed to a declared status change can itself be suppressed, which is exactly what the retention obligation and the independent monitoring exist to catch. Concealment is not made impossible by any of this; it is made far harder, because the event now exists in a record the client is entitled to see.

Ask the question before the charter, in writing. The tender questionnaire should request the vessel’s DP event history and its record of submissions to the IMCA DP event scheme, backed by a truthfulness representation. Owners can still answer “none” – but a self-declared clean history that later proves false is no longer concealment in a grey zone; it is misrepresentation on a signed document, with the contractual consequences that word carries. The lever costs one page of the ITT. It only works, though, if the evaluation matches it: a disclosed event with a documented close-out scores neutral or better, and it is the implausibly clean sheet – not the honest declaration – that earns the deeper verification. Otherwise the ITT simply re-prices honesty as a tender handicap.

Make disclosure cheaper than discovery. Most charters already contain a line requiring incidents to be reported; it stays a dead letter because nothing verifies it and nothing prices it. Give the line teeth. Tie the reporting duty to something already defined rather than leaving “incident” to interpretation: any departure from normal (green) ASOG status – advisory, reduced or emergency – is a notifiable event, reportable within an agreed window. Then price the two paths honestly – a promptly disclosed event costs the owner a review meeting; a concealed event discovered later is a material breach. No automatic commercial penalty for an honestly reported near-miss, and a severe one for concealment. This is the ASRS logic transplanted into a charter party: lower the price of honesty, raise the price of silence, and let the owner’s own economics do the rest.

Give your organisation a memory that outlives its managers. Every DP event on your projects – disclosed, discovered or rumoured – belongs in a vendor assurance record that the next approval decision is required to consult. The test is simple: if the manager who lived through the incident leaves tomorrow, does the vessel still get flagged next year? In our opening case the answer was no, and the system’s only backstop turned out to be a colleague’s memory. Institutionalise the colleague. And apply the same logic to your own people: the vendor record and notifiable events belong with a marine assurance function outside the project team, and an honestly recorded near-miss must cost the project manager nothing – otherwise the tacit agreement described earlier simply re-forms inside your own organisation.

Feed the industry loop with your own hand. Nothing prevents an operator from submitting lessons from its campaigns into IMCA’s schemes, suitably anonymised, even when the vessel owner would rather not – provided the charter’s confidentiality article preserves the operator’s right to make anonymised industry submissions, a right worth writing in explicitly. The operator holds the facts; the flash does not need the owner’s signature. An operator that does this consistently is doing more for the industry’s numerator problem than any culture campaign.

The Bill Always Arrives

The economics of concealment only work locally. Globally, the cost of every hidden event is not eliminated – it is transferred, with interest, to whoever next charters the vessel, works the adjacent platform, or puts divers under the same DP system. The industry pays for every unreported drift-off; it just pays later, in someone else’s campaign, sometimes in a currency worse than money.

Our drilling campaign ended without contact, and the platform crew fifty metres away never learned how close the margin had been. Somewhere in the fleet, the vessel from a case like ours is holding station beside another asset today, its record clean, its history unwritten. The safety flash you never read is the one that was about your own project – one year early.

The technical community did its job decades ago; the guidance is written and the failure modes are catalogued. What remains unsolved is arithmetic: as long as silence is the cheapest line item in an incident, the industry will keep buying it. Operators are the only party positioned to change the price – one contract at a time.

---

Standards and schemes referenced: IMO MSC/Circ.645 and MSC.1/Circ.1580; IMCA M 103, M 220, D 010, and the IMCA DP event reporting and safety flash schemes; NASA ASRS; CHIRP Maritime; OCIMF SIRE and OVID; IMCA eCMID. This article reflects the collective operational experience of the panel – whose divers and ROVs work under the same DP systems the case describes. The case has been anonymised.