ASOG and DP Drift-Off: Why Crews Bypass the Guidelines

The Framework Everyone Adopted But Nobody Enforces

The framework is sound; the problem is that crews bypass it under commercial pressure. Activity Specific Operating Guidelines (ASOG) sit at the centre of modern dynamic positioning planning, and the recurring failure documented in IMCA’s DP event bulletins is not a flaw in the guidelines but a pattern of crews setting them aside when stopping costs money.

IMCA M 220, Guidance on Operational Activity Planning, defines the ASOG as the document that sets the operational, environmental and equipment performance limits for a DP vessel with respect to the specific activity it is undertaking, together with the actions the crew must take after a contingency event. The premise is sound: a vessel conducting a saturation dive operates under different risk parameters than the same vessel running an ROV survey in open water, so the limits and responses should be activity-specific rather than generic. The bulletins do not dispute that premise – they show it being overridden. Crews reconnect failed generators inside the 500 m zone. A mobile offshore drilling unit continues well intervention after its single-fault tolerance is gone. A service vessel re-selects a failed thruster alongside a structure instead of moving to a safe position first. The question is not whether ASOG is superior to the old generic schemes – it is. The question is why crews who help develop these guidelines bypass them when something goes wrong. The recurring pattern across recent bulletins suggests this is systemic, not isolated.

What Changed After a Diver Nearly Died at 90 m

The 2013 DSV incident remains a reference case in DP safety training. IMCA Safety Flash 02/13 describes what happened: two saturation divers were working at 90 m inside a subsea drilling template, carrying out valve operations for barrier testing, when a series of DP alarms sounded relating to the K-Pos RBUS (Redundant communication BUS). The amber alarm was raised and quickly upgraded to red, and the divers were instructed back to the bell staging. The alarms were followed by the loss of all analogue and digital RBUS input/output signals – position references and environmental signals – and a subsequent loss of DP control. The control system did not detect the jammed RBUS and take appropriate action. The vessel drifted off and, while Diver 2 was relocating to the bell, his umbilical snagged on a transponder bucket on the template. As the vessel kept drifting, the umbilical severed, and the diver lost surface-supplied gas, hot water and communications. He went onto bail-out, made his way back onto the template, and was recovered to the bell unconscious by Diver 1, regaining consciousness shortly afterwards. The vessel had drifted 240 m from its original position. Both divers survived. The investigation traced the cause to a jammed RBUS involving faults in the I/O modules of a DP control cabinet, with no single definitive root cause but several contributing hardware faults. A firmware update was issued as a permanent fix, and the UK HSE published Safety Notice 1-2013 on the resilience of DP control systems to single faults that block data communications. The applicable IMCA diving guidance – IMCA D 010 on diving operations from DP vessels and IMCA D 078 on diving umbilical management – sets the framework for managing this risk.

The 2013 case is about equipment resilience, not procedure: the control system failed in a way the crew could not have foreseen, and the regulatory and design response was to harden the hardware. But it is also why activity-specific limits and contingency actions exist in the first place – the case established the worst-case a DP diving operation has to plan for, and it is the reason an ASOG sets a hard deviation limit at which divers return to the bell. That is what makes the later record striking. The hardware failure was addressed, yet recent IMCA DP event bulletins document a different failure mode entirely: crews bypassing the very limits and responses the 2013 case put in place.

How ASOG Should Work (And Where It Breaks Down)

ASOG sets operational constraints for each activity.

• Operational constraints: maximum deviation before divers return to the diving bell, before the ROV is retrieved to the TMS, and before drill string retrieval begins;
• Environmental constraints: wind speed, wave height, current, measured relative to available DP capability;
• Equipment power constraints: the number of thrusters, generators, and positioning systems required to cover a worst-case scenario;
• Response measures: prescribed actions based on potential loss of position during operations.

The ASOG is normally presented as a table using a traffic-light status scheme – green, advisory and emergency – but the actions attached to each status are activity-specific rather than generic. At an advisory (yellow) status during diving, the response is to move to a safe location and prepare to recover the bell; for ROV work it is to recall the ROV to the tether management system (TMS) and move outside the 500 m zone. The DPO’s authority is explicit: if the ASOG says stop, the activity stops. On paper, this removes the ambiguity that used to cause friction between the bridge and the operations team. In practice, commercial pressure still overrides it. For drilling units the same tool is called Well Specific Operating Guidelines (WSOG), and the related operating modes covered by IMCA M 220 – Critical Activity Mode (CAM) and Task Appropriate Mode (TAM) – set how the DP system is configured for high-consequence and lower-consequence work respectively. CAM is the most fault-tolerant configuration, set up to remain single-fault tolerant through a critical activity; TAM is a risk-based mode in which the vessel may be operated accepting that a failure has the potential to exceed worst-case-failure thresholds. That distinction is exactly what the redundancy-loss cases below turn on.

DP Event 04/23: The ROV Incident That Illustrates the Problem

IMCA DP Event Bulletin 04/23 (December 2023) describes a DP vessel conducting ROV operations beside a platform when a generator connected to the port switchboard failed and tripped. The vessel’s technical staff started fault-finding and attempted to reconnect the generator, having concluded they had identified the problem. The reconnection produced a voltage spike that blacked out the switchboard, and shortly afterwards, before the vessel had left the 500 m zone, the port redundant group blacked out – equalling the Worst Case Failure Design Intent (WCFDI). Per the ASOG, the vessel went to a yellow status, the ROV was recalled to its TMS, and the vessel began to move away from the platform in a controlled manner. According to the bulletin, that ASOG response was then defeated when the technical staff bypassed it and re-established the generator connection, contrary to the unequivocal ASOG statement that machinery should not be reinstated until the vessel is outside the 500 m zone. The ASOG was correct; the crew bypassed it anyway. The bulletin’s own framing is blunt – the title IMCA gives the case is “Follow the ASOG – it’s there for a reason.” The contributing factor is a familiar one: the commercial pressure to restore capability and get back on task tends to win over the documented requirement to move to a safe position first.

Why This Matters for Survey and Site-Investigation Managers

For anyone writing a scope for geotechnical or site-investigation work, the ASOG-bypass risk is not an abstract sat-diving concern – it sits inside the survey envelope. Geotechnical drilling vessels face DP position-keeping constraints that are tighter than much diving and ROV operation. Operators such as Fugro and Geoquip Marine run DP2 geotechnical vessels – for example the DP2 units Geoquip Saentis and Geoquip Speer – for offshore wind site investigation, seabed sampling and shallow geotechnical drilling. Without a BOP or well-control barriers, the drill string forms a comparatively rigid connection between vessel and seabed, so even a small position excursion can bend or damage the string. The conditions that make survey and site-investigation work demanding for DP are the same ones that punish a degraded, ASOG-undisclosed vessel:

• Many sites lack pre-installed subsea infrastructure for acoustic position referencing, leaving the vessel dependent on surface references;
• DGNSS and relative reference systems must hold tight accuracy for the operation to proceed;
• Thruster wash can disturb or contaminate the seabed near the borehole, constraining how thrusters are used;
• In shallow water, thruster-to-thruster and seabed interaction effects are more pronounced.

Put a poor-reference site, a meaningful cross-current and a single equipment failure together during a borehole or CPT campaign, and the post-failure margin can be thin. That is precisely the state in which a survey manager wants the ASOG re-run and the degraded status declared – and precisely the moment the commercial pull to keep coring is strongest. The fix is the same one the bulletins below point to, written into the survey contract rather than left to the vessel: an ASOG matched to the actual site, recalculated when capability drops, with a standby provision that does not penalise the stop decision.

What IMCA Bulletins Actually Reveal About Culture

Three further DP event bulletins illustrate the same pattern. DPE 02/22 (service operation vessel, personnel transfer): the vessel was about a metre from a platform gangway, manoeuvring to connect its personnel access platform (PAP), when the starboard azimuth thruster was rejected by the DP system without warning. When the readiness indicator returned, the DPO immediately re-selected the failed thruster. The DP solution could not stabilise with the unresponsive thruster in the calculation, the vessel drifted astern, the PAP contacted and damaged the gangway, and the gangway later detached from its securing point. The bulletin is explicit that the ASOG called for re-selection of failed equipment only once the vessel was in a safe position, and that operations should have been stopped and the vessel moved clear before recovering the DP system. DPE 02/24 (equipment class 2 MODU, well intervention): engineers reported noise and heavy vibration from a seawater cooling pump serving Thruster No. 1 and asked the DPOs to deselect and stop that thruster for investigation. The DPOs agreed, reducing port-side thruster capacity. Around half an hour later a blackout on the starboard power system took out Thrusters 2 and 3. By deselecting Thruster No. 1, the unit had lost its required redundancy and was operating outside its post-worst-case-failure DP capability – no longer single-fault tolerant, and so not DP class 2 compliant – without that degraded status being relayed to all parties. DPE 01/23 (platform supply vessel, degraded capability): the vessel was working near fixed structures with three concurrent defects – Azi 1 restricted to fixed mode by a hydraulic issue, BTT2 sluggish and raising feedback alarms, and generator DGP2 limited to emergency use at no more than 50% power because of a leaking turbocharger. The vessel was no longer single-fault tolerant; an in-depth post-failure evaluation and an updated ASOG with reduced power and thruster limits could have restored WCFDI and made the reduced capability visible to the client, who was unaware. The bulletin points to commercial pressure and the question of whether enough contractual time had been allowed for routine maintenance. The thread across all three is the same: the ASOG was not followed, the degraded status was not fully communicated, and commercial pressure was a contributing factor. The framework exists. Crews know it. They bypass it when stopping costs more than continuing.

The Shore-Based Assurance Solution (That Most Don’t Use)

Shore-based DP assurance has grown as a response to repeated station-keeping events. Independent specialists – for example DP & Marine Assurance Norway and similar marine assurance consultancies – offer DP audits and trials that examine, among other things:

• Compliance with ASOG requirements regarding planned operations;
• The relevance and completeness of the DP FMEA;
• Results and trend analyses of onboard DP tests;
• Crew competence and training;
• The history of DP incidents and corrective actions.

The concept is sound: an independent party reviews the ASOG before operations begin to confirm it is tailored to the specific activity and that the onboard equipment matches the stated capability. The kinds of gaps these reviews commonly surface line up closely with the failure modes in the DP bulletins:

1. Generic ASOG not matched to the activity: vessels arrive with a pre-made ASOG that does not cover the actual task – the limits and responses for the specific operation alongside a structure are missing or unsuitable;
2. ASOG not updated when equipment is degraded: when equipment fails or is taken out for maintenance, the ASOG limits stay unchanged and crews keep working to the original parameters – the exact failure visible in DPE 01/23 and DPE 02/24;
3. On-site DP capability not verified before work starts: field arrival trials confirm the DP system performs as expected under real site conditions, but tight schedules can see them shortened or skipped;
4. Communication gaps: bridge, engine room and contractor teams work in silos, so a degraded status is not relayed to dive supervisors or client representatives.

Shore-based assurance should catch these issues before they escalate. In practice, the added cost and administrative overhead means uptake is uneven – concentrated on high-risk diving and drilling campaigns where clients mandate it, while much routine ROV, geotechnical and supply work is self-certified.

The FMEA Problem: When the Analysis Doesn’t Match Reality

There are really two failure modes here, and they should not be confused. The first – the one nearly every bulletin documents – is an ASOG that was correct but bypassed: the limits and responses were right, and the crew set them aside. The second is subtler and is the one that genuinely fits a “following the rules still fails” reading: an ASOG that was followed but whose limits were wrong. That second mode is an FMEA problem.

Every ASOG rests on the vessel’s DP FMEA. Classification societies require an FMEA for DP class 2 and class 3 vessels, supported by proving trials and annual trials. The FMEA defines the worst-case failure and, with it, the WCFDI – the envelope within which the vessel can hold station after that failure. The practical limitation is timing and conditions: proving and annual trials are conducted periodically and tend to be run in workable weather, with the vessel in good order. The ASOG limits derived from them assume that intact state, which is often not how the vessel sits by mid-campaign once defects accumulate – the situation in DPE 01/23. A vessel that demonstrates its redundancy cleanly in calm trials can have far less margin in a degraded state and a heavier sea. A crew can follow an ASOG to the letter and still be exposed, because the envelope they are obeying was characterised on a different vessel state from the one they are in. The point is not a specific number; it is that the FMEA-derived envelope assumes an intact, well-characterised vessel, and the bulletins show repeatedly that the vessel was neither. The remedy for the bypass mode is enforcement; the remedy for this mode is recalculation – re-running the ASOG against the vessel’s actual condition rather than its trial-condition baseline.

What Actually Works: When ASOG Prevents Incidents

Compliance is invisible by design: a correctly handled event produces no incident report, and IMCA does not publish bulletins about uneventful operations, so the public record is skewed towards the cases where the framework was bypassed. The single most cited benefit of a well-built ASOG is clarity of authority – when a thruster or generator fails, the document states the response in plain terms, and the DPO can point to limits the client itself reviewed and accepted rather than making a personal judgement call under pressure. From the way the bulletins read, whether that authority holds depends on three things:

1. Independent oversight on the job: a competent DP or marine assurance presence reinforces compliance versus self-certification alone.
2. Contract structure: where stopping carries no commercial protection, the incentive runs against the procedure; aligning the commercial terms with the stop decision reduces that conflict.
3. Crew experience with DP incidents: crews who have lived through a drift-off or drive-off treat the ASOG as a live control, not paperwork.

The Recommendations That Most Operators Resist

The fixes are not mysterious – they are mostly commercial and organisational, which is why they are resisted:

• Treat independent DP assurance as standard for high-consequence work, not only deep diving but also ROV and construction work close to structures and geotechnical drilling in confined sites. The cost is small against the consequence of a contact or a diver incident, but it is an explicit line item, so it is the first thing cut;
• Run on-site field arrival trials before operations begin, in line with IMCA M 220. Verify DP capability under the actual site conditions – current, wind, sea – before the first diver enters the water or the first drill string goes down, and compare thruster allocation and position-keeping against the FMEA predictions rather than assuming the trial-condition envelope holds;
• Track ASOG compliance as a measurable KPI, reported monthly alongside uptime and fuel rather than mentioned only after an incident. Give it real units a manager can put in a contract: ASOG breaches per 100 operational hours (target zero, with every breach logged and reviewed); the time from an advisory (yellow) status being reached to the prescribed operational response being executed, against an agreed target measured in minutes; the count of ASOG recalculations triggered by equipment defects per campaign, with the expectation that a defect-laden vessel generates recalculations rather than none; and the proportion of degraded-status events relayed to the client representative within an agreed window. A one-line “we follow the ASOG” assurance is not a KPI; a breach rate, a response-time target and a recalculation count are;
• Update the ASOG immediately when DP-related equipment is degraded. Recalculate the limits to reflect the reduced capability rather than working on a defect against an intact-vessel ASOG. Operating to an out-of-date ASOG with degraded equipment is exactly the failure mode in DPE 01/23 and DPE 02/24;
• Build the stop decision into the contract. A standby provision for ASOG-triggered stoppages – where the vessel moves off and an agreed rate continues – removes the structural incentive to override the procedure. If stopping always means lost revenue with no contractual cover, the procedure will keep losing to the commercial pressure.

Where This Leaves the Industry

ASOG is the right framework. The 2013 DSV drift-off showed how fast a DP control-system failure can put a diver’s life on the line, and activity-specific limits and contingency actions are the proportionate response. The problem is not the framework itself – it is the gap between what is written down and what happens when stopping costs money.

IMCA DP event bulletins documenting ASOG non-compliance will keep appearing until three things change: contracts carry commercial cover for ASOG-triggered stoppages, independent DP assurance becomes the norm rather than an optional extra for the highest-risk campaigns, and vessels track ASOG compliance as a managed KPI alongside uptime and fuel. Until then, the framework exists on paper and fails on the job. The two divers at 90 m in 2013 survived by a margin. The next crew may not.