ASOG spoofing readiness checklist

Before the scope is issued: remove the hazard where you can.

• The geotechnical designer has recorded which close positions truly need a drilled borehole.

  A drilled borehole is the riskiest way to get soil data beside a live line: a heavy rig, a string in the ground and a vessel on DP for a day or more. An ROV-deployed cone or push core placed by sight of the pipe takes the satellite out of the placement. Every position moved to a lighter tool is one this list no longer has to protect.

  Our position Reasoning in the article
• Every rejected alternative is rejected on a written cost.

  ALARP (as low as reasonably practicable) means a measure is taken unless its cost is grossly disproportionate to the risk it removes. A written cost for each tool you did not choose is the evidence that the test was applied. Without it, the choice of a drilled borehole is a habit.

  Our position Reasoning in the article
• Line condition is issued with the tender: burial and cover from the latest survey, wall, pressure, coating, spans, any buckling since lay.

  The consequence of contact depends on the line as it is today. Remaining wall, pressure, coating, impact capacity, spans and burial set how much protection the pipe gives itself, and a line that has buckled since lay may not sit where its drawing says. Bidders cannot price the reference configuration or the response times without it.

  DNV-RP-F107IMCA S 029 Reasoning in the article

Sized from reach, graded by consequence, owned by the operator's pipeline engineer.

• The zone covers the worst credible excursion: conventional drive-off or drift-off, and a slow spoofed drag at the fastest rate no DP test catches.

  A fast drive-off is felt on the drill floor within seconds. The dangerous case is a drag of a few centimetres a second, about two metres a minute, below the limits the DP uses to reject a bad reference. A zone sized only for conventional failures leaves that drag unbounded.

  IMO MSC.1/Circ.1580IMCA M 252 Reasoning in the article
• The time to detect, decide and act includes GNSS removal and pick-up or disconnect from the deepest planned penetration.

  The zone is a distance the vessel can cover in the time the crew needs to respond. That time includes recognising the spoof, taking GNSS out by the proven sequence and clearing the string from the deepest planned penetration. A deep push can take tens of minutes to retract.

  IMCA M 273 Reasoning in the article
• A toppled string (water depth plus drill-floor height), frame landing tolerance, catenaries and nearby transponders are inside the calculation.

  A string released at the drill floor falls over its free length, water depth plus drill-floor height, the way it leans. It reaches the line wherever that length exceeds the offset. Landing tolerance, wire catenaries and transponders near the line add to the reach.

  Our position Reasoning in the article
• An inner geo-fence (yellow) and an outer one at the zone's edge (red) are computed from each non-GNSS reference separately.

  Where GNSS governs, a spoofed drag has no natural limit, so the zone needs alarms that the spoof cannot move. A fence computed from the DP's blended position follows the spoof; one computed from each non-GNSS reference on its own does not. The inner fence leaves time to act, the outer one marks the zone's edge.

  IMCA M 220 Reasoning in the article
• The zone is re-accepted on times demonstrated on a borehole outside it before the first frame landing inside it.

  At tender the zone rests on assumed response times. A drill on a borehole outside the zone, at the deepest planned penetration, replaces them with measured ones. If the zone grows as a result, the reference configuration, the ASOG and the approvals reopen.

  IMCA M 273 Reasoning in the article

Two GNSS receivers listening to one sky are one source.

• Inside the zone: three non-GNSS references with no one principle holding half or more, or two of different principles with one deweighted GNSS input keeping a median.

  DP class 2 asks for three independent position references based on different principles. A spoofer moves every GNSS receiver the same way, so two receivers count as one source, and IN 1730 says multiple GNSS references give no true redundancy when the signal is compromised. Two acoustic systems are one principle as well: in DPE 04/23 water-column conditions corrupted both together, and after a chain of recalibrations the vessel was carried 40 m off its setpoint in 40 minutes.

  IMO MSC.1/Circ.1580IMCA IN 1730IMCA M 235IMCA DPE 04/23 Reasoning in the article
• The heading and aiding chain behind every non-GNSS reference is traced and owes nothing to satellites.

  A USBL fix is a range and two angles rotated into north by heading, roll and pitch. If that heading comes from a dual-antenna GNSS compass, or the solution is referenced through a GNSS-aided INS, the acoustic inherits the spoof. IN 1730 notes that GNSS heading may degrade before position.

  IMCA IN 1730 Reasoning in the article
• An FMEA addendum covers GNSS common-mode failure.

  Class 2 is built around a single fault in one component. Spoofing is one external cause corrupting every GNSS reference at once, a common-mode failure the standard FMEA does not test. IN 1730 asks for it to be addressed in the FMEA.

  IMCA M 166IMCA IN 1730IMO MSC.1/Circ.1580 Reasoning in the article
• An injected common-mode drift on both GNSS feeds has been run on DP trials, recording median, estimator, thrust demand and hull motion.

  With two GNSS and one other reference, both GNSS can drift together and make the third appear to be at fault, as M 252 warns. What the median, the estimator and the thrusters then do differs between vendors and versions. Only an injected drift on the vessel's own DP, away from the pipeline with the vendor present, shows it.

  IMCA M 252IMCA IN 1730 Reasoning in the article
• The DP vendor has confirmed in writing the GNSS removal sequence for every starting state, including an acoustic already rejected by the median.

  Removing GNSS changes what the DP believes and where it drives the hull. In the common two-GNSS, one-acoustic set the median has often rejected the acoustic before anyone acts, and simply reselecting it can fail the DP's prediction test. The vendor's letter fixes one sequence per starting state, so the crew does not improvise under alarm.

  IMCA M 220 Reasoning in the article
• Receivers are multi-constellation and multi-frequency, with signal strength, gain, clock and inter-antenna offset monitored live.

  Receiver diversity makes a crude spoofer visible as disagreement between receivers, and capture is often the most visible moment: a change in signal strength, gain or clock. Hardening helps detection and leaves a competent spoofer undefeated, so it sits beside the non-GNSS references. IOGP 624-02-01 is the contract specification where such checks belong; the 2021 GNSS guideline most specifications cite does not mention spoofing.

  IOGP 624-02-01IOGP 373-19 / IMCA S 015IMCA IN 1730 Reasoning in the article

A coordinate on a drawing is not a measurement.

• The acoustic array is calibrated in a local frame tied to fixes on the pipe, rather than to GNSS alone.

  Array calibration usually takes GNSS as its absolute reference. Calibrated under a spoofed fix, the array is internally consistent and absolutely wrong, and holds the vessel perfectly still at the wrong offset. IN 1730 records that disruption is particularly critical during calibration and beacon deployment.

  IMCA IN 1730IOGP 624-01 Reasoning in the article
• The offset to the line is confirmed against the pipe itself (ROV fix, pipe tracker or acoustic survey) before the frame lands.

  The pipe's drawn route and the vessel's GNSS can share the same error. Only a measurement of the pipe where it lies, by ROV, tracker or an acoustic survey of the line, settles the offset. A buried line is invisible to multibeam and may need a tracker from a second vessel, which brings simultaneous-operations planning.

  IMCA S 029IMCA M 203 Reasoning in the article
• The spread can witness the offset without satellites: frame beacon, string and lift-wire angle, compensator stroke, DVL, cameras on the line.

  The drilling spread carries evidence no spoofer can move: a transponder on the frame, the angle of the string and lift wire, compensator stroke, seabed Doppler and cameras. In shallow water these show a drag as fast as the DP alarm does. They stay honest only if the USBL and DVL take gyro heading.

  IMCA IN 1730 Reasoning in the article

Principles the vessel's ASOG must contain, proven on its own DP in the trial and the drill.

• The ASOG lets spread evidence decide which sensor is lying, whatever the number of references left.

  In the common two-GNSS, one-acoustic set the DP's median has already sided with GNSS and rejected the honest acoustic. Waiting for the reference count to settle it means following the spoof. When the spread shows the hull moving and GNSS does not, GNSS is lying and comes out.

  IMCA M 252IMCA IN 1730 Reasoning in the article
• It forbids entering non-GNSS coordinates as a setpoint while GNSS is still in the solution.

  The DP holds the false position as true. A new setpoint typed from the honest reference is read against that false position, so the DP drives the hull as far again in the direction it has already gone. The correction happens only by the vendor's removal sequence.

  Our positionIMCA M 220 Reasoning in the article
• No reference is re-initialised or re-origined while a disagreement or suspected spoof persists.

  Re-initialising the acoustic so it agrees with GNSS erases the evidence and plants a false origin the DP will hold once GNSS is finally removed. DPE 04/23 shows the same trap from the other side: recalibrating references one after another carried a diving vessel 40 m off its setpoint.

  IMCA DPE 04/23 Reasoning in the article
• When the evidence cannot decide, the vessel follows neither side and moves away from the line on gyro heading once the string is clear.

  Sometimes the spread evidence is missing or contradicts itself. Then no reference is changed and no absolute setpoint entered. Relative moves on gyro heading, each larger than the disagreement, take the hull away from the line until every reference on its own puts it outside the zone.

  Our position Reasoning in the article
• At yellow the driller clears the string first: stop, retract, open the clamp, pick up above the frame and the pipe cover.

  With the clamp closed, string and frame act as one: a moving hull bends the string, loads the frame and can pull both towards the line. Clearing the string turns a pipeline-contact scenario into a station-keeping problem. M 220 asks that the driller or superintendent be involved in the ASOG on drilling units.

  IMCA M 220 Reasoning in the article
• Spoofing triggers map onto the vessel's own statuses and never lower them; the precautionary-yellow waiver is removed for spoofing triggers.

  M 220 uses green, advisory, yellow and red. In its example the client's concurrence before resuming is waived for precautionary yellows the vessel declares itself, which is how a suspected spoof will usually be declared. Removing that waiver, and giving the concurrence to the asset owner, keeps the decision with the person accountable for the pipe.

  IMCA M 220IMCA IN 1730 Reasoning in the article
• The spoofing scenario has been drilled on board, with a signed record, before the first borehole inside the zone.

  An ASOG the crew has only read will not be followed in the first minutes of a real event. IN 1730 advises training DPOs on spoofing through drills, and M 273 sets out how to run them. The drill also measures the response times the zone was sized on.

  IMCA M 273IMCA IN 1730 Reasoning in the article

Decided in advance, demonstrated in the drill.

• No disconnect at the drill floor while the string leans towards the line.

  A string released at the drill floor falls the way it leans, over water depth plus drill-floor height. The hull first moves over the frame, or beyond it on the side away from the line; failing that, the string is released at a pre-set point low enough that what remains standing cannot reach the pipe.

  Our position Reasoning in the article
• By default the frame is left in place, with the lift-wire winch in constant tension and a breakaway connector on the umbilical below the frame's sliding resistance.

  A frame dragged by its lift wire or umbilical can hook an exposed line. Keeping every connection weaker than the frame's grip on the seabed means the frame stays put while the hull moves off. It is lifted only with the hull over it or on its side away from the line.

  Our position Reasoning in the article
• The move-off is confirmed by the hull's position relative to the frame, rather than by range.

  Range has no direction. From the pipe side, the range to the frame falls as the hull moves away from the line until it passes over the frame, which reads like the wrong outcome. Direction comes from the beacon's position on gyro heading, DVL bottom track or the frame camera.

  Our position Reasoning in the article

The vessel controls likelihood; the operator controls consequence.

• The consequence control is chosen and recorded: shut-in and depressurise, local isolation, pressure reduction, or protection.

  Everything above makes contact less likely. Shut-in, isolation, a lower pressure set against dent tolerance and flow assurance, or physical protection decide whether contact becomes a hydrocarbon release and how large. Only the operator can choose these, and the choice belongs on record before mobilisation.

  DNV-RP-F107 Reasoning in the article
• Test records confirm the bounding valves close in time; lost communications with the field control room is a shut-in trigger.

  A shut-in plan is only as good as the valves and the link that trigger it. Test records show the bounding valves close within the time the response allows, and the depressurisation time must be known. A mass-balance leak-detection system will not see a small leak.

  Our position Reasoning in the article
• The response to a hit and the stop conditions are written into the bridging document with the field.

  A gas release under a DP hull is a vessel emergency and a field emergency at once, run under two safety management systems. The bridging document joins them: who stops, who shuts in, who is told. M 125 describes such an interface for DP vessels near offshore structures, and IOGP 423-02 gives the template the contractor completes.

  IMCA M 125IOGP 423-02IOGP 423 Reasoning in the article
• The ASOG and reference configuration are approved by an independent DP specialist paid by the operator, outside the project's management chain.

  By default the ASOG is owned by the contractor's crew and acknowledged by the operator's project team, both with a schedule reason to set triggers loosely. This approval is our working group's position, beyond current IMCA guidance and within M 220's allowance for altering signatories. M 249 accreditation is a baseline, though IN 1726 says it does not indicate expert status.

  Our positionIMCA M 220IMCA M 249IMCA IN 1726 Reasoning in the article
• As-found, as-left and post-event surveys of the line are specified, and every borehole in the zone is backfilled and recorded.

  Damage beside a pipe is often invisible from the vessel. A survey before the first borehole and after the last, and again after any release, dropped object or yellow with a string in the ground, separates new damage from old. An open borehole beside the line, or under a future foundation, is a hazard of its own.

  IMCA S 029 Reasoning in the article

No leg touches the seabed on a satellite position alone.

• The ISO 19905-4 installation assessment covers soil displacement at the pipe, old footprints and anchor corridors.

  A spudcan need not touch the pipe to damage it: penetration pushes soil sideways and can load a buried line. Old footprints can make a spudcan slide off target, and a punch-through can drive it metres deeper in seconds. ISO 19905-4 now holds the assessment for installation, preload and removal; IOGP 373-18-1 lists pipelines among the hazards for bottom-founded rigs.

  ISO 19905-4ISO 19905-1IMCA M 223IOGP 373-18-1 Reasoning in the article
• Each spudcan is watched against the line, or a marker placed over a buried line, from settling height until the legs are pinned.

  As the legs are lowered they can mask satellite signals, and positioning shifts to the acoustics, which may struggle with nothing behind them. An ROV or leg-mounted sonar watching each spudcan against the line is the check that does not share the failure. Over a buried line the watch is against seabed markers placed on a pipe-tracker fix.

  IMCA M 223IOGP 373-18-1 Reasoning in the article