Where the Alarms on the Deepwater Horizon being monitored, were they inhibited? Yes and Yes.
This morning the Sunday New York Times had an article so off point it I felt the need to clarify. In today’s article titled “For No Signs of Trouble, Kill the Alarm” journalist Matthew Wald wrote;
When an oil worker told investigators on July 23 that an alarm to warn of explosive gas on the Transocean rig in the Gulf of Mexico had been intentionally disabled months before, it struck many people as reckless.
esday, the National Transportation Safety Board said that a crash last year on the Washington subway system that killed nine people had happened partly because train dispatchers had been ignoring 9,000 alarms per week. Air traffic controllers, nuclear plant operators, nurses in intensive-care units and others do the same.
Mark R. Rosekind, a psychologist who is a member of the National Transportation Safety Board, said the cases had something in common. “The volume of alarms desensitizes people,” he said. “They learn to ignore them.”
James P. Keller Jr., vice president of the ECRI Institute, formerly the Emergency Care Research Institute, has a name for it: “alarm fatigue.” In a recent Web seminar for health care professionals, he asked participants if their hospital colleagues had become desensitized to any important alarms in the last two years. Three-quarters said yes. “This suggests it’s a pretty pervasive problem,” he said.
Having worked for many years on ships with integrated bridge systems, vessel management systems and a dizzying array of navigational equipment with names like AIS, GMDSS, and ARPA I would have to agree that having processes and procedures for dealing with alarms is critical and it is too easy for carless operators to overlook problems.
The issue here, as it relates to the Deepwater Horizon, is the media relating the inhibiting of alarms with carless watchkeeping. Now the silencing of alarms in nothing new aboard ships, spend a certain amount of time at sea and you will find the buzzers of so call “nuisance alarms” covered with an old sock and duck tape, but I highly doubt that evidence will support any sweaty socks aboard the Horizon.
What the Horizon crew did admit to was inhibiting alarms in the vessel management system (VMS). But to understand the reason for this, and why it is a good idea to inhibit some alarms, you must first have to understand the history of these systems. VMS systems are the latest in a long line of computer systems aimed at reducing the number of crew members standing watch. In a recent trip to a ship yard I talked with an engineer aboard one of the largest container ships ever built. This ship was over 100 feet longer than the largest aircraft carrier in existence but while Nimitz carriers typically carry 5,000 people, this particular ship sailed with only 24.
How does a ship of that size sail with only a couple dozen people? It’s with the help of automation and vessel management systems that have sensors tied to every conceivable machine and system aboard ship, including the toilet system. But sensors where not enough for ship owners trying to reduce the expense of crew salaries they soon demanded that manufacturers automate systems so their single watchstanders would have to press the fewest possible buttons. On the Horizon engines could stop or start, watertight doors could close, fire alarms could sound and a muyriad of other processes could be automated by the computer system. But they where not.
The inhibiting of alarms on a Kongsberg VMS does not necessarily mean the alarms where disabled, it simply means that the automated processes where. And the reason was not “to avoid waking up the crew with late-night sirens and emergency lights” (although prevent a cry wolf scenario is justification enough to inhibit alarms) but because the automated processes were not needed considering the Horizon had 126 people aboard including 2 standing watch on the bridge and others actively monitoring alarms in the engine control room and drill floor.
So when a Kongsberg system was inhibited the alarm still sounded for the watchstanders on the bridge only it did not automatically wake up the entire vessel with the abandon rig alarm rather it, being inhibited, suggested to the watch standers that they sound the abandon rig alarm manually, which they did.
The reason I felt compelled to write this blog post, so early on a Sunday morning, is that Mr. Wald’s article put’s us in great danger. Important people, like our leaders in congress, read the NYTimes and demand that action be taken when safety systems are violated. And they are likely to demand that systems are not inhibited in the future leading not just to more Cry Wolf scenarios but directly to fatalities when an uninhibited system shuts down propulsion in a storm leaving ships powerless against the elements, or closes watertight doors automatically crushing someone walking through.
This is not to say that Transocean is blameless here. In 2008 an entire engine room aboard their largest and , then, newest drillship was engulfed in flame because alarms where inhibited AND no engineers where in the engine room standing watch. But when the system is operated safely, when the company has provided enough watchstanders to manually activate the system, it is not only common practice but suggested practice that alarms are inhibited.
But another problem exists; due to the sudden and rapid influx of gas from the well, there where not enough watchstanders to manually activate all the safety systems on the Horizon, including an ESD 0 (total power shutdown), that night. They where overwhelmed by the speed of the event. If the system had not been inhibited the could have shutdown the system and sounded the alarms faster than the watchstanders could do manually and, with seconds being of great importance, crisis “might” have been averted.
So we get into a Catch 22 scenario. Inhibit your system, letting trained and proficient watchstanders take action when sensors alarm and risk them becoming overwhelmed during major blowouts (a rare occurrence), or let the computer take automatic action and risk having it make a bad decision like shutting down power during a storm. But it is clear, Wald has wrong information, the alarms where not prevented from sounding… they where simply prevented from automatic taking action beyond sounding a buzzer.
There is one final problem. Sensors and alarms are not located in the single palace they would have done any good that night…. 13,000 feet below the ship in the casing and cement. These sensors did not exist because the technology has not been invented and it is only these sensors, not the ones inhibited, that would have prevented this circumstance from happening. The inhibiting of alarms on the bridge only effected the response after the blowout already occurred, a response that was effective in saving 115 people that night.
So once again; gCaptain stands behind the Deepwater Horizon mariners, do you? Post your answer in the comments section below.