Question 1

OCIMF's DP FMEA Assurance Framework states it was developed because, despite extensive existing guidance, "a significant number of FMEAs lack comprehensive analysis," and that adherence to its prescribed format "will be confirmed by OVID inspectors as part of the DP FMEA assurance processes commissioned by OCIMF members." What does this tell a DP crew member about what an OVID inspection is actually checking when it comes to the FMEA?

Accepted Answer

The OVID inspector is not just confirming a class-approved FMEA document exists onboard, but assessing whether that document meets a specific quality and completeness standard (clear identification of common points, fail-safe conclusions, compensating provisions) — a vessel can hold a class-stamped FMEA and still fail this assurance check if the document itself is not comprehensive This is the critical, easily-missed point: OCIMF built this framework specifically because class approval alone was not catching FMEA quality gaps — the 2004 UK HSE/DNV review found weaknesses including non-thorough class review and late submission. An OVID inspection using this framework is checking the substance of the document, not just its existence or its class stamp.

Question 2

The framework defines a "common point" as an element that "interfaces with or influences redundant groups and... can defeat the redundancy concept," and states common points "cannot be eliminated completely in a redundant DP system" — closed bus ties, cross-connected control power supplies, and some hybrid power designs are cited as examples. Why does the framework treat common points as something to be managed rather than something a well-designed DP system simply avoids entirely?

Accepted Answer

Some common points exist because they are required to achieve specific legitimate design objectives (e.g. closed bus tie operation for certain power management benefits) — the framework's actual requirement is that any common point that does exist must be explicitly identified, its failure modes analysed, and its compensating provisions proven by testing, not that DP systems must have zero common points to be acceptable This is a precise, easily misunderstood point — the framework is not a zero-common-points standard, it is a "if a common point exists, prove you understand and have mitigated it" standard. A DPO or vetting-facing officer who assumes any common point automatically means a failed system, or conversely assumes common points are harmless because they sometimes serve a legitimate purpose, has both gotten the principle wrong in different directions.

Question 3

The framework states that for DP Equipment Class 3 operations, "bus-tie breakers should be open... unless equivalent integrity of power operation can be accepted," because operating with bus-tie breakers closed "introduces a fault propagation path during DP operations" where "failure in one system should never be transferred to the other redundant system." If a vessel's charterer requires open bus configuration, what does the framework say about the scope of testing this creates?

Accepted Answer

All intended operating configurations the vessel is capable of — not just the charterer's preferred open-bus mode — should be analysed, verified, and validated for their impact on the redundancy concept and post-failure DP capability, because a vessel may be technically capable of operating in a configuration (e.g. closed bus) that was never properly proven even if it is not the configuration normally used This is a genuine, easily-overlooked scope trap: a vessel might be operated almost exclusively in the charterer's preferred (and well-tested) configuration, while still being technically capable of switching to an alternative configuration that was never actually verified — and that untested capability remains a real, latent risk regardless of how rarely it is used.