Bridge Alarm Management Atle Bulukin - Det Norske Veritas MNBNA379 March 2009 Good afternoon Ladies and Gentlemen, My name is Atle Bulukin and I am working at the nautical safety department at Det Norske Veritas . Yesterday You heard Jan Tore Grimsrud from the same department talk about the use of networks in navigational systems. Today I will address a subject that also takes into account integration of different navigational equipment and this subject is what we at DNV has chosen to call Bridge Alarm Management.

Bridge Alarm Management Motivation: The lack of Alarm management Safety risk Unimportant alarms Distractions and alarm ”blindness” Inconsistent and confusing Alarm Presentation and Handling The motivation for going closer into this subject is that The subject of Bridge Alarm management was a topic yesterday and has for many years been considered to be a safety risk by a majority of Captains and navigating officers. DNV has been interested in this subject for at least the last 20 years and in the later years the international maritime community has joined us in this matter. The key element here is that too many unimportant alarms are leading to distractions and alarm ”blindness” and finally that alarm presentation and handling can be inconsistent and confusing. © Det Norske Veritas AS. All rights reserved 15 April 2017

Bridge Alarm Management Outline: Current International Standards Current DNV regulations Future International Standard The outline of this presentation includes three parts; The current international standards The current DNV regulations within nautical safety and a Future international performance standard for Bridge Alert Management

Bridge Alarm Management Current IMO standards: IMO’s Code on alarm and indicators (Res. A.830(19)) IMO performance standard for Bridge Navigational Watch Alarm Systems –BNWAS (MSC 128(75)) IMO Guidelines on ergonomic criteria for bridge equipment and layout (MSC/Circ.982) Currently The International Maritime Organisation have IMO’s Code on alarm and indicators (Res. A.830(19) which states that an alarm condition is a condition requiring attention. It further describes certain elements of presentation and handling of alarms. The code is recommendatory. Then we have IMO’s performance standard for Bridge Navigational Watch Alarm Systems –BNWAS (MSC 128(75)). The purpose of a bridge navigational watch alarm system (BNWAS) is to monitor bridge activity and detect operator disability which could lead to marine accidents. The system monitors the awareness of the Officer of the Watch (OOW) and automatically alerts the Master or another qualified OOW if for any reason the OOW becomes incapable of performing the OOW's duties. This purpose is achieved by a series of indications and alarms to alert first the OOW and, if he is not responding, then to alert the Master or another qualified OOW. Additionally, the BNWAS may provide the OOW with a means of calling for immediate assistance if required. The BNWAS should be operational whenever the ship's heading or track control system is engaged, unless inhibited by the Master. IMO Guidelines on ergonomic criteria for bridge equipment and layout (MSC/Circ.982) recommends that: “A method of acknowledging all alarms, including the indication of the source of the alarm, should be provided at the navigating and manoeuvring workstation…” and that: “The number of alarms should be minimized.” Acknowledging an alarm is in this context defined as to silence audible alarms and set visual alarms to steady state. © Det Norske Veritas AS. All rights reserved 15 April 2017

Bridge Alarm Management Current IMO standards (cont.): IMO performance standards for the presentation of navigation-related information on shipborne navigational displays (Res. MSC.191(79)): Purpose – harmonizing presentation on navigation displays Specifies how alarms shall be presented on individual equipment Visual indication – colours to be used and flashing/ non-flashing Audible signals One of the newest standards is IMO’s Performance standards for the presentation of navigation-related information on shipborne navigational displays (Res. MSC.191(79)): This was adopted in December 2004 and is recommended for navigational bridge displays installed on or after 1. July 2008. The purpose of those standards are to harmonize the requirements for the presentation of navigation related information on the bridge of a ship to ensure that all navigational displays adopt a consistent human machine interface philosophy and implementation They specify the presentation of navigational information; including consistent use of navigational terms, abbreviations, colours and symbols, as well as other presentation characteristics, like flashing/non-flashing of symbols and audible signals. © Det Norske Veritas AS. All rights reserved 15 April 2017

Bridge Alarm Management DNV’s NAUT Notations – General: Objective – Reduce risk of failure in bridge operations by addressing the total bridge system Technical system, Human operator, Man and Machine Interface, The Procedures Verification of compliance Voluntary Based on studies of numerous navigation-related casualties. Centralized handling of certain important navigation-related alarms was required in NAUT rules already 20 years ago. Relevant notations: NAUT-AW, NAUT-OC and NAUT-OSV I will now move on to our own DNV rules within the subject of nautical safety. DNV’s Nautical Safety Notations have an objective of Reducing the risk of failure in bridge operations by addressing the total bridge system and the total bridge system is considered to comprise four essential parts: First we have The technical system, which is to deduce and present information as well as enable the proper setting of course and speed Then we have The human operator, who is to evaluate available information, decide on the actions to be taken and execute the decisions Then there is The Man and Machine Interface, which shall safeguard that the technical system is designed with due regard to human abilities And finally we include The Producers, which shall ensure that the total bridge system performs satisfactorily under different operational conditions The classification of bridge systems verifies compliance with the rules developed for the safe performance of bridge functions. The classification concept involves affirmation through voluntary class notations that the requirements of the rules and other standards regarding bridge design, instrumentation, working environment, operator quality and procedures have been fulfilled. They are including the compulsory statutory regulations. The requirements in DNV’s Nautical safety notations were initially developed based on studies of numerous navigation-related casualties and regarding the subject of Bridge Alarm Management, we are proud to say that Centralized handling of certain important navigation-related alarms was required in DNV Nautical Safety Rules already 20 years ago. However we are constantly trying to develop, and the relevant notations today are three sets of rules based on type of ship and expected sailing area. These rules are Nautical Safety for All Waters with the abbreviation NAUT-AW Nautical Safety for Ocean going vessels with the abbreviation NAUT-OC and finally Nautical Safety for Offshore Service Vessels with the abbreviation NAUT-OSV © Det Norske Veritas AS. All rights reserved 15 April 2017

Bridge Alarm Management NAUT Notations

Bridge Alarm Management DNV’s NAUT Notations – NAUT-AW and NAUT-OC: Central alarm panel Workstations for Traffic Surveillance/ Manoeuvring and Workstation for Navigation. May be integrated in Conning. Indicate the source (equipment) of the alarm. Cancellation Source (individual equipment) Central alarm panel – i.e. single operator action. Connected to all major navigation systems I will start with the NAUT- notations AW and OC as these are part of the same set of rules and have the same requirements regarding Bridge Alarm Management: As part of the Watch monitoring and alarm transfer system our requirement is that a central alarm panel, or other approved means for indication of alarms related to navigational functions, equipment and systems and that enables cancelling of the alarm sound shall be provided. The Central alarm panel is required in the Workstations for Traffic Surveillance/ Manoeuvring and the Workstation for Navigation. This system may be integrated in the Conning display in the centre of the forward workstations. The Central alarm panel shall indicate the source (equipment) of the alarm and it shall be possible to cancel the audible alarm from both the source for individual equipment and from the central alarm panel – which is single operator action. The central alarm panel shall be connected to all major navigation systems and shall as a minimum handle alarms from: Radar/ ARPA ECDIS GYRO system GPS system Speed log Echo sounder Bridge Navigational Watch Alarm System © Det Norske Veritas AS. All rights reserved 15 April 2017

Bridge Alarm Management WS for Traffic Surveillance/Manouvering and WS for Nav

Bridge Alarm Management DNV’s NAUT Notations – NAUT-OSV: Central alarm panel required for Workstations for Navigation, Navigation support and workstation for Ship Handling. May be integrated in Conning. Centralization of ALL audible alarm and warnings on the bridge. Equipment may be exempted: Only alarm when continuously operated Equipment or slave units is located at all workstations where central alarm panel is required. DNV’s Nautical Safety Notations for Offshore Survey Vessels is our newest standard within Nautical Safety and includes the newest ideas regarding Bridge Alarm Management. The Central alarm panel is required for Workstations for Navigation, Navigation support and workstation for Ship Handling. It May be integrated in the Conning Display. Centralization, with indication of source and possibility to cancel ALL audible alarms and warnings on the bridge. Some equipment may however be exempted: If the equipment only gives alarm when it is continuously operated. Typical examples are Dynamic Positioning consoles and Winch control systems Another typical example is special cases where the equipment or slave units for the equipment is located at all workstations where central alarm panel is required. (also used when equipment does not have the possibility to be connected to the central alarm panel) © Det Norske Veritas AS. All rights reserved 15 April 2017

Bridge Alarm Management Central alarm panel Individual equipment Digital alarm interfaces: BAM is heavily dependant on interfacing Lack of appropriate alarm interfacing Major obstacle Relay contacts most common interfacing Limited possibilities Insufficient for complex alarm interfacing. NAUT-OSV Digital alarm interfaces according to IEC 61162-1 (serial interfaces) Alarm (ALR) and Acknowledge (ACK Digital alarm interfaces: Interfacing, or more precisely the lack of appropriate alarm interfacing has been a major obstacle for implementing Bridge Alarm Management. Today, relay contacts are the most common interfacing available for communicating alarm information between equipment – but such interfacing gives limited possibilities and is insufficient for complex alarm interfacing. DNV’s Nautical safety rules for Offshore Service Vessels specify the use of digital alarm interfaces according to IEC 61162-1 (serial interfaces) using the standardized Alarm (ALR) and Acknowledge (ACK) sentences. This enables better and more advanced alarm management. © Det Norske Veritas AS. All rights reserved 15 April 2017

Bridge Alarm Management Digital alarm interfaces (cont.): The alarm and acknowledge sentences has existed for several years Few manufacturers are using them. Lack of detailed instructions on the exchange of sentences New IEC document IEC 80/520/INF (2008). Until recently – No requirement of use Now – Requirement from DNV (NAUT-OSV) and IMO (Radars, Galileo and lantern controllers) The alarm and acknowledge sentences has existed for several years but few manufacturers were using them. One of the reasons was that detailed instructions on the exchange of these sentences (or syntaxes) were missing. However, such detailed instructions are now available in the IEC document IEC 80/520/INF (2008). Another reason was that, until recently, there was no requirement to use these alarm and acknowledge sentences. This is not longer the case as both the DNV with our NAUT-OSV rules and IMO for radars, Galileo and lantern controllers are requiring the use of such alarm interfacing. © Det Norske Veritas AS. All rights reserved 15 April 2017

Bridge Alarm Management Future IMO Standards: Currently - IMO developing Bridge ALERT Management standard Latest draft - January 2009. Addresses all alerts presented on and transferred to the bridge = NAUT-OSV Two main parts: General part: CAM-HMI part: CAM-HMI GPS Engine bridge alarm unit GMDSS Now I will start with the third part of this presentation – Future IMO Standards Currently, IMO is developing performance standards for Bridge ALERT Management. The latest draft of this standard is dated January 2009. It addresses all alerts presented on and transferred to the bridge and this is as you previously has seen the same as in the DNV NAUT-OSV rules. The Draft IMO standard is divided into two main parts – One general part describing the general concept of the Bridge Alert Management and the presentation of alerts on the bridge equipment. One part including Central Alert Management and Human Machine Interfacing. The purpose of the Bridge Alert Management is to enhance the handling, distribution and presentation of alerts, applying SN.1/Circ.265 – Guidelines on the application of SOLAS regulation V/15 to INS, IBS and bridge design. The BAM harmonizes the priority, classification, handling, distribution and presentation of alerts, to enable the bridge team to devote full attention to the safe operation of the ship and to immediately identify any alert situation requiring action to maintain the safe operation of the ship © Det Norske Veritas AS. All rights reserved 15 April 2017

Bridge Alarm Management Future IMO Standards – General part: Alerts are classified into the following “priorities”: Emergency alarm Immediate danger to life or ship. Audible signal until acknowledged. Example: fire alarm. Alarm Immediate attention needed to avoid hazard and maintain safe state of the ship. Example: collision/ ARPA alarm. Warning Not immediately hazardous, but may become so. Single audible signal Example: equipment failure. Caution Informative. Condition or situation that the officer should be aware of. No audible signal Example: Sailing on un-official charts (Non ENC’s) in ECDIS In the General part we will find a classification of the different alerts based on the level of priority. Criteria for emergency alarms are alarms which indicate that immediate danger to human life or to the ship and its machinery exists and that immediate action must be taken Emergency alarms are specified in the code on Alerts and Indicators. They will give an audible signal until acknowledged and a typical example is fire alarm. Criteria for classification of alarms are conditions requiring immediate attention and action by the bridge team to avoid any kind of hazardous situation and to maintain the safe navigation of the ship. It could also be an escalation required as alarm from not acknowledged warning. Like emergency alarms this will also give an audible signal until acknowledged and a typical example is collision alarm from the ARPA Radar. Criteria for classification of warnings are conditions or situations which require immediate attention for precautionary reasons and are to make the bridge team aware of conditions which are not immediately hazardous, but may become so. They will automatically be escalated into an Alarm if not acknowledged within a specific time (max 5 min). In this case a single audible signal which is distinguishable from the alarm signal will be given and a typical example on a warning is equipment failure. Criteria for classification of cautions are awareness of a condition which still requires attention out of the ordinary consideration of the situation or of given information. No audible signal will be given and a typical example is when sailing on un-official charts in ECDIS © Det Norske Veritas AS. All rights reserved 15 April 2017

Bridge Alarm Management Future IMO Standards – General part (cont.): The draft standard further defines 3 alert categories: Category A Alerts where a graphical/ situation display is needed to evaluate the risk. Can be silenced on both Central Alert unit and equipment giving alert, but acknowledged only on equipment where the risk can be evaluated. Examples: collision and grounding alarms. Category B Alerts where additional information is not needed to evaluate the risk. Can be silenced and acknowledged on both Central Alert unit and on equipment giving alert. Examples: failure alarms. Category C Alerts that cannot be acknowledged on the bridge. Normally alerts transferred to the bridge e.g. from engine or cargo control rooms. Can be silenced on Central Alert unit, but cannot be acknowledged on bridge. Example: certain alerts from the engine. Category A Alerts where a graphical/ situation display is needed to evaluate the risk. Can be silenced on both Central Alert unit and equipment giving alert, but acknowledged only on equipment where the risk can be evaluated. Examples: collision and grounding alarms. Category B Alerts where additional information is not needed to evaluate the risk. Can be silenced and acknowledged on both Central Alert unit and on equipment giving alert. Examples: failure alarms. Category C Alerts that cannot be acknowledged on the bridge. Normally alerts transferred to the bridge e.g. from engine or cargo control rooms. Can be silenced on Central Alert unit, but cannot be acknowledged on bridge. Example: certain alerts from the engine. © Det Norske Veritas AS. All rights reserved 15 April 2017

Bridge Alarm Management Future IMO Standards – CAM-HMI: Can be integrated into other equipment All alert should be displayed on the CAM-HMI. Duplicates the audible signal Alert messages should be complete, including aids for decision making. The CAM-HMI may handle aggregated alerts In case of failure, a CAM-HMI back-up or individual alert presentation/ handling is required. Advanced functionality network communication needed? Future IMO Standards regarding the Central Alert Management – Human Machine Interface: It Can be integrated into other equipment – i.e. do not need to be a separate or additional device. All alert should be displayed on the CAM-HMI. Audible signals are to be duplicated – meaning an audible signal on both the individual equipment and on the CAM-HMI. Alert messages should be complete, including aids for decision making. The CAM-HMI may handle aggregated alerts and with aggregated they mean group alerts. In case of failure, a CAM-HMI back-up or individual alert presentation/ handling is required. The above mentioned points includes rather advanced functionality and it is possible that network communication is needed to make functional system? © Det Norske Veritas AS. All rights reserved 15 April 2017

Bridge Alarm Management Q & A

© Det Norske Veritas AS. All rights reserved 15 April 2017