Question 1

A DP2 vessel has two independent DGNSS receivers, two gyrocompasses, and two wind sensors — all fitted as a redundant pair to meet DP2 requirements. During a post-incident investigation following a DP position excursion, it is found that both DGNSS receivers were wired through the same signal junction box, which failed.

What does this incident illustrate about common cause failure (CCF)?

Accepted Answer

Having two of each component is insufficient if both share a common dependency — a single point of failure (shared cable route, shared power supply, shared junction box) can simultaneously defeat both redundant units, removing the independence that DP2 class requires Common Cause Failure is one of the most important — and most frequently violated — concepts in DP system design. Having two DGNSS receivers, two gyros, or two generators provides no redundancy if both share a common failure path: the same cable trunk, the same breaker, the same UPS, the same cooling water header. IMCA M103 and the FMEA (Failure Mode and Effects Analysis) process exist to systematically identify and eliminate CCF paths. This incident is a classic example: two reference systems that appeared independent were both disabled by a single junction box failure — exactly what DP2 is designed to prevent.

Question 2

A DP Class 2 vessel is operating on a subsea construction project. The chief engineer asks whether the vessel can continue operating in the event of a single active component failure.

What does DP Class 2 guarantee in this situation?

Accepted Answer

The vessel can maintain position after a single failure of any active component or system, provided redundant systems are in place and operational IMO MSC/Circ.645 and IMCA M103 define DP Class 2 as: no loss of position following any single failure of an active component or system. Redundancy in active components is required — thrusters, generators, UPS, switchboards. Fire/flood protection requires DP Class 3. Static components (cables, pipes) are not covered by the single failure criterion.

Question 3

A semi-submersible drilling rig is classed DP Class 3 and operates in deep water on a well with well control implications. A trainee DPO asks what the key distinction is between DP2 and DP3.

Which statement correctly describes the DP Class 3 requirement?

Accepted Answer

DP3 requires redundant systems to be located in separate watertight compartments with physical separation, such that a single fire or flood cannot affect both systems simultaneously DP Class 3 extends the single failure criterion to include fire and flooding in any one compartment. This demands physical separation — redundant power systems, DP control systems, and thrusters must be arranged in separate fire and watertight subdivisions. A cable fire that destroys one entire DP system must leave the other fully capable of maintaining position. This is the "worst credible failure" standard.