Editing Dynamic positioning (section)

==Failure ==
Loss of position, also known as runoff, can be a threat to safe operations and the environment, including possible loss of life, injury, damage to property or the environment, and loss of reputation and time. Incident records indicate that even vessels with redundant dynamic positioning systems are subject to occasional loss of position, which can be due to human error, procedural failure, dynamic positioning system failures, or bad design.<ref name="Castro 2015" /> 
{{expand section|date=November 2018}}

Dynamic positioning failure results in an inability to maintain position or heading control, and can be a drift off caused by insufficient thrust, or a drive off caused by inappropriate thrust.<ref name="Castro 2015" />

*Risk of runoff
*Consequences – for drilling, diving and other operations. Injury to divers is possible, Damage to diving equipment including cutting of diver's umbilical has occurred.<ref name="CADC" />
*Mitigation – dealing with a runoff; training and competence; emergency drills.<ref name="Castro 2015" />

===Dynamic positioning alarm and runout response for bell divers===
*Code amber /Yellow alert – Divers return to the bell immediately, stow umbilicals, and stand by for further developments and instructions.<ref name="IMCA D022 2016 11.8" />
*Code red – Divers return to the bell without delaying to retrieve tools and prepare for immediate ascent. The bell can not be recovered until the umbilicals have been safely stowed.<ref name="IMCA D022 2016 11.8" />
The basic response with a closed bell is similar to wet bell, but after stowing umbilicals, the hatch will be sealed so that internal pressure can be retained. The bell will be recovered as rapidly as possible in a red alert, and may be recovered if there is doubt that a yellow alert will be downgraded.<ref name="IMCA D022 2016 13.10" />

===Redundancy===
[[Redundancy (engineering)|Redundancy]] is the ability to withstand, while on DP mode, the loss of equipment which is online, without losing position or heading. A single failure can be, amongst others:
*Thruster failure
*Generator (power supply) failure
*[[Power bus]] failure (when generators are combined on one power bus)
*Control computer failure
*Position reference system failure
*Reference system failure{{clarify|date=March 2022}}

For certain operations redundancy is not required. For instance, if a survey ship loses its DP capability, there is normally no risk of damage or injuries. These operations will normally be done in Class 1.

For other operations, such as diving and heavy lifting, there is a risk of damage or injuries. Depending on the risk, the operation is done in Class 2 or 3. This means at least three Position reference systems should be selected. This allows the principle of voting logic, so the failing PRS can be found. For this reason, there are also three DP control computers, three gyrocompasses, three MRU's and three wind sensors on Class 3 ships. If a single fault occurs that jeopardizes the redundancy, i.e., failing of a thruster, generator or a PRS, and this cannot be resolved immediately, the operation should be abandoned as quickly as possible.

To have sufficient redundancy, enough generators and thrusters should be on-line so the failure of one does not result in a loss of position. This is left to the judgment of the DP operator. For Class 2 and Class 3 a [[Consequence Analysis]] should be incorporated in the system to assist the DPO in this process.

The redundancy of a DP ship should be judged by a [[Failure mode and effects analysis|failure mode and effects analysis (FMEA)]] study and proved by FMEA trials.<ref name="IMCA M166" /> Besides that, annual trials are done and normally DP function tests are completed prior to each project.