Dynamic Positioning: How DP Holds a Ship on Station

A dynamically positioned vessel holds itself over a point on the seabed with no anchor down, by spinning up its own thrusters faster than the wind and current can push it off. A drillship working in 2,000 metres of water cannot anchor; a dive support vessel holding 5 metres off a platform leg dare not; a pipelay ship laying to a seabed touchdown tolerance has to sit still while the sea moves under it. Dynamic positioning (DP) is the control system that makes that possible, and it is the defining technology of the offshore industry. This article is the hub for the DP cluster: it explains what DP is, walks the control loop from sensor to thruster, sets out the IMO equipment classes and the redundancy basis behind them, and routes down to the cluster’s deep-dive articles and calculators. The DP station-keeping footprint calculator sizes the excursion radius, and the DP thrust capability curve calculator builds the capability plot that decides whether the ship can hold the environment at all.

The logic of DP is a single feedback loop run very fast. The system measures where the ship is and where it is heading, compares that to where it should be, works out the force pushing it off station, and commands the thrusters to push back with an equal and opposite force. Hold that loop and the rest is detail: the position references feed the “where am I” half, the gyros and motion sensors feed the “which way am I pointing and moving” half, the controller and the mathematical model in the middle decide the demand, and the thrusters and the power plant deliver it. The cluster splits the machine into its parts: marine dynamic positioning systems carries the full system architecture and the control theory, bow thruster and stern thruster covers the lateral-thrust units that do most of the station-keeping work, and the calculators run the failure, footprint, thrust, and watch-level arithmetic.

What dynamic positioning is, and what it replaced

DP is automatic station-keeping by thrust. IMO MSC.1/Circ.1580 defines a dynamic positioning system as the complete installation needed to keep a vessel in position and heading, or on a predetermined track, by means of thruster force, and a DP vessel as a unit that maintains its position exclusively by that means. The word “exclusively” matters: a ship using a single tug to hold against a current is not on DP, & a ship moored with one line ashore and trimming with a thruster is not on DP. The system has to do the whole station-keeping job by thrust under automatic control.

What DP replaced was the mooring spread. Before DP, a vessel that needed to stay over a fixed point ran out anchors, often eight or more, on a pattern that could take a day to lay and a day to recover, and the spread fixed the vessel’s reach to the length of its chains. DP removed the chains. A DP drillship can move off a well, sail to the next, and be back on station in hours rather than days, and it can work in water far deeper than any mooring can reach. The trade-off is fuel and complexity: a moored vessel burns nothing to stay put, while a DP vessel runs its diesel generators continuously to feed the thrusters, and it carries a control and power system whose failure can drive it off position in seconds. The whole DP class regime exists to manage that failure risk.

The technology dates to the 1960s. The drillship Eureka, fitted in 1961, is generally recorded as the first vessel to hold position by an automatic thruster control system rather than moorings, and the Glomar Challenger used DP to hold over deep-ocean drill sites through the Deep Sea Drilling Project from 1968. Early systems used a single analog controller; the modern triple-redundant computer system, the wide spread of position references, and the formal equipment classes all came later, driven by the move into deeper water and the safety lessons of working alongside platforms and divers.

The DP control loop

The control loop is the heart of the system, and every component on a DP vessel exists to feed it or to act on its output. The loop runs continuously, several times a second, and it has four stages: measure the vessel’s state, estimate the forces acting on it, decide the thrust demand, and allocate that demand to the thrusters.

Position reference systems

The “where am I” measurement comes from position reference systems (PRS), and a DP vessel runs several at once so the loss of one does not blind it. No single reference is trusted on its own; the DP computer takes the accepted references, weights them, blends them into one position estimate, and votes out a reference that drifts away from the others. Four families cover most installations.

Differential GNSS (DGPS, or DGNSS where more than one satellite constellation is used) gives an absolute fix referenced to a geodetic datum, corrected by a differential signal from a shore or satellite reference station to bring the accuracy down to a metre or better. It is the workhorse for open-water DP because it works anywhere with sky view, but it shares a weakness: a satellite outage, an ionospheric scintillation event, or signal blockage under a large structure can degrade every GNSS reference at once, which is a common-mode failure the FMEA has to address by keeping at least one non-satellite reference running.

Hydroacoustic position reference (HPR) systems range on a transponder dropped on the seabed. A transducer under the hull sends an acoustic pulse, the seabed transponder replies, and the system computes the relative position from the travel time and the bearing of the reply. HPR is independent of the satellites and is the standard relative reference for drilling and subsea work directly over a seabed target. A taut-wire measures the angle and the paid-out length of a weighted wire run to the seabed, giving a simple, reliable relative position in shallow and moderate water; it falls out of use in deep water and high current, where the wire’s catenary makes the geometry unreliable. Laser and microwave systems (the Fanbeam and CyScan laser units, the RadaScan microwave unit) range on a reflective prism or an active responder mounted on a nearby fixed structure, and they are the close-quarters reference for working alongside a platform or another vessel.

Sensors: heading and motion

The “which way am I pointing and moving” half of the measurement comes from the heading and motion sensors. At least one gyrocompass, usually three on a DP2 or DP3 vessel, gives the heading the controller holds the bow on. A motion reference unit (MRU), also called a vertical reference unit, measures the vessel’s roll, pitch, and heave, which the system uses to correct the position references for the lever-arm effect of the ship’s motion: a GNSS antenna 30 metres up a mast swings several metres as the ship rolls, and the MRU lets the computer refer the fix back to the working point on the hull. Wind sensors measure the wind speed and direction at the masthead, and this is the one major force the controller can measure directly rather than infer.

The wind feed is the reason DP holds so well against a steady blow. The controller reads the wind, looks up the vessel’s known wind-force coefficients for that relative direction, and commands a feed-forward thrust to cancel the wind before the ship has even started to move. The current and the wave drift are different: there is no practical sensor for the force a current puts on a hull, so the controller cannot measure it. It infers it instead. The mathematical model in the middle of the loop runs a Kalman filter that compares where the model says the ship should have gone, given the known wind and commanded thrust, with where the position references say it actually went, and attributes the difference to an unmeasured slowly-varying force: the current and the mean wave drift. That estimated force is then fed forward as thrust on the next cycle. The same model carries the ship through a short reference dropout by dead-reckoning on the last good estimate, which is why a brief GNSS glitch does not throw a well-set-up vessel off station.

The filter also has to ignore the wrong motion. Wave-frequency motion (the ship surging and swaying back and forth under each passing wave) averages to nothing over a wave period, so chasing it with thrust would burn fuel and wear the thrusters without moving the mean position at all. The DP model splits the measured motion into the wave-frequency part, which it filters out and does not act on, and the low-frequency part, which is the real drift it corrects. Getting that split right is the difference between a vessel that sits quietly on station and one that pumps its thrusters against every wave; a poorly tuned filter that lets wave-frequency motion through is a classic cause of excessive thruster wear and a noisy footprint.

Reference voting and the weighting

The blending of the position references is not a simple average, because an average is only as good as its worst member. The DP system runs each accepted reference through a test against the others: a reference whose fix jumps away from the group, or whose variance grows, is given less weight or rejected outright, so one drifting DGNSS receiver or a fouled HPR transponder cannot drag the blended position with it. The operator sets which references are enabled and can force one in or out, but the routine voting is automatic. This is why a DP vessel is required to run more than one reference of more than one type: two DGNSS units share a common-mode satellite failure, so the rules and the FMEA push for a mix, a DGNSS plus an HPR plus a laser on a structure, so that no single physical effect can take all the references down at once. The loss of position references, not the loss of thrust, is a leading category in the station-keeping incident record, which is why the reference spread is treated as seriously as the power redundancy.

Controller and thrust allocation

With the state measured and the environmental force estimated, the controller computes the thrust the vessel needs in three axes: surge (fore and aft), sway (athwartships), and yaw (turning). It uses a proportional-integral-derivative (PID) control law, tuned per vessel, that drives the position and heading error to zero while the feed-forward terms handle the wind and the estimated current. The output is a single demand: so much force forward, so much sideways, so much turning moment.

That three-axis demand then has to be split among the actual thrusters, which is the thrust allocation problem. A DP vessel carries more thrusters than the three degrees of freedom it controls, so the allocation is over-determined and the system solves for the combination that meets the demand at the least power, while respecting each thruster’s limits and avoiding wasteful configurations where two units fight each other. When one thruster fails, the allocation re-solves on the remaining units, which is how a DP2 vessel keeps station through a single thruster loss without the operator touching anything. The DP single-fault post-capability calculator works the thrust left after that worst-case loss.

Thrusters and the power plant

The thrust that holds the ship comes from a spread of propulsion units, and the layout is chosen to give force in any direction. The lateral thrust at the bow and stern does most of the station-keeping work, because holding heading and resisting a beam wind or current are sideways problems. A bow thruster and the stern thruster are tunnel units set athwartships through the hull, giving pure side force. Azimuth thrusters, which rotate through 360 degrees, give force in any direction and double as the main propulsion; a typical DP drillship or construction vessel carries six to eight azimuth thrusters and no fixed propeller at all. Larger vessels mix tunnel thrusters forward with azimuth or retractable units to cover both fine side control and main thrust.

The power plant feeds all of it, and on most DP vessels it is diesel-electric. Several diesel generators feed a common high-voltage switchboard, and the thrusters draw from that bus through variable-speed drives, so any generator can power any thruster. This is the source of DP’s redundancy and its single biggest failure mode at once. The redundancy comes from splitting the plant into independent groups: a DP2 vessel runs its generators and switchboards in at least two separated sections connected by a bus-tie breaker, so the loss of one section leaves the other running its share of the thrusters. The failure mode is the blackout: a fault that propagates across the whole power system through a closed bus-tie, taking every thruster down at once. Much of DP power-system design, and a large share of the incidents IMCA records, turns on whether the bus-tie is open or closed and on the protection that has to trip a faulted section before it pulls the healthy one down with it. Running with the bus-tie closed gives more power for the work but exposes the plant to a single common fault; running split sacrifices peak power for fault tolerance, and the choice is part of the operational planning for the task.

The IMO equipment classes and the redundancy basis

The DP equipment class is the formal statement of how much redundancy a vessel carries and what a single failure does to its station-keeping. IMO set the classes in MSC/Circ.645 in 1994 and amended them in MSC.1/Circ.1580, issued 16 June 2017. The 2017 guidelines are recommended for vessels and units constructed on or after 9 June 2017; for vessels built between 1 July 1994 and that date the 1994 guidelines continue to apply, though IMO recommends that the operational and annual-trial sections of the new guidelines be applied to all vessels. The classification societies and IMCA M103 carry the same three-class structure into the class notations and the design guidance.

The three classes are defined by their tolerance to a single failure. Equipment class 1 carries no redundancy requirement, so a single fault in the DP system can cause a loss of position; it is acceptable where the consequence of drifting off is low, such as an open-water survey. Equipment class 2 requires that a loss of position does not occur from a single fault in any active component or system: a generator, a thruster, a switchboard, a control computer, or a remote-controlled valve. To meet that, the vessel needs redundancy of all active components, so the active part that fails has a standby that takes over. Equipment class 3 keeps the class 2 single-fault rule and adds a physical-separation rule: a loss of position must not occur from any single failure including a fire in any one A-60 fire subdivision or the flooding of any one watertight compartment, so the redundant groups sit in separate compartments behind fire and watertight boundaries. The DP Class 2 failure-envelope calculator works the envelope a DP2 vessel must hold after its worst-case failure.

The class on its own does not say a vessel is safe for a task; it says what the vessel can survive. The bridge between the class and the job is the worst-case failure design intent (WCFDI): the single failure with the largest effect on station-keeping, identified in the FMEA, which the vessel must survive with enough thrust and power left to hold the environment for the task. A DP2 vessel whose worst-case failure is the loss of one switchboard section must keep station on the thrusters fed by the other section, and the capability plot for that post-failure configuration has to enclose the environment the vessel works in. That is the calculation that ties the redundancy basis to the actual job, and it is why two DP2 vessels of the same class can have very different real capability.

The FMEA and the worst-case failure

A failure modes and effects analysis (FMEA) is the document that proves a DP2 or DP3 vessel meets its class, and it is mandatory for those classes. The FMEA works methodically through every credible single failure of the power, propulsion, control, and position-reference systems, states the effect of each on the vessel’s ability to hold position, and shows that no single one of them causes a loss of position. It is where the common-mode failures get caught: the shared cooling-water system that would take two generators down together, the single control-network switch that both DP computers depend on, the closed bus-tie that lets a fault on one section reach the other. A failure that the analysis finds will defeat the redundancy is a finding that must be designed out, not operated around.

The FMEA defines the WCFDI and feeds the post-failure capability the vessel is allowed to claim. It is not a one-time paper exercise: MSC.1/Circ.1580 and the class rules call for an annual DP FMEA proving trial, a set of live tests on the vessel that inject a sample of the analysed failures and confirm the system responds as the FMEA says it should. The trial catches the drift between the design and the as-maintained ship: a protection setting changed during a repair, a standby pump that no longer auto-starts, a control change that introduced a new common-mode path. Skipping or short-cutting the proving trial is one of the recurring root causes in the station-keeping incident record.

Online consequence analysis

The FMEA proves the vessel meets its class in the design environment, but the environment changes through a job, so a DP2 or DP3 system runs a consequence analysis continuously while it works. The consequence analysis is a real-time calculation, required by MSC.1/Circ.1580 for class 2 and 3, that checks at intervals whether the thrust and power remaining after the worst-case failure would still hold the present environment. It reads the current wind, the estimated current, and the live thruster and generator status, simulates the worst-case failure, and warns the operator before the present conditions exceed the post-failure capability rather than after a failure has already pushed the vessel off. Without it, the crew would only learn that the environment had outgrown the redundancy at the moment a failure exposed the gap, which on a drilling or diving job is too late. The consequence analysis is the live counterpart of the post-failure capability plot: the plot is the design-time envelope, the consequence alarm is the same envelope checked against the real conditions on the watch.

Class notations and the societies

The IMO equipment class is the common language, but a vessel carries a classification-society notation that maps to it with each society’s own rule detail. DNV uses the DYNPOS and DPS notation families, with DNV-ST-0111 setting the standard for assessing station-keeping capability and the post-failure cases a notation must demonstrate. The American Bureau of Shipping uses DPS marks, Lloyd’s Register uses DP(AA), DP(AM), and DP(AAA) marks, and Bureau Veritas and the other members of the International Association of Classification Societies carry equivalent schemes. The marks line up with IMO classes 1, 2, and 3, but the rule text behind each, the required redundancy, the trials, and the documentation, is the society’s own, so the controlling requirement for a given ship is the notation on its class certificate read with that society’s rules, not the IMO class label in isolation.

The IMCA station-keeping incident reporting scheme

The DP industry runs a structured incident-reporting scheme through the International Marine Contractors Association (IMCA), and it is the closest thing the field has to an air-accident database. Operators report DP station-keeping events to IMCA on a standard form, IMCA collates them, strips the vessel and company identity, and publishes an annual station-keeping review with the events classified and the causes tabulated, so the whole industry learns from each other’s near-misses without naming the ship. In 2024 IMCA received 217 event forms from 56 companies, which gives a sense of the reporting base the annual review draws on.

The scheme classifies events into three grades by severity. A DP incident is the most serious: a failure, an environmental cause, or a human factor that has resulted in a loss of DP capability, meaning the vessel actually lost position or had to stop the task. A DP undesired event is a step below: a cause that resulted in a loss of redundancy or otherwise compromised the DP capability, without yet losing position, so the next failure could have caused a loss. A DP observation is an event that did not lose redundancy or compromise the operation but is still worth sharing for the lesson in it. The gradation matters because the undesired events are the leading indicator: a vessel that keeps losing redundancy and recovering is one failure away from an incident, and the value of the scheme is that it surfaces those near-misses across the fleet before they turn into a position loss alongside a platform or over divers.

DP operator competence

The DP system is automatic, but a person is always responsible for it, and the standard of that person is set by a formal certification scheme. A dynamic positioning operator (DPO) qualifies through a structured path: a recorded induction and simulator training course, logged sea time as a trainee on a working DP vessel, an assessed competence step on board, and an advanced course, building from trainee through DPO to senior DPO. IMCA M117 defines the training and certification requirements for DP personnel that the industry and the flag states accept, and IMO MSC/Circ.738 recognises those definitions; the Nautical Institute administers the most widely held DPO certification against that framework.

Certification alone is not the whole competence picture. A DPO joining a vessel does a documented familiarisation on that specific ship, because the DP control system, the thruster layout, the power-plant configuration, and above all the failure modes differ from vessel to vessel, and the right response to a fault on one ship can be the wrong one on another. The watchkeeping itself is governed by an activity-specific operating guideline (ASOG), and the operator manages the watch against a traffic-light status that the cluster’s three watch-level calculators model: a green status for normal operations when everything is within limits, a yellow advisory status when a degradation or a rising environment means the task should be made safe, and a red emergency status when a loss has occurred and the vessel must move off or terminate the task. The DP watch level 1 green, DP watch level 2 yellow, and DP watch level 3 red calculators frame the limits at each status. IMCA M220 sets out the activity-planning guidance the ASOG is built from.

The capability plot and the footprint

Two diagrams tell an operator whether a DP vessel can do a job and how well it is doing it: the capability plot before the job, and the footprint during it. They measure opposite things and it is worth keeping them apart.

A DP capability plot is a polar diagram of the maximum steady environment the vessel can hold station against, plotted for every heading relative to that environment. It combines a wind speed, an associated current, and a sea state into a single environmental severity, then asks, for each relative heading, how strong an environment the available thrust can balance. The result is a closed curve: inside it the vessel holds, outside it the environment overpowers the thrust and the vessel is pushed off. The plot is drawn for at least two cases. The intact case uses all thrusters and shows the vessel’s full capability. The post-failure case uses only the thrusters left after the worst-case failure from the FMEA, and it is the one that decides whether the vessel is allowed to start the task, because a DP2 or DP3 vessel must be able to hold the working environment after its worst-case failure, not only with everything running. The DP thrust capability curve calculator builds the curve from the thruster forces and the hull’s environmental coefficients.

The footprint is the in-service measurement. It is the cloud of actual positions the vessel occupies around its set point over a period of operation, and its radius shows how tightly the system is holding station in the real conditions on the day. A small, tight footprint says the system has thrust and reference accuracy to spare; a footprint that grows toward the limits of the watch circle says the environment is rising or the system is degraded and the operator should consider the yellow status. The footprint radius is a direct input to deciding the working radius and the safe stand-off from a structure.

The footprint is not a fixed number for a vessel; it scales with the environment and the configuration. Add current, lose a thruster, or degrade a position reference and the same vessel sits in a wider footprint, which is why the operator watches it continuously rather than reading it once. The DP station-keeping footprint calculator sizes the radius from the environmental and system inputs, and reading it against the capability plot is the practical check that the vessel is working inside its margin.

DP operations

DP earns its cost in the operations that cannot be done any other way, and the equipment class follows from the consequence of a position loss in each.

Offshore drilling is the deep-water case. A DP drillship or semi-submersible holds over the wellhead while a riser runs from the vessel to the seabed blowout preventer, and a position loss puts a bending load on that riser and, in the worst case, risks a well-control event, so deepwater drilling units are built to DP3 or a well-found DP2 with a hard focus on the worst-case failure. The drive-off (thrust commanding the vessel away from the well) and the drift-off (loss of thrust letting the environment push it off) are the two failure scenarios the well’s emergency-disconnect sequence is designed around, and the watch-circle alarms are set so the crew can disconnect the riser before the vessel reaches the point of damage.

Diving support is the case where the consequence is immediate and human. A dive support vessel holds station while saturation divers work on the seabed connected to the ship by an umbilical carrying their breathing gas, heat, and communications, and a position loss can part the umbilical or drag the divers, so DSVs work to DP3 or a stringently assured DP2 and run the tightest watch discipline in the industry. The watch circle on a diving job is set so that the loss alarm sounds and the divers are recalled to the bell well before any excursion could put tension on the umbilical, and the bus-tie is normally run open so that no single power fault can black out the whole thruster spread while people are in the water.

Offshore construction and installation, the pipelay, cable-lay, and heavy-lift work covered in subsea, pipelay and offshore installation, uses DP to hold the lay corridor or the lift position to a seabed tolerance while the spread works. A pipelay vessel does not hold a single point: it tracks slowly along the route at the lay speed, and the DP system follows a programmed track while the pipe tension and the touchdown geometry stay inside their limits, so the controller is managing a moving set point rather than a fixed one. A heavy-lift crane vessel during a lift is the opposite: it holds dead still while the load swings, and the DP has to reject the reaction the crane feeds back into the hull as the load comes off the barge or the seabed.

Offshore support, the platform supply and anchor-handling work covered in offshore support vessels and marine operations, uses DP to work a vessel inside the 500-metre safety zone of a fixed installation, where the vessel cannot moor and a position loss risks a collision with the platform. A PSV working a platform crane sits on DP a few metres off the structure while cargo lifts across, and a drive-off or drift-off there turns the vessel into a several-thousand-tonne projectile aimed at a manned installation, which is why the safety zone entry runs under a documented DP approach, a checked reference set, and a defined abort point. The shuttle tanker loading from an offshore terminal holds station off a floating production unit or a single-point mooring on DP while crude transfers through a floating hose, and the cruise and specialised tonnage in offshore, cruise and specialised operations round out the DP fleet. In every case the rule is the same: the higher the consequence of drifting off, the higher the equipment class and the tighter the operational margin the vessel works to.

Limitations

This article describes the DP system and the regulatory framework around it; it is not a substitute for the vessel’s own DP FMEA, its operations manual, or the IMO and IMCA documents themselves. The equipment-class definitions stated here follow MSC.1/Circ.1580 and the original MSC/Circ.645, but a vessel’s actual capability is set by its specific FMEA and its worst-case failure, not by the class label alone, and two vessels of the same class can hold very different environments after their worst-case failures. The class notation a society assigns (the DP1, DP2, DP3 marks, or society-specific notations such as DYNPOS or DPS marks) maps to the IMO classes but carries each society’s own detailed rule requirements, which the operator should read against the actual notation on the ship’s class certificate.

The capability plots and footprint figures any tool produces are model estimates built on assumed environmental coefficients, thruster forces, and interaction losses; the controlling figures for a real operation are the vessel’s own validated capability curves, its trials data, and the ASOG agreed for the specific task. Thruster-thruster and thruster-hull interaction, current shadowing, and dynamic wave loading can reduce real capability well below an idealised plot, and the margins built into the ASOG exist for exactly that reason. The watch-level limits modelled in the cluster’s calculators are illustrative of the green, advisory, and emergency logic; the actual limits are set per vessel and per task by the people running the operation. None of the linked calculators replaces the vessel’s DP documentation, a class survey, or the judgment of a qualified DPO on watch.

See also

• Marine dynamic positioning systems: the full DP system architecture, the control theory, and the redundancy design.
• Bow thruster and stern thruster: the lateral-thrust units that carry most of the station-keeping load.
• Offshore, cruise and specialised operations: the vessel families that use DP to work on station.
• Subsea, pipelay and offshore installation: the pipelay, cable-lay, and heavy-lift work DP supports.
• Offshore support vessels and marine operations: the PSV and AHTS work inside the platform safety zone.
• DP Class 2 failure-envelope calculator: the environment a DP2 vessel must hold after its worst-case failure.
• DP single-fault post-capability calculator: the thrust and power left after the worst-case single failure.
• DP station-keeping footprint calculator: the excursion radius around the set point.
• DP thrust capability curve calculator: the polar capability plot from thruster force and hull coefficients.
• DP watch level 1 green calculator: the normal-operations status limits.
• DP watch level 2 yellow calculator: the advisory-status limits when capability degrades.
• DP watch level 3 red calculator: the emergency-status limits on a loss of position.