What the DPO wishes the engineer knew

Foreword

In October 2026, I had the privilege of representing Maersk Training Brazil as a speaker at the annual Global Dynamic Positioning & Offshore Energy Conference hosted by The Nautical Institute, held at SUNY Maritime College in New York.

My presentation, “What the DPO Wants the Engineer to Know”, focused on a fundamental aspect of Dynamic Positioning (DP) safety: the importance of communication, shared situational awareness, and operational integration between the Bridge and the Engine Room.

As a Chief Engineer and maritime instructor, I emphasized that safe DP operations depend on much more than maintaining a vessel's position. Engineers must understand how machinery conditions, power generation, and propulsion availability directly affect DP capability, while DPOs must recognize the operational limitations of these systems.

I also addressed the importance of Critical Activity Mode (CAM), Task Appropriate Mode (TAM), and the vessel's Failure Modes and Effects Analysis (FMEA) in supporting risk-based decisions and ensuring that operational configurations remain aligned with the vessel's technical capabilities.

One of my key messages was that effective communication and mutual understanding between departments are just as important as technical competence.

Redundancy is what remains after a failure

A common belief in the engine room is simple: We have two, so we have redundancy. In DP terms, that is not enough.

Two generators on the same switchboard are not redundant if one is out for maintenance. A standby thruster that is switched off cannot respond to an immediate failure. A piece of equipment can run perfectly, but if it is not available as an immediate, automatic backup, the redundancy is already lost.

In a DP vessel, redundancy exists to prevent loss of position after a single worst-case failure (WCF). What matters is the capability left once that failure has happened. So the question that engineers must keep in mind is:

“If we lose this equipment, will the vessel remain in position?”

If the answer is no, the operation stops.

The DP system recalculates the worst case every minute

This is the job of consequence analysis. It runs in the background of the DP system and repeats a cycle every minute. It scans the current wind, waves, and current, along with the active switchboard configuration. It then simulates the loss of the equipment defined by the WCF, such as a switchboard. Finally, it calculates whether the thrusters that remain online can still produce enough force to hold position.

If they can, the system stays on standby. If they cannot, the DPO receives a consequence analysis alarm.

Every time that the engine room isolates equipment, takes a generator offline, or puts a thruster into maintenance, that calculation changes. So do the DPO’s operating limits. An unavailable item in the engine room can change everything on the bridge.

A short maintenance task can stop an operation

An example that can happen in real life is a filter change: in the engine room, it may take ten minutes. But... what happens on the bridge during those ten minutes?

The DPO loses that thruster from the WCF calculation. The consequence analysis status changes straight away. The vessel drops out of its Critical Activity Mode. Any subsea or drilling operation underway must be aborted.

The capability plot shows why. With all thrusters and generators working, the vessel has its full envelope. Lose one thruster and that envelope shrinks. After the worst-case failure, it shrinks again. One generator out of service means a lower wind limit. One thruster in maintenance can mean no operation at all.

The same applies to changes in the power plant. To an engineer, a bus transfer can be routine electrical work. To a DPO a few metres from a platform, it is a critical manoeuvre. Not every small issue for the engine room is small for the bridge.

So that is why it is important to engineers to understand the operation. They can ask themselves:

“If I remove this machinery for maintenance, could I change the station keeping capability of this vessel?”

When in doubt, call the bridge.

Engineering limits become operational decisions

There is a difference between what the vessel can do and what it is permitted to do. Technical capacity sits in the machinery. Operational acceptability sits in the plans and procedures that govern each activity.

The path from one to the other follows a clear sequence. It starts with the vessel’s capability and its worst-case failure. It moves to the choice between Critical Activity Mode (CAM) and Task Appropriate Mode (TAM). It is then set out in the Activity Specific Operating Guidelines (ASOG). The result is a safe DP operation built on engineering data.

CAM is the most robust configuration. It is used when loss of position would have serious consequences, for example working 10 metres from a platform. Bus ties are open, generators are distributed, and all thrusters are ready. The vessel must hold position even after its worst-case failure.

TAM is risk-based. It suits activities where a loss of position after a failure would not be catastrophic, such as standby in open water. Some thrusters can be out for maintenance and fewer generators run to save fuel.

This is the core tension in DP operations. On one side is surviving the worst-case failure, with maximum redundancy and fault tolerance. On the other is managing fuel, emissions, and equipment wear. Choosing between CAM and TAM needs a risk assessment for each activity, and engineers hold much of the information that assessment depends on.

The ASOG then defines the limits for a specific activity at a specific location. It sets the maximum wind and current, the DP equipment that must be online, the contingency procedures, and the points at which to abort. It is reviewed and updated as conditions change.

In summary: the vessel’s Failure Modes and Effects Analysis (FMEA) sets the theoretical engineering limit. The ASOG and CAM set the human operational limits and bridge protocols. Consequence analysis constantly compares that theory against the vessel’s current reality.

Redundancy is not a substitute for communication

Most DP incidents I discuss with students do not begin with a dramatic failure. They begin with something small that nobody shared.

For example: a minor anomaly appears in the engine control room, such as a drop in cooling water pressure. It goes unreported and becomes a hidden failure. Then an external trigger arrives, such as a rise in environmental load. Now a single failure combines with the hidden one, and the result can be a total blackout or loss of position.

The goal is zero hidden failures. In my experience, that comes from four habits shared by both teams. Anticipate, by using the FMEA and CAM to know the limits before operations start. Communicate, by using the ASOG advisory levels to share deviations early. Monitor, by tracking parameters against baselines rather than only alarm limits. Align, by running joint checklists and pre-task meetings so the bridge and engine room start each operation with the same picture.

The bridge and the engine room are one team

Technical competence matters. In DP operations, so does understanding what your colleagues on the other deck need from you. Engineers need to see how machinery condition, power generation, and propulsion availability shape DP capability. DPOs need to recognise the real limits of those systems.

When it comes to DP safety, the bridge and the engine room are not two separate teams. They work toward the same goal.

Sources consulted:

1. IMO MSC.1/Circ.1580 – Guidelines for vessels and units with dynamic positioning (DP) systems — available through the IMCA technical library.

2. MTS DP Vessel Design Philosophy Guidelines

3. MTS DP Operations Guidance – Part 1