Most dynamic positioning (DP) control systems require three but some don’t.This is why many classification society (class) rules only required two.Let’s look at why most systems need three and how three is sometimes one.
Let’s start with the heart of the problem.If you have two watches, or a watch and a cell phone, and the battery runs out on one, you still know the time.But if they disagree then you need to check another reference to see which one is right.Depending on the references and the need for accuracy, this can be easy or difficult.If you went to the beach at lunch and, when you come out of the water, one says 1PM and the other says midnight then it is an easy decision.However, when your microwave and oven clocks disagree by 20 minutes after a power outage, and you can’t afford to be late, it becomes harder and you need to check your phone or watch.
So, the basic problem is that two is good enough if one stops working but three are needed if accuracy is needed?Partially.Most vessels used to have two gyrocompasses (gyros) and two motion reference units (MRUs) for years.Were they dumber than we are?Not really, but technology has changed and there was commercial pressure causing compromises.
As an example of the first, MRUs were not strictly necessary for some vessels.The variation in DGPS fix caused by pitch and roll could be averaged out but this could not be done for slower hydro-acoustic position references (HPRs).For years, the MRUs were just for the operators and the HPRs, until a control system philosophy change started using them to actively correct all position references.It was claimed that this gave greater precision, which was true, but some noticed that this change happened to coincide with the DP control system company now owning an MRU manufacturer.This change in control philosophy caused commercial and technical problems.It made MRU inaccuracies important as it now automatically affected all position references, not just the HPR, and customers did not like paying for a third MRU.
This led to an example of the second problem.Some potential customers voted with their feet and selected lower cost DP systems that only needed two MRUs.To compete, or perhaps due to a misunderstanding of the technical change, many of the salesmen of the active MRU company kept selling DP control system packages with only two MRUs.This created further confusion, but with enough testing and incidents in the field, operators, consultant, and class noticed the problem.Worse, software updates inflicted this problem on previously tested and good systems.
This led to technical compromises.Perhaps the best caused most position references to return to averaging, if there was a MRU mismatch.This didn’t work as well for HPRs and was giving ground, so a more pernicious expedient of rejecting MRUs that quickly changed or leaned too far was used as a stop gap solution.This allowed the systems to pass simple lean tests, but created a system vulnerability that led to both MRUs getting rejected when the ship wasn’t vertical enough or rolled too quickly.That’s why all vessels that actively use MRUs to correct all their position references need to have three MRUs.If one goes wrong, the other two can be followed.Vessels, which only use MRUs for display and HPR correction, only need two but need to watch out for software changes.Actually, everyone does.
What about gyros?In the early days, the operator could compare heading with visual references or the magnetic compass.It some cases, it wasn’t critical.Without visual references or easy access to a magnetic compass, it can be difficult to tell which gyro is right and in some operations this can be critical.As the DP system companies did not make the gyros and were under market selection pressure, they tended toward software solutions.These didn’t work well and predictably created problems (e.g. bow hit by a wave causing rejection of both gyros), so three gyros are generally required, so the single wrong gyro can be rejected.sensors.
What if more than one gyro goes wrong together? Sometimes, three is the equivalent of one. This might be due to vulnerabilities created by common correction sources, a common master controller, common power supplies, common network, or common load.
- For example, gyros with automatic north speed error correction functions need to have that function turned off during DP to stop a DGPS jump from swinging the gyro heading. Even if the gyros are fed from separate DGPSs, this can be a common DGPS fault. If they are fed from a common DGPS then you have to worry about a common communication or electrical fault affecting all three gyros. Communication faults include too fast, too slow, noise interpreted as commands or false signals, etc. Electrical faults include voltage bias, spikes, grounds, and lightning. Type approval does not guarantee protection from these things as manufacturers and class aren’t really looking at redundancy, so utilization of type approved equipment needs to be examined from a redundancy viewpoint.
- A common master controller is convenient but creates similar problems as its hardware, firmware, communication, and power malfunctions can corrupt or stop all three gyros. Consider turning it off during DP.
- While it is obvious that all three gyros shouldn’t be fed from a single power supply, because all three will be lost with the power, feeding all three from an independent common backup supply isn’t much better. An electrical fault in one gyro might take out all power supplies or an overvoltage or ground in one power supply might take out all three gyros. There are protective devices that can be used to improve the odds but these devices need maintained and tested. How old is your Phoenix Contact power supply? Has its protection ever been tested? There is a lot of maintenance needed if protections must be effective. It is easier and cheaper to feed each gyro with power from its redundant group. Similarly, careful attention must be paid to system grounding.
- I am increasingly horrified over the years by more and more unnecessary networks interconnecting devices that are meant to be independent. Communication faults and network interaction can cause problems. Buy gyros that aren’t networked together, if you can. Have a plan in place for loss or malfunction of all three, if you can’t. The chances are small but be ready.
- Common communication loads can also have common effects on otherwise independent gyros. Interactive communications present more danger and passive one way serial lines are safer, but there have been incidents where all three gyro serial lines were lost. Even the theoretically two split but tightly coupled DP control systems might have common problems. In the few known cases, the gyro manufacturer blamed the 2 split DP system and the DP manufacturer blamed the 3 split gyros. This isn’t the first problem with “safe” serial lines over the years but they are very rare and the current mechanism is hidden in proprietary systems, if it still exists.
Perhaps the best advice is to keep systems simple, but be prepared for trouble. Nothing is perfect.
Similar considerations apply to MRUs. They should be fed from their redundancy group and supply equipment in their redundancy group. Something that was not discussed while considering gyros comes up here. On one vessel all three MRUs were located below the workdeck and when a load was placed too forcefully, they were rejected together. Placement of both gyros and MRU needs to be away from common sources of vibration and electro-magnetic noise but system designers cannot be allowed to baby their system references and expect lab results on noisy vessels. The DP control system needs to be robust and if the system is dependent on gyros and MRUs then it must robustly handle problems rather than give up.
What about after you have lost a gyro or MRU? You are back to the original problem because the DP control system has lost redundancy in that subsystem. We typically only need to consider a simple failure in DP design and analysis but in the real world, it might not be possible to quickly make safe during some operations. The system now depends on the DPO to select the correct sensor if they disagree. In that case, the DP operator (DPO) needs a visual reference or compass to check heading against, and needs to compare his own sense of motion or the vessel inclinometer against the remaining MRUs. Similarly, a Fanbeam or RadaScan will give angle to target and may aid in selecting between two disagreeing gyros, and “movement” of the horizon helps in selecting between the pitch and roll of two MRUs. In some systems it is still possible to default to averaging by deselecting all MRUs, if the two remaining MRUs disagree. Systems that average the two remaining sensors behave differently than systems that follow one of the two sensors, so the DPO needs to know which his system does and follow the logic to identify and deselect the faulty sensor. The DPO needs the tools and knowledge to mitigate the risk until the vessel can make safe or the faulty sensor is restored. These risks need managed and controlled and the occasional drill would be wise.
What about wind sensors? They are system sensors, so don’t they need three? Healthy, properly installed and maintained gyros and MRUs directly measure heading and pitch/roll, but wind sensors only measure the local wind. While wind compensation can be useful, wind may not be uniform and wind compensation is sometimes counterproductive. There are usually directions that each wind sensor has some interference from and normal eddies and swirls in the wind or around a structure, like a rig, might make them useless. Even if you had three, all three will sometimes be useless or even dangerous if not deselected. The vessel can operate with them but they usually improve performance. The vessel will not DP without gyros and most will not DP without MRUs.
That’s why, DP vessels need three gyros and most modern DP control systems require three MRUs. Systems that do not perform active motion compensation of all position references only need two MRUs, so the possibility still exists in some class rules. This occasionally causes confusion, so some class societies simplified things by requiring three. That is the trend over time.
