12.2 Critical Activity Mode (CAM)

When “good enough” is not good enough

Dynamic Positioning can hold a vessel in many configurations. Some configurations maximise fuel economy. Others maximise survival after a single failure. Critical Activity Mode (CAM) is the second philosophy made operational: the vessel is deliberately set up so that the worst-case single failure (WCF) defined for the plant will not cause loss of position while a high-consequence activity is under way.

If ASOG is the traffic-light decision sheet, CAM is the plant and system setup state that keeps most of those lights green for critical work. Induction and Simulator assessments expect you to know what CAM aims to achieve, what it typically looks like, and when it is mandatory in practice.

CAM definition (exam-stable)

CAM means the DP system and supporting plant are configured for critical activities such that a single failure — generator section loss, thruster loss consistent with design, PRS common-mode avoidance, etc. — leaves enough residual capability to maintain position and heading within the activity’s limits. CAM is not:

• a special DP joystick sub-mode button alone,
• a manning level (number of officers on the bridge),
• automatic permission to ignore weather,
• a guarantee against every multiple failure or human error.

Why critical work demands CAM

Some DP tasks tolerate a controlled drift or a larger footprint after a failure. Others do not. Classic CAM-required activities include:

• Diving (especially saturation) — excursion can kill or trap divers.
• Close proximity to platforms, FPSOs, or other vessels — collision risk.
• Heavy-lift critical phases — load swing, hook load, or structure contact risk.
• Certain construction / SIMOPS where a sudden move damages assets or people.
• Any client-mandated critical window where residual capability after WCF is a contractual or permit condition.

Exam stem pattern: “vessel working close to an installation / divers in the water” → expect fully redundant CAM-type configuration, completed checks, and an ASOG matched to the proximity hazard — not a fuel-saving degraded plant.

Typical CAM plant picture

Exact CAM checklists are vessel-specific (company DP operations manual, FMEA operational notes, class notation). The exam-level pattern is consistent:

[!IMPORTANT] Exam trap: “CAM means run one generator on a closed bus to save fuel during diving.” That is the opposite of CAM philosophy. CAM pays fuel to protect residual capability after WCF.

Open bus, max redundancy, minimum counts

Three phrases appear repeatedly in CAM teaching and must stay distinct:

1. Open bus (or proven isolation) — electrical independence so one-side black does not take all thrusters.
2. Maximum practical redundancy online — generators, thrusters, and references that the design can use are actually available and selected, not left offline for convenience.
3. Minimum thruster / PRS counts — hard floors below which the activity must not continue in CAM; often mirrored as ASOG red rows.

“Maximum redundancy” does not mean every spare part in the workshop is spinning. It means the operational configuration matches the FMEA residual story: enough online plant that after WCF you still have a viable thruster set, power, and references. Running below those floors while calling the watch “CAM” is a paper fiction.

Conservative weather limits

Capability plots and FMEA residual curves often show theoretical holding limits larger than what a client or company will accept for diving or close work. CAM practice tightens environmental limits so that:

• post-WCF thruster demand still fits remaining plant,
• time to terminate remains realistic if weather rises,
• footprint stays inside worksite agreements.

If consequence analysis warns that the current weather would make WCF cause loss of position, you are already outside the CAM safety case for that moment — even if all equipment is green. Equipment redundancy without weather margin is incomplete CAM thinking.

Cost of CAM: fuel, wear, and deliberate prioritisation

CAM is expensive in operating terms:

On exams, if a stem offers “switch to fewer generators to save fuel while divers are deployed,” the correct safety answer rejects that trade unless the task is no longer critical and authority has formally left CAM. Safety is prioritised; efficiency is secondary.

Entering and verifying CAM (operator sequence)

CAM is a setup state, not a slogan. A practical verification sequence before critical work:

1. Confirm activity truly requires CAM (dive, proximity, critical lift phase, etc.).
2. Configure power: generators, bus-tie, PMS inhibits consistent with CAM/FMEA.
3. Confirm thrusters available, deselections intentional, bias/allocation understood.
4. Enable and check independent PRS; verify voting healthy.
5. Confirm sensors redundant and within limits.
6. Set DP mode, footprint, heading (weather-optimal where safe).
7. Activate the matching ASOG; brief Master, ECR, and worksite.
8. Run consequence analysis / capability awareness for present weather.
9. Log CAM entry and defects; only then start or continue the critical phase.

If any step fails, you are not in CAM yet — delay the critical activity.

Worked CAM scenarios

Scenario A — Dive support. Class 2 DSV, divers in water. Plant: open bus, three gensets per side philosophy met, thrusters split, three independent PRS. Wind rises; consequence analysis approaches advisory. DPO notifies dive control early (time to terminate), optimises heading, prepares recovery. That is CAM + ASOG working together.

Scenario B — False CAM. Bridge placard says “CAM” but bus-tie is closed without proven protection, one bus has a single generator, and only GNSS is online. A thruster-side short could black essential thrusters; a GNSS common-mode fault could drive position error. Labelling does not create residual capability.

Scenario C — Heavy lift critical phase. Crane moves from free to constrained geometry over a subsea structure. Company procedure requires CAM only during the critical phase; approach may use elevated readiness, but the hook load critical window is full CAM. After set-down and clear, the vessel may transition toward TAM with documented authority.

Scenario D — Generator loss in CAM. One section loses a genset. Residual still meets WCF design. ASOG may go yellow: start standby, notify worksite, continue only while residual and weather remain acceptable. If residual no longer meets WCF for the activity, ASOG goes red — terminate critical work, even if position still looks perfect for thirty more seconds.

Exam traps for CAM items

Linking CAM to the rest of the guide

• Open vs closed bus (power chapters) is often a CAM decision.
• WCF and consequence analysis (FMEA chapter) define whether CAM residual is real right now.
• ASOG turns CAM degradation into graded stop/go actions.
• TAM (next section) is the intentional alternative when task risk allows less residual protection.

Bottom line: CAM configures power, thrusters, references, and limits so a worst-case single failure will not lose position during high-consequence work. Expect open-bus or proven isolation, strong online redundancy, minimum thruster/PRS floors, conservative weather, and higher fuel cost. Call it CAM only when the plant and checks actually match that philosophy.