5.4 Reference Selection, Voting & Common-Mode Failure
Key Takeaways
- For critical Class 2/3 DP work, enable at least three independent position references when practicable, preferably using different physical principles
- Voting, median selection, weighting, and rejection prevent a single wild PRS from driving thrusters while alerting the DPO
- Common-mode failure defeats “three of the same”: shared GNSS sky/corrections, shared structure motion on two relative systems, or shared acoustic frequency band can remove multiple refs at once
- The DPO must deselect or leave rejected any degraded reference rather than force bad data online for cosmetic green counts
- Exam scenarios test diversity thinking: two DGNSS alone are not independent enough for critical ops; investigate rejected refs; restore true independence
Selection and Voting: Where PRS Chapters Meet Safety
You have now met the major PRS families: DGNSS and relative GNSS concepts, hydroacoustics (USBL/SSBL/LBL), light taut wire, laser relative, and microwave relative. Hardware knowledge is useless if the operator enables the wrong mix or force-feeds bad data into the controller. This section is the operational glue: how many, how independent, how the system votes, and what common-mode failure looks like.
The Rule of Three (and Why Independence Matters)
Industry best practice and Class 2/3 thinking for critical DP operations:
- Enable at least three position references when practicable.
- Prefer references based on different principles (e.g., DGNSS + HPR + laser/microwave, or DGNSS + LTW + microwave in a suitable shallow field).
- Understand that three green lights of the same vulnerability can still be one failure event.
| Count / mix | Safety interpretation |
|---|---|
| 1 PRS | Single-thread; loss = measurement starvation (model dead reckoning only briefly) |
| 2 similar PRS | Disagreement without clear majority; common-mode risk if same principle |
| 3 independent PRS | Voting can reject one deviant; single failure survivable for measurement |
| 3 identical-principle PRS | May look redundant yet fail together (e.g., triple GNSS in scintillation) |
Exam key: “Use a minimum of three independent references, ideally based on differing principles, for DP Class 2/3 operations.” Wrong answers usually say “only one accurate ref,” “always DGNSS only,” or “switch off all but the most stable to avoid conflict.” Switching off healthy diversity reduces the system’s ability to vote.
How Voting, Median, Weighting, and Rejection Work
Implementations vary by vendor, but DPO-level concepts are stable:
- Each online PRS supplies a position (and often a quality/variance/weight).
- The system compares references to each other and/or to the estimated state (Kalman residual tests).
- A median or multi-input vote can identify an outlier.
- Weights may favour low-noise, high-quality sensors and reduce the influence of noisy ones.
- A grossly inconsistent reference is rejected or heavily down-weighted with an alarm to the operator.
- The estimator continues on accepted measurements.
| Mechanism | Operator-facing meaning |
|---|---|
| Median / majority | Odd one out can be discarded when peers agree |
| Weighting | Noisy but not wild sensors contribute less |
| Rejection | Wild points do not become thruster commands |
| Alarm “reference rejected” | Usually protective — investigate why, restore diversity |
Healthy reaction to rejection: treat it as the system doing its job. Check multipath, target ID, acoustic noise, snag, fog on laser, correction loss on DGNSS, etc. Unhealthy reaction: immediately re-enable a thrashing PRS “so we have three again” during a critical lift or dive without fixing the cause.
Weighting Versus Forcing
Some systems allow operator weight preferences or auto-weighting based on variance. Conceptual rules:
- High weight on a known-good absolute ref may be appropriate in open water.
- During platform work, a high-quality relative laser/microwave may deserve strong influence on the relative envelope if peers still provide independence.
- Never confuse “high weight” with “only reference.” Weighting shapes the blend; it does not replace redundancy requirements in procedures/ASOG.
Common-Mode Failure: The Exam Favourite
Common-mode failure means one event degrades multiple references that were counted as separate for redundancy.
| Common-mode example | Why multiple refs fail together |
|---|---|
| Two or more DGNSS only | Same sky view, ionospheric scintillation, jamming, loss of same correction service |
| Two relative systems on same structure motion | Laser + microwave both track the same moving FPSO; relative OK, absolute/earth task wrong together |
| Two acoustics on same frequency band / noise event | Thruster noise, seismic, or interference blinds same band |
| Two lasers both optically blocked | Same fog bank (partial common mode for optical) |
| Shared power/data path | Single cabinet/cable failure removes multiple “independent” inputs |
Classic exam item: Why avoid relying on two DGNSS receivers as the only PRS during critical DP? Answer: they share common-mode vulnerability (scintillation, signal loss, correction loss) and can fail together. It is not because they are “too accurate,” illegal, or banned within 500 m of platforms by a blanket rule.
Another pattern: counting antenna A and antenna B on the same GNSS principle as two full independents for ASOG green criteria without a third different principle — procedures may allow nuances, but the learning objective is diversity of physics.
Operator Deselection of Degraded References
The DPO is part of the voting system. When a reference is clearly sick:
- Acknowledge the alarm and note which PRS failed.
- Confirm remaining independent count and quality against ASOG / WSOG / project limits.
- Deselect or leave rejected a known-bad input rather than letting it chatter at the edge of acceptance.
- Reduce operational risk if remaining refs are insufficient (stop critical activity, increase separation, prepare contingency).
- Restore a fixed, stable reference only after cause is understood and quality is verified — then allow filter settling.
| Bad practice | Better practice |
|---|---|
| Force all PRS online to paint three greens | Keep only healthy independents; fix faults |
| Ignore repeated rejection of one sensor | Investigate root cause; check common-mode |
| Enter Auto DP while refs are jumping | Stabilise measurements first; use present pos carefully |
| Drop to one ref “because it’s the best” | Maintain diversity for voting |
Building a Diverse Portfolio (Practical Mixes)
| Operation type | Example diverse mix |
|---|---|
| Open water / pipeline absolute | Dual DGNSS (not alone) + HPR/LBL where depth allows |
| Platform close approach, clear weather | DGNSS + laser relative + HPR or microwave |
| Platform work in fog | DGNSS + microwave relative + HPR (laser may be offline) |
| Shallow field with LTW fitted | DGNSS + LTW + laser/microwave (snag-aware) |
| Deep water | DGNSS + acoustics primary; LTW not ideal; relative optical/microwave if structure present |
Exam Scenarios to Internalise
| Scenario | Correct principle |
|---|---|
| Minimum refs for critical Class 2/3 | ≥3 independent when practicable; different principles preferred |
| Two DGNSS only on critical job | Common-mode risk — not adequate diversity |
| Reference rejected alarm | System protected estimate; investigate; do not thrash thrusters chasing the spike |
| Laser and microwave both track same swinging crane | Shared structure-motion common mode for relative frame |
| Switch off two good refs to avoid “conflict” | Wrong — kills voting |
| After rejecting laser in fog, still have DGNSS + microwave + HPR | Acceptable diversity if quality good; continue monitoring |
| All PRS lost | Short model dead reckoning only; high risk; contingency |
Link Back to Controller and Kalman Chapters
Voting is not a separate magic box disconnected from the controller. Median/rejection protects the measurement update; the Kalman filter blends accepted measurements with the model; weights influence trust. When you deselect a PRS, you change the information available to the estimator — which is correct when data are false, and dangerous when you deselect the last independent absolute reference without operational justification.
Bottom Line for Assessment
- ≥3 independent PRS for critical Class 2/3 work when practicable.
- Independence = different principles / failure modes, not just different product labels of the same physics.
- Voting / median / weight / reject stop wild points from driving thrusters.
- Common-mode (same GNSS, same structure motion, same acoustic band, shared power) is the hidden killer of false redundancy.
- Operator deselects degraded refs and restores true diversity — cosmetics do not keep the vessel safe.
Master this section and every PRS type becomes a managed portfolio rather than a collection of isolated gadgets.
A key operational rule for selecting DP position-reference systems for critical Class 2/3 work is to:
Why should a DPO avoid relying on two DGNSS receivers as the only position references during a critical DP operation?
When voting rejects a position reference during Auto DP and peers remain healthy, the DPO should primarily:
Which situation is the best example of common-mode failure for position references?