An FPSO sits on station off Brazil's southeast coast. The turret is holding, the risers show nominal tension, and the DP console on the bridge is green across every reference. Wind is inside limits. Current is inside limits. The heading is where the operator wants it. Twenty minutes later, a routine ROV inspection finds the vessel more than fifteen metres from its intended footprint. Nothing on the DP display ever moved.
Cases like this rarely make headlines. The FPSO does not blackout, does not lose thrust, does not drift into the exclusion zone of a neighbour. Industry sources describe a pattern where the vessel quietly holds itself against a position reference that has slowly stopped telling the truth. The Kongsberg or Marine Technologies console shows a tight watch circle. The reference weightings look reasonable. Only later, when someone cross checks the DP fix against an independent GNSS or a subsea transponder array, does the offset appear.
When The Reference Frame Drifts
DP class 2 and class 3 FPSOs run on redundant position references: typically two DGPS receivers, one hydroacoustic system (HPR or USBL), and sometimes a taut wire or a fanbeam laser sighted on a nearby platform. The DP controller does not trust any single input. It weights them, votes them, and rejects outliers. This works well when errors are random and independent. It fails quietly when errors are correlated.
IMCA guidance has flagged this failure mode for years. M 103, the Guidelines for the Design and Operation of Dynamically Positioned Vessels, sets out the reference redundancy philosophy. M 190, the guidance for developing and conducting DP annual trials, spends significant time on reference sensor validation for exactly this reason. Both documents assume the operator will notice when a reference degrades. In practice, degradation on an FPSO is often gradual: an antenna slowly fouled by helideck exhaust, an HPR beam attenuated by rising gas near a wellhead, a DGPS correction stream whose base station has drifted a few centimetres per year and never been recertified.
The MAIB and the US Coast Guard have both published DP incident findings that trace back to reference inputs the DP system accepted as truth. IMCA's own annual station keeping event bulletins carry the same pattern year after year, with reference sensor faults sitting near the top of the causal list. On a drilling unit in open water, a silent offset of a few metres is usually recoverable. On a moored FPSO with production risers, flexible jumpers, and umbilicals on the seabed, the physics are different.
The Reference Voting Trap
The failure that operators describe most often is a common mode error across two DGPS receivers of the same make consuming the same correction service. Both receivers report the same wrong position because both are ingesting the same wrong differential correction. The DP controller sees two references agreeing to within a metre and downweights the acoustic system, which is telling the truth but noisier. The console shows green. Only a fully independent source, a different constellation, a different correction network, or an acoustic array referenced to seabed transponders in a known frame, will expose the drift.
FPSO operators in the Campos and Santos basins live with this risk in a specific way. Turret moored units are compliant systems: the mooring resists lateral drift up to a point, so a small DP position error does not immediately translate into a large vessel motion. The riser tension telltales look normal. The heading stays on target. What changes is the fatigue budget of the flexible risers at the turret, the angle at which the umbilicals meet the seabed, and the standoff to neighbouring subsea assets. Weeks of undetected offset show up months later as accelerated wear at a known stress concentration.
What The Bridge Actually Needs
The gap is not more sensors. Class rules already require redundancy. The gap is a second, independent view of where the vessel actually sits relative to the subsea infrastructure it is supposed to be flying above. That view has to come from a source the DP controller is not consuming, and it has to be visible to the same people who look at the DP console.
Blackwell Atlas puts the seabed on the same map as the vessel. Wellheads, manifolds, flowline routings, umbilical corridors, and jumper end connections sit as first class objects, referenced to a survey grade frame. When the vessel position on Atlas diverges from the position the DP system is reporting, the offset is immediate and visible on the same screen, without waiting for an ROV sortie. Blackwell Compass carries the same picture across a fleet. An operator running four or five FPSOs off Brazil can see, in one view, which units show a widening delta between DP reported position and independent fix, and which references are trending toward the edge of acceptance criteria across sister vessels.
None of this replaces the DP system. It replaces the assumption that a green console is the same thing as a correct position. On a producing FPSO with a turret full of risers, that assumption is expensive to hold.
The Brazilian FPSO Context
Brazil's producing fleet sits at the sharp end of this problem. Petrobras runs the largest FPSO estate in the world by installed capacity, with pre salt units in Santos in water depths well beyond 2,000 metres. Brava Energia inherited the Atlanta FPSO with a documented history of DP and mooring events during its earlier life on the field. PRIO, Karoon, and Petrogal all operate producing units where a quiet reference drift is easier to accumulate than to detect.
Deep water changes the acoustic geometry. USBL slant ranges get longer, transponder response times stretch, and multipath from risers and mooring lines contaminates the fix. DGPS receivers on a turret moored FPSO see a slowly rotating antenna geometry as the vessel weathervanes, which can mask a slow reference drift as apparent heading motion. The DP controller's Kalman filter smooths through all of it and reports a confident position that may be quietly wrong by several metres.
Operators who have run cross checks against independent GNSS receivers on the flare tower, or against a subsea LBL array deployed for a construction campaign, often find offsets they were not expecting. The offsets are rarely catastrophic. They are just larger than the values the DP watch circle would suggest, and they persist long enough to matter for riser fatigue calculations.
References
- IMCA M 103, Guidelines for the Design and Operation of Dynamically Positioned Vessels: https://www.imca-int.com/publications/70/
- IMCA M 190, Guidance for Developing and Conducting Annual DP Trials Programmes: https://www.imca-int.com/publications/72/
- IMCA DP Station Keeping Event annual bulletins: https://www.imca-int.com/product-category/publications/marine/dp-station-keeping-events/
- MAIB published investigation reports (UK Marine Accident Investigation Branch): https://www.gov.uk/maib-reports
- OE Digital subsea and offshore coverage: https://www.oedigital.com/subsea