Risk Analysis of DP Incidents during Drilling Operations

e-mail: david.boullosa@ehu.eus This paper aims to present a method to determine the type of dynamic positioning (DP) incidents that have a more significant risk during drilling operations in the period 20072015, according to the element or the type of failure that causes the DP system to fail. Two different classifications are made: 1) according to the element that produces the incident (which has been the traditional classification in the industry) and 2) according to the type of error that arises, the latter being an alternative classification proposed in this paper. The predictable financial losses for each level of severity are used to define the resulting consequences for each case. A risk analysis is performed with the data obtained, showing the potentially more dangerous incidents, either because of their higher number of occurrences or because their consequences are remarkable. According to the classification proposed, the main causes with the higher risk results were power and environmental, according to the traditional classification, and fault/failure. Thus, the power segment’s combination of failures is the riskiest cause during the DP drilling operations. Risk Analysis of DP Incidents during Drilling Operations


INTRODUCTION
A dynamic positioning (DP) system is an automation used in marine platforms and vessels. Data from wind, currents and ship's motions are taken from different sensors. After analysing them, a signal is sent to the thrusters and rudders to compensate for those movements. This procedure seeks two main goals: maintaining a given position or moving the vessel along a preset track.
This sophisticated system has been in use since the 1970s. Its many applications are primarily found in the offshore industry. The complexity and high accuracy requested for the different offshore operations make the dynamic positioning system a great asset for this sector.
However, rarely does such a sophisticated automated system always perform well. The study of the incidents reported by vessels is vital to discover any failures that could be corrected and to improve DP operation safety.
Various institutions, both governmental and professional, have dealt with these issues, and have contributed to the safety improvement of DP operations by publishing guidelines and circulars for the sector.
Among the groups that have more actively provided feedback information to the industry regarding safety in DP operations, two professional organisations should be emphasised: the International Marine Contractors Association (IMCA) (https://www.imca-int.com/) and the Marine Technology Society (MTS) (https://www.mtsociety.org/). Other organisations, such as the International Maritime Organisation (IMO) (https:// www.imo.org/), different classification societies or flag states base their guidelines on the IMCA and MTS documents.
The MTS is a professional organisation based in Washington DC, USA, whose aim is "to promote awareness, understanding, advancement and application of marine technology" (Marine Technology Society, 2020). Their Dynamic Positioning Committee has published multiple publications regarding design, operations, people element, and technical and operational guidance notes. They produce some interesting feedback in the form of "Classic DP Incidents", where the more frequent incidents are described, along with a description of possible barriers to correct the fault, and some valuable comments.
The IMCA is, without any doubt, one of the most prolific authors to the cause of safety in DP operations. It has published different recommendations to the industry and guidelines for operations, sensors, personnel. Among those, the publication M103 'Guidelines for the design and operation of dynamically positioned vessels' (International Marine Contractors Association (IMCA), 2020) is the primary reference contribution to the dynamic positioning sector. This publication has been revised several times, and the last revision took place in October 2020.
It is also essential to highlight the collection of DP incidents that the IMCA has published since 1994. The large volume of DP incidents reported anonymously and carefully published by the IMCA have been the base of this research.
In the MSC/Circ. 645 (International Maritime Organisation, 6 June 1994), the IMO proposes the guidelines to provide international standards for dynamic positioning systems on all types of new vessels constructed on or after July 1994, in conjunction with the provisions of Paragraph 4.12 of the MODU Code (International Maritime Organisation, 2009), as amended. In June 2017, the IMO revised these guidelines and approved them, publishing them in the MSC.1/Circ 1580 (International Maritime Organisation, 16 June 2017). The Maritime Safety Committee (MSC) provides that the IMCA guidelines (International Marine Contractors Association (IMCA), 2016c) should be applied in the industry with regard to the training of key DP personnel (International Maritime Organisation, 2017). These guidelines are also mentioned in a footnote to section 4.13 of the 2009 MODU Code (International Maritime Organisation, 2009) and section B-V/f of the STCW Code (International Maritime Organisation, 2011).
The IMCA states that each operation will have different worst-case failures and outcomes, as agreed between the company and the customer (International Marine Contractors Association, 2020). Three equipment classes are defined to achieve the safety level required for each operation (International Maritime Organisation, 16 June 2017). These equipment classes are determined according to the probability of a loss of position (LoP), and they depend on where a single fault is generated. Minimising the LoP is achieved by the use of redundancy in the DP systems. Redundancy is the ability of a system to maintain or restore a function in the event of a failure. It can be obtained by installing multiple components or alternative ways of performing a function. In other words, the task should continue with a spare element or in an alternative way.
Classification societies have also added their expertise to the safety aspects of dynamic positioning operations. Their standards and publications have undoubtedly contributed to safety in the offshore industry. The leading classification societies in the DP field are Det Norske Veritas -Germasnischer Lloyd (DNV GL) (https://www.dnv.com/) and the American Bureau of Shipping (ABS) (https://ww2.eagle.org/en.html).
As the offshore industry developed in Northern Europe, the states bordering the North Sea agreed on the necessity of establishing some guidelines for offshore operations. These were published in 2009 and referred to as the North-West European Area (NWEA) guidelines (Norwegian Shipowners' Association et al., 2009). In 2013, the Guidelines for Offshore Marine Operations (known in the industry as G-OMO) succeeded the NWEA Guidelines (Norwegian Shipowners' Association et al., 2013). Within these guidelines, the operators are remitted to the IMO's references regarding dynamic positioning system operation and supported by the IMCA, MTS or other institutions.
As seen so far, the institutional coverage of the technical and managing aspects of the dynamic positioning operations is mainly defined by professional associations like the IMCA and classifications societies like DNV-GL and ABS, backed up by the IMO.
In the academic field, Haibo Chen (Chen, Moan and Verhoeven, 2008) published in 2011 a paper where he introduced the safety of DP operations through a model based on barriers. His research team had previously approached the subject in an article about such units' safety (Verhoeven, Chen & Moan, 2006). Regarding human factors in DP incidents, Chae (2015) researched the human error in DP incidents and applied the formal safety assessment to them (2017). Dong (Dong, Vinnem and Utne, 2017) focused his research on the incidents that had taken place during offshore loading operations. Overgard (Overgard et al., 2015) also researched human element during DP incidents. Sanchez-Varela et al.(2021) researched variables contributing to the LoP of drilling units while using dynamic positioning and concluded that the generators and the meteorological conditions were the main factors that lead to an LoP.
The Quantitative Risk Assessment approach identifies potential hazards associated with given operations and determines the probability of incidents and their possible outcomes and consequences. (Kristiansen, 2005).
The QRA, applied to the field of dynamic positioning, has been improved over the years with different methodologies. Some examples of these are hazard and operability studies (HAZOPs), Failure Mode and Effect Analysis (FMEA), Fault Tree Analysis (FTA), and Event Tree Analysis (ETA) (Khan and Abbasi, 1998). Another method that has been extensively used for risk analysis of DP incidents is the Bayesian Network (BN), a graphical model that represents the dependency between variables, using nodes and directed links, making it possible to show conditional probabilities for a set of variables (Ancione, Bragatto and Milazzo, 2020). In addition, the system theoretic process analysis (STPA) is used for analysing the dynamic behaviour of the systems, providing advantages over other traditional methods (Leveson et al. 2012).
Examples of the application of these methodologies to the field of dynamic positioning are given by Sulaman et al. (2019), Abrecht (2016), and Parhizkar et al. (2020), with different results.

The use of Dynamic Positioning Systems in Drilling Operations
Drilling operations take place over a wellhead. The DP system's primary purpose is to maintain the drilling vessel's position so that the riser/stack angle is close to zero, compensating for currents or tidal flow if necessary. This angle is the one measured between the riser (on the top) and the wellhead or lower marine riser package (LMRP) (Bray, 2018b).
To achieve this, a watch circle system is created for the Dynamic Positioning Operator (DPO) to monitor the vessel's movements. In normal conditions, the vessel will work within the green circle (as shown in Figure 1). Should there be an incident in which the vessel cannot maintain position, there will be an LoP (known as drift-off or drive-off ) beyond the green circle. In this case, the blue advisory alarm will be raised, indicating a degrading status.
If the LoP continues beyond the yellow circle, the yellow alarm should be sounded, and emergency disconnection preparations should occur. Should the LoP continue beyond the red circle, the red alarm is raised, and an emergency controlled disconnection commences.
In a worst-case scenario, the LoP will not be stopped, and the vessel will surpass the red limit. In that case, emergency disconnection should start and the well be shut. However, if the vessel overpasses the physical limit, the riser would break, and the consequences would be catastrophic.
Some authors, like Chen, Moan and Verhoeven (2008) support the idea of determining the raddii of the circles based on the riser/stack angle; thus, the yellow circle will be set for an angle of 3°, and the red circle for a riser angle of 5°. This idea can be valid for shallow waters. As Bray (2018a) indicates, the tidal flow should be taken into account in deeper waters, compensating for its effect on the raiser.
However, the studies made in this field by authors like Weingarth (2006), Bhalla and Cao (2005), Quigley and Williams (2015), Adamson and Abrahamsen (2006), and Teixeira, Oshiro and Tannuri (2014) suggest that there are other factors to be taken into account (e.g. the presence of other objects in the surroundings), on a case-by-case basis. The MTS clearly states this in its DP Operations Guidance -Part 2 -Appendix 1 -MODUs (Marine Technology Society, 2012), where the Well Specific Operating Guidelines (WSOG) are implemented. The WSOG is Table 1.
Data about DP incidents reported each year (prepared by the authors, using data obtained from IMCA DP station keeping incidents, from 2012 to 2015. a similar concept to the Activity Specific Operating Guidelines (ASOG) defined by IMCA in their Guidance on Operational Activity Planning (International Marine Contractors Association (IMCA), 2021). Here, the operational, environmental, and equipment performance limits for each location and activity are specified.
The main objective of this paper is to determine what kind of DP incidents are under a more prominent risk during drilling operations in the period 2007-2015, according to the element or the type of failure that causes the DP system to fail. Determining the kind of incident that is potentially more dangerous could help focus on the DP system segment with a more significant risk.
The secondary objectives are included in a statistical analysis of the incidents and add value to the main objective. Thus, checking the trends of the incidents during the study period is one of the secondary objectives.
This paper proposes an alternative causality categorisation based on the type of failure observed. This new categorisation is compared to the existing causality categorisation presented by the IMCA. The new categorisation is used to complement the traditional one based on the DP system segment in which the incident is triggered. Another secondary objective would be to determine with the help of a correlation table what DP segment is affected by what kind of mistake.
In addition, the secondary causes can add value to the description of the incidents. Knowing the distribution of the secondary causes and their relationship with the main causes will be another secondary objective of this research.  Table 1.

YEAR
No. of vessels reporting The first step was to determine what operations were carried out when the incident happened. The event tree described the operations in progress, but this information was not uniform and had to be labelled and categorised by the team.
From the total DP incidents during the study period, the IMCA published 81 reported DP incidents that took place while drilling operations were in progress. However, a closer analysis led the research team to reject two of these incidents from the study. One of them referred to well intervention operations, so it was decided to remove it from the drilling DP incidents group of study. Although referring initially to a vessel engaged in drilling operations, the other incident had to do with an offshore supply vessel (OSV) undergoing cargo operations that had the DP incident. As the incident had not taken place on the vessel engaged in drilling operations, it was also decided to remove this incident from the study group.
All these incidents are presented in these publications with event-tree presentations. The data presented was then elaborated in a database, with the following entries: incident number, year, operation, main cause, secondary cause, comments, initiating event, and event description.
The incident reports published by the IMCA presented no clearly identified consequence. For each case, the event-tree stages were carefully read to retrieve the information for the consequence. The first classification was made by determining whether an LoP had happened or not. After that, the focus was put on the cases where an LoP was recorded. For these cases, it had to be determined whether the LoP had reached the red, yellow or red circle; then, the further LoP was taken for each case. When the consequence was not clear, the consensus was achieved by a meeting of the research team.
The consequences were then classified as an ordinal variable, according to the following classification: 1: no LoP; 2: LoP into the green circle; 3: LoP into the yellow circle; 4: LoP into the red circle. The main and secondary causes were classified into one of the following categories: Computer, Electrical, Environmental, External, Human error, Power generation, References, Sensors and Thrusters/Propulsion. The IMCA uses this traditional classification of causes. It refers to the DP system component in which the incident was initiated without reflecting the error's nature. The research team decided to reflect this nature in an alternative causality categorisation. This alternative classification is related to the system's malfunction or error that leads to the DP system's degradation. In the following list, a description is given for each cause category: Fault/failure occurs when a component stops working, their function cannot continue, and degradation of the system occurs. An alarm usually accompanies it.
Loss of signal occurs when a component cannot perform its function or it becomes limited due to a loss of the signal it needs to receive.
Procedures is the generic name given to the incidents caused by not following the given operational procedures. This includes, for example, pressing the wrong button in the DP station console.
Settings are assigned to the incidents in which the DP components are not set up correctly to perform to a desirable level of accuracy for the operation's needs.
Weather occurs when the wind force or the current speed, or both, are to blame for the incident.
First, a correlation between the traditional and the alternative classifications was performed using Pearson's residues (r) with the following formula: (1) where e ij is the expected frequency value, and o ij is the observed frequency for different rows i and columns j. The sign of the residue helps to determine whether the correlation is proportional or inversely proportional. The contribution (c) of each pair to the Pearson's chi-square is then calculated as follows: where x 2 represents the empirical chi-square obtained by the formula: (3) A more significant value of this contribution indicates a stronger correlation between the pair.
A descriptive statistic of the main causes was made for both causality classifications. It was considered noteworthy to present the different causalities per year and determine whether they were constant during the period.
To find out what main causes were more prone to have an LoP, a cross-table was made, taking into account the main causes and the variable that indicated whether an LoP had taken place or not. Since the number of observations was not very big (n=79), a Montecarlo exact-test was used, creating 10,000 samples to determine the correlation for a p-value of 0.05.

Risk Classification
Risk (R) is normally evaluated as a function of the severity of the possible consequences (C) for a hazard and the probability of occurrence (P) for that particular hazard: As the incidents happening under the same cause can have a different consequence degree, an average consequence value is calculated.
In this study, P is given by the number of cases registered for each consequence degree. This degree is determined by the watch circle surpassed during the incident.
The risk analysis was performed by multiplying for each different cause the number of incidents (P) by the watch circle surpassed (C).
The operation's total risk can be obtained by adding up the risks obtained for each cause and consequence. The percentage of each cause contributing to the total risk is then considered and analysed.
The total risk was then calculated as the sum of the risks for each cause.
Being n the number of causes in the classification and i the number of different causes.
The value of the losses expected was estimated in the US dollars (USD) for each consequence. Considering the daily rates for different drilling units during the study period (information obtained from Seabreeze reports (Seabrokers Ltd, 2012, the mean daily rate was calculated to be 279,010.00 USD. This value was assigned to the incidents that reached the yellow circle. For the incidents without any LoP, the losses were zero as the operations continued without any downtime. The green and red circles' expected losses were estimated to be 55,000.00 USD and 1,000,000.00 USD respectively, as average quantities mentioned in conversations with experts in the field. These expected losses were multiplied by the number of cases for each circle. Applying a bootstrapping technique with R, we generated 5,000 samples with the same original distribution to obtain a bigger group of cases for the analysis. A boxplot diagram and a table with the central statistics were prepared Both the consequences (C) and the probability (P) are functions of different parameters. However, it is common to simplify the function as the product of the consequences (C) and the probabilities (P) (Kristiansen, 2005): from these samples, showing each category's risk distribution and calculating the differences in the central tendency measures using a Kruskall-Wallis test.
The distribution of the generated 5,000 samples was tested with a one-sample Kolmogorov-Smirnov non-parametric test to determine whether these distributions follow a normal or Poisson distribution.

Statistical Software
The statistical analysis of the database and the Kolmogorov-Smirnov test for the distribution of the risk were carried out using IBM SPSS Statistics software version 23.0 for Windows.
The risk analysis was performed using a bootstrapping technique with R studio.

Annual Description of the Database
Once the database was filtered for cases that took place while drilling operations were in progress, there were 79 cases, of which 45 cases (57 %) had a LoP and 32 (43 %) were able to maintain the position. When compared to the total incidents reported by the DP industry, which include other operations (such as diving, anchor handling, and cargo operations), there were 79 cases out of 642, which is a significant percentage (13 %, p-value < 0.05). There

The Relation Between Both Causality Classifications
The traditional classification takes into account the element of the DP system that fails, while the alternative takes into account the nature of the failure. Thus, crossing both tables, the following information was obtained: The main computer causes correspond in 50 % of the cases to faults/failures, in 20 % of the cases to loss of signal and procedures respectively, and 10 % to settings. The main electrical cause is related to the settings (67 % of the cases) and fault/failure (33 %). Environmental causes are always related to weather, the same as main external causes, 100 % in both cases. Human causes are related to procedures (83 % of the cases), 8 % relate to fault/failure, and an extra 8 % to settings. Power has a great relationship with fault/failure (94 %), while the rest relates to settings. References and Sensors cause incidents when they lose their signals (100 % each). Thrusters are related to fault/ failure in 79 % of the cases, while the rest (21 %) has to do with the signal loss. This cross-table is shown in Table 2.
When performing a chi-square with Monte Carlo exact test, we obtain that both systems are correlated (p-value 0).
From the table of percentages of contribution to the chisquare, it can be observed that the most apparent correlations exist between Weather and Environment (23.2 %), Human and Procedures (19.1 %), and References and Loss of signal (12.6 %). The residues indicate that these relations are positive correlations.
The same methodology is applied to the secondary causes, and its results are shown in Table 3. The more prominent correlations appear to be again between weather and environmental (27.2 %) and human cause and procedures (14.8 %).

The Relation Between Main and Secondary Causes
The relationship between the main and secondary causes was studied with a cross When the same comparison is made using the alternative classification, we obtain that Weather, Fault/Failure and Loss of signal are the main causes with more probability of having a secondary cause (61 %, 62 % and 60 %, respectively). Settings have a probability of 40 %, and Procedures have a secondary cause in 33 % of the cases. The p-values indicate that there is not enough evidence to accept the above trends as significant.
When there is a secondary cause, the distribution can be described as follows: when the main cause is Fault/Failure, then the secondary cause can be another Fault/Failure (

Traditional Classification
The main causes with higher frequency were Environmental and Power, each of them happened 17 times during the study period; both causes together equal 43 % of the total causalities. Incidents caused by problems with Thrusters happened in 14 cases, which means 17.7 % of the total causes. Human errors caused 12 incidents during the period (15.2 % of the total), and Computers were to blame on ten occasions (12.7 %). The rest of the incidents had a lower frequency: References in four cases (5.1 %), Electrical in three cases (3.8 %), External and Sensors in one case each, (1.3 % each).
There were 34 incidents for which a secondary cause was defined. In 9 cases, the secondary causes were defined as Human errors (26.5 %), in 5 cases they were due to Power (14.7 %), 4 cases each (11.8 %) due to External factors, Sensors, and Thrusters. Due to secondary Environmental causes, we had 3 cases (8.8 %). For Reference and Electrical causes there were 2 cases (5.9 %). There was only 1 computer secondary cause (2.9 %).

Alternative Classification
For the main causes in the alternative classification, Faults and Failures happened more frequently, in 34 incidents, i.e. almost half of the incidents (43 % of the total number of incidents). Weather was to blame in 18 incidents (22.8 %), and non-followed Procedures lead to 12 incidents (15.2 %). Loss of signal happened in 10 incidents (12.7 %), and Settings were wrong and lead to an incident on 5 occasions (6.3 %).
The secondary cause with the highest frequency is Settings problems (12 cases or 35.3 %), followed by procedures (10 cases or 29.4 %). Fault/failure appear in 6 cases (17.6 %), Weather in 4 cases (11.8 %) and the lowest frequency corresponds to Loss of signal, with 2 cases (5.9 %).

Traditional Classification
When crossing the main causes with the LoP, it was found out that for the Power causes there was a LoP in 12 out of 17 incidents (70.6 %). This high frequency for a LoP was also found in Computer incidents (60 %), Environmental incidents (64.7 %) and Human errors (66.7 %). Thruster incidents presented a higher frequency for non-LoP incidents, as 11 out of the 14 incidents (78.6 %) resulted in no deviation from the wellhead. Cases with Sensors as main cause had no LoPs, so they are not shown in the following results.
Human error cases had a more significant percentage of LoP beyond the red circle (5 cases, 62.5 %), while only 1 case overpassed the green circle (12.5 %), and 2 cases passed the yellow circle (25 %). Environmental causes had 1 (9 %) case passing the green circle, 5 cases (45.5 %) passing the yellow circle and 5 cases (45.5 %) passing the red circle.
A chi-square test performed with a Monte Carlo exact test shows that the correlations between the causes and the consequences are not significant.
Regarding the secondary causes, those incidents in which there was an external secondary cause have a more significant probability of having a LoP (100 %), followed by Power (80 %), Thrusters (75 %) and Human errors (67 %). Sensor secondary cause has a more significant probability of not having a LoP (75 %). The analysis of the p-values showed that the value for the external secondary cause could be taken as significant (p-value < 0.05).
Out of the 25 LoP cases, the distribution of the watch circle reached is as follows: Power and External causes have the most significant probability to surpass the red watch circle (75 %), while human causes will have 50 % of possibilities of surpassing the red circle and 33 % of surpassing the yellow circle.
The chi-square test with Monte Carlo exact test does not show enough evidence for accepting these results. However, the Goodman and Kruskall tau shows the dependency of the secondary cause as significant.
When analysing the more significant contribution to the chi-square, we obtain the following results, as shown in Table 4.   It is easy to see that those incidents that have Environment as a secondary cause are prone to stay within the green circle, while the incidents happening with Sensors as a secondary cause usually do not have any LoP.

Alternative Classification
The analysis of the causes that more frequently ended in LoP gave the following results: Procedures were the causes of an evident higher frequency of LoP with 9 cases out of 12 (75 %). The weather also had a higher frequency for LoPs, with 12 out of 18 cases (66.7 %). The Fault/Failure has 18 cases in which there was no LoP, and in 16 cases there was an LoP (47.1 %). For Loss of signal, very similar results were obtained, with 5 cases out of 10 having no LoP and 4 cases (40 %) having it. The p-values calculated showed that these percentages were not significant.
Among the 45 cases where an LoP took place, the distribution of watch circles that the unit had surpassed as a maximum was studied. For the cases due to a Fault or Failure, many of them surpassed the red circle (10 cases, 63 %). In Weather, 1 case surpassed the green circle, 5 (42 %) the yellow circle and 6 (50 %) the red circle. Procedures surpassed the red circle in 56 % of the cases.
A chi-square test with Monte Carlo exact test indicates that there is not enough evidence to extrapolate these results with a 95 % confidence.
The highest probability of LoP exists for secondary loss of signal and weather causes (100 %), followed by settings (75 %) and procedures (70 %). For Fault and failure, the probability of a LoP is 50 %.
Within the 25 cases with a LoP, the reached watch circle is classified into different secondary categories. Settings have 6 cases (67 %) that reach the red circle and 3 (33 %) the yellow circle. The percentages are the same for Fault/Failure, with 2 cases passing the red circle and one the yellow circle. Procedures have 3 cases (43 %) reaching the red circle, 3 cases (43 %) the yellow and 1 case (14 %) the green circle. Finally, incidents with secondary cause Loss of signal reached the red circle (50 %) and the other case reached the yellow circle (50 %). The chi-square with Monte Carlo exact test shows that the results could be extrapolated with a 95 % confidence. When the data is ordered and the chi-square contributions are determined, we obtain that the secondary cause weather incidents usually stay within the green circle. At the same time, Fault/Failure is more prone to not having any LoP. These results are shown in Table 5.

Risk Analysis
Estimating the expected losses to be 55,000.00 USD for the incidents in which the green circle was reached, 279,010.00 USD for the incidents reaching the yellow circle and 1,000,000.00 USD for the incidents surpassing the red circle, the qualitative risk analysis of the main causes was obtained for the different causes.
The overall risk per year is shown in Figure 3.

Traditional Classification
The total risk is calculated to be 28.9 million USD for the period of study of 9 years, which means that the expected losses are 3.2 million USD per year.
The contribution of each different cause to the absolute risk is then calculated as a percentage: Computer 13 %, Electrical 4 %, Environmental 22 %, External 4 %, Human error 19 %, Power generation 29 %, References 1 %, Sensors 0 %, and Thruster/ Propulsion 8 %. Figure 4 represents the expected losses with a boxplot and a median graph. In Table 6, the main statistic parameters for the distribution are shown. Regarding the secondary causes of the traditional classification, and following the same methodology, the following values were obtained: Computer 6 %, Electrical 2 %, Environmental 8 %, External 20 %, Human error 22 %, Power 20 %, References 8 %, Sensors 6 %, Thruster/Propulsion 10 %. All these results are graphically represented in Figure 4.
Similarly, the table and boxplot were generated for the secondary causes, showing the risk is 3.60 million USD for Human errors and 3.27 million USD for External and Power causes each.
A Kruskall Wallis non-parametric test was used for the distribution comparison, showing statistically significant differences among the main causes. For the secondary causes, the same test showed no significant differences between Power and External causes (p-value >0.05), but the rest of the causes have a significantly different distribution.
The different causes do not follow a predetermined distribution after performing the one-sample Kolmogorov-Smirnov non-parametric test; they are neither normal nor Poisson; all the data has a positive skewness and is generally leptokurtic.

Alternative Classification
By applying the same methodology as above for the alternative classification, the results obtained show that the distribution of the total risk (28.9 million USD) is as follows: Fault/ Failure 40 %, Loss of signal 5 %, Procedures 20 %, Settings 8 % and Weather 26 %. The statistic parameters are shown in Table 7.
The higher expected losses for main causes are Fault/ Failure with an average risk of 11.64 million USD, while Weather and Procedures have 7.48 and 5.91 million USD risk for the period.
The secondary causes obtained the following values for quantitative risk: Fault/Failure 14 %, Loss of signal 8 %, Procedures 23 %, Settings 41 % and Weather 14 %. The results for both main and secondary causes are represented in Figure 5.
Regarding the secondary causes, Settings with 6.90 million USD is the cause with the higher risk, followed by Procedures with 3.92 million USD.
The Kruskall-Wallis test shows that all the distributions are significantly different among the different causes, both for main and secondary causes.
In the same way as for the traditional causes, the Kolmogorov-Smirnov non-parametric test results show that the distribution of the risk for the different causes is neither normal nor Poisson; here also all the data has a positive skewness and is generally leptokurtic.

DISCUSSION
In the annual description of the database, it can be seen how the number of incidents is increasing. The severity of the consequences is higher at the beginning of the period, improving in the last years. However, this tendency could be influenced by the reporter's mentality to include those potentially dangerous incidents although there was not any great consequence. The company policies indicating the necessity of sending such reports could have influenced this trend.
The correlation between the traditional and alternative categorisation of causes shows the nature of the incidents for each segment of the dynamic positioning system. The results indicate that Environment causes are significantly due to weather conditions and Human errors have their origin mainly in procedures that are not followed correctly and the Referencescaused incidents because they lose their signals. Other segments are affected in more than one way.
At the same time, it is interesting to check the main causes of disruption for the different DP segments as the most significant percentage of faults and failures happen in the Power generation segment.
The secondary causes, when reported, add value to the incident and help define the origin of the main cause. Although the p-values indicate that the correlations cannot be extrapolated within the 95 % confidence interval, it becomes very noticeable how the Human secondary causes are adding to the incidents in a very high percentage.
The frequency of the different categories is a variable of high impact for this study. Within the traditional classification, Environment, Power and Thruster were the most frequent main causes. The secondary causes that occur most frequently are the ones caused by Human errors. Within the alternative classification, incidents caused by Faults or Failures are the main causes of the incidents, almost half of the total number of cases. They are followed by the incidents in which the Weather was the main cause. Regarding the secondary causes, wrong Settings and Procedures cover over half the cases.
When studying the consequences, the first step taken was to check whether a LoP had taken place or not. In this sense, the higher frequency for a LoP is found for Power causes. The higher frequency for a non-LoP incident was found to be for Thruster incidents. For the alternative classification, Fault/Failure and Loss of signal are not significantly predisposed to LoPs. In contrast, incidents caused by inadequate Procedures and Weather have a higher frequency of LoPs.
For the secondary causes, the external secondary cause had a more significant probability of having a LoP. The rest of the causes did not have the same significance, but power is within the secondary causes with a more significant probability of having a LoP. Taking into account the alternative classification, in this case there were no significant causes with a higher likelihood of LoP, the incidents caused by inadequate Procedures having the most significant percentage.
A fascinating discovery of the research was the significance of the results for the consequences based on the secondary causes when a LoP had taken place, as Power and External causes were the secondary causes with more significant possibilities of surpassing the red circle, followed by Human causes. For the alternative classification, Settings and Procedures are the secondary causes that mostly have a severe consequence and surpass the red circle.
The paper's main objective was to determine what kind of DP incidents are potentially more dangerous, having a higher risk. From the qualitative risk analysis results for the period, it can be determined that the Power-related incidents have the highest risk, with 8.37 million USD expected losses in 9 years, followed by Environmental and Human errors. The secondary causes with the higher expected losses are Human errors (3.60 million USD), followed by External and Power causes (3.27 million USD each).
In the alternative classification, the results are independent of each other. The incidents provoked by Faults or Failures are the riskiest ones, 11.64 million USD for the whole period (approximately 1.2 million USD expected losses per year). Weather and Procedures are the next-in-rank causes, having similar qualitative risks. Loss of signal is determined to be the least risky cause in this analysis. Regarding secondary causes, the highest risk appears to be settings, with a very significant mean value of 6.90 million USD for the period.
The distribution of the different causes, although it could not be determined to be normal or Poisson, has a positive skewness in common. The higher amount of incidents without LoP explains this fact. As this study is based on voluntary reports made by the members of the IMCA, it could be reasonable to think that a complete database in case the reporting of incidents were compulsory would add value to the results of the risk analysis.

CONCLUSIONS
Remarkably, most of the LoPs (53 %) had overpassed the red circle. This could indicate that the culture of reporting incidents still refers to reporting when something actually happens and not in the cases when all is resolved before any problematic or expensive situation develops.
By studying the LoPs and their different levels of danger, it was found out that Human error cases had the most significant probability of surpassing the red circle. Regarding the alternative classification, Faults and Failures were the causes with a more severe consequence of reaching the red circle.
Having all the above shreds of evidence taken into account, it can be determined that Power-caused incidents have a potentially more significant risk since the frequency is high and the consequences are severe. In the same way, incidents due to Environmental aspects are also considered to have a significant risk. However, Thruster events appear to have a lower risk even though their likelihood is high.
With the alternative classification, the incidents initiated by a fault or a failure have a higher risk. It could be concluded that the operators should beware of failures in the power system as this seems to be the combination with a higher risk.
Another aspect to consider is that Human factor, which does not appear to be the primary cause with a high frequency, often appears as a secondary cause. The consequences of the Human factor combined with inadequate Procedures, as shown by the alternative classification, have a potentially high risk that should be taken into account and corrected with more specific or specialised training.
In future research, the contributions of different factors such as the configuration of the system or meteorological conditions will be taken into account to build a model explaining the Human error contributions and help minimise them.