A7043-B IMCA Guidance DP Electrical Power and Control

No 1 The Exchange
62 Market Street
Aberdeen
AB11 5PJ UK
Phone +44 1224 289100

Fax +44 1224 289101
www.gl-nobledenton.com
REPORT
IMCA
GUIDANCE
DP ELECTRICAL POWER AND CONTROL

Report No: A7043, Rev B, Dated March 2010
DRAFT
Distribution:
Company: IMCA Attn: Jane Bugler
W/S No: 55/130502
File: a7043-b imca guidance dp electrical power and control
Noble Denton Consultants Ltd trading as GL Noble Denton

Registered in England No. 5513434 Registered Office: Noble House, 39 Tabernacle Street, London, EC2A 4AA, UK
IMCA
GUIDANCE
REVISION DETAILS
Revision Date Description Author Checker Approver
B 18/03/10 For client review JM/DT/SC JM BI

A 23/02/10 For internal review JM/DT/SC JM -
DESCRIPTION OF CHANGES
Revision Section Change
INSERTED DOCUMENT/FILE REGISTER

Path and Filename Details of File
Report No: A7043, Revision: B, Dated: March 2010 W/S No: 55/130502
File: A7043-B IMCA Guidance DP Electrical Power and Control Page 2 of 194
IMCA
GUIDANCE
EXECUTIVE SUMMARY
This guide to DP electrical power and control system is intended to provide those
working in the field of dynamic positioning with a reference guide to the general
principles of diesel electric propulsion and related controls systems. Reference is
made to the concepts of redundancy and fault tolerance in relation to system design.
IMCA
GUIDANCE
CONTENTS
SECTION PAGE
1 INTRODUCTION 9
1.1 GENERAL INTRODUCTION AND SCOPE OF DOCUMENT 9
1.2 ELECTRIC PROPULSION 9
1.3 POWER STATION CONCEPT 10
1.4 CONVENTIONAL PROPULSION 10
1.5 CONCEPTS OF FAULT TOLERANCE AND CONTROL SYSTEMS 11
1.6 DP CLASS 2 & 3 REDUNDANCY CONCEPTS 12
1.7 FAILURE MODES AND EFFECTS 13
2 POWER GENERATION 16
2.1 GENERAL PRINCIPLES OF POWER GENERATION 16
2.2 ENGINES 28
2.3 ENGINE AUXILIARY SYSTEMS 35
2.4 ENGINE CONTROL AND SAFETY SYSTEMS 42
2.5 SAFETY FUNCTIONS 47
2.6 GENERATORS 48
2.7 FUEL CONTROL 52
2.8 EXCITATION CONTROL 63
2.9 MAIN SWITCHBOARDS AND MOTOR CONTROL CENTRES 68
2.10 POWER SYSTEM FAULTS 70
2.11 OVERALL PROTECTION PHILOSOPHY 71
2.12 GENERATOR PROTECTION PHILOSOPHY 79
2.13 ADVANCED GENERATOR PROTECTION 85
3 POWER MANAGEMENT 88
3.1 REQUIREMENT FOR A POWER MANAGEMENT SYSTEM 88
3.2 POWER MANAGEMENT SYSTEM ARCHITECTURE 88
3.3 POWER MANAGEMENT SYSTEM HARDWARE 89
3.4 POWER MANAGEMENT FUNCTIONS 91
4 POWER DISTRIBUTION 108

4.1 POWER DISTRIBUTION SCHEMES 108
4.2 POWER PLANT CONFIGURATIONS 117
4.3 OPERATIONAL CONFIGURATION 123
4.4 TRANSFERABLE AND DUAL FED CONSUMERS 125
4.5 BATTERY SYSTEMS 126
4.6 SEPARATION OF REDUNDANT ELEMENTS FOR FIRE AND FLOOD 128
5 VESSEL MANAGEMENT SYSTEMS 130

5.1 GENERAL DESCRIPTION 130
IMCA
GUIDANCE
5.2 NETWORK TECHNOLOGY 136

5.3 REDUNDANCY 147
6 THRUSTERS, DRIVES AND CONTROLS 152

6.1 GENERAL PROPULSION PRINCIPLES 152
6.2 THRUSTER FAILURE MODES 153
6.3 THRUSTER AUXILIARY SYSTEMS 163
6.4 THRUSTER MOTORS 167
6.5 VARIABLE SPEED DRIVES 167
6.6 THRUSTER CONTROL SYSTEMS 171
7 SAFETY SYSTEMS 177

7.1 GENERAL PRINCIPALS OF SAFETY SYSTEMS 177
7.2 REGULATIONS RELATING TO SHUTDOWN SYSTEMS 177
7.3 ESD SYSTEMS AND DP REDUNDANCY 178
7.4 ACTIVE FIRE PROTECTION 181
7.5 EFFECTS OF VENTILATION SYSTEM SHUTDOWN 183
7.6 GROUP STOPS 184
7.7 CONTROL ROOM LAYOUTS 184
APPENDIX A LIST OF ABBREVIATIONS 188
FIGURES
Figure 2-1 Impedance as the Combination of Resistance and Reactance 16
Figure 2-2 Current and Voltage in Phase – Purely Resistive Load 17
Figure 2-3 Current Lagging Voltage by 30º - Slightly Inductive Load 18
Figure 2-4 Instantaneous Power for a Purely Resistive Load 19
Figure 2-5 Instantaneous Power for a slightly inductive load 19
Figure 2-6 Active, Reactive and Apparent Power 20
Figure 2-7 Conductor Passing Through a Magnetic Field Induces an EMF 21
Figure 2-8 Current Carrying Conductor in a Magnetic Field Experiences a Force 21
Figure 2-9 Cross-section of Four Pole, Salient Pole Alternator 22
Figure 2-10 Three-phase alternator with Wye (star) winding 23
Figure 2-11 Voltage waveforms for Red, Yellow and Blue Phases of 11kV Alternator 23
Figure 2-12 Elementary Three-Phase Equivalent Circuit of Synchronous Alternator 24
Figure 2-13 Phasor diagram 25
Figure 2-14 Generator Capability Plot 26
Figure 2-15 Generator Operating Point 27
Figure 2-16 MAN 16V 32/40 Courtesy MAN 32/V40 Project Guide 29
Figure 2-17 MAN 8L 32/40 Courtesy MAN 32/40 Project Guide 29
Figure 2-18 Medium Speed Engine Starting Time 31
Figure 2-19 Load Increase Rates for Generators Operating at Synchronous Speed 33
Figure 2-20 Engineroom combustion air supply and ventilation 38
IMCA
GUIDANCE
Figure 2-21 Engine HT and LT Cooling Water System 40

Figure 2-22 Engine Control and Protection Based on Engine Manufacturer’s Systems 43
Figure 2-23 Engine Control and Protection Based on Vessel Automation System 44
Figure 2-24 Typical control power arrangement 45
Figure 2-25 engine control power with PMG backup 45
Figure 2-26 Independent engine control supplies 46
Figure 2-27 Diode isolated dual supplies 46
Figure 2-28 Alternator with PMG 49
Figure 2-29 Alternator with AVR powered by Generator VT 50
Figure 2-30 Alternator with auxiliary winding 50
Figure 2-31 Electronic governor with hydraulic actuator 53
Figure 2-32 Speed control for common rail ‘electronic’ engine 54
Figure 2-33 Forward and reverse acting actuators. 54
Figure 2-34 Generators load sharing by speed droop 56
Figure 2-35 Analogue load sharing lines 57
Figure 2-36 Digital load sharing lines 58
Figure 2-37 Master slave load sharing system 59
Figure 2-38 Electronic governor 61
Figure 2-39 Speed offset signal 61
Figure 2-40 Modern digital governor 62
Figure 2-41 Automatic Voltage Regulator - (Divert type) 63
Figure 2-42 Relationship of phase and line quantities 65
Figure 2-43 Voltage representing Blue line current is added to Red-Yellow Line voltage 65
Figure 2-44 Sense voltage increases as reactive component of current increases 65
Figure 2-45 Cross Current Compensation 66
Figure 2-46 Cross current loop - voltage across resisters balances to zero 67
Figure 2-47 Metal enclosed switchgear 69
Figure 2-48 Time graded over current protection 73
Figure 2-49 Differential protection 74
Figure 2-50 Directional over current protection 75
Figure 2-51 Directional over current protection 76
Figure 2-52 Methods of marine power system earthing 77
Figure 2-53 Generator protection relay 80
Figure 2-54 Principle of AGP 87
Figure 3-1 Integrated Automation System 90
Figure 3-2 Standalone PMS 90
Figure 3-3 Blackout detection from single source 93
Figure 3-4 Signals relating to load reduction 98
Figure 3-5 Example Power System 101
Figure 3-6 Initial Thruster, Crane and Hotel Loads 102
Figure 3-7 Thruster, Crane and Hotel Loads after Loss of one 5MW Generator 102
IMCA
GUIDANCE
Figure 3-8 Effect on Power Available Signals to Thruster and Crane 103
Figure 3-9 Sudden Demand for Thrust 104
Figure 3-10 Bus Load and Power Available Following Large Demand for Thrust 104
Figure 3-11 Thruster Step Load of 5MW 105
Figure 4-1 Service transformers 111
Figure 4-2 Harmonics distortion from 12 pulse drives on 6.6kV marine power systems 113
Figure 4-3 Harmonic content of 6.6kV voltage waveform 114
Figure 4-4 Inter trip for parallel service transformers 116
Figure 4-5 Interlocks to prevent parallel service transformer operation 117
Figure 4-6 Shore supply interlock 117
Figure 4-7 Asymmetric two way split 118
Figure 4-8 Three-way split 118
Figure 4-9 Transferable or dual fed thrusters 118
Figure 4-10 Four way split for semi-submersible 119
Figure 4-11 Split reactor power plant 121
Figure 4-12 Phase shifted power system 122
Figure 4-13 Grid interconnector based power system 122
Figure 4-14 Power supplies to thrusters and their auxiliary systems 123
Figure 4-15 Double conversion or online UPS 128
Figure 5-1 Basic Distributed Control System 130
Figure 5-2 Fieldbus Communications using Profibus DP Protocol 131
Figure 5-3 Star Topology 132
Figure 5-4 Physical Star Logical Bus 133
Figure 5-5 Dual Redundant Star Topology 134
Figure 5-6 Bus Topology 134
Figure 5-7 Physical Bus Logical Ring 135
Figure 5-8 Physical Ring Topology 135
Figure 5-9 Dual Ring Topology 136
Figure 5-10 OSI Network Model 138
Figure 5-11 RS 485 Bus Segment 141
Figure 5-12 FIP Network Configuration 145
Figure 5-13 CANbus Arbitration 146
Figure 5-14 Typical Redundant Field Station 148
Figure 5-15 Redundant Power Supplies 148
Figure 5-16 Typical Control Network 150
Figure 5-17 Typical Line Monitoring Circuit 151
Figure 6-1 Relationship between power and thrust 153
Figure 6-2 Voith Schneider propeller 154
Figure 6-3 Tunnel thruster 155
Figure 6-4 Azimuthing thruster 156
Figure 6-5 Podded thruster 157
IMCA
GUIDANCE
Figure 6-6 Thruster hydraulic system 164

Figure 6-7 Thruster lubrication system 165
Figure 6-8 Thruster cooling water unit 166
Figure 6-9 Cycloconverter Drive 168
Figure 6-10 Synchroconverter drive 168
Figure 6-11 Voltage source PWM drive 170
Figure 6-12 Variable speed thruster drive 171
Figure 6-13 Sine / cosine potentiometer 172
Figure 6-14 Thruster control unit 174
Figure 6-15 Thruster emergency stops 175
Figure 7-1 Simple Centralise Emergency Stop System 178
Figure 7-2 ESD and F&G System Integrated into VMS 179
Figure 7-3 ESD 0 Split to Match Redundancy Concept 181
Figure 7-4 Typical CO2 fire fighting systems for large vessel 183
Figure 7-5 Fire damper controls 184
Figure 7-6 Positioning of ESD/Safety Systems 185
TABLES
Table 1-1 DP Related Equipment and Functions Associated with the Redundancy Concept 14
Table 2-1 Typical Engine Speeds and Pole Arrangements for 50Hz & 60Hz alternators 24
Table 2-2 Diesel Engine Speed and Typical Use 28
Table 2-3 Maximum Permissible Step Load 34
Table 2-4 Generator Protective Functions 81
Table 4-1 Voltage distribution levels - large vessels 109
Table 4-2 Voltage distribution levels - Smaller vessels 110
Table 5-1 Profibus Maximum Segment Length 141
Table 5-2 Modbus ASCII and RTU Properties 143
EQUATIONS
Equation 2-1 Ohm’s Law 16
Equation 2-2 Impedance 17
Equation 2-3 EMF 21
Equation 2-4 Force 21
Equation 2-5 Relationship between Line and Phase voltage in Wye winding. 23
Equation 2-6 Relationship between speed, frequency and number of poles 24
Equation 2-7 Three Phase Power 26
Equation 4-1 Transformer formula 111
IMCA
GUIDANCE
1 INTRODUCTION
1.1 GENERAL INTRODUCTION AND SCOPE OF DOCUMENT
1.1.1 This handbook is intended to provide a reference guide for those involved in all
aspects of dynamic positioning with particular relevance to those involved in
designing, assessing and maintaining dynamically positioned diesel electric vessels.
1.1.2 This document consolidates and updates three existing DPVOA / IMCA guidance
documents:-
1. 126 DPVOA – Reliability of Electrical System on DP Vessels
2. 108 DPVOA – Power System Protection and DP Vessels
3. IMCA M154 – Power Management Study
1.2 ELECTRIC PROPULSION
1.2.1 Electric propulsion using steam turbines or diesel engines as the prime mover has
been used in ships since the early 1900s. Diesel electric propulsion is now almost
universal amongst medium and large dynamically positioned vessels but direct
driven and hydraulically driven thrusters are still used in certain applications.
1.2.2 In its simplest form, diesel electric propulsion consists of a diesel engine driving an
electrical generator which is connected to a motor driven propeller or thruster by
way of an electric cable. The generator and motor may be of the alternating current
or direct current type or of different types if converters are included. The thrust
developed by the propeller may be controlled by varying the speed of the engine,
the speed of the motor, or by varying the pitch of the propeller. Such simple systems
can still be found in certain applications but the vast majority of medium to large DP
vessels have a diesel electric power plant based on the power station concept.
IMCA
GUIDANCE
1.3 POWER STATION CONCEPT
1.3.1 In the power station concept, electric power is provided by several synchronous
alternating current generators operating in parallel. The generators are connected to
switchboards by way of circuit breakers that allow the generators and loads such as
thrusters, service transformers and motors to be connected and disconnected as
required. Typical power plants have 4, 6 or 8 generators connected to two or more
switchboards.
1.3.2 The advantages of the power station concept include:-

1. Greater freedom in location of engines and thrusters
2. Ability to provide large amounts of power for activities other than propulsion
3. Ease with which power can be distributed for auxiliary systems
4. Ease of thrust control for systems of multiple propellers
5. Well suited to fault tolerant and redundant propulsion systems
6. Modular designs allow maintenance to continue during operations
7. Good power plant efficiency
1.3.3 The disadvantages of the power station concept include:-

1. High initial cost
2. Complexity
3. Specialist maintenance requirements
4. The need to maintain a large spinning reserve in fault tolerant DP systems can
reduce the efficiency of the power plant and introduce maintenance and
emission control issues.
1.4 CONVENTIONAL PROPULSION
1.4.1 Conventional propulsions systems are still widely used in DP applications usually in
combination with limited diesel electric systems. Offshore supply vessels and anchor
handlers will often have conventional marine engine installations with, gearbox,
shaft line and controllable pitch propellers to provide high transit speeds and along
ships thrust. A combination of shaft alternators driven by the main engines and
auxiliary generators provide power for thrusters and auxiliary systems.
1.4.2 Some offshore supply vessels use direct diesel driven thrusters. Thrust is controlled
by varying the engine speed over a certain range and by varying pitch at lower
speeds. In some arrangements a slipping clutch is used to control speed at the
lower speed range when a fixed pitch propeller is used.
1.4.3 Thrusters driven by a hydraulic motor and power pack are also used in some
applications.
IMCA
GUIDANCE
1.5 CONCEPTS OF FAULT TOLERANCE AND CONTROL SYSTEMS
1.5.1 All DP Class 2 and DP Class 3 vessels are required to be fault tolerant, although
there are slight variations between the major Classifications Societies, almost all
have requirements similar to those described in IMO MSC 645, ‘Guidelines for
Vessels With Dynamic Positioning Systems’, which states in Section 2.2:-
1. For equipment class 1, loss of position may occur in the event of a single fault.
2. For equipment class 2, loss of position is not to occur in the event of a single
fault in any active component or system. Normally static components will not
be considered to fail where adequate protection from damage is demonstrated
and reliability is to the satisfaction of the Administration. Single failure criteria
include:
a. Any active component or system (generators, thrusters, switchboards,
remote controlled valves, etc)
b. Any normally static component (Cables, pipes manual valves, etc.)
which is not properly documented with respect to protection and
reliability.
3. For equipment class 3, a single failure includes:
a. Items listed above for Class 2, and any normally static component is
assumed to fail.
b. All components in any one watertight compartment, from fire or flooding.
c. All components in any one fire sub-division, from fire or flooding.
1.5.2 Key elements of fault tolerant systems
1.5.2.1 In DP vessel design, fault tolerance is generally achieved by redundancy.

Redundancy is defined as having more than one means of carrying out the same
function. However the effectiveness of redundancy is degraded if each method of
carrying out the function is not sufficiently reliable. The International Electrotechnical
Vocabulary’, IEC 60050, defines redundancy and reliability as follows
Reliability ‘The probability that an item can perform a required function under
given conditions for a given time interval’
Redundancy ‘The existence of more than one means of performing a required

function’
IMCA
GUIDANCE
1.5.2.2 In fault tolerant systems based on redundancy there are three important elements
that must be present and maintained these are:-
1. Equivalence
2. Independence
3. Confidence
1.5.2.3 In practical terms these requirements can be translated to:-
1. Performance
2. Protection
3. Detection
1.5.3 Equivalence
1.5.3.1 Redundant elements must be present in both number and capacity, that is to say
that if there are redundant means of performing a function then the secondary
means should provide the same level of performance as the primary means. If this is
not the case then the vessel’s post failure capability will be determined by the
performance of the secondary system.
1.5.4 Independence
1.5.4.1 In practical fault tolerant system based on redundancy there will be a number of
common points where redundant elements are linked together. There must be a
comprehensive set of protective functions designed to ensure that faults in one
redundant element are prevented from adversely affecting the performance of all
other redundant elements connected by that common point.
1.5.5 Confidence
1.5.5.1 Where fault tolerance depends on back up system or standby redundancy there will
always be a degree of uncertainty about the availability of the equipment when
required. Alarms and period testing are generally accepted as means of providing
the necessary level of confidence.
1.5.5.2 Fault tolerance also depends on all systems being set up correctly. The correct
configuration of such things as cross over valves, backup electrical supplies and
duty / standby pumps should be recorded in the appropriate DP checklists.
1.6 DP CLASS 2 & 3 REDUNDANCY CONCEPTS
1.6.1 All DP Class 2 and DP Class 3 vessels must be able to maintain position and
heading following any defined single failure appropriate to their DP equipment class.
The Worst Case Failure Design intent (WCFDI) defines the minimum amount of
propulsion machinery which remains fully operational following the Worst Case
Failure and therefore defines the vessel’s post failure capability.
1.6.2 DP Class 2 and DP Class 3 vessels should work within their post failure DP
capability, when conducting operations requiring a vessel of that equipment class,
so that position and heading can be maintained following a failure.
IMCA
GUIDANCE
1.6.3 The redundancy concept is the means by which the Worst Case Failure Design
Intent is assured and describes how fault tolerance is achieved on a system by
system basis. The redundancy concept will be described in the vessel’s DP system
Failure Modes and Effects Analysis but may also be contained in a standalone
document or in the DP operations manual.
1.6.4 For DP Class 2 the redundancy concept will explain the effects of technical failures
within each subsystem of the overall DP system and describe any features and
functions upon which fault tolerance depends.
1.6.5 For DP Class 3 the redundancy concept will also describe how the DP system is
able to maintain position and heading following the loss of one fire sub division or
watertight compartment to the effects of fire or flooding.
1.6.6 In the language of some classifications societies these properties of fault tolerance
are described as ‘Redundancy in technical design’ for DP Class 2 with the addition
of ‘physical separation’ of redundant elements for DP Class 3.
1.7 FAILURE MODES AND EFFECTS
1.7.1 Throughout the technical discussions that follow, reference is made from time to
time to the ways in which systems can fail. The term ‘failure mode’ is used to
indicate the manner in which a component or subsystem fails. A faulty component
may have several modes of failure. For example, a cable may fail, open circuit, short
circuit or develop an earth fault. One component failure mode can have a relatively
benign effect while another may cause a blackout. Particular attention must be paid
to components that can fail in an active way and not just to an inert state. Generator
control systems are a typical example of systems that can fail in this way.
1.7.2 The term ‘failure effect’ is used to describe the effect of that failure mode on the
system itself and the systems to which it is connected. The term ‘end effect’ is
sometimes used to describe the effect of a particular failure mode on the vessel’s
ability to maintain position and heading.
1.7.3 It is a classification society requirement that the fault tolerance of DP Class 2 and
DP class 3 vessels is proven by a failure modes and effects analysis.
1.7.4 Typical list of equipment and functions related to DP
1.7.5 Table 1-1 below provides a typical list of the equipment and functions that have an
impact on a DP Class 2 or DP Class 3 redundancy concept. Not every vessel will
have all the equipment or functions listed but most modern diesel electric vessels
will have something along these lines.
IMCA
GUIDANCE
Table 1-1 DP Related Equipment and Functions Associated with the Redundancy Concept
1 2 3 4 6 7 8 9 10
Engines and Power Power Power Thrusters & Vessel DP Control Safety Separation for
Auxiliary Generation Management Distribution main propulsion Management systems fire and flood
Systems
Engines and High Voltage or
Fixed fire
engine PMS > 1000V Main & Backup DP
1 Alternators Tunnel thrusters Topology fighting Cable routes
mounted architecture generation controllers
systems
systems level
Generator
Engine control Service Drilling
and Standby Operator Fire
2 system and ROV Diving Azimuth thrusters Operator stations Pipe routes
switchgear selection stations dampers
shutdowns Pipe-lay
control
Fuel oil
Major
storage Generator Generator Field stations Watertight Fire sub
3 auxiliaries Main propellers DP Networks
transfer & Protection start/stop Remote I/O dampers divisions
380V – 440V
distribution
Lubrication Active and Vessel sensors
Bus bar Hubs & Watertight
4 including pre- reactive power LV protection Gearboxes MRU, gyros, wind, ESD
protection Switches compartments
lube sharing draught gauges
Load
Service Distribution Position references Watertight
5 Cooling SW Synchronising dependent Rudders F&G
transformers units DGPS,HPR,TW,FB doors
start/stop
Lighting, small
Manual thruster Group E- Compartment
6 Cooling LTFW Governors Alarm start power Motors UPS for VMS
controls stop analysis
120V - 220V
PMS blackout Emergency Independent
7 Cooling HTFW AVRs Motor starters
prevention 380V – 440V Joystick
IMCA
GUIDANCE
1 2 3 4 6 7 8 9 10
Engines and Power Power Power Thrusters & Vessel DP Control Safety Separation for
Auxiliary Generation Management Distribution main propulsion Management systems fire and flood
Systems
Charge air Manual Blackout
Emergency Variable speed
8 cooling / switchboard prevention in UPS for DP
120V - 220V drives
heating Controls other systems
Blackout
Fuel valve Switchboard Thrusters Voice
9 restart and
cooling control supplies auxiliaries communication
recovery
Heavy Battery
Thruster
10 Start air consumer systems 24V DP Alert
shutdowns
control dc, 110Vdc,
Auto Wheelhouse Thruster
11 Control air
reconfiguration 24Vdc emergency stops
Control and
starting
Speed Torque
12 Service air supplies for
Pitch control
emergency
generator
Engineroom UPS for other
13 Azimuth control
ventilation systems
Remote
14 Interlocks
control valves
Ventilation &
Emergency HVAC for
15
Generator spaces other
than ER
IMCA
GUIDANCE
2 POWER GENERATION
2.1 GENERAL PRINCIPLES OF POWER GENERATION
2.1.1 Voltage, Current and Power
2.1.1.1 When a voltage (V) is applied across an electric load it will draw a current (I)
depending on the impedance (Z) of the load according to the relationship in
Equation 2-1. For alternating current circuits, V, I and Z are complex quantities.
V = IZ
Equation 2-1 Ohm’s Law
2.1.1.2 Impedance is measured in Ohms (Ω) and may be resistive or reactive or a

combination of these. Reactance (X) itself may be inductive (XL) or capacitive (XC)
such that impedance is the algebraic sum of resistance and reactance.
1. Resistance (R) is also measured in Ohms,

2. Inductance (L) is measured in Henrys (H)
3. Capacitance (C) is measured in Farads (F)
2.1.1.3 By convention, inductive reactance is considered to be positive and capacitive

reactance is considered to be negative. Figure 2-1 shows the impedance triangle
which is one of the core principles of electrical engineering.
Figure 2-1 Impedance as the Combination of Resistance and Reactance
IMCA
GUIDANCE
2.1.1.4 Where the applied voltage is sinusoidal, the current drawn by the load is displaced
with respect to the applied voltage depending on the combination of resistance and
reactance. A load consisting of purely capacitive reactance draws a sinusoidal
current which leads the applied voltage by 90º. Similarly a load consisting of purely
inductive reactance draws a current which lags the applied voltage by 90º. Where
the load has an impedance containing both resistance and reactance the current will
lead or lag the applied voltage depending on the relative amounts of each. Figure
2-2 shows the current and voltage relationship for a resistive load. Figure 2-3 shows
the same for a load with some resistance and some inductive reactance such that
the current waveform lags the applied voltage waveform by 30º. The magnitude and
angle of an impedance can be calculated using Equation 2-2 below.
X
Z = R2 + X 2 ∠Z = arctan
R
Equation 2-2 Impedance
10
Voltage-RED, Current-BLUE
-5
-10
0 5 10 15 20
Time (ms)
Figure 2-2 Current and Voltage in Phase – Purely Resistive Load
IMCA
GUIDANCE
10
Voltage-RED, Current-BLUE
5
-5
-10
0 5 10 15 20
Time (ms)
Figure 2-3 Current Lagging Voltage by 30º - Slightly Inductive Load
2.1.1.5 The instantaneous power at any point in time is the product of the instantaneous
voltage and current. Figure 2-4 shows that power flow is always positive from the
resistive load. This represents fuel from the generator’s fuel tank being turned into
mechanical power and waste heat. On the other hand, power flow goes negative in
Figure 2-5 indicating that a certain amount of power is being exchanged between
the generator and the load. Note that in the case of a thruster motor powered by a
variable speed drive with a rectifier front end, the power interchange is between the
motor and the drive and thus the generator sees the power factor of the drive and
not the motor.
IMCA
GUIDANCE
12
10
8
Instantaneous Power
6
-2
0 5 10 15 20
Time (ms)
Figure 2-4 Instantaneous Power for a Purely Resistive Load
10
8
Instantaneous Power
-2
0 5 10 15 20
Time (ms)
Figure 2-5 Instantaneous Power for a slightly inductive load
2.1.1.6 The displacement of voltage and current gives rise to the concept of power factor.
The power factor of a load ‘Cos Ø’ can be defined in several ways such as the ratio
of the apparent power (product of V and I) to the active power (kW) or as the Cosine
of the angle between the voltage and current in the case of Figure 2-3 the Power
Factor is Cos 30º = 0.866.
IMCA
GUIDANCE
2.1.1.7 Many marine loads draw a combination of active (P) and reactive power (Q). The
active power is measured in Watts or Kilowatts and can be thought of as useful work
and waste heat. This requires the consumption of fuel. The reactive power is
measured in Volt Amps reactive or kVAr. It is used to maintain the electric and
magnetic fields in the cables and electric machines and does not require fuel
consumption. Together, the active and reactive power combine algebraically to give
the apparent power and the power factor of any load as show in Figure 2-6
Figure 2-6 Active, Reactive and Apparent Power
2.1.1.8 Power factor can vary between 0 and 1 with 0 representing an entirely reactive load
and 1 representing an entirely active (resistive) load. Non adjustable loads such as
heaters will have unity power factor but pumps and fans will usually have a power
factor in the region of 0.85. Loads which can vary the amount of active power they
can draw from the generators (such as thruster motors) can have a variable power
factor which improves as they draw more active power. Although reactive power
does not directly equate to fuel consumption the fact that additional generators must
be online to supply the reactive power means that there are additional losses
associated with the inefficiency of running another generator just for this purpose.
Power factor correction is the term applied to schemes intended to supply reactive
power from sources other than generators to improve overall plant efficiency.
2.1.2 Generating electricity
2.1.2.1 There are several ways of generating electricity, such as fuel cells, piezo-electric
effects and chemical reactions, but the method employed for large scale power
generation involves moving a conductor (or system of conductors) through a
magnetic field or moving a magnetic field past a system of conductors as shown in
Figure 2-7. This principle is employed in AC and DC power conversion and is
governed by Equation 2-3 and Equation 2-4 where:-
1. E is the electro motive force generated in the conductor in Volts
2. B is the magnetic flux density in Tesla,
3. I is the current in Amperes
IMCA
GUIDANCE
4. l is the length of the conductor in metres,

5. v is the velocity of the conductor in meters per second
6. F is the force in Newtons
2.1.2.2 Note that a force will be created on a stationary current carrying wire sitting in a
magnetic field (motor effect) as shown in Figure 2-8. However, to induce an electro
motive force (voltage) in a wire and therefore drive a current through a load, the wire
must be moving (generator effect).
E = Blv
Equation 2-3 EMF
F = BlI
Equation 2-4 Force
Figure 2-7 Conductor Passing Through a Magnetic Field Induces an EMF
Figure 2-8 Current Carrying Conductor in a Magnetic Field Experiences a Force
IMCA
GUIDANCE
2.1.3 Alternators
2.1.3.1 Almost all diesel electric DP vessels use variations on the three-phase, brushless,
self-exciting, synchronous alternator as the means of generating electricity. The
alternator converts mechanical energy from the diesel engine into electrical energy
at nominally constant voltage and frequency. The frequency and voltage produced
by the alternator are determined by design parameters but for a given design the
frequency of the output waveform is controlled by varying the speed of the diesel
engine and the voltage by controlling the current in the rotor winding. The power
delivered by the alternator is controlled by varying the fuel admission to the engine.
There are two dedicated control systems for this purpose, the engine governor and
the automatic voltage regulator. When generators of this type operate in parallel
with each other, all connected machines naturally run at exactly the same speed (or
related speed if different number of poles) and are said to be synchronised together.
2.1.3.2 Figure 2-9 shows the cross section of a salient pole alternator.
Figure 2-9 Cross-section of Four Pole, Salient Pole Alternator
2.1.3.3 The three-phase winding is located on the stator (or stationary part) and typically
configured as a ‘Wye’ (or star) as shown in Figure 2-10. The rotor winding is located
on the rotating part and arranged to create the required number of magnetic poles.
On a salient pole alternator (as opposed to one with a cylindrical rotor) the rotor
poles are easily identified and each is capped with a dedicated pole piece. On
brushless alternators the rotor winding is connected to a small ac generator (exciter)
mounted on the same shaft by way of diodes. The stationary part of the exciter
winding is powered from the automatic voltage regulator.
2.1.3.4 The stator winding may have a three or four wire connection depending on whether
the neutral point (or star point) of the Wye is used. The terminals of the machine are
often annotated Red, Yellow and Blue or U V W. Note that it is possible to specify an
alternator with a clockwise or anticlockwise phase rotation and this needs careful
consideration in relation to an engine’s direction of rotation. Failure to properly
specify the direction of rotation can result in problems in the distribution system
including motors running the wrong way.
IMCA
GUIDANCE
Figure 2-10 Three-phase alternator with Wye (star) winding
2.1.3.5 The stator winding is arranged to create a 120º phase shift between the three
voltage waveforms produced. Figure 2-11 shows the phase voltage waveforms
produced by an 11kV, 60Hz alternator.
10
5
Voltage (kV)
-5
-10
0 5 10 15 20
Time (ms)
Figure 2-11 Voltage waveforms for Red, Yellow and Blue Phases of 11kV Alternator
2.1.3.6 The alternator’s nameplate voltage rating is called the ‘line voltage’ and refers to the
Root Mean Square (RMS) voltage between the terminals e.g. Red to Blue, Blue to
Yellow and Yellow to Red. The term ‘phase voltage’ refers to the voltage developed
across each winding e.g. Red to Neutral, Yellow to Neutral and Blue to Neutral. The
phase voltage and the line voltage are related as shown in Equation 2-5. The line
currents are equal to the phase currents in a Wye winding.
Vline = 3 Vphase
Equation 2-5 Relationship between Line and Phase voltage in Wye winding.
IMCA
GUIDANCE
2.1.3.7 Equation 2-6below can be used to determine the engine speed required to produce
the desired frequency for an alternator with ‘p’ poles. Table 2-1 lists the engines
speeds required to produce 50Hz and 60Hz from 4, 8 and 10 pole alternators.
120 f
n=
p
where n = speed in revoultions per minute, f = frequency and p = the number of poles
Equation 2-6 Relationship between speed, frequency and number of poles
Table 2-1 Typical Engine Speeds and Pole Arrangements for 50Hz & 60Hz alternators
Engine Speed (rpm) Frequency (Hz) Number of Poles

1800 60 4
1500 50 4
900 60 8
750 50 8
720 60 10
2.1.3.8 The basic, per phase, equivalent circuit of an elementary three phase synchronous
alternator operating under steady state conditions is shown in Figure 2-12 below. E
represents the Electro Motive Force (EMF) created by the excitation system and Xs
is the internal impedance, called the synchronous reactance, represented by an
inductance. V is the voltage across one winding (phase voltage) at the terminals of
the machine. In practice, the windings also have resistance but this is generally
neglected for ease of comprehension.
Figure 2-12 Elementary Three-Phase Equivalent Circuit of Synchronous Alternator
IMCA
GUIDANCE
2.1.3.9 The phasor diagram in Figure 2-13 shows the currents and voltages when the
generator is delivering power to a lagging (inductive load) as is typical for a marine
application.
Figure 2-13 Phasor diagram
2.1.3.10 The phasor sum of the terminal voltage (V) and the voltage drop across the internal
impedance (ILXS) add to give the EMF of the machine. The angle of the internal
voltage drop depends on the power factor (Cos Φ) of the load and together with the
magnitude of the current being supplied determines the load angle (δ) of the
generator. In theory, the alternator will stay synchronised for load angles up to 90º
but in practice, the stability limit of the machine will be much lower. Large voltage
and current swings can occur if a machine loses synchronism with other machines
when the practical limit is exceeded.
2.1.4 Generator Capability
2.1.4.1 Several other design features determine the operating limits of the generating set
and it is common practice to develop a generator capability plot which shows the
steady state limits of machine operation as shown in Figure 2-14. The plot takes the
form of a P and Q axis with the 1st quadrant representing power flow out of the
generator and lagging reactive power. In most practical applications, the upper limit
is determined by the power that can be delivered by the engine. The limits of
positive reactive power are defined by the thermal rating of the windings. The limits
of negative reactive power form the practical limit of stability. Parallel operation
beyond this limit risks the machine breaking synchronism leading to severe voltage
and current transients with the potential for blackout. In practical operations the
machine will almost always operate in the first quadrant. How the alternator is
protected against the effects operating out with this envelope is discussed later in
section 2.12.
IMCA
GUIDANCE
Figure 2-14 Generator Capability Plot
2.1.5 Alternator nameplate power factor and operating power factor
2.1.5.1 The nameplate power factor of an alternator is just one of the parameters used to
define the power capability of a generating set. Electrical standards typically state
that the output rating of the generator will be given in kVA at rated voltage, current,
frequency and power factor. Alternators are rated in kVA or MVA but the amount of
active power (kW) they can deliver is determined by the power of the engine driving
the alternator. The amount of current they can deliver is determined by winding
construction and cooling etc.
2.1.5.2 The nameplate power factor (Cos Ø) is the ratio of the real power (P in kW)
delivered to the apparent power (S in kVA) delivered when the generator is
operating at rated current, voltage and frequency. cos Ø = P/S
2.1.5.3 Typical nameplate data:-

1. 5375kVA = S = Apparent power (approx 5.3MVA)
2. 11kV = VLINE
3. 282A = ILINE
4. 0.8 p.f. (Cos Ø)
2.1.5.4 From the information above it is possible to calculate the rated output power by
using Equation 2-7.
P = 3 VLINE I LINE Cos Ø
Equation 2-7 Three Phase Power

IMCA
GUIDANCE
2.1.5.5 The mechanical power into the shaft of the alternator must be higher than the
electrical power output so the example alternator would typically be driven by an
engine capable of slightly more power than this to allow for losses such as fiction,
windage and waste heat.
2.1.5.6 The nameplate power factor indicates how much reactive power (kVAr) the
generator can supply continuously without overheating when it is delivering rated
active power (kW). In the case of the example generator 4.3MW / 5.3MVA = 0.8.
The nameplate power factor operating point is just one point in the generator’s
operating range.
2.1.5.7 The operating power factor is the ratio of the real power (kW) to the apparent
power (kVA) that the generator is actually supplying to any load, and changes as the
load conditions change, so can be any value from 0 to 1, leading or lagging - (loads
are mostly lagging)
2.1.5.8 The generator can supply loads at any operating power factor within its capability
curve. If the operating point goes outside the capability curve the alternator may trip
on over current or some other protective function. It may also become unstable and
lose synchronism with the network if the operating point swings across the stability
limit.
2.1.5.9 However, regardless of nameplate details the generator must accept whatever
power factor is demanded by the load, as shown in Figure 2-15. In the case of
parallel operation of two or more generators, each generator can be arranged to
provide different portions of the kW and kVAr demand (normally set to be equal).
(W) ACTIVE POWER
3MW W LIMIT
IMPOSED BY ENGINE
PRACTICAL
STABILITY LIMIT OPERATING
POINT WINDING THERMAL
1.5 MW LIMIT
Ø 1ST
QUADRANT
REACTIVE POWER
δ
(VAr)
1.0MVAr 3MVAr
OPERATING
LOAD ANGLE POWER FACTOR
Figure 2-15 Generator Operating Point
IMCA
GUIDANCE
2.2 ENGINES
2.2.1 Marine Engine Types
2.2.1.1 Engines for electric power plant are almost invariably four stroke, turbocharged
medium speed diesel engines. Some applications use two stroke diesels, and others
such as those for FPSOs make use of dual fuel (MDO or fuel gas), and some
applications use gas turbines.
2.2.1.2 Marine diesel engines are categorised by their speed. Table 2-2 shows the speed
range and traditional application in DP vessel power plant. Slow speed engines are
used primarily in merchant vessel applications and usually only found in DP vessels
that have been converted from an existing merchant ship such as a tanker.
Table 2-2 Diesel Engine Speed and Typical Use
Category Speed range Application

Auxiliary and emergency
High speed >1000 rpm
generators
Main, auxiliary and
Medium speed 400 – 1000 rpm emergency generators
Main propulsion engines
Slow speed < 400 rpm Main propulsion engines
2.2.1.3 Typical medium speed diesel engines for DP vessel applications are rated from
around 1MW in small vessels to 10MW in large vessels. Installations of 4, 6 or 8
engines are commonplace with 2MW to 7MW being a popular power range. The
engines are invariably multi cylinder units in either ‘in-line’ or ‘V’ configuration as
shown in Figure 2-16 and Figure 2-17 below.
IMCA
GUIDANCE
Figure 2-16 MAN 16V 32/40 Courtesy MAN 32/V40 Project Guide
Figure 2-17 MAN 8L 32/40 Courtesy MAN 32/40 Project Guide
2.2.2 Engine rating
2.2.2.1 Diesel engines for generators are rated in kW at synchronous speed. The engine
manufacturer’s data sheets may provide information such as:
1. Cylinder bore 320 mm
2. Piston stroke 400 mm
3. Cylinder output 500 kW/cyl
4. Speed 750 rpm
5. Mean effective pressure 24.9 bar
IMCA
GUIDANCE
2.2.2.2 For an HV generator, the electrical power output is typically around 3% less than the
power rating of the engine, to allow for the losses in the electrical machine. In the
case of vessels with different sizes of engines such as in a ‘father – son’
arrangement, the same alternator may be fitted to all the engines such that the
smaller engine is rated well below the alternator rating. Care must be taken when
specifying engine and generators of different sizes. Transient stability may require
closer scrutiny as the difference in generator ratings approaches 2:1.
2.2.3 IMO NOx Emissions
2.2.3.1 The performance of modern diesel engines is influenced by the need to comply with
IMO requirements for exhaust gas emissions described in Annex VI of the MARPOL
73/78 convention. Engines complying with these requirements are described as IMO
Tier I. Further reductions in NOx emissions to be designated IMO Tier II and Tier III
become effective for ships built on, or after, the 1st of January 2011 and 2016
respectively.
2.2.4 Speed regulation
2.2.4.1 Diesel engines are fitted with a speed governor, which will control the engine fuel
admission, so as to maintain the desired speed (and load in the case of parallel
operation of generators) within the engine’s ability to accept the load change. In
diesel electric power plants it is possible for very large load changes to occur in
normal operation, or in response to faults in the power system, and the plant
designers must ensure that measures are in place to limit the magnitude and rate of
change of load to levels within the capability of the engines. The ease with which the
power consumption of large variable speed drives can be controlled has greatly
improved the management of such load changes.
2.2.4.2 The major classification societies are fairly well aligned on requirements for the
speed regulation of engines for main and emergency power. In general:-
1. Transient frequency variations will not exceed 10%
2. Steady state frequency must be achieved within 5s of the maximum
permissible step load being applied or thrown off.
3. Transient frequency variations in excess of 10% are accepted in the case of
100% load rejection provided the generator does not trip on over speed.
4. For diesel generators, the over speed protection will shut down the engine at
115%.
2.2.5 Engine start up time
2.2.5.1 Generators using high speed and smaller medium speed engines are generally able
to start and achieve nominal speed within 8 to 10 seconds. Larger medium speed
engines can reach nominal speed in around 20 seconds, but some larger medium
speed engines may take longer and have special requirements in respect of pre-
lubrication, length of time on standby and the need to perform a slow turn before
starting. The run up time may also be controlled to limit the acceleration and
therefore the amount of smoke generated during starting.
IMCA
GUIDANCE
2.2.5.2 Figure 2-18 shows the starting time for a large medium speed diesel engine starting
from the ‘not on standby’ condition. If the engine must be prelubricated it can take
over 2 minutes to connect the generator. If prelubrication was running at the time of
the start signal then the connection time begins with the slow turn function and
reduces to around 1.5 minutes. If the generator was in ‘hot standby’ mode then the
slow turn is omitted and connection times reduce to around 1 minute. The time
taken to synchronise the generator may depend to some extent on the stability of
the power system at the time of connection.
2.2.5.3 It may be possible to improve upon standard starting and connections times with the
engine manufacturer’s agreement and assistance. Designers should enquire about
starting restrictions as these can significantly influence time taken to connect
standby generators in response to engine failure. This may in turn influence the
power plant operating strategy in respect of the amount of spinning reserve that
must be maintained.
2.2.5.4 Blackout recovery times can also be adversely affected by starting requirements
which should be minimised as far as possible for DP vessels.
100
80
60
Speed (%)
40
Slow Sync
Prelubrication
20 Turn
0 Run Up
0
Start Signal 20 40 60 80 100 120 140 160
Time (s)
Figure 2-18 Medium Speed Engine Starting Time
IMCA
GUIDANCE
2.2.6 Restriction on standby status and starting time
2.2.6.1 Some diesel engines have restrictions on the time they can remain on standby
without an increase in the starting time. These restrictions can be due to such things
as oil build-up due to prelubrication which must be removed. Power management
systems may include engine management routines specifically to deal with these
features. Typical restrictions may include:-
1. Engine must be at preheat temperature and prelubrication must be running
2. Up to 12 hours engine may start without slow turn. This condition is
sometimes referred to as ‘Hot standby’
3. After 12 hours of prelubrication, engine must perform a slow turn before
starting. This extends starting time. This condition is sometimes referred to as
‘Cold standby’
2.2.6.2 Management of these restrictions typically includes the power management system
monitoring the time an engine has been on standby. As the time approaches 12
hours, the PMS will start the engine and run at 30% power or above. If this is not
possible the engine status will be changed to ‘Not standby’.
2.2.7 Black start capability
2.2.7.1 Most engines are capable of being started in an emergency situation without pre-
lubrication providing the engine jacket water is at or above a defined temperature
and the prelubrication was running a short time before the start request. A time limit
may be set for the maximum time after which the engine can be started without
prelubrication. Such limits can be of the order of one minute, which should be
adequate for most DP blackout recovery purposes. Confirmation should be sought
from the engine manufacturer that the engine can be started in this way. It may be
necessary to provide a dedicated ‘black start’ signal to the engine control system.
Although it is good practice to design the blackout recovery system to be
independent of the emergency generator, it is prudent to ensure that all systems
required to black start the engines can be supplied from the emergency generator in
case the engines cannot be started within the prelubrication override time. A dual
supply to such consumers from the main and emergency power system is
recommended, with the main power system providing the ‘normal’ source of power.
2.2.7.2 Where an exemption from prelubrication is not possible, or as additional protection,

an air driven prelubrication pump can be driven from the starting air system.
2.2.7.3 Where the engine requires fuel pressure for starting it may be possible to arrange a
gravity feed tank or an air driven fuel pump to be activated for blackout recovery.
IMCA
GUIDANCE
2.2.8 Load application time
2.2.8.1 Most engine manufacturers will provide figures for the maximum continuous rate of
application of load (kW/s) and for the maximum step load that can be applied. In DP
applications, the rate of load application required by the thrusters for accurate
station keeping may approach the limits of the engine’s capability and plant
designers should ensure that loading ramps are not unnecessarily severe. Most
thruster control systems can be programmed to accept a loading ramp to ensure
limits are not exceeded. Similar safeguards should be applied to large non DP
related consumers such as active heave compensation or drilling consumers.
2.2.8.2 Load increase on an engine may occur due to increasing demand from consumers,
but also as a result of engine failure leading to loss of generating capacity. In many
DP power plant designs it is possible for several generators to be lost together as
the result of a single failure. Therefore, plant designers need to consider the
maximum loss of power generating capacity that is likely to occur, not just failure of
one generator. Rapid load shedding functions may assist in meeting engine
manufacturer’s requirements.
100
90 Blackout Normal
80 Standby
DP
70
60
Power(%)
50
40
30
20
10
0
0 20 40 60 80 100 120 140 160 180
Time(s)
Figure 2-19 Load Increase Rates for Generators Operating at Synchronous Speed
2.2.8.3 Engine manufacturers may also define an emergency or blackout load up ramp
which is considerably steeper than the normal ramp.
2.2.8.4 In Figure 2-19, the load ramp required by thrusters, i.e. ‘DP’, falls between the
normal operating curve and blackout curve.
IMCA
GUIDANCE
2.2.8.5 Note that load application may be the combination of load increase on the overall
system and the load transfer to a newly connected generator which is following a
load up ramp.
2.2.9 Load steps
2.2.9.1 At one time classifications societies required generators to be capable of a 50% load
step without unacceptable fall in frequency. Many modern medium speed diesels
are highly turbo charged and cannot achieve these levels of step load because of
the lag introduced by the turbocharger. Current practice is to make reference to
IACS requirements or ISO 8528-5 which can be achieved. Engines which meet
these requirements may be referred to as 3 or 4 step engines, that is to say they
require that the largest instantaneous load step be limited to some specified value.
Some manufacturers simply state a maximum step load such as 33% of MCR where
as others relate the maximum permissible step load to the load on the engine at the
time the step is applied as shown in Table 2-3 below. Limits may include a period of
stabilisation after application of the step load which may be of the order of 10s.
Table 2-3 Maximum Permissible Step Load
% MCR 0 33 56 74
Max load step % 33 23 18 26
2.2.9.2 To reduce the effects of turbocharger lag and thus improve the step response some
manufactures employ other methods such as a combination of
mechanically/electrically driven compressors and exhaust gas driven compressors.
Driving the turbocharger compressor with a short blast of compressed air is another
method used to improve step response.
2.2.10 Load rejection
2.2.10.1 The engine manufacturer may specify the maximum load rejection rate for normal
operation but in diesel electric designs the possibility of the generator circuit breaker
opening with the engine at or above full load must be considered.
2.2.10.2 In cases where the generator remains connected to the power distribution system
and the load rejection is caused by tripping of consumers, medium speed diesels
can generally accept instantaneous 100% load rejection without operation of the
over speed device, but speed deviation may be higher than that specified for normal
operation.
2.2.10.3 For power system operating in uncorrected droop the requirement to accelerate a
large number of pumps and fans from low frequency to high frequency can act as a
buffer to limit the rate of load rejection.
IMCA
GUIDANCE
2.2.11 Low load running
2.2.11.1 The following terms are used by engine manufactures to describe engine loading
1. Overload > 100% rated power
2. Full load = 100% rated power
3. Part load < 100% rated power
4. Low load < 15% (MDO) 25% (HFO) rated power
5. No load = 0% rated power
2.2.11.2 Long periods of low load running can be a feature of DP operations particularly
where the fault tolerance of the power plant depends on maintaining a large
spinning reserve. As this type of operation is detrimental to engine, efficiency,
emissions, performance and reliability, some engine manufacturers state a minimum
figure such as 15% of MCR if the engine is operated on diesel fuel oil.
2.2.11.3 If the DP power plant has been designed to have a low impact worst case failure
(WCFDI = 1 Generator) then the plant can generally be run at relatively high loads.
However, if prolonged low load running is unavoidable there are a number of
features that can be considered to improve conditions.
1. Most power management systems load dependent stop as a way to manage
low load running but most operators prefer to use this in an advisory mode.
2. Most power management systems offer an asymmetric load sharing functions
to allow soot deposits to be burnt off on one engine at a time
3. Engines can be fitted with part load nozzles
4. Engines can provided with two stage charge air cooling systems
5. Some high speed diesels can reduce the number of cylinders in use at low
power output levels.
2.3 ENGINE AUXILIARY SYSTEMS
2.3.1 General
2.3.1.1 The term ‘marine auxiliary systems’ is used to describe all those systems and
functions required to support thruster, generator and related plant. Some of the
systems may be mounted on the generator skid or as standalone units while others
may be part of the engineroom and pump room design. In any fault tolerant system
based on redundancy it is the common points between otherwise separate and
redundant elements of the design that allow faults to propagate from one redundant
element to the other. This is particularly true of engine auxiliary systems related to
fuel, compressed air and cooling water systems where several generators may be
connected to a common system. In recent years some classifications societies have
introduced additional DP rules related to the design of marine auxiliary systems to
try and limit the potential for more than one generator to be lost as the result of a
single failure. There are significant advantages to making generators as
independent as possible even if power distribution system faults could cause the
loss of multiple generators.
IMCA
GUIDANCE
2.3.2 Fuel
2.3.2.1 Most engines for DP vessels use diesel fuel oil but heavy fuel oil system can be
found in some applications such as heavy lift vessels and shuttle tankers. Heavy
fuel oil system need careful attention to ensure there are no single point failures
associated with fuel heating systems or changeovers from HFO to DFO.
2.3.2.2 A secure supply of clean fuel is essential for reliable operation. Although
redundancy in DP system design generally begins at the fuel oil day tanks, reliability
begins with the design and operation of the fuel oil storage, purification and
distribution systems. Fuel system faults are generally associated with blockages,
leaks and contamination by water or MBC.
2.3.2.3 Although DP Class 2 failure definitions allow redundant generators to share

common pipe work, some classification societies now require that fuel systems for
engines considered to provide redundancy are totally separate. Cross over valves
are permitted for maintenance but they must be kept closed during DP operations
requiring the vessel to be fault tolerant.
2.3.2.4 Fuel system design benefits from fuel oil pressure alarms, differential pressure
alarms at filters, water detectors at purifiers and leak detectors for high pressure fuel
lines. Provision of independent tank level gauges and low level alarms offers
additional protection against an empty day tank.
2.3.2.5 The practice of running ballast or cooling water lines through fuel storage tanks
should be avoided. Faults in engine fuel oil coolers can also be responsible for water
contamination.
2.3.2.6 Where engine operation depends on fuel pumps, consideration should be given to
how a fuel supply can be provided for blackout recovery. A limited supply from a
gravity tank or pneumatically operated black start fuel pump are amongst the
options.
2.3.2.7 In general the design of the engine fuel supply system should follow the overall split
in the redundancy concept including, day tanks, supply and return lines, filters,
pumps, quick closing valves and their controls.
2.3.3 Lubricating oil
2.3.3.1 Engines generally have independent lubrication systems but engineroom pipework
intended to provide facilities for replenishing engine sumps and recovering waste oil
may increase the risk of inadvertently emptying one engine and simultaneously
overfilling another. Consideration should be given to the provision of valves and
control measures to prevent such acts of mal-operation.
2.3.4 Starting systems
2.3.4.1 Starting system for diesel engines can be by electric or pneumatic starter motor, or
by distributor type starting where high pressure air at 30bar is injected directly into
the engine cylinders. The later is the most common system on large medium speed
engines.
IMCA
GUIDANCE
2.3.4.2 The starting air system must be designed to meet classification requirements for the
type of vessel, in relation to numbers of starts on each engine etc. Where fault
tolerance depends on the successful connection of standby generators the starting
system must be particularly robust.
2.3.4.3 The design of the starting air system must also consider the blackout restart
strategy. In some designs the power management system will simultaneously order
the start of all available generators following detection of blackout. In such cases the
starting air system must be designed to allow simultaneous cranking.
2.3.4.4 Where low pressure control air supplies are derived from high pressure starting air
systems, a risk of overpressure exists if the pressure reducer fails in such a way that
it passes high pressure air to the lower pressure system. Overpressure in the control
air system can cause unexpected effects including the operation of engine stop
cylinders. Correctly calibrated pressure relief valves provide a degree of protection
as does the relative volume of the lower pressure system if it is large in comparison
to the high pressure systems.
2.3.5 Control air
2.3.5.1 Control air systems for engines can have a wide variety of uses including.
1. Oil mist detectors
2. Start and stop cylinders for the fuel system
3. Operation of ‘rig saver’ combustion air shut off valves
4. Operation of combustion air dump valves
5. Temperature control valves for HTFW and LTFW systems
6. Jet assist for the turbocharger
7. Pneumatically operated governors
2.3.5.2 Problems with the design of control air systems generally arise when failure of the
control air supply has an adverse effect on engine operation and several engines
share a common control air supply.
2.3.5.3 At least one classification society now requires full separation of pneumatic systems
serving equipment intended to provide redundancy even for DP Class 2 designs.
2.3.6 Combustion air and engineroom ventilation
2.3.6.1 For DP Class 2 and Class 3 vessels ventilation and the supply of combustion air to
the engines is considered in the same way as any other marine system. No single
failure should cause the engines to be adversely affected to the point where position
and heading cannot be maintained. Although DP Class 2 permits designs having a
single engineroom, most modern DP Class 2 vessels have at least two enginerooms
making it easier to split ventilation and fire control measures along the lines of the
redundancy concept.
IMCA
GUIDANCE
Figure 2-20 Engineroom combustion air supply and ventilation
2.3.6.2 Combustion air can be drawn from inside the engineroom or from outside the vessel
by way of dedicated combustion air vents connected to the turbocharger inlets.
Figure 2-20 shows the conventional arrangement where combustion air is drawn
internally. A flap can be arranged to draw combustion air from inside the
engineroom to ease starting in cold climates. Ventilation is primarily concerned with
the extraction of heat and fumes to maintain acceptable engine room conditions.
Engine manufacturers may stipulate a range of permissible combustion air
temperatures such as 15ºC to 35ºC with an occasional increase to 45 ºC. Vessels
for arctic service may require heating of combustion air in some circumstances.
Sources of air for ventilation and combustion should be arranged to avoid sea spray
dust and exhaust fumes in all wind directions and vessel headings. Control of
engineroom internal pressure is important for safety reasons and a slight
overpressure is often recommended.
2.3.6.3 Engineroom ventilation and combustion air supply may be arranged separately with
dedicated combustion air fans directing air to the turbocharger inlets and ventilation
being ducted to locations for heat extraction.
2.3.6.4 Ventilation and combustion air failures can be related to:-

1. Failure of ventilation fans or their supplies
2. Closure of fire or watertight dampers
3. Operation of combustion air shut-offs on engines
4. Operation of combustion air dump valves on engines
5. Release of fire-fighting medium
IMCA
GUIDANCE
2.3.6.5 Experience suggests that fan failure does not usually affect engine operation in the
short term but temperatures may rise relatively quickly. See also crankcase
breathers in Section 2.3.9.
2.3.6.6 Design problems may arise in respect of fault tolerance when fire damper operation
is linked to fan running status such that the fire dampers close when the fans stop.
Closure of fire dampers on a running engineroom has a more severe effect and may
result in significant negative pressure in the engineroom. This can represent a safety
hazard and this should be borne in mind when conducting DP FMEA proving trials.
Engineroom fire dampers should generally fail ‘open’ or ‘as set’ on loss of actuator
power or control signal but classifications society requirements may also influence
such designs.
2.3.6.7 Poor design of F&G and ESD systems has also been known to cause fire dampers
in otherwise independent engineroom to close because of power and
communications faults in safety system field stations. Poor choice of ‘fail safe’
settings can also have this effect.
2.3.6.8 Closure of combustion air shut-offs (rig savers) results in immediate stop of the
engine and tripping of the generator on reverse power. Rig savers are normally
designed to require air pressure to close, and failures are generally related to
spurious activation. Design problems in relation to fault tolerance can arise where
engines share a common control system for the rig savers.
2.3.6.9 Combustion air dump valves (or flaps) are located after the turbocharger and are
designed to vent the air from the turbocharger into the engineroom when the rig
saver closes. Failure of this valve to the open position results in a large reduction in
the engines ability to generate power. This creates a severe load sharing imbalance
accompanied by large amounts of black smoke from the exhaust because the
governor advances to the full fuel position in order to try and restore power output.
This may distract attention from the true cause of the failure. Design problems can
arise in respect of redundancy when these valves fail to the open position on loss of
air supply and multiple engines share a common control air supply or control
system.
2.3.6.10 Classification societies may require that rig saver valves are located after the
turbocharger in view of the risk of over speeding of the turbocharger if the
combustion air supply is cut off.
2.3.6.11 It has been stated that using combustion air from outside the vessel provides
protection against release of unexpected fire-fighting medium. This is an unlikely
failure mode for established fire-fighting systems but has occurred.
2.3.7 Jacket cooling water and control
2.3.7.1 Most engines for DP vessels are fresh water cooled by way of heat exchangers
served by the vessel’s seawater cooling system. On smaller DP vessels engines
may be radiator cooled or by way of box coolers set into the hull. In some cases
equipment may be directly cooled by the seawater system. Circulation of coolant
may be provided by engine driven pumps or electrically driven pumps or by a
combination of the two as shown in Figure 2-21 below.
IMCA
GUIDANCE
EXPANSION
TANK
LT
ALTERNATOR
ELECTRIC
PUMP
90°C
TT
36°C HT
TT CHARGE AIR COOLER
STAGE 1
ENGINE
JACKET
SW ENGINE
DRIVEN PUMP
HEAT
EXCHANGER
PREHEATER
ELECTRIC
PUMP
M CHARGE AIR
COOLER STAGE 2
ENGINE
DRIVEN PUMP LT LUBE OIL
COOLER
Figure 2-21 Engine HT and LT Cooling Water System
2.3.7.2 Engine cooling system may be divided into:-

1. High Temperature Fresh Water cooling (HTFW) – typically 90ºC
2. Low Temperature Fresh Water cooling (LTFW) – typically 36 ºC
2.3.7.3 These systems may in fact share the same cooling water and expansion tank by
way of three-way mixing valves designed to regulate the relative system
temperatures.
2.3.7.4 The HTFW circuit will normally be connected to such things as :-

1. 1st stage charge air cooler
2. Engine water jacket
3. Jacket water pre heater
4. Water maker
5. Water maker booster heater
2.3.7.5 The LTFW circuit will normally cool such things as:-
1. 2nd stage charge air cooler
2. Lube oil cooler
3. Alternator cooler
IMCA
GUIDANCE
2.3.7.6 Control valves for regulating engine temperature are generally:-

1. Wax element type – AMOT
2. Electric actuator with electric controller – Motorised valve
3. Pneumatic actuator with electric controller
2.3.7.7 Control valves are generally designed to fail to full cooling. Fail ‘as set’ may not be
sufficient to prevent temperature instability in the power plant. Wax element type
valves may fail to open on rising temperature but the use of multiple elements
means that failure is usually gradual, providing an opportunity for the degradation of
performance to be noticed.
2.3.7.8 Where several engines share a common LTFW system controlled by a single valve,
failure of the valve to open on rising temperature due to mechanical faults may be
enough to cause generators to trip even if the valve normally fails to the open
position.
2.3.7.9 Temperature control may be by way of dedicated PID controllers, the engine
manufacturers control system, or by the vessel management system.
2.3.7.10 Problems with the design of cooling systems in respect of fault tolerance usually
arise when designers interconnect generator cooling water systems say to a
common engineroom LTFW system or to supply a single water maker.
2.3.7.11 Design errors also include failure to correctly assign power supplies for pumps,
temperature control valves and their controllers in line with the overall split in the
redundancy concept. At least one classification society now requires that that FW
cooling systems for engines and other equipment intended to provide redundancy
are totally separate (even for DP Class 2) in view of the risk of leaks leading rapidly
to overheating.
2.3.8 Jet assist
2.3.8.1 Jet assist is a function added to highly turbocharged medium speed diesels to
reduce the turbo lag and increase the step response. Nozzles within the compressor
casing direct air on to the impeller to accelerate it rapidly in response to load
changes. Jet assist may be activated in response to:-
1. Engine starting
2. Generator circuit breaker closing
3. Speed undershoot
4. Sudden increase in fuel racks
2.3.8.2 Jet assist time can be varied according to demand – 5s to 10s is typical.
2.3.8.3 The activation and duration of the jet assist function can be controlled by the engine
manufacturer’s control system or by the vessel management system and requires
information on the speed of the engine, the fuel admission and starting air pressure.
A number of conditions are monitored and may cause Jet Assist to be inhibited to
prevent it being on for too long or depleting the air supply.
IMCA
GUIDANCE
2.3.8.4 Experience suggest that failure of the jet assist function to operate in response to
step loads does not cause generators to trip but may cause frequency based load
shedding to function briefly in extreme cases. Nevertheless, air supplies and control
systems for Jet Assist functions should be split along the lines of the redundancy
concept.
2.3.8.5 Information from one engine manufacture of large medium speed diesels suggests
that pulsating load changes of greater than 25% can occur as frequently as 30 times
per hour in dynamically positioned vessels.
2.3.8.6 Design errors in relation to Jet Assist functions are normally related to under sizing
the air supply and introducing commonality between redundant generators by way of
the air supplies or control systems.
2.3.9 Crank case breathers
2.3.9.1 The crank case breather is intended to allow oily fumes to escape from the engine
crankcase and vent any slight pressure build up. More severe pressure build up
related to crankcase explosion is vented by dedicated crankcase doors or
expanding bellows. Engine manufacturers may recommend that crank case
breathers are taken to the funnel top by way of individual pipework for each engine.
In the case of vessels intended to work in explosive atmospheres, the crankcase
breathers may be fitted with spark arresters.
2.3.9.2 Spurious operation of oil mist detectors can occur if crank case breathers become
blocked, and design problems related to fault tolerance and redundancy can arise if
the pipework for crank case breathers is made common such that multiple engines
may be affected by a blockage in the pipe or spark arrester.
2.3.9.3 Engineroom ventilation failures have been known to cause multiple engine loss
when engine safety shut downs include crank case differential pressure. This occurs
because the crankcase internal pressure is determined by the pressure outside the
engineroom through the crank case breathers while the external pressure on the
crankcase is determined by the pressure in the engineroom. In DP Class 2 vessels
with a single engineroom this can cause loss of engines exceeding the worst case
failure design intent.
2.4 ENGINE CONTROL AND SAFETY SYSTEMS
2.4.1 Control topologies
2.4.1.1 Most modern diesel engines have comprehensive and complex control and
monitoring systems. Various control topologies are possible using either the engine
manufacturer’s control system or the vessel automation system as shown in Figure
2-22 and Figure 2-23 respectively. Various hybrid combinations which use the
electronic speed governor as part of the control system are also possible. Many DP
vessel owners also specify unmanned machinery space notations such as UMS,
ACCU or E0, not because they intend to operate with an unmanned engineroom but
because these notations provide a suitable standard for the control and safety
systems required in a redundant propulsion system.
IMCA
GUIDANCE
2.4.1.2 It is extremely important to understand the extent of control and safety functions
provided by engine control system and the common mode failures that can be
introduced by connecting engines together through these systems. In general,
redundant systems should, have as few common points between them as possible
and any such common points should fail to the safest condition and have a
comprehensive set of protective functions designed to prevent faults in one
redundant element affecting another.
GOVERNOR ACTUATOR
DIESEL ENGINE
ENGINE TERMINAL BOX
TO VESSEL
SWITCHBOARD
ENGINE MANUFACTURER’S
CONTROL SYSTEM
MAIN
AUXILIARY ENGINE ENGINE POWER SUPPLY
SPEED
SYSTEM SAFETY CONTROL UPS
CONTROL
CONTROL SYSTEM SYSTEM EMERGENCY
POWER SUPPLY
ENGINE ENGINE VESSEL

FIELD
CONTROLS CONTROLS AUTOMATION
STATION
WHEELHOUSE ECR PMS
NET A NET B
Figure 2-22 Engine Control and Protection Based on Engine Manufacturer’s Systems
IMCA
GUIDANCE
GOVERNOR ACTUATOR
DIESEL ENGINE
ENGINE TERMINAL BOX
TO VESSEL
SWITCHBOARD
AUXILIARY
SYSTEM PMS AND
CONTROL ENGINE ENGINE LOCAL
SWITCHBOARD SPEED
SWITCHBOARD SAFETY CONTROL CONTROL
CONTROL FIELD CONTROL
CONTROL SYSTEM SYSTEM PANEL
STATION
VESSEL AUTOMATION SYSTEM VESSEL AUTOMATION SYSTEM FIELD STATION
NET A NET B UPS NET A NET B
VESSEL AUTOMATION SYSTEM
MAIN EMERGENCY
POWER SUPPLY POWER SUPPLY
Figure 2-23 Engine Control and Protection Based on Vessel Automation System
2.4.2 Control power
2.4.2.1 Engine control power is typically 24Vdc which may be derived either from a DC
power supply with battery backup or from a control system which is itself powered
from a UPS. Switchboard control supplies are typically 110Vdc and may mirror the
24Vdc distribution to the engines. Occasionally, engine and switchboard control and
protection functions are supplied from a common DC distribution system. This
arrangement introduces a common point of failure between control and protection
that can leave one or more uncontrolled generators connected to the switchboard
with no way to trip them. In such cases it may be necessary to have another supply
to trip the generators in the event that control power is lost. The circuit breaker
spring winder supply is sometimes used for this purpose.
2.4.2.2 The engine control and safety system should have separate power supplies. Ideally,
these supplies should be from separate sources but class may accept separate
fuses from the same distribution. UPS battery endurance should be a minimum of
30 minutes. The UPSs (or DC supplies) should have a dual power supply from the
normal and emergency distribution. The normal source of supply should be the main
power system.
IMCA
GUIDANCE
Figure 2-24 Typical control power arrangement
2.4.2.3 Figure 2-24 shows the most common supply arrangement where all engines on one
bus share a control power supply. However, there are significant benefits to making
each generator as independent as possible, even if the redundancy concept is only
a two way split. Losing multiple generators as the result of a single failure is
extremely disruptive to the power system. Where the alternator has a permanent
magnet generator consideration can be given to using this as one source of control
power such that each generator is independent of the external control power source
once it is running. Figure 2-25 shows just such an arrangement.
Figure 2-25 engine control power with PMG backup
2.4.2.4 Alternatively each generator can be supplied from its own control power system as
shown in Figure 2-26.
IMCA
GUIDANCE
Figure 2-26 Independent engine control supplies
2.4.2.5 In a few cases designers have elected to supply some engine control systems on
each side of the split in the redundancy concept from the same power source.
Although this arrangement ensures that a control power fault will not disable all
generators on one bus, it may introduce unacceptable restriction on the combination
of generators that can be connected as any combination powered from the same
source will result in loss of control over all running engines, and possibly a blackout.
2.4.2.6 Cross connecting redundant engine control power supplies by way of diodes as
shown in Figure 2-27 is also not recommended as a way of improving reliably as a
voltage dip associated with a fault in one control power supply will be seen by all
control systems. If the voltage dip ride through is insufficient then all running engines
may malfunction. This arrangement is also dependent on the selectivity of the fuses
at the generator and power supplies to ensure a fault in one engine supply does not
blow the main fuses at each DC supply output.
Figure 2-27 Diode isolated dual supplies
IMCA
GUIDANCE
2.5 SAFETY FUNCTIONS
2.5.1 General requirements
2.5.1.1 Modern diesel engines are supplied with a large range of alarms and protection
functions. Specific requirements for safety systems depend on the size of the
generators and also whether the vessel has unmanned machinery space notation or
not. The redundancy concept needs to carefully consider the implications of each
function which is capable of stopping the engine. Some classifications societies
require that power failure in the safety system is not to lead to a loss of propulsion.
Engine safety systems are generally created using hardwired relay logic. A few of
the more common engine shut down functions are discussed in the sections which
follow.
2.5.2 Over speed
2.5.2.1 This may be a mechanical or electronic device and must be independent of the
normal speed control system. Sometimes the electronic over speed is based on a
transducer sensing the passing of teeth on the flywheel or similar arrangement.
These devices normally fail safe (engine continues to run) on failure of the power
supply. However, there have been cases where low voltage (rather than zero
voltage) in the power supply to the transducer and electronics has caused it to
falsely indicate over speed and shut down the engine. In designs where all engines
share a common power supply it is possible for all engines to trip if the power supply
voltage goes out of tolerance.
2.5.2.2 Other control devices can also malfunction. Certain models of governor are known
to fail to full fuel if their 24Vdc supply falls to 18Vdc.
2.5.3 Rig savers
2.5.3.1 In the case of vessels operating in explosive atmospheres the over speed device
must be supplemented by a device that shuts off the combustion air supply as
discussed in Section 2.3.6. These devices normally fail as set on loss of control air
supply.
2.5.4 Oil mist detection
The presence of oil mist in the crankcase may indicate main bearing failure but also
represent a potentially explosive condition. In other cases the condition is caused by
a blocked crankcase breather. Oil mist detectors are generally arranged to stop the
engine on detection of oil mist. The detectors generally operate on optical principles
in which a sample of the crankcase gases is drawn through a sensing chamber
using a venturi effect. The air supply to drive the venturi is typically derived the from
the engine control air supply. Loss of the air supply causes an instrument alarm but
does not usually cause a false indication. Very occasionally oil mist detectors on
multiple engines have been known to operate spuriously is response to certain
tropical atmospheric conditions or if engine share crank case vents.
IMCA
GUIDANCE
2.5.5 Crank case differential pressure
2.5.5.1 Crankcase differential pressure sensors are arranged to stop the engine if significant
pressure difference is detected. The presence of significant pressure in the
crankcase may indicate a cracked piston, broken piston ring or water in the
crankcase. As it takes a short time for the crankcase and engineroom pressure to
equalise following a sudden change, loss of engineroom ventilation may trigger a
spurious shut down on multiple engines. A time delay may be introduced in to the
alarm and shut down circuit to overcome this problem.
2.5.6 Fuel shut down
Engine emergency stops and safety system may act in several ways to ensure an
engine is stopped:-
1. Governor signal to zero
2. Air cylinder pushes fuel rack to zero fuel – A ‘break back’ system may be used
to overcome the force of a faulty governor
3. Fuel solenoid valve will be closed
4. Electrically drive fuel pumps will be turned off
2.5.7 JW temperature high
2.5.7.1 High jacket water temperature may indicate a problem with the engine cooling water
systems. Loss of cooling water can cause engines and thrusters to overheat in a
matter of seconds, so operator intervention to isolate leaks is not a credible
mitigation. It is for this reason that IMCA and some major classification societies
require complete separation of freshwater cooling systems for equipment intended
to provide redundancy, even in DP class 2 designs.
2.5.8 Emergency stops
2.5.8.1 In addition to any other location required by Class, engine emergency stops should
be provided for DP operators and engineers at the vessel management station close
to the main DP station. In DP Class 3 designs, line monitoring systems should be
used to prevent loss of multiple engines if emergency stop control lines pass though
areas subject to fire or flooding.
2.6 GENERATORS
2.6.1 Types of AC machine
2.6.1.1 The generators used in the majority of modern DP vessel are three phase,
synchronous, self exciting, alternating current generators with brushless excitation
systems. Variations on this design include:-
1. Self excitation based on build up from remnant field
2. Permanent magnet exciter
3. Excitation supply from auxiliary stator winding
IMCA
GUIDANCE
2.6.1.2 In almost all self exciting generators the main DC field current is provided by way of
shaft mounted diodes from a small AC generator on the same shaft. This AC
generator is called the exciter. The stationary winding of the exciter is supplied with
variable DC power from the Automatic Voltage Regulator (AVR) which may be
supplied from another shaft mounted AC generator called the PMG, as showing in
Figure 2-28, or by way of a transformer at the generator terminals as shown in
Figure 2-29 . Some generators have an auxiliary stator winding for this purpose as
shown in Figure 2-30. Self exciting alternators can excite without an external source
of power. In the case of generators that do require an external source of power,
class may require that a redundant source is provided for field flashing.
Figure 2-28 Alternator with PMG
IMCA
GUIDANCE
Figure 2-29 Alternator with AVR powered by Generator VT
VOLTAGE SENSE
AVR
CURRENT SENSE
POWER OUT POWER IN
Figure 2-30 Alternator with auxiliary winding
IMCA
GUIDANCE
2.6.2 Short circuit performance
2.6.2.1 Classification societies typically require that alternators are able to deliver at least
three times rated current for 2s. Such large currents are often necessary to ensure
the over current protection scheme operates selectively. Alternators with permanent
magnet generators or auxiliary windings as the primary source of excitation power
can maintain excitation through the severe voltage dip associated with a close short
circuit fault. However, alternators using the terminal voltage as the source of
excitation power require excitation support for the duration of the short circuit fault.
Excitation support is generally created by providing the AVR with an alternative
power supply from current transformers which allow it to derive power from the fault
current itself. Without excitation support, the generator may not be able to deliver
enough fault current to operate the over current relays, and the voltage dip may be
extended to the point where the generator feeders or other circuit breakers trip on
under voltage protection, leading to blackout or widespread dislocation of the power
distribution system.
2.6.3 Generator voltage ratings
2.6.3.1 Generators for marine applications are typically rated for one of the many standard
voltages such as 380V, 440V, 480V, 690V, 3.3kV, 6.6kV and11kV.
2.6.3.2 In marine rules and guidelines any voltage less than 1000V is considered to be Low
Voltage (LV) and anything above that is referred to as High Voltage (HV). Shore
based utilities and their equipment supplies may refer to marine HV voltage levels
as Medium Voltage (MV).
2.6.3.3 For any given power rating the line current falls as the generator’s voltage rating
increases. A significant factor in the choice of the system voltage level is the short
circuit fault withstand rating of the switchboards. Generally, the higher the fault
withstand level the more expensive the switchboard. Thus the higher cost of high
voltage equipment may be offset by lower short circuit fault withstand level. Higher
current levels in Low voltage equipment and distributions also requires more copper
and thus the cost, bulk and weight of cables may also have an influence on the
design. HV solutions tend to be favoured for power plants above about 10MW
installed power.
2.6.3.4 Alternators may be fresh water cooled, air cooled or seawater cooled. Bearings may
be provided at both the non drive end and the drive end. In some designs, the
engine and alternators share the drive end bearing.
2.6.3.5 Alternators are typically provided with a range of alarm and monitoring functions
including:-
1. Current transformers for monitoring and protection
2. Stator winding temperature sensors
3. Air temperature indicators
4. Lubrication flow
5. Cooling water temperature indicators
6. Cooling water leak indicators
IMCA
GUIDANCE
2.6.3.6 The generator protection scheme is discussed in more detail in Section 2.122.12 on
generator protection philosophy.
2.7 FUEL CONTROL
2.7.1 Compression ignition
2.7.1.1 Diesel engines operate on the principal of compression ignition. Fuel is admitted to
the cylinders as the piston rises, compressing the air and increasing its temperature
to the point where it can ignite the fine spray of fuel.
2.7.1.2 There are three typical types of fuel control system for diesel engines.
1. Small multi cylinder engines may have a rotary distributor type pump were
each injector is connected to a high pressure fuel pump in turn according to
the firing sequence.
2. Modern ‘electronic’ diesel engines may have a ‘common rail’ fuel system
where a supply of fuel is maintained at high pressure by the fuel pump and
continuously distributed to the injectors by high pressure pipework. Injection is
triggered electronically. The amount of fuel admitted is controlled by the time
each fuel valve is open.
3. Large medium speed diesel engines usually have one fuel pump and one fuel
valve per cylinder. The fuel pumps are operated by a camshaft and fuel is sent
to the fuel valve (injector) from the fuel pump at high pressure causing a
spring loaded valve to lift from its seat in the nozzle admitting fuel at the right
time for combustion. The amount of fuel admitted is controlled by varying the
stroke of the fuel pumps. This function is carried out by the fuel rack.
2.7.2 Engine governors
2.7.2.1 The engine governor controls the fuel admission to the engine to maintain the
desired speed when the engine is operating independently and to maintain both the
system frequency and the desired share of the total system load when the generator
is operating in parallel with other generators.
2.7.2.2 There are various types of governors but the market for DP vessel generators is
now dominated by electronic governors with electric or electro hydraulic actuators to
control the fuel rack on the engine as shown in Figure 2-31.
IMCA
GUIDANCE
Figure 2-31 Electronic governor with hydraulic actuator
2.7.2.3 Some governor actuators contain a mechanical ‘ball head’ governor as backup to
the electronic unit. Although this feature was introduced to improve reliability it can
be difficult to coordinate with some load sharing systems and has caused blackouts
in a few cases.
2.7.2.4 Many older vessels were fitted with hydro-mechanical governors. These units are
often interfaced to the power management system by a speeder motor (or pilot
motor) which physically adjusts the speed set point up and down in response to
electric ‘raise speed’ and ‘lower speed’ commands.
2.7.2.5 The governor is essentially a speed control system. The speed of the engines is
monitored by a magnetic pickup and transmitted to the speed control unit. Here the
speed of the engine is compared with the speed set point. The speed error is
applied to a three term controller which drives the fuel rack actuator to reduce the
speed error. When two or more generators are required to share load between them
a power sensor is added to the control scheme although it is possible to make
generators load share without measuring the power being delivered.
2.7.2.6 Electronic governors from the main manufactures have reached such a level of
sophistication that they can be programmed to carry out many features normally
found in vessel management systems such as load sharing, synchronising, power
management, alarm and monitoring, and control of auxiliary systems such as fuel
and cooling water pumps.
2.7.2.7 Fuel control for ‘electronic’ engines is usually provided by the engine manufacturers
themselves and may be integrated into the engine control system as shown in
Figure 2-32.
IMCA
GUIDANCE
Figure 2-32 Speed control for common rail ‘electronic’ engine
2.7.3 Actuators
2.7.3.1 Governor actuators for electronic governors can be electric torque motors or electro
hydraulic actuators. Actuators are described as forward acting if power is applied to
drive them towards the full fuel position and reverse acting if power is applied to
drive them to the zero fuel position as shown in Figure 2-33. Forward acting
actuators are the most common but a few vessels were fitted with reverse acting
actuators containing a mechanical ‘ball head’ backup governor. The principle of
operations is that if the electronic governor fails, the spring will pull the fuel rack to
the operating point of the mechanical back up governor which is adjusted to a
slightly higher set point.
2.7.3.2 Forward acting actuators fail to the zero fuel position on loss of power or signal. This
is a relatively safe failure mode. Reverse acting actuators fail to the full fuel
condition. This is not a safe failure mode and can cause blackout unless another
system intervenes. Electro hydraulic actuators derive their power from the engine by
way of a gear drive from the camshaft or other source. Electric actuators usually
derive their power from a UPS or battery charger supply associated with the
electronic governor.
2.7.3.3 Problems can arise with actuators if they stick in one position.
Figure 2-33 Forward and reverse acting actuators.

IMCA
GUIDANCE
2.7.4 Speed pickups
2.7.4.1 Engine speed is usually measured by a magnetic pickup sensing the passing of
teeth on a toothed wheel which may be the engine flywheel or mounted on an
auxiliary shaft. Sometimes, the toothed wheel is inside the actuator itself, mounted
on the drive for the hydraulic pump.
2.7.4.2 Failure of the magnetic pickup to ‘no signal’ may cause the engine governor to go to
full fuel as it assumes the engine is not running fast enough. Most electronic
governors have a motoring function that will shut down the engine if the speed pick-
up fails electrically. This function can be turned off during certain maintenance
procedures so it may be prudent to confirm the function is active by periodically
failing the speed pick up when it is safe to do so. There have been a few cases
where the speed pick up became loose and started to miss pulses. This failure
mode defeats the monitoring system and has caused a few blackouts.
2.7.4.3 Some governors are fitted with dual speed pick-ups. The governor will normally take
the highest reading pick-up as representing the engine speed. If one pick-up fails
the governor will issue an alarm but the engine will continue to operate. If the
second pickup also fails the engine will stop. It may be necessary to stop and start
the engine to clear the alarm on the first pickup after it has been repaired or
replaced.
2.7.4.4 Dual speed pickups can also be used to improve frequency stability on generators
with flexible coupling between the engine and the generator. Such couplings have
been known to introduce very severe frequency oscillations leading to blackout if a
single speed pick is installed on the engine side of the coupling. Special software
must be installed in the digital governor to take advantage of this arrangement. If
this feature is not available on the governor in question, the pickup should normally
be installed on the generator side of any flexible coupling to get the best results.
2.7.5 Load sharing schemes
2.7.5.1 There are three basic types of load sharing scheme

1. Speed droop
2. Compensated speed droop
3. Isochronous
4. Master slave
IMCA
GUIDANCE
2.7.6 Speed droop
2.7.6.1 In this mode of load sharing, the governor is adjusted to allow the engine speed
(system frequency) to droop slightly as the load on the generator increases. Typical
values for speed droop are 3% to 5%. The generator’s speed may start to oscillate if
the droop is too low and 2.5% is about the practical limit of stability. When two or
more generators are operating in parallel they naturally share load at a balance
point where the common network frequency intersects their respective droop lines.
In Figure 2-34 the total system load is equal to the rating of one generator. G1 and
G2 are identical and have 3% droop represented by the solid droop lines. Each
generator therefore carries 50% of the available load at 60.9Hz. If the droop line on
G2 is offset upwards (dashed line) the system frequency rises to 61.25Hz and load
sharing becomes imbalanced with G1 carrying about 30% and G2 about 70%.
G1 G2
63 63
62.5 62.5
Network Frequency (Hz)
62 62
61.5 61.5
61 61
60.5 60.5
60 60
0 20 40 60 80 100 0 20 40 60 80 100
Load (%) Load (%)
Figure 2-34 Generators load sharing by speed droop
IMCA
GUIDANCE
2.7.7 Compensated speed droop
2.7.7.1 Power management systems use the method of offsetting the droop line in Figure
2-34 to adjust both the network frequency and the relative load carried by each
generator to compensate for changes in total system load and engine/governor
characteristics. In this method of load sharing, which is sometimes called pseudo
isochronous, the PMS is constantly moving the droop lines on all the generator
governors up and down to make each generator carry an equal share of the load
and maintain a constant system frequency across the entire load range. To do this
the PMS needs to know that a generator is connected and what load it is delivering.
The PMS also need to know the bus frequency. Problems can arise with this type of
load sharing system in a number of ways.
1. A raise, lower signal sticks in the speed raise direction
2. A generator circuit breaker gives false indication of status
3. A generator kW transducer reads too low
4. A bus frequency transducer reads too low
2.7.7.2 Compensated droop can also be used to make one generator carry a much higher
load for engine conditioning purposes. This method of load sharing is often called
asymmetric or fixed target load sharing.
2.7.8 Isochronous
2.7.8.1 In this mode of control, the governors act to balance load sharing and maintain a
constant steady state frequency regardless of system load. The electronic control
units for each governor are directly connected by analogue or digital load sharing
lines which transmit information on generator load to the governors for all other
connected generators. In the case of analogue units, load bridges are used to
develop a speed bias representing the difference in the load carried by each
generator as shown in Figure 2-35. This bias is applied to the speed control loop in
each generator to balance load at the desired bus frequency.
POWER POWER POWER POWER

DG 1 DG 2 DG 3 DG 4
SPEED BIAS SPEED BIAS SPEED BIAS SPEED BIAS

GEN CB GEN CB GEN CB GEN CB
LOAD SHARING LINES
MAIN
BUSTIE
Figure 2-35 Analogue load sharing lines
IMCA
GUIDANCE
2.7.8.2 In the case of digital load sharing Figure 2-36, the digital speed control units are
connected by a communications network.
DG 1 DG 2 DG 3 DG 4
DSC DSC DSC DSC
COMMUNICATIONS
NETWORK
MAIN BUSTIE
Figure 2-36 Digital load sharing lines
2.7.8.3 Although synchronous generators run at exactly the same speed it is not possible to
set the speed set point of every generator exactly the same so the speed control
loops will always have a small error. This creates a very slight load sharing error that
cancels out the speed error provided the load sharing control loop is working
properly.
2.7.8.4 Problems can arise with this type of load sharing scheme if the load sharing lines
fail. Some manufactures offer dual load sharing lines backed up by default to droop
mode on loss of communication or detection of significant load sharing imbalance.
Although these features mitigate many of the risks associated with control system
failures they do not provide comprehensive protection against a generator failing to
full fuel and it is necessary to provide a supervisory protection scheme to monitor
generator performance independently of the load sharing system and split the power
system or trip a faulty generator before it can cause a blackout.
2.7.9 Master slave
2.7.9.1 Figure 2-37 shows a much simplified sketch of a master slave load sharing system.
In this arrangement one generator is always the master. There are two main parts
to the control system:-
1. Speed control
2. Load (real current) control
2.7.9.2 The speed control loop acts to keep the master generator running at set point
speed, normally equivalent to 60Hz. The load controller then applies additional
governor actuator command signal proportional to the load being carried by the
generator, thus the combined signal is intended to ensure the generator carries the
applied load at the required frequency. Only the master generator is under the
control of its own speed control loop but it supplies its speed error signal to all the
slave generators for combination with the signal from the real current sensor at each
of the slave generator terminals. This system is not widely used in modern DP
vessels.
IMCA
GUIDANCE
Figure 2-37 Master slave load sharing system
2.7.10 Electronic governor - principle of operation
2.7.10.1 Figure 2-38 is a much simplified drawing of an electronic governor and its
connections to a generator. Most electronic governors are capable of operating in
droop mode or isochronous mode. The speed of the generator is monitored by the
speed pick-up and compared with the speed set-point to create a speed error signal
to drive the actuator. The speed error is modified by a signal from the real power
transducer to create the required speed droop as generator load increases.
2.7.10.2 The real power transducer measures the generator’s terminal voltage and line
current and calculates the three phase power being delivered in kW. The kW signal
is applied to the load bridge which has different functions depending on whether the
governor is in droop mode or isochronous mode.
2.7.10.3 In droop mode, one element of the bridge is imbalanced by adding R5 in parallel to
create the required droop signal. Unbalancing the bridge in this way causes the V
diff signal to increase as generator load rises as shown in Figure 2-39.
IMCA
GUIDANCE
2.7.10.4 In isochronous operation, the load sharing lines are connected to the load bridges
on all other online generators at the point of circuit breaker closure. Any difference in
the load being carried by a generator will cause a current to circulate in the load
sharing lines creating a voltage difference on the output from the bridge (Vdiff). This
signal then modifies the speed error signal such that the signal to the actuator now
admits fuel to correct for speed errors and load sharing imbalance.
2.7.10.5 Effects of power sensor failures in droop mode. If the real power transducer fails to
‘no output’, the generator’s speed and therefore the network frequency will rise to
the no load speed. This has the effect of unloading all the generators operating in
parallel which also run at their no load speed. If the total system load is greater than
the rating of the faulty generator, it may trip on overload in which case the load will
be thrown back on the generators operating in parallel. If the system load is less
than the rating of the faulty generator the load sharing imbalance may stabilise with
the faulty generator carrying the total system load and all other generators running
at no load. However, if the no load set point of the faulty generator is higher than the
setting of the healthy generators there is a risk that they will trip on reverse power.
The exact outcome in this case depends on a number of different factors but
blackout cannot be ruled out and protective functions should be provided to split the
power system or trip the faulty generator.
2.7.10.6 Effects of power sensor or load sharing line failure in isochronous mode. If the real
power sensor or load sharing lines fail in isochronous mode a similar effect occurs
as there is no signal to modify the speed set point and balance out the error
between the actual bus frequency and the speed set point. If the speed set point is
lower than the actual bus frequency then the integral part of the speed controller will
continue to admit more and more fuel in an attempt to reduce the speed to zero.
However, this has the effect of unloading the other generators to the point where
they may trip on reverse power. Experience of this fault in marine power system
suggests the imbalance develops over a period of 5 to 10 minutes. A similar effect
occurs if the load sharing lines break between groups of generators.
2.7.10.7 Effects of power supply failure. Most types of electronic governors with forward
acting actuators fail to zero fuel if the supply voltage fails completely. However,
certain models are known to fail to the full fuel condition when the 24Vdc supply
voltage falls to around 18Vdc.
IMCA
GUIDANCE
ACTUATOR
GENERATOR
CIRCUIT BREAKER
24VDC
FUEL RACK
R R
Y Y ALTERNATOR
ENGINE
B B 24VDC
SPEED PICK UP SPEED SETPOINT
OPEN
CLOSE OV
SPEED SPEED
AMP
-+- PID
DROOP ISOCH
REAL POWER SPEED OFFSET (DROOP)

TRANSDUCER SPEED ERROR
LOAD OFFSET (ISOCH) OV
kW
R6
R1 R3 R5
CLOSED FOR DROOP

OPEN FOR ISOCH LOAD SHARING
LINES
V DIFF
V LOAD
R2 R4
LOAD BRIDGE
Figure 2-38 Electronic governor
2.5
2
Speed Offset (%)
1.5
0.5
0
0 10 20 30 40 50 60 70 80 90 100
Generator Load (%)
Figure 2-39 Speed offset signal
IMCA
GUIDANCE
2.7.11 Modern digital governors
2.7.11.1 Modern digital governors monitor several engine parameters to optimise engine
efficiency and reduced pollution. Vessel owners with identical engines having a
mixture of analogue and digital governors report superior engine performance from
the numerically (digitally) controlled engines. In particular, the load acceptance can
be considerably improved.
2.7.11.2 Parameters monitored by digital governors include:-

1. Engine speed
2. Actuator travel
3. Turbocharger boost pressure
4. Jacket water temperature
5. Oil pressure
6. Engine load
2.7.11.3 Figure 2-40 shows the block diagram of a typical modern digital governor
MAGNETIC
PICKUP
REDUNDANT ENGINE SPEED SIGNAL ADDITIONAL

MEMORY
PROCESSOR
ENGINE SPEED
ACTUATOR TRAVEL
SETPOINT
CONVERTER
VALUES
ALARM
BOOST
PRESSURE
SENSOR MICRO PROCESSOR
CONVERTER
TEMPERATURE
SENSOR
ENGINE STOP
POWER CAN-BUS
OIL PRESSURE CONVERTER
AMPLIFIER
SENSOR
DIGITAL INPUTS
DIGITAL APPLICATION UNITS

e.g. SYNCHRONIZER &
LOAD MEASURING UNIT
ACTUATOR
Figure 2-40 Modern digital governor
IMCA
GUIDANCE
2.8 EXCITATION CONTROL
2.8.1 Excitation systems
2.8.1.1 The various type of excitation systems have already been discussed in Section
2.6.1.
2.8.2 Automatic voltage regulators
2.8.2.1 The automatic voltage regulator is responsible for maintaining the generator’s
terminal voltage when the generator operates independently and maintaining the
voltage and reactive power sharing when the generator operates in parallel with
others. Figure 2-41 shows a much simplified schematic of a Thyristor Divert
regulator that was popular on DP vessels.
Figure 2-41 Automatic Voltage Regulator - (Divert type)
2.8.2.2 The bridge rectifier has two sources of ac power. The normal source of supply is
from the Red phase voltage by way of a choke. The alternative source of supply is
via the two excitation CTs on the Red and Blue phases respectively. This supply
provides power when the terminal voltage is low as in the case of a close short
circuit fault. On the output from the DC bridge is the divert thyristor. This
semiconductor is controlled to ‘divert’ current away from the generator field winding
thus controlling the excitation level of the generator and thus the terminal voltage.
The controller compares the generator’s R-Y line voltage against the voltage set
point and alters the firing angle of the thyristor accordingly. If the thyristor fails to the
open circuit condition, the field voltage current will go to maximum. Over excitation
may cause the operating point of other machines operating in parallel to move into
the ‘capacitive region’ and trip on their field failure protection. If the thyristor fails to
the ‘on’ condition the faulty generator will be tripped by its field failure protection.
IMCA
GUIDANCE
2.8.3 Reactive power sharing schemes
2.8.3.1 Much like load sharing schemes for governors there are three common types of
reactive power sharing schemes for automatic voltage regulators. Most AVRs are
capable of all three modes of control:-
1. Quadrature current compensation (reactive droop)
2. Compensated reactive droop
3. Cross current compensation
2.8.4 Quadrature current compensation
2.8.4.1 Quadrature Current Compensation (reactive droop) is added to the control scheme
to allow stable sharing of reactive power when generators are operated in parallel. It
is analogous to speed droop in governors. It is by far the most common form of
reactive power sharing scheme for DP vessels.
2.8.4.2 In this form of reactive power sharing, the excitation level is allowed to fall slightly
as the amount of lagging reactive current increases. This is achieved by adding a
small voltage representing the reactive current being deliver to the sensed line
voltage from the generator VT. This makes the sensed voltage appear greater than
it actually is thus reducing the excitation to create the voltage droop. A signal
related to the reactive current is obtained by measuring the blue line current with a
CT. The current from the CT is used to develop a voltage across a potentiometer.
The voltage is then added to the Red-Yellow line voltage before being applied to the
controller as the ‘sensed’ voltage.
2.8.4.3 Figure 2-42 shows that the blue phase voltage is 90° displaced from the Red-Yellow
line voltage. Thus the Blue line current will similarly be displaced by 90° plus how
ever many degrees it lags the blue phase voltage. Thus by adding the signal derived
from the blue line current CT (VIB) at 90° to the sensed voltage (VRY) as shown in
Figure 2-43 the sensed voltage will increase and decrease with the power factor
seen by the generator. Although the sensed voltage will be affected to some extent
by both the active and reactive components of the blue line current the geometry is
such that changes in the reactive component (inline with VRY) have much more
effect on the length of the ‘sensed voltage’ vector than changes in the active
component which is at 90° as shown in Figure 2-44. Most marine loads are inductive
and thus the line current lags the phase voltage thus creating the required droop as
it increases. However, if the line current is leading the excitation level will increase
as the current increases.
IMCA
GUIDANCE
Figure 2-42 Relationship of phase and line quantities
Figure 2-43 Voltage representing Blue line current is added to Red-Yellow Line voltage
Figure 2-44 Sense voltage increases as reactive component of current increases
IMCA
GUIDANCE
2.8.5 Compensated reactive droop
2.8.5.1 In this form of reactive power sharing scheme the power management system
adjusts the voltage set points of AVRs operating in reactive droop in much the same
way as it adjusts the governor set points. Thus the PMS can trim the AVRs to
maintain system voltage and balance reactive power sharing.
2.8.6 Cross current compensation (astatic loop)
2.8.6.1 This form of reactive power sharing is analogous to isochronous speed control. Just
as isochronous control maintains the system frequency irrespective of load (no
speed droop) so cross current compensation maintains the system voltage
irrespective of the amount of reactive power being supplied (no voltage droop).
Cross current compensation uses reactive power sharing lines in much the same
way that an Isochronous load sharing scheme does.
2.8.6.2 Cross current compensation schemes makes use of the same droop CT and burden
resistors as used in the Quadrature Current Compensation scheme with the addition
of a loop connecting generators operating in parallel as shown in Figure 2-45.
G1 G2
VL1 VL2
AVR AVR
IP1 IP2
DROOP CT DROOP CT
VR1 VR2
R1 R2
CROSS CURRENT LOOP
Figure 2-45 Cross Current Compensation
IMCA
GUIDANCE
2.8.6.3 The loop splits the current from the droop CTs with some passing through the
burden resistor as before and the rest circulating in the loop. When the reactive
power being delivered by the two generators is equal, the current circulating in the
loop is equal and opposite to that circulating through the droop CTs with the effect
that there is no voltage across the burden resisters R1 & R2. If one generator
delivers more reactive power than the other for some reason, the current in the loop
changes in such a way to create a positive voltage across the generator with too
much excitation and a negative voltage across the generator with too little. This
voltage difference across the resistors drives the two generators back into balance
again and the voltage across the resistors returns to zero. So long as the voltage
across the resistors is zero the sensed voltage will equal the actual terminal voltage
of the generators thus the AVR will maintain the terminal volts at the set point
regardless of the level of reactive power being delivered. Note that if the loop
breaks, both generators return to sharing reactive power in droop mode. If the line
short circuits then the resistors are effectively shorted out and one generator will
take the entire reactive load.
2.8.6.4 If power system is using cross current compensation with more than two generators
it is necessary to arrange for the loops to be created on either side of the busties so
that the generators on each independent power system can share reactive power.
This further complicates the switching arrangement required to break and terminate
the cross current loop.
DROOP CT G1 DROOP CT G2
I1 I2
R1 = R2 = 1 Ω
R1 R2
VR1 VR2
I3
CROSS CURRENT LOOP
Figure 2-46 Cross current loop - voltage across resisters balances to zero
2.8.7 Diode failure detector
2.8.7.1 The shaft mounted diodes that rectify the ac power from the exciter for use in the
stator field can fail. Some generator excitation systems have a diode failure
detector. These detectors work on the principle that rectifiers produce a
characteristic ripple in their DC voltage waveform and a faulty diode affects the
frequency of this ripple. This effect can be used to activate an alarm or shut down a
faulty generator. Diode failure may eventually lead to excitation system failure
which can lead to blackout if suitable protection is not part of the generator
protection scheme.
IMCA
GUIDANCE
2.8.8 Excitation shutdown
2.8.8.1 Most AVRs or excitation systems will have some means of shutting down the
generator field in response to an external request. A typical application for this
feature is the differential protection used to detect a short circuit in the generator’s
stator winding.
2.8.9 Digital AVRs
2.8.9.1 Analogue AVRs using the principles described above can be found on many DP
vessels but are increasingly being replaced by digital AVRs using numerical
techniques to achieve the same effects. These digital AVRs sometimes require a
control power source independent of the generator such as a 24Vdc battery/ charger
supply. The response of the AVR to failure of this supply needs to be considered in
the redundancy concept.
2.9 MAIN SWITCHBOARDS AND MOTOR CONTROL CENTRES
2.9.1 Main switchboards
2.9.1.1 Main switchboards can be rated for HV or LV use and are generally of metal-
enclosed construction. HV switchgear is generally designed to comply with
standards such as IEC 60298, ‘A.C. metal-enclosed switchgear and control gear for
rated voltages above 1kV and up to and including 52kV’. Switchboards have a
voltage rating, a continuous current rating and a fault withstand current rating. The
latter is intended to define the maximum fault current the switchboard can physically
stand without suffering damage. In some vessel design the short circuit withstand
rating limits the number of generators that can be connect to the main switchboard
at one time. When all generators are connect the main bustie opens automatically to
limit the fault current that can be experienced on each side.
2.9.1.2 Figure 2-47 shows a cross section of a typical marine switchboard consisting of
steel panels arranged to carry a three-phase copper bus bar arrangement mounted
on insulators within a common enclosure separated to divide the bus bar system
from the cable compartments and the circuit breaker. Air is used as the insulating
medium but some bus bars may be insulated along their length for additional
protection. The circuit breaker can be withdrawn and is interchangeable with those
in other circuits. A low voltage enclosure is provided for mounting instruments and
control gear. Cable connects must be bottom entry for marine applications.
2.9.1.3 A system of mechanical interlocks and shutters prevents access to live parts of the
switchgear when the circuit breaker is withdrawn and also prevents the carriage
being withdrawn or engaged when the circuit breaker is closed. Closing the circuit to
the load using the primary contacts of the circuit breaker when inserting the carriage
with the circuit breaker closed can result in severe damage.
2.9.1.4 Some classification societies require an arc proof rating for the switchboard and a
pressure relief duct be provided to vent arc products safely out of the enclosure in
the event of a fault in the switchboard itself.
IMCA
GUIDANCE
BUSBARS
INSTRUMENT AND
CONTROL CUBICLE
PRESSURE
RELIEF DUCT
WITHDRAWABLE
VACUUM CIRCUIT
PRIMARY BREAKER
CONTACTS
LOCAL
CURRENT CONTROLS
TRANSFORMER
EARTH SWITCH
VOLTAGE
TRANSFORMER
CABLES
Figure 2-47 Metal enclosed switchgear
2.9.2 Switchgear
2.9.2.1 Switchgear generally takes the form of circuit breakers or contactors. Circuit
breakers for marine applications are generally three pole and designed to close onto
a short circuit fault and open again without damage. Each circuit breaker has a
continuous current rating and a making and breaking capacity which indicate the
fault current it is capable of interrupting. Circuit breakers are generally capable of
interrupting the current arcing across their open contacts within three to five cycles
of the power frequency waveform. Current limiting circuit breakers are available for
low voltage applications which operate quickly enough to prevent the fault current
reaching its peak level.
2.9.2.2 Power for the circuit breaker’s closing mechanism is derived from a motor wound
spring. The powerful spring which provides the force to open the contacts is charged
by the action of closing the circuit breaker. The spring mechanism is recharged by
the motorised spring winder every time the circuit breaker is closed. Enough energy
is stored in the mechanism for an OPEN-CLOSE-OPEN cycle. Circuit breakers can
have different types of insulating medium including:-
1. Air
2. Vacuum
3. SF6
4. Oil
IMCA
GUIDANCE
2.9.2.3 Very few marine applications make use of oil filled circuit breakers but they found
limited application in fixed offshore structures.
2.9.2.4 Contactors are electromagnetically operated switching devices. An AC or DC coil is

used to pull the switching contacts together against the force of a spring. Loss of
current to the coil will cause the contactor to open again. Some designs are
mechanically latching. In this design, a pulse of current is sent to close the contactor
and another to open it. This type of contactor remains ‘as set‘ on loss of control
power. Contactors are only designed to handle load current not fault current and
thus contactors must be paired with a suitable circuit breaker or fuses.
2.9.3 Motor control centres
2.9.3.1 Motor Control Centres (MCCs) contain groups of motor starters and may form a
significant part of the low voltage distribution in a marine power system. A motor
starter for an LV circuit typically contains a Moulded Case Circuit Breaker (MCCB), a
contactor with thermal or magnetic overload protection and relay logic to allow
remote starting and stopping of the motor. Modern motor control centres may be
controlled by a dedicated communications network or by hardwired contacts to a
local vessel management field station.
2.10 POWER SYSTEM FAULTS
2.10.1 Critical power system parameters
2.10.1.1 A power system can be said to be in a fault condition if any of its critical parameters
are out of tolerance for more than an acceptable time period such as that associated
with expected power system transients.
Quantities which must remain with tolerance include:-

1. Voltage
2. Current
3. Frequency
4. Levels of harmonic distortion
5. Line current balance
6. Phase voltage balance
IMCA
GUIDANCE
2.10.2 Fault conditions on three phase system

1. Short circuit - one or more phases
2. Open circuit - one or more conductors
3. Earth fault
4. Over / under frequency
5. Over / under voltage
6. Over load – rating of engine exceeded
7. Over current – rating of alternator, busbar, cable, motor, transformer or other
consumer exceeded
8. Severe active power sharing imbalance
9. Severe reactive power sharing imbalance
10. Excessive regeneration of power
11. Severe waveform distortion
12. Loss of synchronisation & crash synchronisation
2.11 OVERALL PROTECTION PHILOSOPHY
2.11.1 Purpose of electrical protection schemes
2.11.1.1 Electrical protection schemes are designed to prevent the uncontrolled release of
energy associated with power system faults, thus protecting life and limiting damage
to equipment. In the case of dynamically positioned vessel of DP Class 2 and DP
Class 3 the power system protection scheme must also ensure continuity of supply
to essential consumers such as thrusters and auxiliary systems. The protection
scheme must be coordinated to ensure that faults are isolated as close to source as
possible and that failure effects do not exceed the worst case failure design intent.
The primary protection function in any electrical protection scheme is over current
protection, which is intended to prevent excessively high currents causing cables to
catch fire.
2.11.1.2 The overall electrical protection scheme can be broadly divided into the following
sections:-
1. Generator protection
2. Bus bar protection
3. Feeder protection
2.11.1.3 Generator protection is provided to limit the effects of internal faults in the generator,
to protect the generator from the effects of power system faults and protect the
power system from the effects of generator faults. Generator protection is discussed
in more detail in Section 2.12.
IMCA
GUIDANCE
2.11.2 Protection relays
2.11.2.1 Modern protection schemes use digital protection relays to detect a large fault
conditions and trip the appropriate circuit breakers to isolate the fault. The relays are
usually mounted in the instrument and control cubicle of the switchboard and make
measurements of the power system voltage and current from voltage and current
transformers (VTs and CTs) connected to the bus bars and cable ways. Current
transformers for protection duties require a special rating which indicates their ability
to measure fault currents without saturation. Modern multi function relays can be
programmed for many different protection tasks and can also be used as
transducers to feed power system information to other systems for monitoring and
display. However, care must be taken not to link control and protection functions in
such a way that protection and control functions can be lost at the same time.
Failure to separate control and protection functions may lead to a situation where a
single failure causes machinery to adopt a dangerous condition and render the
automatic protection inoperative at the same time.
2.11.2.2 Protection relays are programmed with the settings from the protection coordination
study. Programming may be carried out by way of the front panel or by attaching a
dedicated programming tool or laptop. Protection relays typically require 110Vdc
power for operation which is supplied from a dedicated charger rectifier with battery
bank.
2.11.3 Bus bar protection
2.11.3.1 Bus bar faults are the least likely failure in a marine power system but a great deal
of time and cost is expended trying to ensure that a fault acting directly on the bus
bars does not cause the worst case failure design intent to be exceeded. In fact bus
bar faults are so unlikely that some vessel owners have successfully negotiated an
exemption from Class for bus bar faults in relation determining the vessel’s worst
case failure and therefore its post failure DP capability.
2.11.3.2 Bus bar protection is designed to isolate the effects of short circuit and earth faults
acting directly on the bus bars or their connections. Bus bar protection can take the
following forms depending on the number of bus sections that have to be protected:-
1. Over current protection
2. Differential protection
3. Directional over current protection
4. Optical arc detection
5. Pressure detection
6. Earth fault protection
IMCA
GUIDANCE
2.11.4 Over current protection - Quick Trip
2.11.4.1 Figure 2-48 shows the most common arrangement for vessels with a simple two
way split. In the event of a short circuit on either bus all connected generators will
feed the fault. Each generator’s over current relay can trip the generator and one of
the main busties. Time delays are arranged so that the busties open after 0.3s
isolating the fault to one bus or the other. The generators on the healthy bus section
will no longer see the fault and their over current relays will reset. Those on the
faulty section will trip after 1.0s isolating the fault. A fault in a feeder is cleared by
dedicated feeder over current protection within the 0.3s time delay. A fault on a
generator is cleared near instantaneously by the generators differential protection.
Thus the protection scheme is fully selective faults in any part of the power system.
Some classification societies are considering introducing a requirement to trip the
busties first for all faults no matter where they are in the system. Some vessel power
plant designers have extended the Quick Trip principle to cover many other faults
that might destabilise the power plant. Including but not limited to:-
1. Over / under voltage
2. Over/ under frequency
3. Over current
4. Current imbalance
Figure 2-48 Time graded over current protection
IMCA
GUIDANCE
2.11.5 Differential protection
2.11.5.1 Figure 2-49 shows one of the popular solutions for bus bar protection in multi-split
power distribution systems. The challenge for the protection scheme in a multi split
system is to isolate only the faulty bus section leaving all others connected together.
This is particularly important if some bus sections have no generator connected.
Differential protection works on the principle of Kirchhoff’s current law which states
that the sum of the currents entering a node must equal the sum of the currents
leaving the node. The bus bars are considered to be the node and the currents
being supplied or consumed by all the generators, feeders and busties are summed
by the protection relay for that zone. The boundary created by the location of the
current transformers used to measure the currents flowing in and out of the bus
section is called the protection zone. For this reason differential protection is
sometimes known as zone protection. If the bus bar is healthy the current
measurements will sum to zero. If however, the bus bar is faulty there will be a
current path within the zone which is not balanced out. This imbalance is detected
by the protection relays and the bus section is isolated by tripping the busties at the
end of the zone. In some schemes the generators in the faulty zone may also be
tripped by this function. To ensure complete coverage it is common practice to
overlap the CT’s for each zone. This does create a very small area common to two
zones. A fault exactly at this point could cause two zones to trip exceeding the worst
case failure design intent. Additional complexity can be added to overcome this but
this may not be justified by the risk.
G1 G2 G3 G4 G5 G6
NC NC
NC NC NC NC
A
D
B
Figure 2-49 Differential protection
IMCA
GUIDANCE
2.11.5.2 Faults at A B C & D have the following effects

1. A fault at point A causes the LHS bus section to be isolated by the zone
protection. The Centre and RHS bus sections remain connected.
2. A fault at point B will cause the tie line to be tripped trip leaving all other bus
sections connected
3. A fault at point C will be detected by the generators differential protection.
Only G4 will be tripped
4. A fault at point D will be detected by the thrusters’ over current protection.
Only the thruster will be tripped
2.11.5.3 The number of CTs required to implement the scheme makes it more costly than the
other solutions but it does allow the power system to be run as a closed ring and
therefore allows complete flexibility in generator utilisation. There have been
problems with spurious tripping of zones in response to large motor or transformer
starting transients and the efficacy of differential protection schemes is related to the
quality of the protection equipment specified.
2.11.6 Directional over current protection
2.11.6.1 Directional over current protection offers a slightly cheaper alternative with many but
not all of the advantages of differential protection. Directional protection schemes
are generally operated in split ring configuration to establish well defined fault
current paths so there is no ambiguity about which circuit breakers should be
blocked and which should be tripped. Figure 2-50 illustrates the general principle.
Directional over current relays at each bustie are arranged to block the circuit
breaker up stream of the fault from tripping thus only the circuit beakers closest to
the fault trips. Because the ring is split there may be no current through some bustie
circuit breakers. Generators left connected to the faulty bus section will trip on over
current. In Figure 2-50 a fault at point A will cause the bustie circuit breaker at the
left hand end of the G5, G6 bus section to trip. All upstream circuit breakers which
see fault current are blocked.
Figure 2-50 Directional over current protection
IMCA
GUIDANCE
2.11.6.2 Figure 2-51 illustrates one of the disadvantages of directional protection which is
that if one of the bus sections has no generators connected then two bus sections
will be lost if a fault occurs at Point A. Thus the vessel may lose more thrusters than
desired. In some arrangements it may be possible to overcome this disadvantage by
always running at least one generator on each bus or by changing the point at which
the ring is split to ensure there are always generators at the extremities of the circuit.
This would need careful coordination with the power management system running
order selection.
Figure 2-51 Directional over current protection
2.11.7 Optical and pressure arc detection
2.11.7.1 This method of bus bar protection is based on an entirely different principle. Faults
in switchgear are generally associated with arcing faults. Thus it is possible to create
a protection system which will rapidly trip the bustie circuit breakers for the faulty
bus section if the light from an arc is detected inside the bus bar chamber.
Commercial systems use fibre optic cables to monitor the internal spaces of the
switchboard. Systems based on detecting the pressure rise associated with arc
products work on a similar principle. Some vessel power plant designers chose to
use arc detection as the primary protection scheme which supports the vessel’s
worst case failure design intent but provide more conventional over current
protection as a backup. The over current protection is not sufficiently selective to
prevent WCFDI being exceeded but it should prevent a fire if the optical system
failed for any reason.
2.11.8 Earth fault protection and system earthling.
2.11.8.1 The type of earth fault protection specified for marines system is influenced to some
extent by the size of the power distribution system and the maximum prospective
earth fault current. Many LV marine power systems were designed as un-
intentionally earthed systems where the power system has no direct connection or
reference to earth (vessel’s hull). On these systems, earth faults were typically
indicated by earth fault lamps connected from each line to earth. When one lamp
goes dark and the other two go bright there is an earth fault on the line connected to
the dark lamp. Earth insulation meters are the modern alternative. These devices
can be connected to the alarm and monitoring systems
IMCA
GUIDANCE
2.11.8.2 On HV systems, high resistance earthing of various types is generally employed. In

high resistance earthing systems a high impedance path for earth fault currents is
created by adding a resistor from the generator star point to the ship’s hull or by way
of one of several types of neutral earthing transformer that can be connected to the
bus. Earthing the power system by way of the generator star points causes the earth
fault current to vary with the number of generators connected. Nevertheless, this
continues to be a popular method of system earthing.
VCB
GENERATOR
Y
NEATRAL
EARTHING B
RESISTOR
+ + +
SYSTEM
CAPACITANCE
+ + +
OPEN DELTA ZIG-ZAG

NEUTRAL NEUTRAL
EARTHING EARTHING
TRANSFORMER TRANSFORMER
Figure 2-52 Methods of marine power system earthing
2.11.8.3 All power systems are referenced to earth by way of the distributed capacitance of
cables and windings and a significant earth fault current can flow even in
unintentionally earthed systems. The intentional earth impedance only adds to the
system charging current when an earth fault occurs and is often sized to provide an
earth fault current three times that which would flow as a result of the capacitive
charging current. This provides well defined current paths for protection purposes.
2.11.8.4 Classification societies differ on the level of earth fault current that can be accepted
without automatic isolation. Some vessel’s in service only have an alarm to indicate
an earth fault on the HV power system others have fully selective earth fault
protection schemes. The requirement for the voltage rating of HV cables differs for
systems intended to operate continuously with an earth fault and those with
automatic disconnection.
2.11.8.5 Earth fault protection for the main power system is sometimes based solely on time
grading. The relay in the earthing resistor or earthing transformers for each bus will
detect an earth fault at any point in the plant not isolated by a transformer.
IMCA
GUIDANCE
2.11.8.6 Earth fault protection in the feeders will isolate a fault in a consumer. If the earth
fault persists after the tripping time of the feeder the fault is assumed to be in the
generators or on the bus bars itself. At this point the protection driven from the
neutral earthing transformers will trip the main busties to limit the earth fault to one
bus or the other. Whichever neutral earthing transformer continues to detect an
earth fault will then trip all generators connected to that bus. As losing a whole bus
because of an earth fault in one generator is unnecessarily severe some designers
add restricted earth fault protection to the generators.
2.11.9 Feeder protection
2.11.9.1 Feeder protection is generally limited to over current and earth fault protection but
specialist protection functions may be used to protect motors and transformers. In
particular, protection functions for transformers may need to be desensitised to the
inrush current transient that occurs when a large transformer is connected. In
protection schemes where the generators are protected against the effects of
unbalanced currents (sometimes referred to as Negative Sequence Protection -
NPS) it may be prudent to include NPS protection in the feeder protection scheme
and coordinate it with the NPS protection in the generators to prevent a large
unbalance current originating in the distribution scheme causing all online
generators to trip. Such faults are uncommon in marine power system but cannot be
ruled out completely. NPS can also be used to trip the main busties as additional
protection although this may only be suitable for power systems with a simple two
way split.
2.11.9.2 Feeder circuit breakers for service transformers may be fitted with under voltage
release to disconnect transformers on blackout. It is important that an under voltage
trips have adequate time delays to prevent the trip operating on a voltage dip
associated with a short circuit fault. If this is not the case, all marine auxiliary
services may stop due to an unrelated fault somewhere in the power system.
2.11.10 Power system studies
2.11.10.1 Several studies may be commissioned to support the design of a marine power
systems including:-
1. Short circuit calculations
2. Protection coordination study
3. Load balance
4. Harmonic analysis
5. Transient stability study
2.11.10.2 Short circuit calculations are performed to ensure the switchgear is able to withstand
the forces generated by the worst case short circuit current. It is also used to ensure
the circuit breakers are able to interrupt that level of fault current.
2.11.10.3 The protection coordination study (sometimes known as the discrimination or

selectivity study) is carried out to determine the various protection settings
necessary to ensure that faults are isolated as close to source as possible.
IMCA
GUIDANCE
2.11.10.4 The load balance is used to show the power consumed under various operating
conditions, which may included DP, transit, harbour with variations for summer and
winter operation if appropriate.
2.11.10.5 The harmonic analysis is used to show that levels of harmonic distortion fall within
acceptable levels under all expected operating conditions. Excessively high levels of
harmonic distortion have been known to cause equipment malfunction exceeding
worst case failure design intent.
2.11.10.6 The transient stability study identifies the ability of the generators in a power system
to maintain synchronism when subjected to a severe transient disturbance such as a
fault, sudden loss of generating capacity or large load rejection. This study is not
considered to be necessary for most marine power system because of their compact
nature but some of the more unusual designs do have additional impedance
between generators.
2.12 GENERATOR PROTECTION PHILOSOPHY
2.12.1 Importance to redundancy concept
2.12.1.1 The range of protective functions applied to the generators is an important

consideration in the design of any DP vessel power plant. However, in the case of
vessels intending to operate with a common power system, the generator and bus
bar protection is fundamental to ensuring fault tolerance and the integrity of the
redundancy concept. It is important to understand the dual role of generator
protection in a DP vessel application. The protection must provide the necessary
level of safety but also ensure continuity of supply and limit the severity of the failure
effect to within the worst case failure design intent. Adding inappropriate protective
functions can be as damaging to the redundancy concept as having insufficient
protective functions.
IMCA
GUIDANCE
VCB
ALTERNATOR
OPEN
WITH TRIP
COIL
SUPERVISION
TO BUS TIE
EXTERNAL EXTERNAL CONTROL CCT
PMS PMS PROTECTION PROTECTION
ESTOP OPEN TIE TRIP CB TRIP POWER
110Vdc
CTs CTs VTs GROUND TRIP TRIP

CT GEN CB BUSTIE
DIGITAL INPUTS
CB
STATUS GENERATOR PROTECTION RELAY RTDs STATOR
FIELD ACTUATOR 4-20 mA

CURRENT CURRENT Hz MVAR MW V
SERIAL LINK START RELAY COMMON EXCITE

TO ALARM ALL FAILURE ALARM TRIP FROM FROM
AND DIESELS AVR GOVERNOR TO PMS
MONITORING
Figure 2-53 Generator protection relay
2.12.2 Standard generator protection functions
2.12.2.1 Figure 2-53 shows a typical multifunction generator protection relay. All information
regarding the health of generator is obtained from VTs, CTs and winding
temperature sensors. Table 2-4 shows a typical list of protective functions that
might be available within such a multifunction relay and the executive action that is
taken on detection of each type of fault. It is important to note that this range of
protective functions is not sufficient to ensure the fault tolerance of a common power
system. Section 2.13 on Advanced Generator protection discusses the additional
protection features required for fault tolerance.
2.12.2.2 From Table 2-4 it can be seen this protection relay can be programmed to:-
1. Trip the generator
2. Trip the bustie circuit breaker between the two main switchboards
3. Shut down the faulty generator’s excitation system
4. Signal the PMS to start another generator
5. Lockout the generator from reconnection
6. Activate an alarm.
IMCA
GUIDANCE
Table 2-4 Generator Protective Functions
Bustie
Generator (Quick Excitation Start all Gen
Function Trip Trip) trip generators Lockout Alarm
Phase differential 9 X 9 X 9 X
Negative sequence 9 9 X 9 X 9
Under-voltage 9 9 X 9 X 9
Reactive power 9 X X 9 X 9
Over-voltage 9 9 9 X X 9
Phase reversal 9 X X X X X
Under frequency 9 9 X X X 9
Loss of excitation 9 X X X X X
Reverse power 9 X X 9 X 9
Phase over-current 9 X X X X X
Over frequency 9 9 9 X X 9
IAS/PMS E-Stop 9 X 9 X Y 9
IAS PMS CB open 9 X X X X 9
High set over-current X 9 X X X X
Trip coil monitor X X X 9 X 9
VT Fuse failure X X X 9 X 9
Diode failure X X X 9 X 9
Gen winding RTD X X X 9 X 9
Gen Bearing RTD X X X X X 9
Field current X X X 9 X 9
Relay fault X X X 9 X X
ESD 9 X X X 9 9
Earth Fault 9 9 X 9 X 9
2.12.3 Phase current differential
2.12.3.1 This function uses current transformers located at both ends of the generator
windings. Any fault path within the generator is seen as an imbalance by the
protection relay. The function is only required on larger generators typically
(1500kVA and above) and is designed to detect stator winding faults at a lower level
of fault current than the phase over-current function. It will trip the affected
generator very rapidly on detection of this fault.
IMCA
GUIDANCE
2.12.4 Negative sequence
2.12.4.1 This function is designed to protect the generator from damage associated with a
significant imbalance in the generator phase currents. However, a broken conductor
on a generator, drive transformerorservice transformer feeder could have this affect.
Such failures are very unlikely but if the overall protection scheme is not fully
selective then all generators which see the fault may trip leading to blackout.
Certain types of drives may draw unbalanced currents in certain failure modes
without necessarily tripping immediately. It may be possible to configure this
function as an alarm rather than a trip with the agreement of the generator
manufacturer.
2.12.5 Under voltage
2.12.5.1 This function is commonly applied to generators and is a class requirement. It has
no particular benefit for the redundancy concept except to ensure that the plant can
be restarted after a blackout. One possible way in which an under voltage could
occur is the voltage dip associated with short circuit faults. These faults should be
cleared by the over-current scheme and the under voltage protection should have a
suitable delay to prevent it reacting to this.
2.12.5.2 Under voltage could also be caused by the direct online starting of a large motor.
2.12.6 Reactive power
2.12.6.1 There are considered to be two ways in which generators could be called upon to
supply too much reactive power to the system. The first is due to an excitation
system fault in one generator. This fault affects the operation of generators running
in parallel with the faulty machine. The second is for the reactive power demand of
the drilling or propulsion system to exceed the capacity of the online generators. In
general there needs to be other protective functions in place to prevent the power
plant reaching this condition.
2.12.7 Over voltage
2.12.7.1 This condition might occur as the result of an AVR failure to full or over excitation.
This function has very little benefit for the redundancy concept as it is not fully
selective and cannot identify the source of the over voltage and disconnect it. Other
protective functions need to be in place to prevent the power plant reaching this
condition.
2.12.8 Phase reversal
2.12.8.1 This fault is unlikely to be present beyond the commissioning phase but could occur
after repair.
2.12.9 Under frequency
2.12.9.1 This is a symptom of plant overload or a common speed control problem on all
engines. The under frequency trip does very little for the redundancy concept
because it is not fully selective. It is usually a classification society requirement. In
general, other protective functions need to be present to prevent the power plant
reaching this condition.
IMCA
GUIDANCE
2.12.10 Loss of excitation
2.12.10.1 This function is designed to prevent the generator running asynchronously and also
to prevent it becoming a significant VAr drain on the surviving generators which may
cause them to trip on over current this function is usually fully selective and will only
trip the faulty generator.
2.12.11 Reverse power
2.12.11.1 This function is designed to prevent a faulty generator engine being motored by the
other online generators and becoming a significant kW load which may cause them
to trip on over current.
2.12.12 Phase over-current
2.12.12.1 This function is designed to protect the generator from thermal damage associated
with an over current condition. If the protective functions in the drives and power
management system are working correctly, healthy generators will not be
overloaded. In systems designed to operate at a high power factor, over-current
and overload are almost the same condition.
2.12.13 Over frequency
2.12.13.1 This fault could occur as the result of a severe engine governor failure which could
cause the entire bus frequency to rise to unacceptable levels. This function provides
little benefit for the redundancy concept other than to limit the potential for damage
and ensure that generators can be restarted after blackout.
2.12.14 High set over-current
2.12.14.1 This function is often used to trip the bustie breakers if a short circuit fault occurs on
the main switchboard when the vessel is operating with busties closed.
2.12.15 Trip coil monitor
2.12.15.1 This function will alarm if a faulty trip coil is detected on a generator circuit breaker.
This is a very useful function to prevent a hidden failure compounding another fault
which could defeat the redundancy concept.
2.12.16 VT fuse failure
2.12.16.1 This function alarms if a faulty fuse is detected on a generator VT. It provides
further confidence that the protection system is healthy. A faulty VT will also prevent
a standby generator synchronising and may cause certain meters and PMS
indications to be in error.
2.12.17 Diode failure
2.12.17.1 Loss of a single diode in an alternator is not usually fatal immediately but may
reduce the effectiveness of the excitation system. In some protection schemes
detection of a faulty rotating diode initiates an alarm and a start request for a
standby generator to connect. In other schemes the faulty generator may be tripped.
IMCA
GUIDANCE
2.12.18 Gen winding RTD
2.12.18.1 High stator winding temperatures are indicative of a fault which may be related to
overload or a malfunction of the cooling system. In this protection scheme detection
of high temperatures initiates an alarm and a start request for all standby sets to be
connected.
2.12.19 Gen Bearing RTD
2.12.19.1 High bearing temperatures are indicative of a fault in the bearing lubrication or that
the bearing itself is beginning to deteriorate. In this protection scheme detection of
high bearing temperatures initiates an alarm and a request for standby sets to
connect. As a faulty bearing can lead to seizure and loss of synchronism the faulty
machine should be taken out of service as soon as possible.
2.12.20 Field current
2.12.20.1 This is similar to the loss of excitation trip but for a less critical condition, this initiates
an alarm and a request for all standby sets to be connected.
2.12.21 Protection relay faulty
2.12.21.1 This alarm is initiated if the generator protection relay fails to pass its own internal
diagnostic check. It is a useful feature which improves confidence that the relay is
healthy and thus prevents hidden failures compounding a power system fault.
2.12.22 Lockout
2.12.22.1 This function acts to lockout generators from reconnection if they have tripped on a
particular fault. Generators should only be locked out from reconnection if they are
actually faulty. Care needs to be taken not to lock out generators for external faults
otherwise the reliability and effectiveness of blackout recovery may be impaired.
2.12.23 Earth fault - sometimes called ‘zero sequence’
2.12.23.1 This function will alarm or trip the generator on detection of an internal earth fault.
On high resistance earthed power system, the earth fault current may be too low to
activate the differential protection. Therefore a more sensitive form of protection is
required. Restricted or directional earth fault protection using ‘core balance’ CTs
may be used. A core balance CT is a large current transformer which passes over
all conductors in a three phase circuit. Care must be taken when terminating the
screen of a cable protected by a core balance CT. The earthed screen must not
pass through the CT.
IMCA
GUIDANCE
2.12.24 Quick trip
2.12.24.1 This function is a combination of:

1. High set over current
2. Negative sequence
3. Under / over voltage
4. Under/over frequency
5. Any other non selective protective function
2.12.24.2 It is intended to open the bustie to separate the two halves of the power plant before
these functions trip their respective generator circuit breakers. Although all
generator protection relays will see the fault, only the protection relays on the side
with the fault will trip leaving half the power system in operation. This function is
only effective in splitting the plant. This is effective for a redundancy concept with a
50% split. It is more difficult to use this function effectively in a power system with a
multi-way split.
2.13 ADVANCED GENERATOR PROTECTION
2.13.1 General
2.13.2 Very significant advances have been made in the area of marine power plant
protection in recent years. Possibly the greatest improvement has come in the form
of protection systems able to identify which generator is responsible for causing a
severe active or reactive power sharing imbalance. Fuel control and excitation
system faults are relatively common in marine power systems. When governor and
AVRs fail to an inert state (no fuel or no excitation) the failure effects are relatively
benign and will only result in the loss of the faulty generator, provided the system is
properly protected by traditional generator protection. Unfortunately, traditional
generator protection offers little if any protection against failures to an active state
(typically excess fuel or excitation) which can both result in severe load sharing
imbalance and blackout. In fact the incorrect response of traditional generator
protection is usually responsible for causing the blackout.
2.13.3 In many cases the driving force for developing this improvement has come from
vessel owners themselves, but protection systems are now available from several
sources including some of the large electrical system supplier and vessel
automation vendors. All systems offer certain core protection features but are also
capable of being expanded to address many other less critical failure modes and
provide a useful backup to the traditional generator protection.
2.13.4 Core protection functions
2.13.4.1 The two most important failure modes that must be protected against are ‘failure to
excess fuel’ and ‘failure to excess excitation’. In the case of failure to full or excess
fuel there is a risk in light load conditions that all healthy generators will trip on
reverse power or over frequency. In the case of exaction faults the healthy
generators may trip on their field failure protection or over voltage. In some cases
the system may be left running on the faulty generator which subsequently trips.
IMCA
GUIDANCE
2.13.5 Predecessors to modern AGP
2.13.5.1 A few vessels were fitted with bespoke protection systems of various degrees of
sophistication and early examples can be found dating back over fifteen years.
2.13.5.2 Failure to excess fuel could be protected against by maintaining a base load in
excess of the rating of the largest generator. This was easily achieved by vessels
using thruster bias mode for DP control but was wasteful of fuel and not very
environmentally friendly. In some cases this protection measure was inadvertently
defeated by the power management system which was programmed to shed
thruster bias and/or thruster load on detecting the overload of any single generator.
2.13.5.3 Other early attempts to provide protection included systems which would trip the
bustie if two or more generators were simultaneously in the reverse power condition.
2.13.6 Principle of operation
2.13.6.1 There are two basic principles of operation for Advanced Generator Protection:-
1. Voting systems
2. Conformance to predicted generator behaviour
2.13.6.2 Protection systems based on voting functions tend to be centralised protection

systems which collect and compare information on all online generators. They
attempt to identify the faulty generator by observing that one generator may acquire
all the system active or reactive power and other generators shed it. These systems
assume the generator carrying all the load is the faulty generator. Great care must
be taken in the design of the plant to ensure that this is the only failure mode that
can have this effect otherwise the protection system may trip the wrong generator.
For example, if there are three generators online and two of them shed load
because they share a common faulty fuel system the generator left carrying the
system load is the healthy generator. If the protection system assumes that the
generator carrying all the load has taken it from the others it will trip the healthy
generator leading to blackout. The security of voting systems can be improved by
combining the power comparison function with bus frequency measurement. The
principle of operation is that a generator that is taking the system load from others
because it has failed to excess fuel will drive up the power system frequency. A
generator which is taking load because others are shedding it will not do this and
bus frequency may fall.
IMCA
GUIDANCE
2.13.6.3 Protection systems based on conformance to predicted generator behaviour do not

require information on the status or condition of other generators and can be
designed such that there is an independent protection system for each generator.
The power plant is operated in uncorrected speed and voltage droop mode so that
the operating point of healthy generators can be predicted from the speed and
voltage droop characteristics. Figure 2-54 shows how the protection function works
in the case of two generators running in parallel. For as long as both generators are
healthy, their operating points follow their respective speed and voltage droop lines.
When G2 fails to full fuel it takes load from G1 and drives it into reverse power.
However, because the speed (frequency) of both generators must remain the same,
the operating point of G2 deviates from the droop line. The operating point of G1 on
the other hand remains on the droop line. The protection function is therefore
created by placing a window round the droop line and tripping any generator that
strays outside it. Suitable delays are added to allow for system dynamics and the
AGP must act to isolate the faulty generator before the traditional generator
protection operates to trip the healthy ones.
Figure 2-54 Principle of AGP
IMCA
GUIDANCE
3 POWER MANAGEMENT
3.1 REQUIREMENT FOR A POWER MANAGEMENT SYSTEM
3.1.1 International Maritime Organisation
3.1.1.1 IMO MSC 645 does not specifically require that a power management system is
fitted only that it should be suitably reliable if it is.
3.1.1.2 Generally, power management systems should fail in such a way that:-
1. The power plant continues to run ‘as set’
2. Local control is still possible
3.1.2 Classification societies
3.1.2.1 Most classification societies require that DP Class 2 and DP Class 3 vessels are
fitted with a power management system but the requirement to have such a system
may be waived if the various functions provided by a basic power management
system are located in other systems. Also, if there would be no significant
advantage in having a power management systems such as in the case of a DP
vessel using direct diesel driven thrusters.
3.1.3 Power management system principles
3.1.3.1 The primary objective of a power management system is to ensure continuity of the
power supply to essential consumers under all defined operating conditions. In the
event that it fails in this objective it may be programmed to restore power
automatically.
3.2 POWER MANAGEMENT SYSTEM ARCHITECTURE
3.2.1 Centralised control systems
3.2.1.1 The older and more basic power management systems tend to be centralised
control systems in which a single processor or master slave arrangement interface
to the entire power plant from a single cabinet located in the engine control room.
Such designs offer little in the way of redundancy and the need to bring large
amounts of analogue control signals back to a single location can present difficulties
for DP Class 3 designs. Variations on this design use remote stations to gather the
information from the field by way of a data communications network but all the
control algorithms reside in the central controller.
3.2.2 Distributed control systems
3.2.2.1 Distributed control systems have been used in DP vessels for over a decade now
and are the preferred solution for larger more complex vessels. In distributed control
systems the control algorithms reside in processors located out in the field and close
to the machinery they control and monitor. Failures in these field stations generally
affect only the machinery controlled by that field station but the effect of failures in
field stations for power management functions may be more widespread as the
actions of one field station may depend on receiving information from another.
IMCA
GUIDANCE
3.2.3 Intelligent consumers
3.2.3.1 There is an increasing trend to move the intelligence and control algorithms even
closer to the machinery they control. As many elements of the DP system such as
engine and thrusters are now controlled by local PLCs it is possible to put much of
the intelligence required to create an integrated propulsion system into the
machinery itself. Features of such intelligent consumers include the ability to:-
1. Make the equipment ready for remote control independent of any other control
system
2. Take direct action to relieve stress in the power system
3. Monitor their own condition and disconnect themselves if they consider
themselves to be faulty
3.3 POWER MANAGEMENT SYSTEM HARDWARE
3.3.1 PMS as part of an integrated automation system
3.3.1.1 In large complex vessels, the power management system tends to be just another
software module within the overall integrated automation systems which may
include:-
1. Dynamic positioning
2. Vessel management
3. Power management
4. Engine control and protection
5. Vessel safety system
3.3.1.2 Figure 3-1 shows a few of the most significant interfaces between the IAS and the
power plant.
IMCA
GUIDANCE
Figure 3-1 Integrated Automation System
3.3.2 PMS as a standalone function
3.3.2.1 In less complex vessels there may be no integrated automation system and it is not
unusual to find that the power management system is provided by a different vendor
to the DP control system and vessel alarm system. The power management system
may be separate from the control and alarm system or there may be a link to record
PMS alarms. The PMS may only offer very basic functions and load sharing and
engine control could be carried out by other standalone hardware as shown in
Figure 3-2.
Figure 3-2 Standalone PMS

IMCA
GUIDANCE
3.4 POWER MANAGEMENT FUNCTIONS
3.4.1 Range of available functions
3.4.1.1 The extent of control provided by the PMS varies significantly between installations.
The types of functions considered to be power management functions also varies
from system to system and the boundary between PMS and vessel control functions
may be determined by the system architecture.
3.4.1.2 A large range of control options are available in the most sophisticated systems
including:-
1. Engine control, monitoring and protection
2. Charge air temperature control
3. HT cooling water control
4. Turbocharger assist control
5. Remote start & stop - initiation of generator synchronising
6. Standby generator running order selection
7. Standby generator management - standby time limitations
8. Load sharing (kW)
9. Asymmetric or fixed target load sharing
10. Reactive power sharing (kVAr)
11. Frequency control
12. Voltage control
13. Synchronising
14. Load dependant start & stop
15. Reactive power dependent start
16. Current dependent starting
17. Alarm initiated starting
18. Start all
19. Consumer load application rate control
20. Control of multiple independent power systems
21. Control of regenerated power
22. Consumer priority (Drilling)
23. Control of heavy consumer starting - advanced power reservation
24. Blackout prevention - phase back (load shedding) of heavy consumers
25. Load shedding of non essential consumers
26. Blackout restart of generators
27. Blackout recovery of power plant
IMCA
GUIDANCE
3.4.1.3 Very basic power management systems may offer little more than remote manual
control of generator starting, standby running order selection and load dependent
starting. In such installations it may be necessary to supplement the PMS functions
with standalone protective functions to ensure the power plant is fully protected
against blackout.
3.4.2 Synchronising and dead bus closing
3.4.2.1 This can be a PMS function or a switchboard function. Synchronisers are widely
available from a range of sources including engine governor manufacturers. These
devices control the engine speed to bring incoming alternators in to phase, voltage
and frequency alignment (excitation control is not normally used in synchronisers for
marine applications).
3.4.2.2 Classification societies usually require that these automatic synchronisers are
backed up by a manual circuit breaker control and a synchroscope or synchronising
lamps. Generators are normally connected to the bus while running very slightly
above system frequency to ensure that reverse power protection does not
immediately trip the generator off line. Synchronising may fail when attempting to
connect generators during large load fluctuations. Such conditions may arise when
several generators trip because of a common mode failure and blackout protection
functions are actively shedding load to prevent remaining generators from tripping
on overload. Thus it is clear that synchronisers may be under the most onerous duty
just when standby generators are needed most.
3.4.2.3 Power management system interaction with the DP system could be used to freeze
load for long enough to allow successful synchronisation however modern power
system manufacturers questioned for this survey were confident of synchronising
under all steady state and transient load conditions. Generally, system
manufacturers recommend one synchroniser per generator for redundancy.
3.4.2.4 In modern power management systems it is possible to configure the function of a

synchroniser in software and use the PMS I/O modules to control the generator’s
speed and monitor generator and bus waveform alignment. The PMS sends the
signal to close the generator circuit breaker directly rather than just initiating the
operation of the external synchroniser.
3.4.2.5 Dead bus closing facility. Most synchronisers also have what is called a dead bus
closing facility. This overrides the synchronising function if the bus is dead. Power
management systems may have an additional feature designed to prevent two
generators dead bus closing at the same time. This may be achieved by staggering
the start of generators following blackout recovery or using a system which passes a
token from one generator to the next over the vessel management system network.
Only the generator holding the token can dead bus close.
IMCA
GUIDANCE
3.4.2.6 It is important that dead bus detection is robust and cannot incorrectly indicate that
the bus is dead when it is live. Dead bus connecting a generator when the bus is
actually live can cause very severe power system transients leading to blackout.
Some power management systems make use of several sources of information
such as blackout relays and voltage transducers, but in many cases these sources
are connected to the same bus VT and interface with the same I/O module and are
not as independent as they appear. Such an arrangement is shown in Figure 3-3.
Some power management systems also include the status of generator and bustie
circuit breakers in the detection algorithm to improve confidence in bus bar status.
Some designers use a second source of bus voltage data to confirm the bus VT
signal. Even where multiple sources are used there is a risk of spuriously declaring
a blackout if there is insufficient delay in the detection algorithm to cater for the
effects of voltage dips associated with short circuit faults.
BUS
BUS VT
K2 BLACKOUT
K1 WHEN K1-K3
K3 CLOSED
K1 K2 K3
VOLTAGE TRANSDUCER VOLTAGE
VOLTAGE TRANSDUCER FREQUENCY
I/O MODULE
Figure 3-3 Blackout detection from single source
IMCA
GUIDANCE
3.4.3 Frequency Control
3.4.3.1 In control schemes where the PMS acts to alter the governor speed set point as a
means of correcting droop, frequency control is the responsibility of the engine
governor and the power management system. Typically, the PMS interfaces to the
governor by two digital inputs, one for ‘raise’ speed set point and the other for ‘lower’
speed set point. This type of interface was originally developed to allow power
management systems and remote manual controls to adjust the speed set points of
mechanical governors by driving a ‘speeder’ or ‘pilot’ motor clockwise or anti
clockwise. The speed set point will increment by a defined number of RPM/s during
the time that the ‘raise’ or ‘lower’ contacts are closed. Thus, the speed set point is
effectively adjusted by the time for which the control pulse is applied. This type of
interface is still used on modern digital governors and is vulnerable to failures.
Typical faults include broken wires disabling the ‘raise’ or ‘lower’ signal. A more
dangerous fault is when the contacts for the set point ‘raise’ signal stick in the closed
position driving up the load on the faulty generators and pushing the healthy
generators towards the tripping point of their reverse power protection.
3.4.3.2 When the PMS is responsible for frequency control and load sharing, computations
for how to adjust the governor to correct frequency and load sharing imbalance are
carried out simultaneously. A composite time pulse is calculated for each governor
that will simultaneously correct frequency and load sharing deviations.
3.4.4 Voltage Control
3.4.4.1 Voltage control by PMS is less common than frequency control. This is because
several power management system providers choose to leave this function under
the control of AVR’s operating in uncorrected droop mode. Other power system
manufacturers choose to control AVR set points for voltage control and reactive
power sharing in much the same way as generator speed control. There is little
evidence to suggest that compensating for voltage droop offers any significant
advantages for the redundancy concept. However, introducing additional complexity
into the generator control system can also introduce additional failure modes.
3.4.5 Multiple independent power systems
3.4.5.1 This refers to the need for a power management system to be able to manage bus
sections as separate power systems when opening and closing busties. Several
classifications societies have requirements in their DP rules relating to the need for
the PMS to be able to operate effectively when the power system is subdivided into
smaller independent power systems.
3.4.6 Load Dependent Start/Stop
3.4.6.1 This function is universal amongst power management systems. Although the need
for load dependent starting of standby generating sets is clear, vessel operators are
divided as to the wisdom of allowing generators to be automatically stopped. Many
vessel operators prefer to have the power management system alarm on light
loading rather than act directly. Classification society rules may require that there is
a facility to disable the load dependent stop function.
IMCA
GUIDANCE
3.4.7 Blackout Restart
3.4.7.1 Blackout restart is an extremely important feature of any power management system
but is generally only present in the more sophisticated systems. There are many
older vessels in service where manual intervention is still required after a blackout.
At least one classification society makes reference to the requirement for connection
of a standby set and the sequential automatic reconnection of essential consumers
within its DP rules.
3.4.7.2 A modern power management system should be able to re-establish limited

propulsion capability rapidly and automatically without any human intervention. As a
first step, a typical blackout recovery strategy will start all available generators. In
some cases, the standby start matrix may be disregarded and the first generator to
run successfully will be closed on to the dead busbars. The actions that follow may
be highly vessel specific, but typically, the power management system will then
close the HV and LV transformer feeder circuit breakers in order to restore essential
services. This action will be followed by a sequential restart of services that were
already running before blackout occurred. To prevent further problems, the power
management system will not attempt to reconnect any generator to a switchboard
that has tripped on a fault, or start generators that were withheld from the standby
start matrix for any reason.
3.4.7.3 In some blackout recovery strategies, the first action of the PMS is to open all
generator and bustie circuit breakers. Thus it is important that the method for
detecting blackout is secure and reliable. In PMSs with this type of function, a false
indication of blackout may actually create a blackout.
3.4.7.4 There are conflicting opinions on the wisdom of automatically restarting thrusters
and assigning them to the DP system, due to the risk of repeating the fault that
cause the power system to blackout out in the first place. However, vessel owners
who have such functions have stated that the benefits of having the DP control
system automatically arrest the drift-off outweigh the possible risk that the protection
system fails to isolate and lock out the faulty consumer which caused the blackout.
3.4.8 Autonomous restart of thrusters
3.4.8.1 Possibly one of the greatest advances in recent years is in the ability of certain
designs of thruster drive to make themselves ready for DP independently of any
centralised control system. In the event of any significant disturbance or voltage dip
which causes them to disconnect, these thrusters will monitor the condition of the
main power systems and reconnect as soon as conditions permit. This makes
blackout recovery of generators and thrusters a parallel operation rather than a
sequential one, saving a considerable amount of time compared to conventional
designs. System based on these principles can typically recover from blackout in
several tens of seconds rather than minutes. When attempting to optimise blackout
recovery times it is important to carefully consider the control sequences leading to
generator and thruster connection. In particular, it is important to identify any
unnecessary delays or permissive that might prevent a thruster connecting. For
example it may be better to allow a thruster to start without its cooling fans running
than lock it out from reconnection until the become available, particularly if the
thruster will take many minutes to overheat without them, and there will be alarms to
indicate the over temperature condition.
IMCA
GUIDANCE
3.4.9 Start Prevention of Heavy Consumers
3.4.9.1 This is not a standard feature on every power management system but is common
on more sophisticated systems. The additional load of, for example, a large deck
crane may require a standby generator to be connected if kW or kVAr spinning
reserve will be compromised or if the anticipated transient voltage dip threatens
malfunction. A typical heavy consumer function will allow the start to proceed after
connecting the required number of generators according to a look up table. As it is
possible for multiple start requests to occur near simultaneously, the heavy
consumer module needs to be able to treat each request separately.
3.4.10 Load Limitation / Load shedding - General
3.4.10.1 Load limitation / shedding may be carried out by several systems including:-
1. The DP control system
2. The power management system
3. The generator protection
4. The thruster pitch control system
5. The thruster speed control system in the variable speed drive
3.4.10.2 The DP control system is programmed to limit or reduce the thrust order if there is
insufficient power available. In the event of a short fall in power, the DP control
system will generally sacrifice position to maintain heading. The load reduction
functions in the DP control systems are generally considered to be too slow to
provide effective blackout protection so it is normal to supplement these with fast
acting load reduction functions in the power management system. Such functions
may also be included as part of the control system for variable speed drives or for
generator protection and these are discussed in more detail in the sections that
follow.
3.4.10.3 Care needs to be exercised in the design and tuning of load limitation and load
shedding schemes as poorly designed systems can induce severe oscillations in the
power systems which can escalate to blackout or prevent standby generators
connecting.
3.4.10.4 Careful coordination is required to ensure that load reduction functions and load
dependent start function are properly coordinated Load dependent start should be
initiated at a power level below the point at which load reduction or load shedding
measures are activated. Failure to arrange the levels correctly creates a condition
where standby generators cannot start because the load is being maintained below
the starting point. Such a condition will result in a drift off unless the engineers
connect additional generators manually.
3.4.11 Load shedding - Power or Frequency
3.4.11.1 Load reduction systems may be based on:-

1. Available power
2. Power system frequency
IMCA
GUIDANCE
3.4.11.2 Available power Load reduction systems based on available power monitor the
power being supplied by the generators and status of generators (online or offline)
to determine the level of available power. Such systems depend upon the
generators being able to deliver rated power and are thus vulnerable to failures
cause by conditions such as fuel starvation where the generators cannot deliver
rated power. Care is required to ensure the power available calculation is robust and
some PMS manufactures carry out confidence checks by comparing the power
delivered by the generators to the load consumed - load reduction functions are
suspended if a significant discrepancy is detected. On older vessels the power
limitation signals connect the PMS field stations to the thruster or heavy consumer
control system by way of dedicated analogue links. This arrangement ensures the
necessary speed of load reduction but may introduce complications in DP Class 3
designs where the effects of fire on cable route must be considered. In more modern
vessel the load reduction signal are carried by the dual redundant communications
network.
3.4.11.3 Power system frequency Load reduction systems based on bus frequency simply
reduce load to prevent unacceptable drops in bus frequency which indicate that the
generators are unable to support the load. Such systems are not vulnerable to
conditions which limit the power of the generators but care must be taken to ensure
the frequency measuring scheme is robust and not likely to trigger a spurious load
reduction due to erroneous frequency measurements. Detection of low frequency
can also be used to open busties and trip non essential consumers.
3.4.12 Load shedding systems in variable speed drives
3.4.12.1 The control system for variable speed drives used for thrusters, cranes and pipe lay
systems may also contain independent load reduction functions based on
measuring the frequency at their power input. Because each drive makes its own
frequency measurements, failures are generally limited to one consumer. Because
this makes for a very robust system some vessel owners chose to base the entire
load reduction system on this principle and have no other system based on
centralised control and measurement other than the DP control system. Careful
design and tuning of these functions is important to prevent unwanted oscillations.
Some systems use a ‘fast-attack, slow-release’ function. In this type of function a
very rapid power chop is initiated followed by a slow ramp up to the limit of the
available power determined by the bus frequency.
3.4.13 Load limitation / shedding of variable speed drives based on available power
3.4.13.1 The speed with which variable speed drives can be controlled allows power
management systems to use them for blackout prevention purposes. This form of
control is often based on measurement of consumed power and estimates of
available power based on generator rating.
3.4.13.2 The control lines for load limitation are usually a mixture of 4-20mA loops and Net
I/O. In some cases analogue load limitation signals will connect PMS Field Stations
directly to the variable speed drive control systems. In other cases the PMS field
stations will communicate with the thruster or drive field station which will then pass
the signal or (some derived signal) to the variable speed drive itself.
IMCA
GUIDANCE
3.4.13.3 In properly designed systems the effect of PMS failure or control wiring failure on
thrusters will be ‘fails to no limit’ with appropriate alarm. The failure modes for non
DP consumers may be to ‘full limit’ or ‘no limit’ depending on what is considered to
be the safest mode. Figure 3-4 shows the signals related to power limitation and
control.
Figure 3-4 Signals relating to load reduction
3.4.14 Load Limitation and reduction functions
3.4.14.1 To ensure that available power is shared in an orderly manner amongst all the
various consumers according to their importance, each consumer is sent a ‘power
available’ signal that tells the drive how much power it can have at any instant in
time. If the speed or torque command to that drive requires more power than the
power available signal allows, the drive will set its ‘power limit active’ signal to
advise the PMS and DP system that it has reached the power limit. The power
available signal is recalculated each scan cycle of the PMS and can be visualised as
a dynamic ceiling on the power that the drive can draw. When there is plenty
spinning reserve, the power limit will be high and well above what the drive is
actually consuming but as the spinning reserve is used up the ceiling will fall to just
above what the drive is actually drawing. (The power available signal can be
‘absolute’, i.e. the total power that the drive can draw or ‘relative’, the amount by
which it can increase its load. The example below shows a ‘relative’ figure for power
available).
3.4.14.2 If the demand for power exceeds the power available signal, the effect is that the
drive load ramps up by the value of the power available signal in each scan cycle
until the desired load level is achieved or bus capacity limits further increase. In real
systems it is possible to specify an additional ramp function to prevent significant
dips in bus frequency and voltage or to prevent excessive torque in the drive train. It
is also possible to specify a delay on reallocation of power after a power reduction is
active (such features are not included in the discussion below).
3.4.14.3 To prevent an overload created by several systems each simultaneously grabbing

all the spinning reserve, the power available calculation for each consumer includes
coefficients reflecting the relative priority of consumers.
IMCA
GUIDANCE
3.4.14.4 Two conditions are simultaneously monitored and controlled.

1. Consumer wishes to draw more power than has been allocated to it
2. Overload caused by sudden loss of generating capacity
3.4.15 Power available for load increase - Example System
3.4.15.1 The example in Figure 3-5 is a much simplified power system with two generators,
one thruster, a crane and a fixed hotel load. There is no control over the hotel load
but both the thruster and the crane can be controlled as described above.
3.4.15.2 The crane and the thruster are each allocated power according to the following
functions:-
1. Power available to crane = crane allocation x (bus capacity x crane priority –
bus load)
2. Power available to thruster = thruster allocation x (bus capacity x thruster
priority – bus load)
3.4.15.3 The variables and coefficients are defined as follows:-

1. Bus capacity is equal to the sum of the ratings of the online generators.
2. Bus load is the total load on the bus.
3. Crane priority is 90% - The crane cannot raise the bus load to more than 90%
capacity – If the bus load exceeds 90% the crane load will be reduced.
4. Thruster priority is 100% - The thruster can raise the bus load to 100%
capacity and will force down the crane load to ensure it can access the power
it needs to hold station.
5. Crane allocation is 40% - At any instant in time, the crane can increase its
load by 40% of power available.
6. Thruster allocation is 60% - At any instant in time, the thruster can increase its
load by 60% of power available.
3.4.15.4 Note that in commercially available power reduction schemes the control functions
are more sophisticated with additional coefficients. This much simplified example is
only intended to help the reader understand the concept.
3.4.16 Thruster priority
3.4.16.1 Because the thruster has a higher consumer priority than the crane it will continue to
be assigned a power available figure which allows it to increase bus load over the
crane priority. This has the effect of invoking the crane overload function which then
ramps down the crane load incrementally as thruster load increases.
3.4.17 Consumer allocation
3.4.17.1 The effect of the consumer allocation is that whatever power is available for
simultaneous load increase by thruster and crane, the crane can have 40% of it and
the thruster can have 60%. The consumer priority and allocation can be set to suit a
particular application.
IMCA
GUIDANCE
3.4.18 Response to overload
3.4.18.1 In addition to managing the rate and percentage by which each consumer can
increase its consumption, the PMS must respond rapidly to loss of generating
capacity before the surviving generators trip on overload. Various schemes are
possible but load shedding in response to bus overload and falling bus frequency
are almost always included. Load shedding in response to individual generator
overload may also be included but this needs careful scrutiny to make sure it will not
compound a governor failure to excess fuel leading to blackout.
3.4.19 Load shedding in response to bus overload is performed using the following
functions:-
1. Overload thrusters = bus load – thruster priority x bus capacity
2. Overload crane = bus load – crane priority x bus capacity
3.4.20 Actual vessel systems
3.4.20.1 Reference to philosophy documents for actual vessel systems will reveal more
complex algorithms which allow the user to assign the percentage of available
power that is allocated from each bus in a multi bus system and also to include a
fixed power reserve for such things as active heave compensation but it may be
useful to consider the simplified scheme in Figure 3-5 below prior to considering the
effects of additional complexity.
3.4.21 Example power limitation and reduction scheme
3.4.21.1 Refer to Figure 3-5. In the example power system below, the generators are rated at
5MW each and the figures below each consumer are the power consumption used
in the first example rather than their rating. Two examples are used to demonstrate
how the load limitation and reduction systems respond to changes in the power
system conditions to prevent blackout and drift off. The figures used are intended to
help the reader understand the action of the power management system rather than
represent realistic conditions.
IMCA
GUIDANCE
Figure 3-5 Example Power System
3.4.22 Example 1 – Sudden loss of generating capacity
3.4.22.1 In the first example, the hotel load is 1MW and the thrusters are consuming about
3MW but this is varying up and down by about 1MW due to the environmental
conditions as shown in Figure 3-6 such that the total bus load is peaking at 9MW or
90% of generating capacity. The crane is hosting at a rate that requires 4MW.
3.4.22.2 At 45s into Figure 3-7, one of the two 5MW generators trips on a fault. Immediately
the thruster and crane loads are each reduced by the calculated overload, but are
allowed to ramp up again. However, as the new generating capacity is not enough
to support the original thruster and crane loads the crane is forced to slow down
during the thruster power peaks. As Figure 3-8 shows, the crane and thruster Power
Available (PA) figures fall almost to zero and the bus load is near to the remaining
generating capacity of 5MW.
IMCA
GUIDANCE
6 Thruster Load, Crane Load, Hotel Load

x 10
10
Total Bus Load

6 Thruster Load
Power (W)
Crane Load
Hotel Load
4
0 50 100 150
Time(s)
Figure 3-6 Initial Thruster, Crane and Hotel Loads

x 10
10
Thruster Load
8 Crane Load
Bus Load
6
Power (W)
0 50 100 150
Time(s)
Figure 3-7 Thruster, Crane and Hotel Loads after Loss of one 5MW Generator
IMCA
GUIDANCE
6 Bus Load, PA - Crane, PA - Thrusters

x 10
10
Bus Load
8 PA Crane
PA Thrusters
6
Power (W)
0 50 100 150
Time(s)
Figure 3-8 Effect on Power Available Signals to Thruster and Crane
3.4.23 Example 2 – Sudden demand for thrust
3.4.23.1 In the second example, bus capacity is 10MW and the thrusters are idling at a
steady 1.5MW, with the crane hoisting at rate which requires 4MW. The hotel load is
1MW. At 90s into Figure 3-9 there is a sudden demand for the thrusters to increase
to 8MW. The power limitation functions limit the rate at which the thrusters can ramp
up and the crane load is shed away such that the crane has to slow to a stop. Figure
3-10 shows how the bus load levels out at 9MW and the remaining power available
to the thrusters is low. Although there is some bus capacity left this is not available
to the crane as its priority level is 90%.
3.4.23.2 Had the thruster demand been 5MW instead of 8MW as shown in Figure 3-11 then
3MW would have been available to allow the crane to continue to hoist.
IMCA
GUIDANCE

x 10
10
Thruster Load
6 Crane Load
Hotel Load
Power (W)
0 50 100 150
Time(s)
Figure 3-9 Sudden Demand for Thrust
x 10
6 Bus Load, PA - Crane, PA - Thrusters
10
8 Bus Load
PA Crane
PA Thrusters
6
Power (W)
0 50 100 150
Time(s)
Figure 3-10 Bus Load and Power Available Following Large Demand for Thrust
IMCA
GUIDANCE

x 10
10
6
Power (W)
0 50 100 150
Time(s)
Figure 3-11 Thruster Step Load of 5MW
3.4.24 Load Shedding - Preferential trips
3.4.24.1 This feature is universal within all the more sophisticated power management
systems but may be provided by switchboard protection functions in some cases.
The effectiveness of preferential tripping in some DP vessel types may be limited by
the size of non-essential loads that can be made available for tripping.
3.4.24.2 Typical non essential loads include:-

1. Ventilation fans
2. HVAC
3. Galley services
4. Calorifiers
5. Water makers
6. Compressors
3.4.25 Drilling priority
3.4.25.1 In the case of vessels operating in deep water where the permissible position
excursion is relatively large, some vessel owners have chosen to prioritise power to
drilling and pipelay systems until a defined excursion is reached. At this point,
priority for power is returned to the thrusters and the drift off will be halted. This
small excursion is tolerated during the time that the power shortfall is made good by
the connection of standby sets. This arrangement requires the DP control system to
supply position information to the PMS so that it can reconfigure.
IMCA
GUIDANCE
3.4.26 Active heave compensation reserve
3.4.26.1 More sophisticated power management systems offer a facility to cope with
consumers that can vary their power demand over a very large range in a short
period of time. Active heave compensation systems for drilling are typical of this type
of consumer. In simple terms, a ‘false’ load figure equal to the expected peak power
demand is added to the actual load to maintain a reserve and trigger load
dependent starting to preserve it. Thrusters and other consumers cannot access this
reserve until they are given power priority over the active heave compensation.
3.4.27 Harmonic filter control
3.4.27.1 Systems that employ harmonic filters can have these devices connected or
disconnected by the power management system as conditions dictate. Filter
disconnection may be desirable to improve power factor under certain running
conditions or reduce power losses in conditions where they are not required. A
complementary strategy offered by one manufacturer starts an additional generator
when total harmonic distortion exceeds a certain level.
3.4.28 Derating
3.4.28.1 Derating is a useful but unusual power management system feature when a Diesel
engine is no longer able to attain its rated power. This feature allows the operator to
reassign a new maximum kW rating to one generator. The power management
system will then use this new value to determine the division of load between
generators.
3.4.29 Starting of standby generators on alarms from running generator
3.4.29.1 Connecting a replacement generator on detection of an alarm condition on a running

generator is another standard feature of most PM systems. Users may have the
choice of programming the automatic stopping of faulty sets depending upon the
severity of the alarm. Some vessel owners prefer to have manual stopping of the
faulty generator.
3.4.30 Remote Start Stop
3.4.30.1 Almost all power management systems offer this feature. How it is actually
achieved may depend on the particular system configuration, for example, use of an
engine manufacturer’s control system or direct control from the power management
systems.
3.4.31 Standby Generator Selection
3.4.31.1 The standby starting matrix is another central component in most power
management systems. This may be configured by the engineer to take account of
ongoing maintenance. Several incidents have been recorded where failure of a
standby generator start was due to improper setting of the starting order. Power
management system manufacturers would claim that these problems have now
been overcome. Even in the most modern systems it may be possible to select the
same standby order number for more than one generator without any alarm on the
power management system. The PMS will generally connect the generator with the
lowest physical number. However this generator may be on a different switchboard
to the one the operator intended to connect.
IMCA
GUIDANCE
3.4.32 Circuit Breaker Open / Close
3.4.32.1 Circuit breaker open / close is a standard feature of many systems and a network
mimic is often provided as an aid to correct selection. Interlocking of circuit breakers
is normally hardwired. In some cases software interlock are used as a backup to the
hardwired interlocks. Some power management systems offer a convenient feature
that allows the power system to be configured for different types of operation.
3.4.33 Password Protection
3.4.33.1 Password protection on some system controls access to more advanced features.
When a choice of settings is provided, some manufactures will ensure that it is not
possible to inadvertently set parameters beyond reasonable limits.
IMCA
GUIDANCE
4 POWER DISTRIBUTION
4.1 POWER DISTRIBUTION SCHEMES
4.1.1 General principles and influence on redundancy concept
4.1.1.1 The power distribution scheme of a DP Class 2 or DP Class 3 vessel forms the very
heart of the vessel’s DP redundancy concept. How generators, thrusters and
auxiliary services are divided into groups largely determines the vessel’s worst case
failure and therefore its post failure DP capability. It is common practice to describe
the electrical part of the redundancy concept in the form of an overall power system
single line diagram.
4.1.2 Design methodology
4.1.2.1 There are several possible approaches to DP vessel design but two possibilities are
outlined below.
1. If the intention is to build a vessel similar to a unit that already exists in the
fleet then data on the station keeping capability of this vessel may serve as a
guide or base line for development of the new vessel.
2. If the new vessel is significantly different, then the process leading to
development of the redundancy concept follows the pattern below.
4.1.2.2 The hull form required for the application is chosen, typically ship-form, barge or
semi submersible. Catamaran forms are now becoming popular for certain
applications.
4.1.2.3 Established regional data on weather, sea state and tidal currents is consulted to
further refine the choice of hull design and propulsion machinery.
4.1.2.4 For DP Class 2 and DP Class 3 vessels, the post worst case failure capability
defines the environmental conditions in which the vessel can operate and this can
be related to uptime by reference to the regional environmental data.
4.1.2.5 How the post worst case failure DP capability is achieved is determined by the
redundancy concept and worst case failure design intent which are intimately linked
to the arrangement of main and auxiliary switchboards. This will influence the type
and rating of propulsion machinery along with estimates of power requirements for
hotel and process loads such as drilling, pipelay, ROV support etc. An allowance for
maintenance of major machinery may also be included.
4.1.2.6 The whole process may go through several iterations leading to the point where the
DP Class, redundancy concept, operating configuration, WCFDI, single line power
system diagram and the rating and type of the major propulsion machinery has been
established.
IMCA
GUIDANCE
4.1.3 Distribution system components
4.1.3.1 The power distribution scheme consists of:-

1. Switchboards - with switchgear, protection and control equipment
2. Service transformers
3. Distribution boards
4. Motor control centres
5. Cables - cable trays
4.1.3.2 The purpose of the power distribution scheme is to distribute power to consumers at
the required voltage level.
4.1.4 Voltage distribution levels
4.1.4.1 There may be several voltage levels in a power distribution scheme to provide
power at a voltage appropriate to the type and power rating of the consumer. As
might be expected, low power consumers tend to be supplied at lower voltage levels
than high power consumers. As power ratings increase, the rated voltage is
increased to reduce the current and thus the cross section of the cables and
windings required to supply the power. Increasing the voltage rating also reduces
the maximum fault current. Low voltage supplies may be provided for safety reasons
and because there are fewer restriction on the qualifications of maintenance
personnel. In a large diesel electric vessel the distribution levels might be as listed in
Table 4-1. Voltage distribution levels for smaller or less complex vessel are given in
4.1.4.2 Table 4-2. However, some quite large vessels are now using LV power generation.
Table 4-1 Voltage distribution levels - large vessels
Voltage level designation Typical voltage Use

Generators, thrusters, service
HV 11kV 6.6kV transformers, drilling and pipe lay
drives
Pumps, fans, service
690V 480V 440V transformers, HVAC,
LV
380V accommodation heating.
Emergency services
Lighting and small power 220V 208V 110V Lighting, single phase motors
Systems for navigation, DP vessel
Battery systems 110Vdc 24Vdc management, thruster drives,
engines and switchboards
IMCA
GUIDANCE
Table 4-2 Voltage distribution levels - Smaller vessels
Voltage level designation Typical voltage Use

Generators, thrusters, large
Main generation level 690V
pumps
Pumps, fans, service
transformers, HVAC,
Auxiliary system level 480V 440V 380V
accommodation heating.
Emergency services
Lighting and small power 220V 208V 110V Lighting, single phase motors
Systems for navigation, DP vessel
Battery systems 110Vdc 24Vdc management, thruster drives,
engines and switchboards
4.1.5 Emergency generators
4.1.5.1 Vessels which fall under the SOLAS regulations must have an emergency source of
power capable of supplying designated emergency consumers. In larger vessels this
requirements is typically fulfilled by the provision of an emergency generator. This
generator and its associated emergency switchboard form part of the vessel’s low
voltage scheme but there are requirements for separation between the two systems.
On smaller vessels the emergency generator may be 300kW but on larger vessels it
is common to find generators of 1MW to 2MW rating.
4.1.5.2 It is sometimes possible for DP vessels to obtain an exemption from having an

emergency generator if they meet certain requirements in addition to their power
system redundancy. However, the emergency generator has so many useful
functions related to black starting the vessel, providing an alternative source of
power and providing long term backup to battery systems that most DP vessel
power plant designers choose to incorporate an emergency generator in their
design. Some even elect to have a full sized main generator as the emergency set.
4.1.5.3 SOLAS and classification society rules influence the way in which the emergency
generator is used for non emergency functions. Generally, it is accepted that the
emergency generator can act as a harbour set for short periods of time. This is
useful if the harbour load is very small in relation to the load at sea as it may help to
prevent a large main engine running at low load for an extended period.
4.1.5.4 Some classification societies interpret SOLAS requirements as:-

1. Normal operation of the vessel shall be possible with the complete emergency
electrical power supply system out of operation.
2. All consumers that support functions required to be available in normal
operation, shall be supplied from distribution systems independent of the
emergency electrical power supply system.
3. All consumers required to be available in emergency operation shall be
supplied from distribution systems independent of the main electric power
supply system.
IMCA
GUIDANCE
4. Consumers required to have both main and emergency supply shall be

supplied as required by relevant rules applicable for these consumers. The
primary supply shall be from the main system. Upon failure of any of the
required power supplies, an alarm shall be initiated.
4.1.5.5 This last clause is generally interpreted to mean that mains power for UPSs and
battery systems required to support DP essential consumers should be supplied
from the same side of the main power distribution system as the equipment they
support but can have a back up supply from the emergency power distribution.
Under no circumstances should all DP UPSs and battery systems have a sole
source of power from the emergency switchboard. Although this arrangement was
once popular.
4.1.6 Service transformers
4.1.6.1 Service transformers are provided to transform power from one voltage level to
another. They are typically a three phase two winding transformer with a delta / delta
or delta / star arrangement with or without an earthed star point as shown in Figure
4-1. Occasionally a three phase transformer is constructed from three single phase
transformers and a fourth single phase transformer is provided as a spare winding.
Figure 4-1 Service transformers
4.1.6.2 The voltage at a transformer secondary winding can be predicted from a knowledge
of its primary voltage V1 and turns ratio N1/N2 according to Equation 4-1
V1 N 1 I 2
= =
V2 N 2 I 1
Equation 4-1 Transformer formula
IMCA
GUIDANCE
4.1.7 Service transformers can be water cooled or air cooled. Air cooled transformers can
be convection (naturally) cooled or forced cooled using fans. Some transformers
may be arranged to trip on over temperature and others may only have an alarm. It
is not uncommon in older DP Class 2 design to find all the vessel’s service
transformers in a single compartment. This is acceptable but the provision of
ventilation supplies and fire dampers may need careful consideration.
4.1.8 Some classification societies may require over voltage protection on the transformer
secondary in view of the risk of an over voltage being coupled through from the
primary side although an earthed screen between primary and secondary windings
may be accepted in mitigation. Where an earthed neutral is provide on the
secondary side it may be necessary to have only one service transformer earthed at
any one time to prevent circulating currents.
4.1.8.1 Service transformers can have an unexpected influence on the redundancy concept
of a DP vessel particularly when they have cooling or other auxiliary functions which
are powered from sources other than the distribution systems they feed. Such
arrangements are surprisingly common and can cause distribution system failure
effects to be more severe than would otherwise be expected if not identified in the
DP system FMEA.
4.1.8.2 Where the secondary side of two service transformers can be connected by a tie
line connecting their respective LV switchboards both transformers will be able to
contribute current to any fault. In some distribution systems the LV switchboards are
not rated for this level of fault current and interlocks are provided to prevent the
parallel operation of the service transformers. Short term paralleling may be
arranged to allow bumpless transfer of the load from one service transformer to the
other.
4.1.8.3 Large service transformers may have a significant inrush current at the point of
connection which is capable of tripping over current protection. This can have a
distinct disadvantage for blackout recovery as it may be necessary to wait for two
generators to connect before the service transformers can be energised.
4.1.8.4 The inrush current transient is cause by the action of synchronising the magnetic
core of the transformer with the applied voltage at the time of connection which may
drive the core into saturation initially.
4.1.8.5 This effect can be prevented by using a pre magnetising transformer. This is a small
LV transformer which is used to back feed the large service transformer from its
secondary side before the primary side of the service transformer is connected.
Thus the magnetic core is already in synchronism with the primary side supply when
the transformer is connected.
4.1.9 Phase shifting transformers
4.1.9.1 Phase shifting transformers are normally used in marine power plant applications for
harmonic cancellation. Excessive levels of low order harmonic distortion are
associated with equipment malfunction, unwanted heating, audible noise, lighting
failures and other faults.
IMCA
GUIDANCE
4.1.9.2 The idea that a distorted waveform can be represented by a series of sinusoidal
waveforms is credited to Joseph Fourier an 18th century French mathematician. The
frequency of each harmonic component is a multiple of the fundamental frequency
which is typically 60Hz in marine power systems.
4.1.9.3 Classification societies set various limits for Total Harmonic Distortion (THD) but
figures of 5% for THD and 3% for the maximum contribution of any one harmonic
are not uncommon.
4.1.9.4 In marine applications the primary sources of harmonics are from AC and DC
variable speed drives used for thrusters and drilling equipment. Figure 4-2 shows
the distortion in the red - yellow line voltage of a large DP vessel using 12 pulse
thruster drives.
4.1.9.5 Variable speed drives using three phase bridge rectifier front ends are still popular
for thruster drives and drilling equipment. These drives draw non linear current with
significant quantities of 5th and 7th order harmonics. The level of low order harmonics
can be reduced by using two 6 pulse rectifiers supplied from a single three winding
transformer with a delta primary and two secondary windings. One secondary is a
delta and the other a star. This arrangement introduces a 30 degree phase shift
between the current pulses drawn by the two 6 pulse rectifiers and the dual rectifier
drive is referred to as a 12 pulse drive. Figure 4-3 shows the harmonic analysis of
the waveform in Figure 4-2. Although it still contains significant quantities of 11th and
13th harmonic the 5th and 7th order harmonics have almost been eliminated.
4.1.9.6 The increasing use of drives with Active Front End (AFE) rectifiers has removed the
need for phase shifting transformers but an isolation transformer is still required.
Volts
10000
7500
5000
2500
-2500
-5000
-7500
-10000
12:57:36.000 12:57:36.005 12:57:36.010 12:57:36.015 12:57:36.020
CHA Volts
Timed event at 14/02/01 12:57:36.000
Figure 4-2 Harmonics distortion from 12 pulse drives on 6.6kV marine power systems
IMCA
GUIDANCE
% of FND
4.5
4.0
3.5
3.0
2.5
2.0
1.5
1.0
0.5
0.0
Thd H10 H20 H30 H40 H50
CHA Volts
Total RMS: 6609.47 Volts

DC Level : 4.64 Volts
Fundamental(H1) RMS: 6602.38 Volts
Total Harmonic Distortion (H02-H50):4.48 % of FND
Even contribution (H02-H50): 0.18 % of FND
Odd contribution (H03-H49): 4.48 % of FND
Timed event at 14/02/01 12:57:36.000
Figure 4-3 Harmonic content of 6.6kV voltage waveform
4.1.9.7 It is possible to create transformers with other phase shifts to further reduce the
harmonic contribution from drives. The International Electrotechnical Commission
(IEC) devised the concept of the transformer vector group code to indicate the
internal connections of transformer windings. The vector group takes the form of a
three element code such as Dy11.
1. D indicates the HV winding is a delta
2. Y indicated the LV winding is a wye (star)
3. 11 indicates the voltage of the LV winding leads the HV winding by 30° (by
reference to a clock face) - In a Dy1 transformer the phase shift would be 30°
lag.
4.1.9.8 Note the IEC standard refers to HV and LV windings not primary and secondary
windings. Transformers built to ANSI standards may have a vector diagram rather
than a vector group code on their nameplate.
IMCA
GUIDANCE
4.1.10 Protection for LV distribution
4.1.10.1 Protection system for LV distribution (where it is not the main power generation
level) tend to be limited to :-
1. Over current (short circuit)
2. Overload for motors
3. Under voltage trip for service transformer feeders - with suitable delay
4. Earth fault alarm
4.1.10.2 At the lowest power distribution levels such as 120V or 24Vdc it is not uncommon to
find that distribution boards are populated with miniature circuit breakers. The
selectivity provided by these devices needs very careful scrutiny particularly if the
redundancy concept depends on their correct operation.
4.1.11 Interlocks
4.1.11.1 Interlocks in power distribution systems are necessary to prevent the plant entering
a dangerous condition or configuration. Hardwired interlocks are required to prevent
such things as:-
1. Switchboards being configured in such a way that their short circuit rating is
exceeded
2. Bus sections being connected when not in synchronism
3. Generators being connected when not in synchronism
4. Circuit breakers being withdrawn or engaged when closed
5. Generators being started or exciting when earth switches are engaged
6. To prevent a variable speed drive being connected without pre charging its DC
link
7. To prevent all generators connecting to a switchboard at the same time if
these would exceed the short circuit rating.
4.1.11.2 Interlocks are also used to restrict access to live parts when maintenance is being
carried out. Specialised key type interlocks are used to ensure that:-
1. The switchboard earth switch cannot be engaged unless all generator and
bustie circuit breakers are in the open position.
2. Cabinet doors for dual fed consumers cannot be opened unless both sources
of power are isolated.
4.1.11.3 Key type Interlocks may have a mechanical part and an electrical part. The
mechanical part may be intended to physically lock the circuit breaker in the open
position and the electrical part will interrupt the closing circuit and apply a trip signal
to open the circuit breaker if for any reason the circuit breaker is closed.
IMCA
GUIDANCE
4.1.11.4 Some interlocking schemes include inter trips. An inter trip is a signal sent to one
circuit breaker from another. Typical uses of inter trips are:-
1. To open the HV bustie if the LV bustie trip, in power system that run with
service transformer in parallel as shown in Figure 4-4
2. To open the primary side circuit breaker of a service transformer if the
secondary side trips on a fault as shown in Figure 4-5
3. To prevent service transformers being operated in parallel as shown in Figure
4-5
4. To prevent the shore supply being paralleled with the vessel’s generators or to
disconnect all the service transformers from the LV power system if the shore
supply is connected as shown in Figure 4-6.
4.1.11.5 Care must be taken in the design of interlocks and inter trips not to create single
point failures that can cause a blackout. As the electrical part of interlocks and inter
trips often form a common point between redundant parts of the power system there
may be a possibility that faults on the interlocking lines affect both power systems. In
particular, the effects of fire and flooding on interlocking lines needs to be
considered.
G G G G
HV
LV
TRIPS HV BUSTIE
IF LV BUSTIE OPENS.
PREVENTS LV BUSTIE CLOSING
IF HV BUSTIE IS OPEN.
Figure 4-4 Inter trip for parallel service transformers
IMCA
GUIDANCE
Figure 4-5 Interlocks to prevent parallel service transformer operation
Figure 4-6 Shore supply interlock
4.2 POWER PLANT CONFIGURATIONS
4.2.1 Power plant topologies
4.2.1.1 There are a huge number of variations in the design of diesel electric power plant for
DP vessels although many designs are variations on a smaller number of basic
designs and some use elements from several different design concepts. All the
examples which follow can be built as DP class 2 or DP Class 3 designs and can be
operated as common or independent power systems with suitable protection
schemes.
IMCA
GUIDANCE
Figure 4-7 Asymmetric two way split
4.2.1.2 Figure 4-7 shows one of the most basic arrangements. Each of the two main
switchboards connects to the same number of generators and thrusters but because
of the arrangement of thrusters in the hull, each main switchboard supplies different
numbers of bow and stern thrusters. Although very popular, this design does not
make optimum use of the available machinery because the worst case failure effect
is loss of 50% of the generating capacity. The worst case failure also leaves only
one bow thruster operating which results in a poor post failure DP capability.
4.2.1.3 Figure 4-8 shows another popular arrangement. This design is based on a three
way split. Provided the power system is properly designed and protected, the worst
case failure is now reduced to 33% of the power generating capacity and there
should always be two bow thrusters available after any single failure.
Figure 4-8 Three-way split
Figure 4-9 Transferable or dual fed thrusters
IMCA
GUIDANCE
4.2.1.4 Figure 4-9 shows another alternative. In this arrangement the power generation and
distribution system is arranged as a two way split but two of the thrusters can be
powered from either main switchboard. The worst case failure is loss of 50% of the
power generating capacity but it should be possible to have two bow thrusters
available after any single failure. It is possible to provide every thruster with a dual
feed such that the worst case loss of thrusters is reduced to a single thruster. The
transfer or dual feed mechanism introduces additional complexity and bring with it
additional scrutiny from regulators but provided this is properly managed the design
is a useful way of enhancing the post failure capability of the simple two way split.
4.2.1.5 The four way split is also been popular and is better suited to the thruster
arrangement of semi-submersible than monohulls. There are a large number of
variations on this design. In some arrangement the power distribution is arranged to
ensure that there is always at least one thruster operating in each corner following a
single failure. In other arrangements the design accepts loss of thrust in one corner.
Figure 4-10 shows one possible variation on this theme.
Figure 4-10 Four way split for semi-submersible
4.2.1.6 In all designs it can be beneficial to closely associate the power supplies for thruster
auxiliary systems with the supply to the main motor itself. Some designers chose to
derive the auxiliary supply from the drive transformer by way of a fused isolator
while others provide a dedicated step down transformer from the main power
system. The latter arrangement may be preferred if the drive auxiliaries must be
energised from the main power system before starting the drive as the drive circuit
breaker will be closed by the drive itself after pre charging.
4.2.2 Innovations
4.2.2.1 There have been several innovative designs for improving redundancy and fault
tolerance in diesel electric systems some dating back to the early nineteen eighties,
long before the DP rules and guidelines were established. Others have been made
possible by advances in power electronic converters and their control systems. It is
interesting that the impetus for many innovations originates with vessel owners
seeking to improve reliability. A few of these innovative designs are discussed in the
sections that follow.
IMCA
GUIDANCE
4.2.3 Split reactor
4.2.3.1 It has long been recognised that one of the greatest challenges in the design of fault
tolerant diesel electric power systems is to ensure that consumers can survive the
severe voltage dip associated with clearing a short circuit fault anywhere on the
main power distribution system.
4.2.3.2 In the early nineteen eighties one of the classification societies developed a power
plant design for low voltage diesel electric systems which allowed all generators to
supply power to all thrusters while at the same time protecting the surviving thruster
motors against the severe voltage dip associated with a fault on one of the two main
switchboards. Figure 4-11 shows the overall single line diagram.
4.2.3.3 In a conventional diesel electric power system with a two way split operating as a
common power system a short circuit anywhere on the main power distribution
system can pull the system voltage down to zero until it is cleared by the over
current protection. The resulting disruption can cause thruster and auxiliary system
motors to trip. In the split reactor system each generator supplies both main
switchboards by way of a split reactor and there is no direct connection between the
two switchboards as in a conventional power plant. If a fault occurs on one main
switchboard (Point A) it will cause the voltage at the generator terminals to fall, but
the voltage drop across the split reactor is coupled across to the healthy
switchboard and used to maintain the system voltage until the fault is cleared. All
generators are left connected to the healthy switchboard. The split reactor system
also significantly reduces the magnitude of the fault current allowing all generators
to be connected to one switchboard and reducing the need for a switchboard with a
high short circuit current rating. In conventional low voltage power systems it is
sometimes necessary to open the bustie when the fourth generator connects to limit
the fault current that can be experienced by each main switchboard. During normal
operation the split reactor system has no core losses provided the thruster loads are
reasonably well balanced.
IMCA
GUIDANCE
Figure 4-11 Split reactor power plant
4.2.4 Phase shifted power systems
4.2.4.1 One marine power system provider developed a method to reduce the electrical
losses (wasted power) associated with the phase shifting transformers required for
harmonic cancellation in propulsion systems utilising variable speed drives. Figure
4-12 illustrates the general principle of operation. Rather than provide a phase
shifting transformer for each thruster drive, two phase shifting transformers (one for
each half of the power plant) are used to phase shift the generators connected to
the two main busses with respect to each other. One of the two rectifiers for each
thruster drive is connected to each bus and thus the drives draw power directly from
the generators with the correct phase shift for harmonic cancellation.
IMCA
GUIDANCE
Figure 4-12 Phase shifted power system
4.2.5 Grid interconnector
4.2.5.1 One vessel owner’s design initiative led to the development of a new type of power
system for large vessels which can be applied to DP Class 2 and DP Class 3
designs. In this design, grid interconnector technology is used to provide each
thruster variable speed drive with a continuous dual feed from both main
switchboards as shown in Figure 4-13. Each thruster is designed to be independent
of the others and thus the worst case failure is limited to loss of a single thruster. In
addition to supplying the thruster drives from a dual source, the thruster auxiliaries
are also supplied in this way as shown in Figure 4-14. The thruster auxiliary system
can be powered from a large battery bank for a short period of time and from the
emergency generator if required. The battery bank allows the thrusters to be made
ready for DP independently of the generators and thus thruster and generator
recovery become parallel activities, rather than sequential ones, saving time in the
recovery sequence.
Figure 4-13 Grid interconnector based power system
IMCA
GUIDANCE
11 kV BUS A 480V BUS E 11 kV BUS B
AUXILIARY CONVERTER
1 kVdc
THRUSTER AUXILIARY
PUMPS AND FANS
MAIN CONVERTER
1.8 kVdc
THRUSTER
Figure 4-14 Power supplies to thrusters and their auxiliary systems
4.3 OPERATIONAL CONFIGURATION
4.3.1 Choice of operational configuration
4.3.1.1 All DP Class 2 and DP Class 3 power plants are intended to be fully fault tolerant
when operated in one of the configurations analysed in the vessel’s approved DP
FMEA.
4.3.1.2 Conventional diesel electric power plants can usually be operated in one of two
configurations. Either as a single ‘common’ power system capable of automatic
subdivision in response to a fault or as two or more independent power systems.
These modes of operation are sometimes referred to as ‘busties closed’ and ‘busties
open’ respectively.
4.3.1.3 Much debate in the DP community has centred on the relative advantages and
disadvantages of these two modes of operation but one thing is certain, neither
configuration guarantees station keeping integrity on its own and the whole issue of
‘DP safety and reliability’ is far more complex than choosing one power plant
configuration or the other.
IMCA
GUIDANCE
4.3.1.4 The issue is not whether one power plant configuration is safer than another but
rather whether each chosen configuration is adequately safe given the
consequences of loss of position, i.e. an absolute test rather than a relative one.
IMCA document M191, ‘Analysis of Station Keeping Incident Data’ 1994 to 2003’
presents some interesting conclusions of the subject of open and closed busties for
those readers who wish to know more.
4.3.2 Common power system
4.3.3 The greater the number of generators connected to a power system, the more
robust is that power system because it becomes increasingly difficult for a single
generator to vary the power system voltage and frequency. Common power systems
allow greater flexibility in generator utilisation which translates to lower fuel
consumption, less pollution and reduced maintenance.
4.3.4 Marine power systems are relatively small and DP vessels operating with a common
power system are heavily dependent on a wide range of protective functions for fault
tolerance. They are also heavily dependent on the voltage dip ride through capability
of all generators and consumers connected to that power system. Neither of these
features is fully tested at sea trials and therefore much depends on the quality of the
power system studies on which the protection schemes are based and on the
commissioning of the protective functions themselves. At least one of the major
classification societies does carry out live short circuit testing of power systems for
redundant propulsion systems and such tests do reveal inadequate protection
schemes and poor fault ride through capability.
4.3.5 Independent power systems
4.3.5.1 When diesel electric systems are designed to operate as two or more independent
power systems each power system may consist of only one or two generators and
the ratio of generator rating to system load is greater than in the common power
system case. That is to say the system load is smaller as it is divided amongst
several independent power systems. Thus, it is easier for a faulty generator to force
healthy generators to trip.
4.3.5.2 In order to run all the thrusters there must be at least one generator running on each
power system. Thus in light load conditions the reliability of the power system and
thus the thrusters is heavily influenced by the reliability of a single diesel engine
which is relatively low. Thus, there may be a more frequent occurrence of partial
blackout and loss of thrusters. Provided the vessel is being operated within its post
failure DP capability for that power plant configuration, there should be no significant
position excursion but this will increase the number of times that the remaining
generators and thrusters are called upon to compensate rapidly for the loss of one
power system. Thus it can be argued that, in practical terms, although common
power systems are vulnerable to the hidden failure of protective functions. Multiple
Independent power systems are vulnerable to failure of redundant elements to
achieve their rated capacity. This includes equipment such as cooling systems as
well as thrusters and generators.
IMCA
GUIDANCE
4.4 TRANSFERABLE AND DUAL FED CONSUMERS
4.4.1 General
4.4.1.1 Providing means by which a thruster or generator can connect to more than one
main switchboard is a way of reducing the permanent impact of the vessel’s worst
case failure without further subdivision of the power plant. However, the redundancy
concept and therefore the vessel’s post failure DP capability is dependent upon
successfully restarting the transferable generator or thruster on the healthy side of
the power plant. The transfer must be carried out fairly rapidly to limit the position
excursion and figures of 10s or less are often specified. Note that the views of
classification societies differ on whether or not transferable generators and thrusters
can be considered to contribute to redundancy. It is highly advisable to consult
Class at an early point in the development of the basic design if considering having
transferable or dual fed equipment as part of the redundancy concept.
4.4.2 Generators
4.4.2.1 Some classification societies will accept transferable generators as contributing to

the vessel’s post failure DP capability and others may not accept such features or
only for certain notations. However, even those classification societies that require
redundancy to be based on ‘running machinery’ will generally allow such features to
be included in the design even though they are not part of the redundancy concept.
Some vessel designers add transferable generators as a means of recovering
power for process activities such as drilling or pipe laying and not for station
keeping.
4.4.3 Thrusters
4.4.3.1 In the last ten years there have been significant changes in attitudes towards
transferable thrusters. Originally, all the major classification societies were prepared
to accept thrusters with automatic changeover as contributing to the vessels’ post
failure DP capability. Opinions then changed and it became difficult to have any
type of changeover thruster accepted by some classification societies. However,
designs which transferred the thruster supply without the thruster stopping or
dropping out of DP were viewed more favourably than others. More recently
opinions have changed again with the availability of power electronic changeovers
and true dual feed arrangements such that these types of features can be accepted
as contributing to post failure capability on DP Class 2 and DP Class 3 designs.
However, particular attention must be paid to eliminating the possibility of a fault in
one power system or the thruster being transferred to the other power system. It is
also very important to reduce the risk of hidden failures which may prevent the
transferable thruster connecting successfully to its alternate source of power.
Careful consideration should be given to alarms and monitoring, internal diagnostics
and test facilities to give a high degree of confidence that the changeover will
operate successfully on demand.
IMCA
GUIDANCE
4.4.4 Essential services switchboards
4.4.4.1 Some vessel designers elect to provide motor control centres for essential engine
room services with two sources of power. The normal supply is typically the LV
distribution associated with the generators in that engine room. The alternate source
of power is usually the emergency switchboard. Note that this arrangement is only
practical if the vessel has a large emergency generator. The essential services
switchboards for each engine room will typically supply such things as:-
1. Electric fuel pumps
2. FW cooling pumps
3. SW pumps
4. Starting air compressors
5. Combustion air fans
6. Engine jacket water pre-heaters
7. Pre lube oil pumps
4.4.4.2 Note that some classification societies will not accept that the essential services
switch automatically to the emergency switchboard as this may compromise the
availability of the emergency generator. Therefore it is often necessary to ensure
that blackout recovery is possible with none of the essential services available at
least in the short term. Making blackout recovery independent of the emergency
generator is good practice in any case.
4.4.4.3 Some designers have chosen to install an essential services generator for this
purpose rather than use the emergency generator, and then seek exemption from
having an emergency generator, on the basis of having a fully redundant power
system. Note that some fairly onerous conditions may be applied to such an
exemption.
4.4.5 Transfer of fault
4.4.5.1 In all cases where one power system or one control system is connected to another
by shared equipment such as a thruster or generator there is a risk of transferring a
fault from one system to the other. In general, transferable or dual fed equipment
must be provided with a comprehensive range of protective function to prevent or
limit the effects of faults that could transfer in this way.
4.5 BATTERY SYSTEMS
4.5.1 General
4.5.1.1 IMCA document M196, ‘Guidance on the design, selection, Installation and use of
uninterruptible power supplies onboard vessels’, April 2009 provides information on
how UPSs and DC power supplies can be integrated into the redundancy concept.
IMCA
GUIDANCE
4.5.2 DC supplies for switchboard and generator controls
4.5.2.1 DC supplies with battery backup are used for switchboard controls, governors,
AVRs, thruster control and navigation equipment etc. Typical voltages are 125Vdc,
110Vdc and 24Vdc. In the absence of any other requirement, the battery endurance
for generator and switchboard related equipment is typically sized to allow 30
minutes operation, but it is prudent to size battery banks with a generous margin to
allow for aging.
4.5.2.2 As the power consumption of a switchboard control system increases greatly when
the circuit breakers are being opened and closed it may be appropriate to consider
the need to manoeuvre the switchboards during blackout in addition to the static
control load. It may also be prudent to provide separate battery supplies for spring
winders and control supplies to prevent a voltage dip associated with multiple
simultaneous operations of spring winders adversely affecting the control voltage.
4.5.2.3 Loads such as space heating should be separated from control supplies.
4.5.2.4 It is beneficial to provide all battery systems with a normal supply from the main
power distribution and a backup supply from the emergency power distribution.
4.5.3 UPSs
4.5.3.1 Modern DP vessels make extensive use of UPSs to supply equipment such as:-
1. DP control system
2. Vessel management system operator stations and field stations
3. Network hubs and switches
4. Power management system
5. Thruster controls
6. Pre-charge and ride-through supplies for UPSs
4.5.3.2 Figure 4-15 Shows the schematic of a double conversion UPS. In this design the
load is normally supplied by way of the battery charger and inverter. The bypass is
only used for battery maintenance purposes or if the inverter fails. This is the most
popular UPS for marine applications and the type recommended for DP vessels.
Other designs are available such as ‘line interactive’ types. In this design the load is
normally fed from the bypass and is only switched to the inverter when the main
supply fails. There have been cases of this type of UPS switching to the inverter on
detection of low power quality which is common in some vessel power plants. This
happened so frequently that the battery was almost depleted when needed.
IMCA
GUIDANCE
Figure 4-15 Double conversion or online UPS
4.5.3.3 It is beneficial to provide all UPSs with a normal supply from the main power
distribution and a backup supply from the emergency power distribution.
4.5.3.4 The ability of UPSs to supply sufficient fault current to operate over current
protection selectively needs careful consideration in any application where
redundancy depends upon the selectivity of circuit breakers or fuses.
4.5.3.5 There are several strategies for providing UPS power to the various consumers and
these are discussed in detail in IMCA M196 but the two extremes are-
1. Two large centralised UPSs
2. Distributed UPSs for each piece of equipment
4.5.3.6 Both methods have their advantages and disadvantages but it can be difficult to
overcome problems associated with transfer of fault and poor selectivity in the
centralised arrangement particularly for DP Class 3 designs.
4.6 SEPARATION OF REDUNDANT ELEMENTS FOR FIRE AND FLOOD
4.6.1 Requirements for physical separation
4.6.1.1 Although the requirements for physical separation of redundant equipment are
focused on DP Class 3 designs there are requirements to consider the possibility of
mechanical damage and fire in DP Class 2 designs. Even though DP Class 2
designs may have a single engine room, common cable routes serving redundant
equipment may not be accepted if they pass through high risk areas. In general it is
consider good practice to separate cables for thrusters and controls systems as far
as practical even in DP Class 2 designs.
IMCA
GUIDANCE
4.6.2 Cable and pipe routes
4.6.2.1 Physical separation of cable and pipe routes serving redundant equipment is
required for all DP Class 3 designs. Rules and guidelines vary on what level of
separation should be provided. IMO MSC 645 requires that cables and pipes
serving equipment intended to provide redundancy should be separated by
bulkheads of A60 classification. Cables may pass through the same compartment in
ducts of A60 rating if the only fire risk within the duct comes from the cables
themselves. Similarly for pipe work. Most classification societies will accept cross
over pipe work connecting redundant system in DP Class 3 designs provided it can
be isolated on either side of the bulkheads providing physical separation. Without
such isolation facilities it may be necessary to allow a compartment to continue to
flood so that cooling of other systems can continue (in the case of seawater cooling
systems).
4.6.3 Fire subdivisions
4.6.3.1 Some classifications societies only require that redundant equipment and cables are
in separate compartments. No mention is made of the rating of bulkheads or deck
heads. Other classification societies require A60 classification but will accept two A0
bulkheads as satisfying the requirements for physical separation provided the space
between them is a low fire risk.
4.6.4 Watertight compartments
4.6.4.1 IMO MSC 645 requires physical separation of equipment installed below the
operational water line. Equipment intended to provide redundancy must be located
in watertight compartments complying with requirements for fire protection. Some
classification societies make reference to the damaged water line and at least one
classification society requires that every thruster is in its own A60, watertight
compartment. Others may accept that thrusters are grouped in compartments
reflecting the overall split in the redundancy concept. Watertight fire dampers may
be arranged to prevent down flooding and the failure modes of these devices need
to be considered in the redundancy concept.
IMCA
GUIDANCE
5 VESSEL MANAGEMENT SYSTEMS
5.1 GENERAL DESCRIPTION
5.1.1 Distributed Control System
5.1.1.1 The Vessel Management System will manage the functions of control, monitoring
and alarm management of vital machinery required to control the vessel including
engine and propulsion auxiliary systems, fluid and cargo systems and other ancillary
systems. A modern vessel management system will utilise a distributed control
system to perform these functions.
5.1.1.2 As the name implies a distributed control system does not concentrate control of all
processes at a central location, rather it ‘distributes’ the control of tasks to different
nodes (PLCs or RCUs). These nodes will normally be housed close to the plant they
are controlling, thereby cutting down on wiring. Suitable communication networks
will link all aspects of the system together.
5.1.1.3 DCS architecture generally consists of one or more HMI, PLCs or RCUs, I/O
modules and a data communication highway linking the PLCs to the HMI and vice
versa. The IO modules within the controller nodes will use appropriate
communication for the plant it is controlling. This could be analogue or digital IO as
required. The diagram below shows a basic DCS with A60 compartment separation
to allow some continued operation following the loss of any compartment to fire or
flood etc.
Figure 5-1 Basic Distributed Control System
5.1.1.4 In reality it can be argued that current systems are a SCADA/DCS hybrid in as much
as the software within the HMIs will monitor aspects of the plant, alarm when an
event is detected and carry out some supervisory action such as starting a standby
pump.
IMCA
GUIDANCE
5.1.1.5 This is the basis of a SCADA system where data gathering is the prime objective
and actions are event driven. A DCS is usually accepted as being process driven,
meaning that all tasks allocated to a node are normally run sequentially, usually
within a ladder program of a PLC, and mismatch alarms etc. are not generated until
the process looking at that particular IO is run.
5.1.2 Industrial Networks
5.1.2.1 Industrial Networks is a general term given to any type of communication connecting
devices for process control applications. Industrial networks can be divided into
several types.
1. Control Networks
2. Fieldbus Networks
3. Sensor Networks
5.1.2.2 Control Network: Sometimes called the Process Network, this is the high level
network used to transmit instructions and data between the HMI and the PLCs
which control the plant. Different technologies and protocols have been used over
the years but the preferred solution used by most companies at this time is
Ethernet/IP, where the IP stands for ‘Industrial Protocol’.
5.1.2.3 It has been argued that Ethernet/IP is a non deterministic protocol and when the
system is using network hubs, half duplex, CSMA/CD architecture this is true to
some extent, depending on overall bandwidth usage. However with newer
installations, where data switches are used in place of hubs, and full duplex 100M
networks are in use, the network can be considered deterministic for all practical
purposes. The use of switches also allows additional Quality of Standard (QoS)
rules to be implemented i.e. the switches can assign higher priorities to specific
traffic.
5.1.2.4 Fieldbus Network: The origin of the ‘fieldbus’ was to replace hard wired connections
between complicated field devices and their controllers by a single digital link where
all data could be transmitted in a serial string. To accommodate information from
several sources the data is time multiplexed.
Figure 5-2 Fieldbus Communications using Profibus DP Protocol
IMCA
GUIDANCE
5.1.2.5 With all devices or equipments that support the Profibus DP protocol, a General
System Data (GSD) file (text file) should be supplied by the manufacturer. This GSD
file contains general information about the device; type of device, supported baud
rates, a summary of functions supported within the protocol, and all cyclic data (data
that is exchanged every bus scan with the master).
5.1.2.6 Figure 5-2 above shows how this operates in practice. The PLC will have the MCC
as one of the devices it must interrogate and control during its scan. Data recovered
from the MCC will be repackaged and sent to the HMI on the Control Network.
5.1.2.7 Sensor Network: This is the most basic network and works by detecting the status of
a sensor and transmitting this information as a discrete ‘1’ or a ‘0’ to the PLC. This
might be the position of a valve (open or closed) or the state of switch.
5.1.3 Network Topologies
5.1.3.1 With different types of networks as described above there are different network
topologies. Historically, these were designated as star, bus and ring, however as
technology has progressed these have changed somewhat from their original design
and a more correct name for each one is now:
1. Physical Star Logical Bus
2. Physical Bus Logical Ring
3. Physical Ring Logical Ring
5.1.3.2 Physical Star Logical Bus Topology: In its simplest form a star network consists of a
single device connected to each node by a separate cable. In earlier fieldbus
iterations this would have been all field devices possibly connecting to a single main
frame computer in the control room. All control functions would be sent to the field
devices using point-to-point hardwired connections. This was a ‘true’ star topology
as all data would flow back through the mainframe. The system was expensive due
to the amount of wiring involved, complex to configure and difficult to maintain. In
addition the lack of effective standards led to expensive upgrades when new
technology was introduced.
Figure 5-3 Star Topology
IMCA
GUIDANCE
5.1.3.3 With the introduction of distributed control and agreements on standards for
industrial data communications new models were required. Figure 5-4 shows a
small network with three switches and twelve nodes. Although each switch may
physically look as though it is the centre of a star, internally each switch has a linear
bus as a backbone. Making this a ‘physical star logical bus’ topology.
Figure 5-4 Physical Star Logical Bus
5.1.3.4 Some of the main advantages of this network are scalability with no disruptions to
the network when adding or removing devices and easy fault detection. In addition,
the failure of a node will have no effect on the rest of the network. With the use of
switches and 100M full duplex communication a node communicates with any other
node using point-to-point communications. Each node believes it has total use of the
bandwidth, so no collisions occur and retransmitting of data is not required.
5.1.3.5 In addition to contributing to the advantages of this topology, the switches can be
seen as the main disadvantage. Failure of a switch will mean any nodes connected
to it will be unreachable. As discussed above each node believes it has total use of
the bandwidth, therefore although the bandwidth used between nodes in point-to-
point communications may be low, if several nodes are communicating
simultaneously the cabling between the switches may become a bottleneck. This is
usually overcome by using fibre optic cabling between switches connected to
Gigabit uplink modules within the switches. As modern switches normally have a
Gigabit backbone this effectively means the network can accommodate 10 x 100M
individual networks.
5.1.3.6 The disadvantages discussed above are overcome by utilising a dual network,
nominally called Net A and Net B. Figure 5-5 illustrates this configuration. The two
networks are completely independent with separate switches, separate cabling and
dual isolated network adapters within the network nodes. Separately sourced power
supplies are also provided for switches on the different networks. All data is
transmitted on both networks simultaneously with the same time stamp. Only one
message is processed and the other one is dropped with no further action being
carried out.
5.1.3.7 This dual redundant topology is ideal for Ethernet connections and is used
extensively for Control Networks i.e. between the HMIs and the RCUs etc.
IMCA
GUIDANCE
Figure 5-5 Dual Redundant Star Topology
5.1.3.8 Physical Bus Logical Ring Topology: In this topology all nodes are connected to a
shared backbone using multidrop lines connected to medium access units (MAU).
The MAU devices ensure the connected node is ready for network traffic before it is
allowed onto the bus. Data placed on the bus is propagated to all operating nodes
and is therefore sometimes described as a broadcast system. A terminating load
(resistor) is fitted at each end. This is required to optimise signal quality and prevent
signal reflection. Incorrect termination can make a bus unusable especially at high
transmission speeds.
Figure 5-6 Bus Topology
5.1.3.9 This topology greatly reduces cabling costs when compared to a star network. It is
easy to implement and fault finding is relatively easy. Failure of a node should have
minimal effect on the rest of the network.
5.1.3.10 There are several disadvantages of this basic system, the main one being that as a
single backbone is used only one data packet can be transmitted at any time. All
transmissions must therefore be carefully controlled by some arbitration system.
This explains why most industrial bus systems use some type of token passing
system.
IMCA
GUIDANCE
5.1.3.11 A basic token passing system would consist of a data object that is passed around
the nodes in a ring. When a node receives the ‘token’ it has a finite time (token hold
time) to take control of the bus, to either send data or receive data. It will send any
high priority packets first and if any time is left will send any low priority packets.
Once the token hold time has expired the next lowest addressed node receives the
token and the cycle continues.
5.1.3.12 The token passing protocol is easy to implement in software, in addition when
adding new nodes to the network the ring is reinitialised and the ‘target token
rotation time’ (time for a complete cycle around the bus) is recomputed.
5.1.3.13 The token-passing bus is a physical bus but a logical ring, in other words once the
token has been passed to node 12 on our diagram it is then handed to node 1,
thereby completing the ring. Figure 5-7 illustrates this setup below.
Figure 5-7 Physical Bus Logical Ring
5.1.3.14 Physical Ring Topology: Figure 5-8 shows a basic ring network where each node
connects to the nodes directly adjacent to it on both sides forming a single
continuous route around the ring. Data travels in one direction with each node
regenerating the network packets and forwarding them to the next node. A token
passing system is used as discussed above, except that the token is passed to the
next physical node as opposed to logical node as seen in the physical bus logical
ring topology. If any node is not switched on, electronics within the MAUs ensure
data is still forwarded to the next node.
Figure 5-8 Physical Ring Topology
5.1.3.15 Advantages of this arrangement are that data transmission is structured with every
node having access to the token for a specific time. Large networks can be
configured without complex mapping being required.
IMCA
GUIDANCE
5.1.3.16 Historically, logical and physical ring token passing networks performed better than
star networks at heavy network loads due to the complexities and time delays
introduced by the retransmissions of data caused by the CSMA/CD aspect of a star
network. However this advantage has been negated by the use of full duplex point-
to-point operations as discussed above. Typical ring transmission rates are 4M or
16M which means they are considerably slower than a star/bus topology using Fast
Ethernet which will operate at 100M.
5.1.3.17 Because the basic ring topology is uni-directional a failure of a single cable,
multidrop link or node, could cause severe disruption to network traffic. To overcome
this problem it is now common practice to install a counter-rotating ring to provide a
redundant topology. Until recently this was commercially unfeasible due to the cost
(and perhaps weight) of the additional cabling. With the introduction of cheap fibre
cabling more vendors are offering this solution as an alternative to the star/bus
system, arguing that it is a more deterministic solution.
Figure 5-9 Dual Ring Topology
5.2 NETWORK TECHNOLOGY
5.2.1 General
5.2.1.1 There are many vendors offering electrical, power and control systems, and there
are as many different network technologies on offer. A vessel management system
will have several networks installed, perhaps an Ethernet control network, a Profibus
DP fieldbus network and a Modbus RTU sensor network. Gone are the turnkey
solutions of the past where the owner was tied into a particular vendor for the life of
the vessel.
5.2.1.2 Standards based solutions have allowed several network protocols to come to the
fore. This section discusses several of the most popular technologies in use and
examines some of the advantages and disadvantages of each. Before discussing
the differences, it is useful to consider what each of the networks have in common,
that allows them to be used extensively in an industrial environment.
IMCA
GUIDANCE
5.2.1.3 Offshore industrial network systems are subject to environmental factors and other
design requirements not normally included in the design of an office network. Some
of these are:
1. Predictability
2. Reliability in a harsh environment
3. Minimum down time
4. Ease of maintenance / repair
5.2.1.4 Predictability: The system must have some degree of determinism. As systems
operate in a real time environment any failure or alarm must be reported and acted
on quickly enough to prevent any knock on effect further affecting the system. The
network topology plays a part in this determinism. Token ring networks and star /
bus networks operating in full duplex can be considered deterministic.
5.2.1.5 Reliability in a harsh environment: Offshore environmental factors including,

vibration, heat, salt laden atmosphere, electrical noise, etc must be taken into
account when designing the network system.
5.2.1.6 Minimum downtime: If a network is unavailable, some systems / devices may stop
communicating. At a minimum this will mean redundancy is compromised. The
network system should have been in service long enough for any inherent design
flaws to come to the fore or been stress tested to ensure mean time between
failures is acceptable.
5.2.1.7 Ease of maintenance / repair: A well designed system should have built in
diagnostics that enable the electrical or instrument technicians to quickly pin point
where system failures have occurred. Most vendors now provide some type of ‘Net
Status’ page or mimic on the HMI to assist fault finding. Where possible, modules
should be designed to allow them to be swapped out either without switching off the
rest of the network, or by isolating just the faulty section.
5.2.1.8 Other issues which may influence the choice of a particular network include cost
effectiveness, whether it complies with relevant standards, scalability and ease of
use. These are more ‘budgetary’ considerations and are not considered further here.
5.2.2 Introduction to Network Protocols
5.2.2.1 It’s not possible to discuss network protocols without mentioning the Open Systems
Interconnection (OSI) reference model. This is a seven layer model developed in the
1970s to attempt to standardise network communications.
5.2.2.2 Network protocol describes the functions that happen within these SEVEN layers.
The following discussion is a very broad description of the functions of each layer of
the model with Figure 5-10 illustrating a typical transfer of data between two
operator stations.
IMCA
GUIDANCE
Figure 5-10 OSI Network Model
5.2.2.3 Physical Layer: Provides the connection to the media, electrical and physical. This
layer also provides the Data Link layer with the means to transmit a serial bit stream
onto the media. This might be RS232, RS485 or transmissions from/to a Network
Interface Card.
5.2.2.4 Data Link Layer: Defines the network topology to be used. Chops the data into byte
size packets and wraps them for transmission by adding frame headers and footers.
Unwraps and reassembles packets coming back in before passing them up to the
Network Layer. The Data Link Layer is also responsible for the first line of error
checking and retransmission of missed packets.
5.2.2.5 Network Layer: Primarily used for routing, it takes the data from the layer above
(Transport Layer) and adds the network address of the destination. Passes it down
to the Data Link Layer. Removes superfluous information on packets received from
the Data Link Layer before passing up the chain.
5.2.2.6 Transport Layer: Responsible for reliable end to end user communications. Typical
functions include flow control (ensuring a reliable connection has been established
between devices) and multiplexing or slotting data from several applications into a
single packet. On receipt of the packets from the Network Layer removes any
remaining bits relating to data communications and formats the messages into a
language which is not protocol dependent.
5.2.2.7 Session Layer: Establishes, maintains and terminates network sessions by

allocating system resources as required. Will provide error reporting for the
Application and Presentation Layers.
5.2.2.8 Presentation Layer: If required, translates the incoming data sent to the Application
Layer into a format it will understand. For example if the data is a text message to
be displayed on the screen the Presentation Layer may ensure the output is sent as
an ASCII character. If it is a diagram, it may send as a GIF or a JPG.
5.2.2.9 Application Layer: This is basically the user interface, if the command sent from the
operator was to start a pump this is the instruction sent to the controller, RCU or
PLC.
IMCA
GUIDANCE
5.2.2.10 It is worth noting at this point that most industrial networks do not implement all
seven layers and actually use a 3-Layer model. Layer 3 (Network) is normally not
implemented as no routing to external networks is required. Layer 4 (Transport) is
not needed as the Data Link Layer (Level 2) carries out similar packet sequencing
functions, which is adequate for the complexity of these networks. Level 5 (Session)
is not required as high level software (e.g. token passing system) can be used to
control session lengths etc. Level 6 (Presentation) layer is not required as all
devices and nodes will be communicating in the same language.
5.2.3 Ethernet/IP
5.2.3.1 Ethernet/IP is the preferred option at this time for the Control Network; Ethernet/IP
implements Layer 1, 2, 3 and 7 of the OSI model. Current systems utilise a full
duplex industrial Ethernet network operating at 100MHz. The protocol used is
TCP/IP.
5.2.3.2 The purpose of the Ethernet/IP network is to transmit control data between the units
comprising the Vessel Management System. All operator stations (HMI) and field
stations are referred to as data terminating equipment (DTE). Each DTE has one or
more network interface adapter. Each node has a unique static Internet Protocol
address allocated when the interface card is installed. The use of IP addressing
requires the inclusion of Layer 3 (Network) in this model.
5.2.3.3 Operation: Data on an Ethernet network is transmitted across the medium in serial
using a non-return-to-zero signal. The encoding scheme is differential Manchester
code. The concepts and description of how Manchester code operates is beyond
the scope of this document.
5.2.3.4 The network interface card acts as a transceiver. The transceivers within each node
provide the following:
1. A medium access control (MAC) unit, which is responsible for frame wrapping
/unwrapping and error detection (OSI Layer 2).
2. A RAM module to allow the medium access control unit to talk to both the
network cable and the host computer at a high bit rate (OSI Layer 2).
3. Electrical isolation between the cabling and the interface electronics. (OSI
Layer 1).
4. Protection of the network from malfunctions in the transceiver (OSI Layer 1).
5.2.3.5 This last function is also referred to as jabber control since without the appropriate
protection electronics, if a fault develops, a faulty transceiver may continuously
transmit random data (jabber) onto the network and inhibit or corrupt all other
transmissions. This has great significance for DP control systems and most system
providers now implement measures to prevent this.
5.2.3.6 Network collisions are avoided by utilising fast Ethernet in full duplex mode for
network data transmissions. Fast Ethernet utilises two pairs of wire from CAT 7
shielded twisted pair (STP) cabling. In older systems with half duplex mode, one
pair of wires is used to send or receive data, and the other pair is used to listen on
the network for other nodes transmitting. (Collision detection). In full duplex mode
one pair of wires is used to transmit and one to receive.
IMCA
GUIDANCE
5.2.3.7 The use of network switches ensures the network packet is only sent to the correct
address. When a switch is first connected to the network it builds up a routing table.
When messages are received on a particular port the ‘from’ address is noted in the
routing table, the switch will initially forward this message to all ports except the port
the message was received on. Only the destination port will acknowledge receipt of
the message so the switch can further build up the routing table. Eventually all ports
will have entries in the routing table and the data through the switch will be
effectively point to point.
5.2.3.8 CRC and other validation checks are carried out. These include checking the frame
is neither too short nor too long. If any of these checks fail the frame is discarded
and an error status sent to a higher level and eventually to some type of ‘Net Status’
page. Assuming no frame errors the destination address field is processed.
5.2.3.9 Some data is still required to be sent to several or all units. This can be done by
sending a ‘broadcast’ packet. During normal operations broadcast packets will be
forwarded to all ports, however if the number of packets exceeds a preset threshold
in a preset time, packets will be discarded for a set time. When this time has
passed the adapter will resume accepting packets until the time threshold is
exceeded again.
5.2.3.10 All correctly addressed messages are processed at the Network layer and if it is
determined the data is for the current node the frame is passed to Layer 7 for further
processing.
5.2.4 Profibus
5.2.4.1 Profibus provides three different versions of the communication protocol: factory
message specification (FMS), decentralised peripherals (DP) and process
automation (PA). A brief description of each is given below, however only the
operation of Profibus DP is described in any detail.
5.2.4.2 Profibus FMS: In this model Layers 1, 2 and 7 are implemented. FMS was
developed as a multi peer network for communications between PLCs, HMI and
field devices. This general purpose solution could therefore be used in Control
Networks, fieldbus networks and sensor networks. Due to several factors, including
the limited baud rate not being able to supply the required refresh rates for modern
HMI, it is not being implemented in new Control Networks. In addition the newer
Profibus DP uses a similar transmission medium so FMS is now mainly used to
support legacy equipment
5.2.4.3 Profibus DP: Implemented at Layers 1 and Layers 2 and optimised for high speed,
this version was designed especially for fieldbus operations and is used extensively
in modern vessel systems.
5.2.4.4 Profibus PA: Profibus PA is designed for the sensor networks to connect sensors,
relays, actuators etc. to a common fieldbus. Implemented at Layers 1 and Layers 2,
Profibus PA transmission techniques are in accordance with standards to ensure
intrinsic safety and bus powering of field devices even in potentially explosive areas.
IMCA
GUIDANCE
5.2.4.5 Operation: Profibus DP can operate in a mono-master or multi-master mode

depending on configuration. Basically one or more ‘master’ (active node) controls a
number of slave devices (passive node) and polls them as required. Although the
Profibus protocol includes token-passing software Profibus DP only uses this if it is
configured in multi-master mode. The token is only passed between the masters,
not the slaves. The procedure for token passing is discussed above in bus
topologies. Once an active node receives the token it communicates with the
passive nodes using a master-slave setup.
5.2.4.6 Profibus DP normally operates using a cyclic transfer of data between master and
slaves on an RS485 network. The master-slave procedure permits the master to
periodically poll each node assigned to it. All data communication between a master
and slave originate from the master device. Each slave is assigned to one master
and only that master may write output data to that slave. Profibus DP is most often
set up as a single mono-master configuration, however, in a multi-master
configuration any master may read information from any slave, but masters can only
write data to their own assigned slaves.
5.2.4.7 The RS 485 specification for Profibus is based on semi-duplex, asynchronous

transmission. The transmission medium can be shielded twisted pair (STP) or fibre
optic cabling. When using STP the maximum line length is determined by
transmission speed.
Table 5-1 Profibus Maximum Segment Length
Baud Rate (kbit/s) 9.6 to 187.5 500 15,000 12,000
Segment Length (m) 1,000 400 200 100
5.2.4.8 Data is transmitted in an 11-bit character frame in non return to zero (NRZ)
differential Manchester code similar to Ethernet. As each slave is polled cyclically
there are no collisions and large amounts of data can be transferred in single
telegrams.
390Ω
390Ω
220Ω
220Ω
390Ω
390Ω
Figure 5-11 RS 485 Bus Segment
IMCA
GUIDANCE
5.2.4.9 In Figure 5.11 above, the bus line is a shielded twisted pair cable which is
terminated at both ends. A maximum of 32 nodes can be connected to any
segment. Line B high / Line A low indicates a binary ‘1’. The start bit is always a
‘low’ and the stop bit and any idle bits are always a ‘high’.
5.2.4.10 Data transferred between the master and slave is formatted according to the generic
station description (GSD) file for the particular master or slave device. GSDs files
must be provided by the device vendor to meet Profibus standards; however
Profibus International has also defined GSDs for many standard devices.
5.2.4.11 Advantages of Profibus: Profibus is the most widely accepted and installed industrial
network for fieldbus applications and is supported almost universally by all vendors.
It was developed in 1989 and has a stable architecture. Platform independence
means any number of master and slave devices are available off the shelf. The
polling nature of Profibus means it is a truly deterministic network. The FMS, DP and
PA versions cover all aspects of the industrial network.
5.2.4.12 Disadvantages of Profibus: When only transferring small amounts of data there is a
high overhead and it has slightly higher installation costs than some other networks.
The main Profibus version (DP) has no power on the bus. Due to the requirements
for termination resistors the bus topology used is sensitive to wiring problems and
installation problems when upgrading. However with the increased acceptance of
ProfiNet, basically an Ethernet version of Profibus-DP most if not all of these
disadvantages will be overcome.
5.2.5 Modbus
5.2.5.1 Modbus is briefly discussed here as it is used by most PLC manufacturers in

addition to their own proprietary language. Modbus is an application layer (Layer 7)
messaging protocol. Communication is based on a query-response protocol where
there is one master and one or more slaves. Modbus was originally created as a
way for main frame computers to gather information and control the operation of the
PLCs connected to them, a basic SCADA system.
5.2.5.2 Although not all Modbus slave devices are PLCs, they are still composed of two
basic components. These are the central processing unit (CPU) and the I/O system
interface. The CPU section is designed to carry out a programmed set of
instructions in a pre determined order. This program will normally be stored as a
ladder diagram within a memory map and the PLC will ‘descend’ the ladder one
rung at a time. Information will be sent to or requested from the field equipment.
5.2.5.3 The I/O system is the interface between the field equipment and the controller.
Incoming signals from limit switches, relays, pumps etc are wired to terminals of the
input interfaces, where if required they are passed through analogue to digital
converters, and the resultant data is stored in 16-bit unsigned (positive integer)
addressable registers until the CPU via the ladder program requests the data.
5.2.5.4 16-bit unsigned addressable registers are also used to store the information for
devices to be controlled, when the PLC ladder program instructs the control signals
to be output, the data is connected to the terminals of the output modules, this time
through a digital to analogue converter if required.
IMCA
GUIDANCE
5.2.5.5 The Modbus protocol was designed to provide a way to transfer the contents of
these registers to another PLC or a host PC. Serial Modbus connections use two
basic protocols these are Modbus ASCII and Modbus RTU. Both methods use Layer
1, 2 and 7 of the OSI model.
5.2.5.6 Modbus ASCII: When using Modbus ASCII, all messages are coded in hexadecimal
values, represented with readable ASCII characters. For every byte of information,
two communication-bytes are needed, because every communication-byte can only
define 4 bits in the hexadecimal. As discussed above the protocol was designed to
pass 16-bit register values, so it can be represented as 4 hexadecimal numbers
each made up of 4 bits of data.
5.2.5.7 The data is then sent for framing using a process called ASCII encoding. A colon (:)
character begins the message frame and a carriage return / line feed signifies the
end of the message. A longitudinal redundancy check (LRC) and a parity bit
provides assurance that the data is not corrupted in transmission.
5.2.5.8 Modbus RTU: The RTU model was developed to provide faster transfer of data.
When using Modbus ASCII the messages are encoded in hexadecimal. When using
RTU the data is exchanged in binary making the transfer more efficient. In addition
better error checking is carried out with RTU as CRC checking is carried out instead
of LRC. The table below lists the properties of the two protocols.
Table 5-2 Modbus ASCII and RTU Properties
Modbus ASCII Modbus RTU

Characters ASCII 0-9 and A-F Binary 0...255
Error Checking LRC Longitudinal Redundancy CRC Cyclic Redundancy
Start Frame “:” (colon) >28 bits idle time
End Frame CR/LF >28 bits idle time
Fragment Error 1 second / no data 12 bits / no data
Start Bit 1 1
Data 7 8
Parity even/odd none even/odd none
Stop Bit 1 2 1 2
Medium RS232 / RS422 / RS485 RS232 / RS422 / RS485
5.2.5.9 Modbus RTU messages are framed differently to ASCII messages. Each message
is preceded and ended by a time gap >28 bits. If a receiver detects a gap of at least
12 bits during a transmission this is assumed to be an error and the receive buffer is
cleared in preparation for a new message.
5.2.5.10 Although both protocols use the same medium (RS232/RS422/RS485) it is not
possible to mix Modbus ASCII and Modbus RTU on the same wire. It should also be
noted that although both ASCII and RTU support RS232 and RS422, if these
mediums are used only point to point communication can be established, i.e. only
one slave device can be connected. To allow multiple slaves RS 485 is required.
IMCA
GUIDANCE
5.2.5.11 Modbus also has a TCP/IP version which is essentially binary data (RTU) packaged
within the TCP/IP protocol. This allows for faster data over greater distances;
however it is not used to any extent in offshore systems at this time.
5.2.5.12 The main advantages of Modbus is its easy deployment, and simple configuration,
allowing legacy equipment to be easily interfaced with newer technologies. Its
universal acceptance by vendors in all regions of the globe means Modbus RTU
along with Profibus-DP and Ethernet/IP are seen as the de facto standards for
industrial networks.
5.2.6 WorldFIP
5.2.6.1 WorldFIP is the protocol from which the original Fieldbus standards were developed.
The protocol is based on a producer/distributor/consumer (PDC) model with
distributed arbitration, rather than the master / slave or token passing systems
discussed earlier. The WorldFIP protocol like the majority of the other protocols is a
3-layer model operating at Layers 1, 2 and 7 of the OSI model.
5.2.6.2 The WorldFIP physical layer ensures the transfer of information on the bus. The
transmission medium is either shielded twisted pair or optical fiber. The network
topology is a physical bus, which means all devices are attached to the same line.
Data is transmitted using differential Manchester code and transmission speed is
31.25Kbps, 1Meg, 2.5Meg and 5Meg (fibre only).
5.2.6.3 There are two types of node in the WorldFIP network. These are the ‘Bus
Arbitrating’ nodes and the ‘Producer/Consumer’ nodes. The Bus Arbitration (BA)
node, controls accessibility to the bus and signals to the other nodes when they can
communicate and is the ‘Distributor’ in this model. At any instant in time a subscriber
can be either a “Producer” or a “Consumer”. If a “Producer” it is placing data on the
network to be picked up or consumed by other subscribers on the network. If a
“Consumer” the controller listens on the networks and receives the data.
5.2.6.4 For redundancy purposes it’s common practice to configure several nodes to
perform the task of Bus Arbiter, however only one BA can be active at any time.
Normally the bus arbiter is selected arbitrarily - the first controller capable of being a
bus arbiter that ascertains that the network has no bus arbiter will assume the role.
Once the system is operational and a BA has been identified it commences a bus
scan. A scan involves the constant repetition of the FIP macrocycle. The macrocycle
contains a scanning table, a list of identifiers to scan and the periodicity associated
with each identifier.
5.2.6.5 The BA runs through the scanning table sequentially. It broadcasts the name of the
identifier on the network. One and only one PLC recognises itself as the ‘producer’
of the identifier. One or more PLC recognises they are ‘consumers’ of the variable to
be transmitted. The producer then broadcasts the value of the identifier and all
consuming stations simultaneously capture the variable.
IMCA
GUIDANCE
Figure 5-12 FIP Network Configuration
5.2.6.6 Figure 5-12 above describes the BA putting identifier 1 on the bus. Node 01
recognises this as a variable within his databanks and prepares to puts this on the
bus as the ‘producer’. Nodes 3 and 4 identify themselves as consumers and ready
themselves to accept the variable. The BA waits the correct amount of time to allow
the transactions to occur and then places the next identifier on the network. This
scanning table is read through and then the operation is repeated.
5.2.6.7 This type of transmission is classed as periodic transfer, in addition to this, at

preconfigured time slots within the macrocycle time may be allocated to allow
subscribers to transfer aperiodic data, making this both a process driven and event
driven protocol.
5.2.6.8 It appears from recent designs that the WorldFIP protocol is being used less and
less in offshore installations, but is considered here due to the legacy equipment still
in use.
5.2.7 CANbus
5.2.7.1 Another producer/consumer network that is gaining popularity, particularly in engine

monitoring systems and with some control system vendors, is CANbus (Controller
Area Network). CANbus uses Layer 1 and Layer 2 of the OSI model and was
originally developed in the late 1980s to simplify the design of wiring harnesses
within automobiles by moving from point-to-point connections to using a multidrop
bus topology. Since then several industrial fieldbuses have been developed using
CAN as their underlying technology, these include DeviceNet, ControlNet, CANopen
and CAN Kingdom. The fieldbuses mentioned are not compatible with each other
and the following description is of the messaging protocol within the basic CAN
network.
IMCA
GUIDANCE
5.2.7.2 Unlike most other protocols, in basic CAN the data packets do not contain either a
transmitting or receiving node address. Instead each message contains a unique
identifier based on the content of the message and its priority. This identifier is
assigned during system design. Parameters might be RPM, temperature, frequency
etc, it is expected that some parameters will change more rapidly than others and
therefore need to be transmitted more frequently; these will be allocated the higher
priority. The identifiers allocated the lowest physical values (binary) have the highest
priority.
5.2.7.3 A node with data to transmit will place it onto the bus, it’s possible that more than
one node will attempt to transmit simultaneously, therefore some type of arbitration
is required. The method used is a version of CSMA/CD similar to half duplex
Ethernet, except that where Ethernet uses destructive bus arbitration, CANbus uses
non-destructive bitwise arbitration.
5.2.7.4 With Ethernet, on detection of collision all parties retreat from the bus for a random
amount of time and retransmit, hoping the bus will be free. With CANbus any bus
conflicts are resolved with the identifier with the lowest value transmitting, and all
other nodes halting transmission. A wired-and mechanism (collector dotting) is used
to determine the message with the lowest identifier, where the dominant state (logic
0) overwrites the recessive state (logic 1). Nodes not transmitting, or with a
recessive transmission, automatically become receivers of the transmission. The
message is transmitted as a broadcast with all receivers interrogating the message
and using the data as required.
5.2.7.5 The drawing at Figure 5-13 illustrates the wired-and non destructive arbitration in
operation. Nodes A-D are transmitting simultaneously, arbitration is necessary and
the signals are wired-anded. The first node to pull back and cease transmitting is
Node C, followed by Node B then Node D. Node A continues transmitting and the
bus output reflects this.
Figure 5-13 CANbus Arbitration

IMCA
GUIDANCE
5.2.7.6 One advantage of this system is that bus allocation is determined by need and
negotiated only between the messages attempting to transmit. As there is no
requirement for silence on the bus as with Ethernet CSMA/CD, or the time
scheduling required with token passing, this non-destructive bitwise arbitration
usually ensures no bandwidth is utilised without the transmission of useful data.
5.2.7.7 CANbus has been around for over 15 years and a perceived disadvantage was the
limited data transfer rate, however with the number of fieldbuses developing this
technology it is now possible to achieve data transfer up to 5 Mps. As all identifiers
are allocated a physical number during the design phase, it may be expensive to
scale the system up during mid life upgrades.
5.3 REDUNDANCY
5.3.1 Introduction
5.3.1.1 As control systems have become more complex the number of installed devices has
multiplied, with each device potentially affecting the overall reliability of the system.
System failures, whether due to hardware or software problems may cause
downtime or compromise safety. To minimise downtime vendors have developed
products and solutions to provide fault tolerant systems by the use of redundant
hardware or software.
5.3.1.2 Hardware solutions include the use of redundant power supplies, redundant
processors, redundant IO modules, multiple HMIs and redundant cabling. Software
solutions might include using separate servers to install supposedly identical
software or using different versions of software in master and slave controllers or
PLCs. The figure below illustrates a typical distributed field station with redundancy
built in, and the discussion below describes the different ways redundancy can be
achieved.
IMCA
GUIDANCE
Figure 5-14 Typical Redundant Field Station
5.3.1.3 Power supply redundancy: In the illustration above each PSU is fed from a different
UPS. These UPS would normally be configured in a redundant fashion with each
one being supplied from different sides of the bus. Each PSU is feeding separate
PLCs and IO Racks providing complete isolation of supply. One disadvantage of this
setup is that the failure of a PSU will cause loss of a PLC and an IO Rack. An
alternative power distribution configuration would be to feed the output of both
power supplies to each module using decoupling diodes as shown in Figure 5-15 to
prevent a short circuit in one PSU affecting the other. The diodes must be tested
periodically to ensure a hidden failure does not compromise redundancy.
Figure 5-15 Redundant Power Supplies
IMCA
GUIDANCE
5.3.1.4 PLC redundancy: This can be designed in several ways. The most common way is
in a master/slave or ‘hot standby’ arrangement where status is continuously
monitored and data is synchronised between both controllers. On a failure of the
‘master’ there will be a bumpless transfer to the ‘slave’. Only one controller actually
outputs to the IO modules. An alternative way is to allow both processors to act as
peers and with both controllers outputting data to the IO modules, voting is carried
out using software algorithms and one or other of the signals is used.
5.3.1.5 IO module redundancy: Identical racks can be configured to ensure each line of field
IO is duplicated, in this way the total failure of a single rack will not affect the
operation. Although this may give excellent fault tolerance it is expensive and
somewhat complicated to implement. A more usual configuration is to split the IO
logically between the racks or IO modules. Loss of a rack or power supply to a rack
may have an effect on the redundancy of the system, and some field IO will be lost,
but the correct mapping of the IO will ensure fault tolerance is maintained. For
example, from the diagram at Figure 5-14 above, if pumps are operating in a duty /
standby configuration, control of one pump will be by IO Rack 1 and the other pump
by IO Rack 2. Although loss of IO Rack 1 will cause loss of communication with the
‘duty’ pump, the system can still start the ‘standby’ pump as a precaution if required.
Fail ‘as set’ is the preferred failure mode for most propulsion related equipment such
as pumps and cooling water valves. Some classifications societies require a pulse-
to-start, pulse-to-stop control strategy.
5.3.1.6 Sensor redundancy: Some critical systems may have twin sensors located close
together, or even as part of the same unit. When the same action is carried out if
either or both sensors register a signal, the sensors can be considered part of the
redundancy system. Once again it enhances redundancy if the outputs from the
sensors are mapped to different IO modules.
5.3.1.7 Data communication redundancy: Data communication redundancy was discussed

in the section on network topologies. The favoured solution at this time for the
control network is Ethernet in a star/bus topology. It is normally installed as a dual
independent system nominally Net A and Net B. All aspects of the network are
duplicated including cabling, switches, Ethernet adapters, network interface cards
(NIC). The drawing at Figure 5-14 illustrates this by showing separate Net A and Net
B cabling to each of the PLCs. Within the communication module on the PLC there
will be individual Ethernet interface adapters.
5.3.1.8 The drawing at Figure 5-16 shows a typical DP/VMS control network. The network
switches and any medium converters (STP to Fiber) are housed in network
distribution units (NDU). It can be seen that losing any single node on the network or
any active component (like a switch) will not affect the operation of the overall
system as communication is still operational on the alternative network.
IMCA
GUIDANCE
NDU-A1 NDU-A2
NET A
DP Control Thruster FS
DPC VMS OS FS 31
DP OS1 OS34 FS 32
DP OS2 OS35 FS 33
VMS OS
Thruster FS Aux FS
OS31
FS 34 FS 43
OS32
FS 35 FS 44
History Station
FS 36
PMS FS
FS 41
FS 42 NDU – Network Distribution Unit
VMS – Vessel Management System
OS – Operator Station
Thruster FS – Thruster Field Station
NET B
Aux FS – Auxiliary Field Station
NDU-B1 NDU-B2 PMS FS – Power Management Field Station
DPC – Dynamic Positioning Controller
Figure 5-16 Typical Control Network
5.3.1.9 Normally there is no redundant cabling to the field IO or even between field stations
and main units like the generator control panels or MCCs. Communication is
normally via a single Modbus or Profibus connection. However on safety critical
systems such as fire and gas, where a fieldbus connects the vendor specific
equipment to the VMS system for activation of CO2, closing of dampers and
ventilation etc. it is normal to have a dual Profibus link for redundancy purposes.
5.3.2 Alarm and Monitoring
5.3.2.1 Most DCS vendors provide an Alarm and Monitoring System as an integral part of
their delivery, if not it will be available as an optional extra. The main purpose of the
alarm and monitoring system is to give the operators the basic alarm and status
information they require to maintain safe and efficient operation of the plant.
Information relating to power management, propulsion, ballast control, HVAC, safety
systems etc. should all be available. To provide this data the distributed control
system processes information from a multitude of different sources. It’s not unusual
for a system to interrogate over 2000 separate IO devices and large vessels may
have upwards of 5000 IO.
5.3.2.2 Alarms: Built-in diagnostics ensure inconsistencies in expected results will be

detected and reported. These inconsistencies may be due to faulty field equipment,
faulty wiring, logic errors, incorrect configuration etc. The operator is made aware of
these anomalies by the use of audio and visual alarms. The audio alarms are
normally buzzers at the VMS Operator Stations (OS). This is usually a generic alarm
that the operator will silence locally at one of the HMI. The audio alarm is
accompanied by a visual alarm on a reserved part of the screen of the operator
station.
IMCA
GUIDANCE
5.3.2.3 As all operator stations are peers, the visual alarm will show at each station. This is
normally a banner alarm with a brief description of the fault and the tag number or
IO module generating the fault. Although different vendors have different systems
the alarm is normally colour coded with separate colours for severity of fault (yellow
or red). Safety critical faults may have a different coloured banner.
5.3.2.4 Alarm printers are provided to give immediate hard copy reports on alarms and
incidents. Historically these were parallel port dot matrix printers with a continuous
form feed output. In new or upgraded systems these are being superseded by
network fed single sheet feed laser printers. This network is usually an Ethernet
network connecting each HMI to the printer. This is a separate network from Net A
and Net B discussed earlier in the Control Network and is normally referred to as
Net C or the ‘admin net’. There is no requirement for redundancy in this network as
there are no control functions involved.
5.3.2.5 Monitoring: Continuous monitoring of control functions is carried out by the alarm
and monitoring system with all alarms and process events stored in a database
within each operator station. Relevant parts of this history log can be called up
within user defined time slices and all alarms and events displayed. The operator
can then use a search string to retrieve specific information.
5.3.2.6 To assist in fault analysis a history station can be provided, where in addition to
alarms and process events, selectable vessel management parameters are
recorded for a length of time decided by the operator. Information can then be
offloaded to external media for in-depth analysis offsite, or fed into a simulator to
recreate a specific situation. Software within the operator stations also allow real
time trending to be carried out for most power management and propulsion
parameters.
Figure 5-17 Typical Line Monitoring Circuit
5.3.2.7 Further monitoring is carried out including line monitoring of discrete inputs. The
simple drawing above at Figure 5.16 shows a basic line monitoring circuit with a
single field input to redundant RCUs. The line to the switch is active at 24V. With the
switch open the current in the circuit will be 6mA, with the switch closed the current
will be 19mA. Any other signal on the line will be incorrect and raise an alarm. It
should be noted this circuit is for illustration of the principle only. In a real situation
the resistor values would be different to take the resistance of the wire and
impedance matching etc. into consideration.
IMCA
GUIDANCE
6 THRUSTERS, DRIVES AND CONTROLS
6.1 GENERAL PROPULSION PRINCIPLES
6.1.1 The origins of the propeller
6.1.1.1 The Archimedes’ screw was used to move water as part of irrigation schemes in the
3rd century BC, but the first use of a screw as a means of propulsion occurs much
later in history.
1. James Watt said “Have you considered a Spiral oar?” (1770)
2. Joseph Bramah patented a “screw” propeller but never developed it practically
(1785)
3. Joseph Ressel is credited as the inventor by Austria (patent 1827)
4. Richard Trevithick described one in an 1815 patent
5. John Swan is heralded as the practical inventor, using one in 1824
6.1.2 Relationship between propeller power, thrust and RPM
6.1.2.1 Sir Isaac Newton’s third law of motion states that each action has an equal and
opposite reaction. A propeller develops thrust by accelerating water to a given
velocity. The water velocity V is proportional to the speed of the propeller (RPM).
From F = 2 MV 2 it can be said that:-

1
1
Thrust ∝ RPM 2 or RPM ∝ Thrust 2 .
The power to develop this thrust follows the relationship:-
Power = Thrust × Velocity

Therefore:-
3
Power ∝ RPM or Power ∝ Thrust
3 2
6.1.2.2 Figure 6-1 shows the relationship between power and thrust for an actual
azimuthing thruster in bollard pull conditions. The figure was plotted using data
supplied by the manufacture. DP thrusters only operate in ‘bollard pull’ conditions
when the sea current is zero. When the current is non zero there may be water flow
into the thruster even though the vessel is stationary.
IMCA
GUIDANCE
Power Against Thrust Typical FP Thruster (Bollard Pull)

100
90
80
70
Percentage Power (%)
60
50
40
30
20
10
0
0 10 20 30 40 50 60 70 80 90 100
Percentage Thrust (%)
Figure 6-1 Relationship between power and thrust
6.2 THRUSTER FAILURE MODES
6.2.1 Thruster failure modes
6.2.1.1 Some DP rules and guidelines have specific requirements that thrusters should fail
safe and not go to uncontrolled thrust or change direction with thrust applied as the
result of a single failure. Fail safe conditions are generally considered to be:-
1. Fail as set
2. Fail to zero thrust
3. Motor stop
4. Uncontrolled change in thrust direction may be accepted provided thrust goes
to zero.
6.2.1.2 Fail ‘as set’ may not be a good choice in some situations.
IMCA
GUIDANCE
6.2.2 Thruster types
6.2.2.1 There are several different types of thruster:-

1. Propeller with high lift rudder
2. Gill Jet
3. Voith Schneider
4. Tunnel Thruster
5. Azimuth thruster (Several forms)
6.2.2.2 Propellers can be of fixed pitch or variable (controllable) pitch
6.2.2.3 Propeller: This is a component part of many thrusters as well as the most common
form of propulsion. The propeller can be of fixed pitch or variable pitch. The pitch of
a propeller is the theoretical distance moved through the water for one revolution,
but due to slippage this is never achieved. One way to visualise this is to consider
the axial distance moved when a wood screw is turned through one revolution in a
piece of wood. Propeller efficiency is an important consideration as; if the propeller
is not correctly matched to the vessel then it will never perform to expectations. This
is not only an important consideration for operational costs but also for the
environmental emissions.
6.2.2.4 The high lift rudder can be connected to a DP control system and may be accepted
as contributing to athwart-ship’s thrust in certain conditions.
6.2.2.5 Gill jet: This system is not as common now as it was in the past. The thruster
consists of an axial flow pump delivering water across a grill with angled plates
(gills) in the bottom of the vessel to direct the thrust in the required direction. The
“gill” plate is circular and can be rotated through 360° to provide a multidirectional
thrust capability.
6.2.2.6 Voith Schneider unit: This type of unit is capable of thrust delivery in any direction.
When used as a means of propulsion it does not need a rudder. The blades are
attached at right angles to the rotor casing and rotate around a vertical axis. Each
blade performs an oscillatory motion around its own axis. This is superimposed on
the uniform rotary action of the entire unit. When the unit is fitted in the hull, only the
blades protrude from the hull as shown in Figure 6-2 below.
Figure 6-2 Voith Schneider propeller
IMCA
GUIDANCE
6.2.2.7 Tunnel thruster: The tunnel thruster requires a tubular water passage running
athwart-ships with the unit placed at its centre. This allows for the thrust to be
directed in either port or starboard directions by reversing propeller pitch or direction
of rotation. The limitations of this type of thruster are the length of tunnel in which it
is situated and the distance it is located from the bow or stern. The longer the tunnel
the greater the possibility of cavitation at high loads as the water flow may become
restricted. The further from the bow or stern the less the turning moment created
about the vessel’s centre of rotation.
6.2.2.8 Tunnel thrusters located at the stern may also be susceptible to aeration of the
water caused by the main drive propellers. There are no protrusions from the hull
when tunnel thrusters are used.
6.2.2.9 Rim drive thrusters are a relatively recent innovation which essentially removes the
need for a gearbox as the rotating element is the propeller which sits inside the
stator of the motor. This has the advantage of reducing the central body of the
propeller thus aiding the flow of water.
Figure 6-3 Tunnel thruster
6.2.2.10 Azimuth thrusters: The azimuth thruster is mechanically similar to the tunnel
thruster; it has the advantage, however of being able to direct the thrust in any
direction as opposed to port and starboard only. It also operates in open water
which has fewer problems in relation to the dynamics of flow as compared to the
tunnel thruster.
IMCA
GUIDANCE
Figure 6-4 Azimuthing thruster
6.2.2.11 Propulsion thruster: This is used in the same manner as the conventional shafted
propeller system with steering being achieved by rotating the thruster rather than
operating a rudder. It also forms part of the station keeping system when operating
in DP. On some types of vessel, all the thrusters are of this type and are designed to
be removed without the need to put the vessel in drydock. Class may apply
elements of steering gear rules to designated propulsion thrusters.
6.2.2.12 Retractable azimuth thruster: This is similar to the propulsion thruster but it can be
withdrawn into the hull of the vessel in order that it does not create extra drag while
the vessel is in transit. For short transit distances, the thrusters may be left deployed
and under power. For long transit distances, the increase in speed achieved by their
use is not justified normally due to the high additional operating cost incurred.
6.2.2.13 Combined retractable thruster and tunnel thruster: Theoretically, this provides
the advantages of both types but as with any multifunctional system it is a
compromise which may be suitable for some situations but not for all. As the hull
has less material, the possibility of structural deformation as a result of the forces
developed increases; therefore the hull has to be considerably strengthened to
compensate for this loss of strength. The increase in weight created may be
detrimental to the vessel or the thruster power may need to be decreased to
accommodate it adequately. It also has to be drawn further into the vessel thus
increasing the use of internal space.
6.2.2.14 Contra rotating azimuth thruster: Thrusters with contra-rotating propellers offer
higher efficiencies of between 10-15 per cent because the “aft” propeller regains
some of the energy losses in the stream as well as rotational losses. Contra-rotating
propeller thrusters also have low noise and vibration, and for the same power have
propeller diameters 20 per cent smaller than single screw units, giving a shallower
draught. The unit requires a variable speed drive as there is no option for a CP
Propeller. There are also more complex sealing and thrust containment systems to
consider.
IMCA
GUIDANCE
6.2.2.15 Podded azimuth thruster: The podded drive provides the means to deliver greater
power than previously possible with a geared azimuth thruster by eliminating the
gear train in the thruster as shown in Figure 6-5. The shaft of the thruster is also the
motor rotor with the pod casing being the stator. The seal arrangement becomes
much more critical as there is now the possibility of electrical failures occurring as a
result of seawater ingress. There is also a bilge arrangement to remove any leakage
into the pod itself and provides a means to assess if there is excessive leakage
taking place. Power can be of the order of 2 to 25 MW.
Figure 6-5 Podded thruster
6.2.2.16 Azipull thruster This appears to be a back to front azimuth thruster but there are
advantages in this design. A pulling propeller (CPP or FPP) is mounted ahead of the
leg, which is a streamlined unit incorporating the gear house and a lower fin. The
leg/housing/fin combination recovers swirl energy from the propeller slipstream
which would normally be wasted, converting it into additional forward thrust. At the
same time the underwater unit has more rudder effect than a conventional azimuth
thruster, improving the steering ability of many hull forms. The disadvantage is that it
is primarily a propulsion / DP thruster as it could be problematic trying to
accommodate a retractable unit.
6.2.2.17 Portable thruster: At least on manufacture now offers hydraulically driven swing
down thrusters which are largely independent in terms of power and control and can
be added to a dumb barge to provide a DP capability with relatively little effort
compared to a conventional unit.
IMCA
GUIDANCE
6.2.3 Choice of thruster
6.2.3.1 In any DP Class 2 or 3 new building or conversion project, the choice of which
thrusters to use is often made at an early stage in the basic design process due to
the long manufacturing lead times for such units. In addition to lead time, there are
many other factors to consider when choosing a thruster for a particular application
such as:-
1. Thruster type – tunnel or azimuthing
2. Thrust capability
3. Physical size – headroom under deck head etc
4. Fixed or retractable
5. Variable speed, variable pitch or combinator
6. Electrical drive, direct diesel drive
7. Reliability
8. Maintainability
9. Availability of service engineers
6.2.3.2 One of the most important points to consider is:-
‘How will the choice of thruster influence the development of the redundancy
concept?’
6.2.3.3 The choice of thruster type will significantly influence the redundancy concept and it
is important to ensure that the redundancy concept incorporates the necessary
features to support that particular choice.
6.2.4 Physical constraints
6.2.4.1 Fixed pitch thrusters driven by variable speed AC drives are very popular but it is not
always appreciated how much space and weight can be taken up by the drive and
its related support equipment such as drive cabinets, phase shifting transformers,
de-ionized cooling water units, UPSs, pre-charge units etc. There will also be a need
to provide connections to FW cooling systems, HVAC and electrical supplies for all
these units.
6.2.4.2 Although the variable pitch propeller may have some perceived disadvantages in
terms of increased maintenance requirements and lower reliability due to its
mechanical complexity, it can be packaged into a very compact arrangement at low
and medium power levels, and requires very little in the way of ancillary equipment
and support services. This might be an important consideration in small and medium
sized DP vessels.
IMCA
GUIDANCE
6.2.5 Low load performance and related issues
6.2.5.1 The advantages of the fixed pitch, variable speed thruster are its mechanical
simplicity and low power consumption at low propeller speed. Many DP vessels
spend only a fraction of their working life operating in conditions close to their
maximum post failure capability and therefore thrust demand levels can be very low
much of the time. The result is that the vessel has to operate with a few lightly
loaded generators online which can be an uncomfortable condition both in terms of
power plant stability and running conditions for diesel engines, which need to be well
loaded to prevent carbon build-up reducing performance.
6.2.5.2 Vessels with variable pitch thrusters can depend on a guaranteed based load from
each thruster of around 20% but this is not the case with variable speed drives. The
solution for vessels employing variable speed drives is to use the thrusters in bias
mode (fixed azimuth with opposing thrust vectors to create the desired resultant
force) and apply significant amounts of force bias to increase the load on the
generators by having the thrusters work against each other. This method works well
and has advantages of improved station keeping stability in benign environmental
conditions and reduced wear and tear on thruster steering gear. However, the need
to manage this force bias correctly following a power plant failure was not fully
understood in some early applications. In particular, it was not always properly
controlled by the power management system, particularly if the PMS was a
standalone unit not supplied by the DP control system provider. Two issues
associated with early implementations were the need to shed the bias load before
initiating overall thrust reduction as a means of blackout prevention and also the
need to shed bias in such away that the desired thrust vector is maintained,
otherwise a drive off will result.
6.2.5.3 Provided the sum of the base load provided by the variable pitch thrusters and the
hotel load is larger than the rating of the largest generator on the vessel, the power
plant is relatively immune to ‘failure to excess fuel’ generator faults. In this type of
failure one faulty generator takes the entire load and others trip on reverse power
leading to cascade failure and blackout. With fixed pitch, variable speed propellers
there may be times when the total system load falls within the rating of one
generator leaving the system vulnerable to this type of failure.
6.2.6 Effect of propeller law and power factor on post failure capability
6.2.6.1 Because the relationship between propeller thrust and power is a not a straight line,
as shown in Figure 6-1, a vessel which is holding position with all thrusters available
may need significantly more power to hold station in the same conditions following a
failure that leads to loss of some thrusters. Thruster tripping was (and still is) a
popular, ‘last resort’, load-shedding feature on vessels with variable pitch thrusters.
The poor low load power factor of large asynchronous motors means that more
generators have to be online even at relatively low load, thus tripping thrusters
reduces the total current demand even if the power demand increases. On vessels
with fixed pitch thrusters, which tend to have a high power factor throughout their
operating range, the advantage lies in keeping as many thrusters running as
possible following a failure as it is more efficient to divide the available power
between them than to have a few thrusters working hard. In reality the advantage
may be quite small and each case needs to be considered on its merits, taking into
account the power savings associated with thruster auxiliaries which can also be
tripped.
IMCA
GUIDANCE
6.2.7 Regenerated power
6.2.7.1 Other issues associated with the use of large power electronic variable speed drives
are the need to manage power regenerated by braking action. This is not usually an
issue for DP but more for transit and vessel manoeuvring when much higher levels
of power can be returned to the power plant. Some types of drives are not capable
of regenerating power. With this type of drive, care must be taken when using speed
control not to reduce the speed command set point at a rate faster than the propeller
will naturally decelerate otherwise the inverter part of the drive will attempt to return
power. Because power cannot be transmitted beyond the drive to the power plant
the drive will only succeed in storing the energy within itself to the point where it will
be tripped by its own over voltage protection. It can be very alarming for the DPO or
helmsman to suddenly have all the thrusters’ trip off line simply because the manual
thruster control levers were pulled back to zero too quickly.
6.2.7.2 Where drives are designed to return power to the power generation system or to
dynamic breaking resisters, care must be taken to manage the return of this power
in such a way that generators are not tripped on reverse power or braking resistors
overloaded.
6.2.7.3 This problem is often eliminated when variable speed drives are designed for ‘true’
torque control rather ran speed control.
6.2.8 Effect of harmonics
6.2.8.1 Power system harmonics have already been discussed in relation to phase shifting
transformers in 4.1.9. All variable speed drives produce harmonics of one form or
another. Generally, the more sophisticated the drive, the smaller are the levels of
harmonic distortion produced. However, this is another area where the choice of
thruster type can influence the redundancy concept. If it is necessary to add
harmonic filters to deal with the effects of harmonics then it is necessary to consider
the effect of these on DP redundancy.
6.2.8.2 It is notoriously difficult to specify a passive harmonic filter that will be effective in all
power plant configurations. The additional capacitance these filters add to the
system may also affect the power factor to the point where there are restrictions on
the number of generators that can be run with certain combinations of filters. If
harmonic filters are to be part of a DP redundancy concept then a very careful study
of their failure effects needs to be carried out to ensure they do not create
undesirable operational restrictions.
6.2.8.3 More recently there is a trend to use variable speed drives with so called active front
ends. These are generally advertised as a solution to the problems of harmonic
distortion associated with older 6 and 12 pulse drives. These modern drives make
use of individual filters at the thruster rather than attempting to correct the entire
power system. However, even with these modern devices there have been concerns
about system resonance. It is also necessary to consider whether failure of the filter
will lead to equipment malfunction elsewhere in the plant, and studies backed up by
suitable testing should be carried out to establish this.
IMCA
GUIDANCE
6.2.9 Starting transients and inrush current
6.2.9.1 Before solid state power electronic frequency converters of large power rating were
available, dc drives were the most popular method of obtaining speed control of
motor loads. Since this time, power electronics have advanced to the point where
frequency converters of very high power rating are available. Two device types
dominate the market, the gate turn off thyristor (GTO) and the insulated gate bipolar
transistor (IGBT). The advantages of fixed pitch propellers using variable speed
drives are higher efficiency under all operating conditions (typically in excess of 90%
at full load), mechanical simplicity, improved control and negligible starting
transients. The reduction of starting transients is a significant advantage as many
motor failures can be linked to excessive heating and the large electromagnetic
forces generated by starting currents. Many motor manufacturers impose limits on
the number of starts per hour to control the thermal effects associated with direct on
line starting of large motors. It should be noted that some classification societies
specify that there should be no restriction on thruster starting intervals.
6.2.9.2 When variable speed drives were first introduced, one of their advantages was the
ability to soft start large motors. Prior to the application of power electronic
technology this was achieved through the use of reduced voltage starting
techniques such as star-delta and Korndorffer starters, both of which have a
significant degree of mechanical complexity.
6.2.9.3 It is entirely fair to say that variable speed drives do remove the large starting
current transient of thruster motors when the thruster is started. This effect is
achieved by ramping the speed order up from zero to the desired speed. What is not
so obvious is that there is still a large inrush current associated with connecting the
drive’s phase shifting or isolation transformer. The problem has therefore been
shifted from normal starting and stopping of the thruster to blackout recovery when it
is arguably more important to be able to start thrusters with as few generators as
possible. Because of the transformer inrush current it is still possible to trip a
generator if too many thrusters are started too early. An obvious solution is to add
‘heavy consumer start blocking’ but this delays the point at which thrust can be
applied until sufficient generators are online to connect the drive transformers safely.
Pre magnetising of transformers has been effectively used to remove inrush
transients. Pre-magnetizing can be carried out by using a small transformer to back
feed the main drive transformer or by using the drive its self powered from a large
UPS or battery bank.
6.2.10 Thruster restart
6.2.10.1 Other factors to be considered when specifying a thruster driven by a variable speed
drive is whether or not it can start the motor while it is still turning or decelerating,
sometimes called ‘restart on the fly’, and also whether it can start a thruster that is
not stationary because of inflow from sea current or adjacent thrusters. If the drive
trips prior to restart it will have to go through a pre-charge routine which can take up
to 10s to make the drive available again provided it is programmed to restart
automatically. All these issues can be successfully addressed in modern drive
systems but it may be more cost effective to enquire about this feature at the time
the specification is being prepared than after the thruster is installed.
IMCA
GUIDANCE
6.2.10.2 Large modern variable speed drives now offer sophisticated control systems which
can include a customer application element such that they can be used to start and
stop their own auxiliary systems such as pumps and cooling fans. This can be
usefully employed to give a thruster drive a great deal of autonomy to make itself
ready for operation in receipt of a simple request to start the thruster. Care must be
taken to ensure that such control systems are protected by a UPS with sufficient
duration to keep the drive controls available during blackout recovery. It is also
worth ensuring that the ‘ride through’ of auxiliary systems such as cooling pumps
matches that of the drive. In the worst case there is little point having a sophisticated
drive designed to ride through a voltage dip if it is tripped on loss of cooling water
flow because the contactor for its cooling water pump dropped out due to the same
voltage dip.
6.2.11 Diesel driven thrusters
6.2.11.1 Even thrusters which are directly driven by Diesel engines are not without issues
that can influence the redundancy concept. Fixed pitch variable speed units often
have clutches to disconnect the propeller from the engine for starting. These
clutches can be operated by an engine driven hydraulic pump but can also be
operated from an electric pump. Some designs require pressure to keep the clutch
engaged and should have their own accumulator to allow for auto changeover of the
pump to a standby unit. However, there have been designs where this has not been
the case and many thrusters dropped out of DP simply because one switchboard
supplying several pumps blacked out. The standby pumps powered from the other
side of the switchboard started immediately, but too late to keep the thruster from
dropping out of DP and going to idle. In such designs, what should have been a
‘cast iron’ redundancy concept employing direct diesel driven thrusters has been
compromised by failing to understand the importance of maintaining clutch pressure
during auto-changeover of pump supply.
6.2.12 Variable pitch thrusters (Controllable pitch propellers)
6.2.12.1 Variable pitch thrusters also have features that will influence the redundancy
concept including:-
1. The pitch must be brought back to zero before the unit can be started
2. Many designs will trip on loss of hydraulic pressure requiring that there be a
suitable delay on tripping during standby pump changeovers etc
3. Large motors will require some form of soft starting as already discussed star-
delta units, Korndorffer starters or even power electronic soft starts are
possible
6.2.12.2 A failure mode that is sometimes overlooked is what happens to the power system if
one of the large motors starts direct and goes online without going through the star-
delta sequence. This is known to have happened in at least one case causing a very
severe voltage dip which affected the performance of other parts of the DP system
leading to drift off.
IMCA
GUIDANCE
6.2.12.3 The standard arrangement for fixed speed thrusters uses an induction motor to drive
a controllable pitch propeller (CPP). Selectable speed motors are also available
which will normally have two separate windings, one for high speed and one for low
speed. Speed selection in this type of machine is achieved by altering the number
of poles.
6.2.12.4 Traditional methods for large high voltage machines include autotransformer and
Korndorffer starting. The high starting currents also require a substantial spinning
reserve of reactive power to restart propulsion motors. There has been at least one
incident where motors could not be restarted after a partial blackout because of the
lack of spinning reserve, in spite of the fact that there was adequate power to
maintain the on line thrusters at full power. The problem was worsened by the
vessel operating in ‘open bustie’ configuration.
6.3 THRUSTER AUXILIARY SYSTEMS
6.3.1 General
6.3.1.1 Thrusters need various support services including:-

1. Hydraulic power packs for blade pitch control
2. Hydraulic power packs for steering of azimuth thrusters
3. Hydraulic power pumps for retraction
4. Lubricating pumps
5. FW and de-ionised water cooling units for motors, transformers and drives
6. Ventilation
7. UPSs for control, pre-charge and ride through
6.3.1.2 There are several strategies for providing power for thruster auxiliary systems.
Arguably the most secure is to closely associate the power supply for the auxiliary
systems with the supply to the thruster main motor itself. However, many vessels
were, and continue to be, designed with thruster auxiliary system powered from the
main LV distribution. Where a thruster has a duty and standby pump for a particular
service, one will be supplied from the port LV switchboard and the other from the
starboard LV switchboard. This is not necessarily the best arrangement however as
it introduces vulnerability to standby start failure and certain restriction on pump
utilisation and maintenance. If the reason for providing dual pumps is to mitigate the
low reliability of the pump and not its source of supply then there is no significant
disadvantage to powering both the duty and the standby pump from the same LV
switchboard. This arrangement allows any pump to be withdrawn from service for
maintenance with no significant impact on the redundancy concept.
IMCA
GUIDANCE
6.3.2 Hydraulic power packs
6.3.2.1 Hydraulic power packs typically consist of two or three electrically driven pumps in a
duty standby arrangement. Where the thruster requires more than one pump for
normal operation the action of pitch or steering control can become slower if
operation is reduced to one pump. This needs to be considered in the design of any
protective functions based on steering or pitch control speed particularly if a single
distribution fault can fail one pump on each thruster. As with any essential
consumer, voltage dip ride-through needs to be considered. Figure 6-6 shows the
schematic of a typical hydraulic steering system for a large azimuthing thruster.
6.3.3 Thruster prediction errors
6.3.3.1 Most DP control system are arranged to provide a ‘prediction error if the thrust
magnitude or direction is not as expected. Prediction errors may occur if hydraulic
systems are not capable of turning the thruster or changing blade pitch in the
expected time.
Figure 6-6 Thruster hydraulic system
IMCA
GUIDANCE
6.3.4 Thruster lubrication
6.3.4.1 Figure 6-7 shows a typical thruster lubrication system for a large azimuthing
thruster. Many thrusters of this type can operate for an extended period without
forced lubrication. Some designs of thruster impose a maximum load under these
conditions. Where such restrictions are applied automatically, the DP control system
must be advised that the thruster is no longer capable of its full capacity.
6.3.4.2 Many types of thruster depend upon compressed air to provide positive pressure on
shaft seals to prevent seawater ingress and contamination of the oil. Compressed
air systems are often common to all forward or all aft thruster such that failure of the
service air system leads to a loss of seal pressure on all forward or all aft thrusters.
Figure 6-7 Thruster lubrication system
IMCA
GUIDANCE
6.3.5 Thruster cooling
6.3.5.1 Many thrusters require some form of fresh water cooling for things such as:-
1. Phase shifting transformers
2. Motors
3. Variable speed drives
4. HPUs
5. Lube oil coolers
6. HVAC
6.3.5.2 In the case of high voltage variable speed drives, there may be a need for an
intermediate cooling system using de-ionised freshwater. Figure 6-8 shows a typical
thruster FW cooling system for a single thruster. In general, thrusters should be
designed to be as independent of each other as practical even if the redundancy
concept accepts that more than one thruster can fail due to loss of a main
switchboard. Some classification societies require independent cooling systems all
equipment intended to provide redundancy and independent cooling system for
thrusters are considered to be good practice in view of the risk of losing multiple
thrusters due to leaks or maintenance related activities. If there are concerns about
the ability to carry out maintenance on freshwater cooling systems then each
thruster should be provided with a second pump and cooler rather than create
commonality.
Figure 6-8 Thruster cooling water unit
IMCA
GUIDANCE
6.4 THRUSTER MOTORS
6.4.1 DC motors
6.4.1.1 DC motors come in several winding configurations. DC motors for speed control are
generally separately excited machines with separate controlled rectifiers for the field
winding and armature winding. DC motors for thrusters are generally rated at 600V
and power ratings of a few hundred kW to 1MW. For larger power outputs it is
common to find tandem motors arranged to drive a common shaft. Commutators
and brushes are sued to make the main power connection to the armature winding
and these introduce maintenance issues. DP vessels are still being built using Dc
motors and modern DC drives.
6.4.2 Asynchronous motors
6.4.2.1 Asynchronous motors, also known as induction motors, are by far the most common
type of motor for fixed speed and variable speed drives. This type of motor has a
squirrel cage rotor and a three phase stator winding. Large motors for fixed speed
drives are generally rated at 6.6kV or 11kV and power ratings up to 3MW (typical
marine application). Asynchronous motors for use with variable speed drives may be
typically rated at lower voltages such as 1270V, 2.2kV or 3.3kV and power ratings
up to 5MW are not untypical in marine applications although much larger drives can
be found in other applications. A typical motor speed range is 0 to 750 rpm but
higher speeds can be found.
6.4.3 Synchronous motors
6.4.3.1 Synchronous motors are very similar to synchronous generators in so far as they
have an AC stator winding and a DC rotor winding. They found specialist application
in the ‘Synchrodrive’ which was fitted to some types of podded drive and are still
specified in some higher power applications. They were also used as synchronous
condensers in some vessel to correct low power factor.
6.5 VARIABLE SPEED DRIVES
6.5.1 General
6.5.1.1 Several types of power electronic variable speed drive are available for propulsion
drives. By far the most popular is the multi level Pulse Width Modulation (PWM)
inverter but other types of drive are specified for some applications.
6.5.2 Cycloconverter Drive
6.5.2.1 The cycloconverter drives offer very high torque at low speed; typical applications
include icebreakers and large ships. Disadvantages include poor speed range.
Figure 6-9 shows the power component layout of a basic cycloconverter drive. Note:
In practice, there are several different forms of cycloconverter.
IMCA
GUIDANCE
Figure 6-9 Cycloconverter Drive
6.5.3 Synchroconverter drive
6.5.3.1 The synchroconverter drive is a current-source Load-Commutated Inverter (LCI)

connected to a synchronous motor. This type of inverter is available to power
ratings in excess of 50MW. The synchroconverter drive has the advantage of being
electrically and mechanically simple. Characteristics include high starting torque,
good voltage dip ride through and wide speed range. Figure 6-10 gives the basic
power component layout of a LCI driver.
SMOOTHING INDUCTOR
INPUT
TRANSFORMER
M
SYNCHRONOUS
MOTOR
THYRISTOR CONVERTERS
FORCED COMMUTATION FOR STARTING,

NATURAL COMMUTATION WHEN RUNNING
Figure 6-10 Synchroconverter drive
6.5.3.2 Note that good voltage dip ride through depends on the drive controls being well
protected by UPS
IMCA
GUIDANCE
6.5.4 Voltage source PWM Drives
6.5.4.1 Multilevel Pulse Width Modulation (PWM) drives are now the industry standard for
most electric propulsion applications. Figure 6-11 show the basic power
components of a PWM drive. Pulse width modulation was developed to improve
upon the current harmonics of six and twelve pulse fully controlled bridge output
stages. Although the drive output voltage of simple PWM schemes is still a square
wave, the mark space ratio is altered to simulate the effective area under an
equivalent sinusoid. The effect is a near sinusoidal motor line current waveform with
considerably fewer low order harmonics. Higher order harmonics may be increased
but these are more easily filtered.
6.5.4.2 Lower harmonics in motor line current means smooth, quiet operation and a
reduction in unwanted heating effects. Although the line current waveform of PWM
drives is a major improvement the voltage waveform is still essentially a square
wave, More advanced PWM drives use multiple step levels combined with pulse
width modulation to improve the voltage waveform. When these drive output
voltage waveforms are filtered, the result is a near sinusoidal voltage and current
waveform.
6.5.4.3 Major drive manufactures claim an overall efficiency of the order of 96% including
the output filter. PWM drives offer many other advantages such as near constant
power factor throughout the operating range; values in the region of 0.9 are typical.
Many drives also offer sophisticated motor control algorithms, some of which used
mathematical models of the motor. From a system protection standpoint, drive
manufacturers offer short circuit proof drive output converters which means that a
thruster failure is handled at the drive itself and the upstream protection need not
operate for this type of fault. Earth fault, thermal, over current and over voltage may
also be offered as standards.
6.5.4.4 Wear and tear on circuit breakers may be reduced as motor starting and stopping is
handled by the drive. Reduced arcing can also be expected.
6.5.4.5 All power electronic drives create harmonics on the system to which they are
connected. Generally speaking, the higher the order of harmonics, the more easily
they are dealt with and much may depend on the type of input stage specified. Six-
pulse input rectifiers offer low cost with a penalty in terms of harmonic performance.
Twelve-pulse rectifiers, supplied by drive transformers with star and delta secondary
windings, are a standard way of improving upon this. Even better performance can
be obtained by increasing the pulse number yet further. However, a cost penalty
has to be accepted. Several manufacturers also offer drives with an active front end
as another way of reducing supply side harmonics.
IMCA
GUIDANCE
Figure 6-11 Voltage source PWM drive
6.5.5 Ride through performance
6.5.5.1 Although power electronic variable speed drives have been in use in DP vessels for
more than ten years, the significance of some of their features and flaws is only now
being understood by the DP community, often as the results of investigations into
DP incidents. In many cases these features were well understood by the drive
manufacturers but for some unknown reason the significance of these flaws and
features was not communicated to the designers of the DP redundancy concept.
One such feature is the ability (or lack of ability) of the variable speed drive to ride
through a power system transient caused by the effect of clearing a fault elsewhere
in the distribution system. This issue is also of great importance in the process and
chemical industries where plant operators do not want critical parts of the process to
trip every time there is dip in grid voltage.
6.5.5.2 Figure 6-12 shows a much simplified schematic of a variable speed AC thruster
drive. Voltage source drives such as this will trip on severe voltage dips to protect
themselves from the inrush current that follows power restoration. In recent years,
drive manufacturers have addressed this issue by using the power of fast control
systems to stop the drive consuming power during the voltage dip thus preventing
its own internal voltage falling to dangerously low levels. However, these features
are often not tested in practice and therefore the first real test is usually when the
feature is called upon to operate in service. Had vessel owners and designers been
more aware of these flaws and features, the arguments surrounding operation with
busties open or closed may have been very different.
IMCA
GUIDANCE
Figure 6-12 Variable speed thruster drive
6.5.5.3 Some designers back up the voltage dip ride through capability of the drive by
providing automatic reconnection and restart. If the drive detects a significant power
system disturbance (over/under voltage, over/under frequency) it will be
disconnected but will continue to monitor the power supply until it determines that it
is safe to automatically reconnect.
6.6 THRUSTER CONTROL SYSTEMS
6.6.1 Thruster manufacturer’s control systems
6.6.1.1 Most thruster manufacturers provide a closed loop control system for their thrusters.
For azimuthing thrusters with controllable pitch propellers the closed loop control
system will accept both steering and pitch commands from the DP control system
and operate the hydraulic control system to achieve the desired blade pitch and
steering angles. In the case of azimuthing thrusters with fixed pitch propellers, the
closed loop control of propeller speed is provided within the variable speed drive.
Only the closed loop steering control is provided by the thruster control unit.
6.6.1.2 Figure 6-14 shows a typical thruster control unit for a fixed pitch azimuthing thruster.
The unit accepts steering commands from the DP control system in the form of an
analogue 4-20mA loop representing the required angle. The control unit then
interprets the command and operates the clockwise CW and counter clockwise
CCW solenoid valves to bring the thruster azimuth to the required angle by the
shortest possible route. The hydraulic system is typically capable of turning the
thruster at 2 rpm.
IMCA
GUIDANCE
6.6.1.3 There are three angle measuring devices mounted on the thrusters. One device
provides feedback to the control unit for closed loop control, the other provides
feedback direct to the DP control system and the third is used for indication at the
manual thruster control levers. The closed loop feedback device may be a shaft
encored in some applications. Feedback to the DP control system is usually
provided by a sine / Cosine potentiometer driven from an ±10V supply as shown in
Figure 6-13. This device has resistance elements which produce a sinusoidal
distribution of voltage. Wipers displaced by 90° allow a cosine voltage to be
produced. The angle of the thruster is then computed from :-
1. if V_sin > 0 and V_cos > 0 angle = arctan(V_sin/V_cos/ (2*pi) * 360°
2. if V_cos = 0 and V_sin > 0 angle = 90°
3. if V_cos < 0 angle = 180° + arctan(V sin/V_cos)/ (2*pi) *
360°
4. if V_cos = 0 and V_sin < 0 angle = 270°
5. if V_cos > 0 and V_sin < 0 angle = 360 + arctan(V_sin/V_cos)/ (2*pi) *
360°
6.6.1.4 In other devices a 4-20mA interface is used to indicate the sine and cosine
feedback. Loop monitoring is provided to indicate that one channel has failed. Some
control system supplier also carry out a check that Sin2 A+Cos2 A = 1.
Figure 6-13 Sine / cosine potentiometer
6.6.1.5 Although the DP control system only provides open loop control of the thruster
(closed by vessel position) it does monitor the thruster speed and azimuth and will
issue a prediction error if either variable deviates from the required value by more
than a defined amount in a specified time. Note that at least one type of thruster has
a single mechanical drive for all three angle indicators. If this drive slips, the thruster
may be pointing in the wrong direction with no indication that this is the case.
IMCA
GUIDANCE
6.6.1.6 The thruster control unit provides one of several inputs to the DP control signal. This
signal indicates to the DP system that the thruster is ready for DP commands. Other
inputs may include the variable speed drive indicating that it is ready for speed or
torque commands. Some thruster failures will cause the DP ready signal to indicate
‘not ready’. As soon as the DP control system detects the change in status it will
automatically deselect the thruster and reduce the command to zero.
6.6.1.7 The thruster control unit will also provide some of the interlocks and protection
associated with the thruster. Typical interfaces for this purpose include:-
1. Shaft brake applied
2. Air pressure available
3. HPU pressure
4. Main and backup power supply present
5. Lube oil pressure
6. Thruster control unit healthy - warning / fault
7. DP ready
8. Local / remote
9. Main motor start allowed
10. Main motor running / stopped
11. Stop main motor
IMCA
GUIDANCE
PROP SPEED
SINE / COSINE
AZIMUTH FEEDBACK TO DP
LOCAL / REMOTE
PROP SPEED FEEDBACK
AZIMUTH FEEDBACK TO
VESSEL DP READY
THRUSTER CONTROL UNIT
AUTOMATION
SYSTEMS
BRAKE
WARNING
CW
FAULT
CCW
AZI CMD 4-20mA THRUSTER UPS POWER IN

CONTROL UNIT THRUSTER
BACKUP DC SUPPLY
MOTOR STOPPED SHAFT BRAKE OPEN
SHUTDOWN MOTOR
SHAFT LOCK OPEN
DRIVE
START ALLOWED
HPU PRESSURE
HYDRAULIC PUMP RUNNING

(RETRACTABLE LUBE OIL PRESSURE
AZIMUTH THRUSTER ONLY)
Figure 6-14 Thruster control unit
6.6.2 Direct control by vessel automation system
6.6.2.1 In some applications there is no thruster manufacturers control unit and the
hydraulics are interfaced directly to a vessel management system field station. The
thruster control algorithms for steering and pitch control reside within the field
station. This is a popular solution for vessel upgrades where the thruster mechanical
part is to be retained but the obsolete control system is absorbed into a new vessel
automation system.
IMCA
GUIDANCE
6.6.3 Thruster emergency stops - line monitoring
6.6.3.1 Classification societies normally require that remote thruster emergency stops are
located at the main DP station. Emergency stops for safety purposes may be
located at other points in the thruster or drive machinery space. The thruster
emergency stop must be independent of the normal drive control system. Ideally the
emergency stop would act directly on the drive main circuit breaker but very few
variable speed manufactures adopt this because shutting down the drive in this way
carries a significant risk of damage. Therefore most emergency stop functions act
on the drive control system in some way, usually as an input to the safety shutdown
chain part of the drive controller electronics. An alternative scheme has been
proposed in which the drive will be shut down gracefully by the initial action of the E
stop, with a time delay circuit to open the drive circuit breaker directly if the drive
controller fails to open it in a few seconds.
6.6.3.2 DP rules and guidelines require that thrusters fail safe but there will always be some
circumstances where the DPO needs to shut down a thruster quickly using a control
other than the normal stop function. In the case of a run-away thruster it may be
difficult to tell which thruster is faulty as all thrusters may load up to oppose the
faulty one. Prediction alarms or other alarms indicting thruster faults may help to
identify the faulty unit.
6.6.3.3 Classification society requirements vary but for DP Class 2 it is not unusual to
require that all propulsion related emergency stops use normally open contacts to
prevent spurious loss of a thruster. At least one classification society requires line
monitoring to prevent shutdown of the thruster on emergency stop cable faults such
as open circuit or short circuit. To achieve this, isolated switch amplifiers are used in
combination with stop buttons having the necessary series and parallel resistors as
shown in Figure 6-15. The amplifiers will only respond to the correct change in line
current caused by closing the stop button across the parallel resistor. Alarms are
provided to indicate a cable fault or loss of the E-stop power supply.
Figure 6-15 Thruster emergency stops
IMCA
GUIDANCE
6.6.3.4 In DP class 3 vessels, the thruster emergency stops may form a common point
connecting all thrusters, which must be taken into account when the effects of fire
are considered. Line monitoring is generally accepted as mitigation of this potential
failure. Other methods have been accepted as reducing the risk of thrusters
responding to E-stop cable faults. One possible alternative is to arrange the E-stop
with two control circuits one using normally open contacts and the other using
normally closed. The thruster will only shut down if both circuit change state. Alarm
will be given if the two circuits ever indicate the same status. This arrangement is
similar to the logic used in the DP control system’s ‘fire back-up’ switch for DP class
3 vessels.
6.6.3.5 To provide more information on the nature of a fault, the alarms for E stop cable
faults should reset automatically at the switch amplifier if the fault clears. However,
the vessel management system will retain the alarm until acknowledged so that the
fault can be investigated.
IMCA
GUIDANCE
7 SAFETY SYSTEMS
7.1 GENERAL PRINCIPALS OF SAFETY SYSTEMS
7.1.1 Purpose
7.1.1.1 Safety Systems are designed and installed to protect personnel, environment and
assets from the consequences of abnormal and hazardous situations, and to allow a
safe evacuation of personnel within a reasonable time frame. The hazards that are
considered include fire and the presence of inflammable gas from drilling operation,
onboard hydrocarbon processing or nearby installations.
7.1.1.2 The safety systems are designed to allow for the shutdown of main power plant,
thrusters, ventilation systems and fuel and lube oil pumps. For fire incidents there
may also be systems to trigger injection of fire suppression mediums. When fire
suppression systems are used these will require ventilation shutdowns for the
associated spaces.
7.1.2 Application
7.1.2.1 For installations covered by MODU and vessels such as FPSOs a shutdown system
will be required to make safe the processing plant. This system may be integrated
with a common ESD or may be a separate system.
7.1.2.2 The ESD System is used to provide a safe and rapid shutdown of systems and
equipment. The ESD System processes input signals from manual pushbuttons and
selected F&G signals.
7.1.2.3 When designing these systems associated with a dynamic positioning system the
design must consider possible impact of the Safety Systems on the DP system,
including the effects of the failure modes or acts of maloperation.
7.1.2.4 The designer of the safety systems may prioritise the reliable operation of
shutdowns to ensure faults do not prevent a shutdown being carried out. The
designers of the DP system are more interested in ensuring that faults in the safety
systems do not compromise station keeping integrity. This section is mainly
concerned with resolving that apparent conflict.
7.2 REGULATIONS RELATING TO SHUTDOWN SYSTEMS
7.2.1 Regulations for shutdown systems are almost entirely written from the point of view
of ensuring safety rather than minimising the risks of faults in safety systems
affecting the DP system. However, there is some recognition that the risk of
“unintentional stoppages” should be minimised. See (MODU Code 6.5.3, DNV-OS-
A101 SAFETY PRINCIPLES AND ARRANGEMENTS Section 5 “Table C1 - Safest
conditions and corresponding output circuit configuration” )
IMCA
GUIDANCE
7.2.2 A comprehensive treatment of ESD systems and Fail Safe Functionality is given in
DNV-OS-A101 SAFETY PRINCIPLES AND ARRANGEMENTS Section 5. This
describes how systems should be “designed so that risks of un-intentional shutdown
caused by malfunction or inadvertent operation is minimised.” However there is no
cross reference to the sort of redundancy requirements that are now commonplace
in vessel management systems.
7.2.3 Classification Society rules require ventilation stops outside machinery spaces to be
used in the event of a fire but make no mention, directly, to the consequences of any
failure in the stop system.
7.2.4 As discussed earlier the DP system will be affected by failures of the auxiliary
systems. For DP class 2 that will include any failure in the shut down systems and
for DP class 3 systems it will include the effect of fire on associated cabling in any
compartment. Rules also require the consideration of any reasonable act of
maloperation. These requirements should mean that the shutdown and safety
systems are treated in the same way as any other part of the vessel’s control
system meet the same redundancy requirements, and have their failure modes
analysed in the DP system FMEA.
7.3 ESD SYSTEMS AND DP REDUNDANCY
7.3.1 There are numerous ways to arrange emergency shutdown systems and Fire and
Gas detection. Some of these are illustrated in the diagrams below.
Fixed Fire Suppression System Operating

Gas Detection
Cabinets
Fire Detection
Fire and
Gas Alarm
Mimic
Diagram
Emergency Stop
Panel with
Group Stops on
Mimic Diagram
Push
PLC or Relay
Button
Cabinet
Signals
Outputs to Ventilation Fans, Ventilation

Flaps, Fuel Pumps, Lub Oil Pumps etc.
Figure 7-1 Simple Centralise Emergency Stop System

IMCA
GUIDANCE
7.3.2 In Figure 7-1 fire and gas detection is displayed on a mimic diagram above another
mimic with group and individual stop buttons. The stops are implemented via a
central PLC cabinet. The main issues here for effects on the DP system are failure
effects due to hardware or power failures in the PLC cabinet. Although the PLC
may be designed so that no shutdowns occur when power fails it would be
preferable to use separate PLCs with redundant power sources split to match the
redundancy concept.
7.3.3 The same issues, of the system not being split to match the redundancy concept,
also apply to the more sophisticated system shown in Figure 7-2. Here although the
F&G system uses four field stations the ESD system only uses two. If such an
arrangement is used on a system with a four way redundancy split the ESD system
might cause the failure of half the systems which may be worse than the WCFDI.
To make this arrangement acceptable, the system must be designed to fail safe.
Arranging circuits such that they do not trip on power failure greatly reduces the risk.
Class may require that this is demonstrated at FMEA proving trials for DP vessels.
Redundant Data/
Network Links
Gas
Detectors
Push Fire Pumps
Fire and Gas System
Buttons
based on Four VMS Field
Fire Stations Fire
Detectors Fighting
Fire Detection Systems
Manual
Call Points
VMS System Based on Field
Stations and Redundant ESD and F&G Matrixes
Network for Control of Power Incorporating ESD 1
System, Auxiliaries and DP. and ESD 0 buttons.
Uses separate Field stations for Located in Bridge and
each Thruster and Each ECR
Switchboard.
Fire Dampers
ESD Level 0 Pushbuttons at
Lifeboat Muster Stations
Ventilation Fans
ESD System Based on
two VMS Field Stations
Local Emergency Stop Buttons in Valves
Machinery Spaces (ESD 2)
Equipment
Shut Down
ESD 0 Abandon Platform Shutdown

ESD 1 Preparation to Abandon
ESD 2 Local ESD F&G Pushbuttons
Figure 7-2 ESD and F&G System Integrated into VMS
7.3.4 An ESD 0 as shown in Figure 7-2 causes a total shutdown of all systems. Some
would consider such an arrangement an unacceptable risk and have a policy to not
implement ESD 0.
IMCA
GUIDANCE
7.3.4.1 Measures that may be included in such a system to reduce risk include:-
1. Additional subdivision of hardware to operate all stop functions along the lines
of the redundancy concept
2. Use of two buttons to avoid accidental operation
3. Use of covered type buttons
4. Use of an enable keyswitch which can be in the off position during DP
operations
5. ESD set to manual activation only during DP Operations
6. Field station outputs fail safe on power loss to prevent tripping of DP critical
items
7.3.5 An arrangement split along the lines of the redundancy concept (in this case a four
way split) is shown in Figure 7-3. Here any fault in the ESD should only affect one
of the four switchboards.
7.3.6 The ESD system shown in Figure 7-3 is divided into four, along the lines of the
redundancy concept. This means that the worst failure that is likely to occur would
be a spurious shutdown of 25 % of the power and thruster systems. There is a
small risk that a severe event affecting one of the lifeboat stations could affect all
engine rooms. This risk could be minimised by operating the system inhibits on the
bridge during DP operations. Providing alarm and delay on ESD 0 to allow the
control room operators or DPOs to cancel the shutdown has also been implemented
in some applications.
7.3.7 Note that the system is provided with a separate disable facility to each controller on
the bridge (Bridge Enable Control). This is a recently introduced safety measure
required to enhance security.
7.3.8 The difficulties with the design of ESD 0 when applied to dynamically positioned
drilling units arise because the rules were written for moored units and thus station
keeping was of little concern. A moored unit will not drift off on loss of power but
blackout of a DP MODU (because of a gas cloud) means that the vessel drifts
downwind remaining in the gas cloud.
7.3.9 In the design of an ESD system there may be a risk of a blackout due to a wiring
fault. These risks can be minimised by using:-
1. Line monitoring
2. Dual circuits with NO & NC contacts which must change state together
3. Voting systems
4. Ensuring that trips do not occur if power is lost to the controllers or field
stations.
IMCA
GUIDANCE
11KV SWGR RM A
480 SWBD RM A 10 c
ESD HVA 11 kV Swbd
Controller
Water Mist Valve Operation Panel in ECR To CPA CPA
Stbd Pump Rooms, Engine Rooms 1 – 4, 24V VMUPS1
Thruster Rms 1, 3, 5 and 7 FS05
PSU
Water Mist Valve Operation Panel in ECR To CPB
Stbd Pump Rooms, Engine Rooms 1 and 2,
Trip Signals to 440V ac
Thruster Rms 1, 3, 5 and 7
Consumers
Water Mist Valve Operation Panel in ECR To CPC
Port Pump Rooms, Engine Rooms 1 – 4,
Thruster Rms 2, 4, 6 and 8
Water Mist Valve Operation Panel in ECR To CPD
Port Pump Rooms, Engine Rooms 1 – 4, Drill Cabin
To CPA,
Thruster Rms 2, 4, 6 and 8 VESD-DF- CPB, 11KV SWGR RM B
CPC and 480 SWBD RM B
PB1 10 c
Bridge Control Panel CPD. ESD HVB
Controller
11 kV Swbd
LQ Vent Shutdown CPB

ESD-LQ-PB VMUPS2
24V
FS06
PSU
FWD Lifeboat Station
To CPA, CPB, CPC and CPD ESD HVA
PB-2 Trip Signals to 440V ac
MS Vent Shutdown To CPA Consumers
A
ESD-MS-PBA
ESD HVB
PB-2
To CPA To CPB
MS Vent Shutdown
B ESD HVC 10 c 11KV SWGR RM C
480 SWBD RM C
ESD-MS-PBB PB-2
To CPC ESD HVC 11 kV Swbd
Controller
To CPB CPC
ESD HVD VMUPS3
MS Vent Shutdown PB-2 24V
To CPD FS07
C PSU
ESD-MS-PBC Bridge Enable Control
ESD HVA
Trip Signals to 440V ac
To CPC ENABLE
To CPA Consumers
AFT Lifeboat Station
MS Vent Shutdown
ESD HVA
D ESD BVB PB-2
ESD-MS-PBD ENABLE To CPA
To CPB
To CPD ESD BVB

ESD HVC 11KV SWGR RM D
PB-2 480 SWBD RM D 10 c
E-GEN Room Vent ENABLE To CPB
To CPC ESD HVD 11 kV Swbd
Shutdown
Controller
VESD-EGEN-PBD
ESD HVC CPD
ESD HVD PB-2 24V VMUPSD
To CPD ENABLE To CPC FS08
To CPD PSU
Main DP/Back-UP
DP Alt. Vent S/D ESD HVD
PB-2 Trip Signals to 440V ac
ESD-PB-DP Consumers
To CPD
To CPD
Figure 7-3 ESD 0 Split to Match Redundancy Concept
7.4 ACTIVE FIRE PROTECTION
7.4.1 Design considerations
7.4.1.1 Active fire suppression systems include fire suppression gases and water mist
systems. These are usually activated from individual control panels mounted
immediately outside the space covered. These panels are in turn linked to some
arrangement that will shut off the ventilation and close ventilation flaps (fire
dampers) related to the area containing the fire. With this design, any fault in these
panels should only affect the ventilation for one space. However, if a central relay
panel is used, the failure effects from that panel may affect more than one space if
not carefully designed. When designing these systems it is important to consider
the effect on DP related systems caused by intentional operation and by system
failure.
IMCA
GUIDANCE
7.4.1.2 For DP Class 2 vessels it is generally accepted that failure of the fire-fighting system
must not lead to a failure effect exceeding the worst case failure design intent even
if intentional operation will have that effect. However, it is good practice to split fire
fighting systems and their controls along the lines of the redundancy concept. This is
particularly valid in the case of DP Class 2 vessels with more than one engine room.
DP Class 3 vessels are designed to withstand the effects of fire in any one
compartment and fire fighting systems should be designed in a manner that
supports the redundancy concept.
7.4.2 Typical system
7.4.2.1 Figure 7-4 shows a typical CO2 system for a large DP Class 2 vessel with two
enginerooms. The operating philosophy outlined below describes some of the
features used to help ensure the correct space is flooded and prevent unintentional
actions such as:-
1. Stop of fans
2. Closing of dampers
3. CO2 discharge
7.4.2.2 In this example the starboard engineroom requires 44 CO2 cylinders and the port
generator engineroom requires 47 CO2 cylinders. One control valve cabinet is
allocated to each engineroom and each cabinet houses two manually operated
valves. One of the two valves valve directs gas from the pilot bottles to activate all
the cylinders downstream of the CO2 control line through a pneumatic timer. The
other valve directs pilot gas to keep the main stop valve in the open position. A limit
switch on the main stop valve will indicate to the F&G system that the valve has
been opened.
7.4.2.3 The pilot cylinders are located in the cylinder control cabinet, accessed by a key. On
a confirmed fire in a CO2 protected space, a red light will be illuminated on the
corresponding control valve cabinet to direct the operator to the correct cabinet.
Ventilation shutdown and alarms are initiated by limit switches on the cabinet doors.
7.4.2.4 Opening the control valve cabinets for the port or starboard enginerooms is detected
by two limit switches to reduce the risk of spurious operation, this triggers the
following actions:-
1. A CO2 release column light alarm will be activate in the associated space
2. The bridge will receive audible and visual alarms on the F&G system
7.4.2.5 Opening the cylinder control cabinet activates a third limit switch which initiates:-
1. CO2 release alert on the F&G system
2. Trip of ventilation fans and closure of fire dampers (provided all three limit
switches are activated)
7.4.2.6 More advanced features can be included such as linking initiation of the CO2 release
process to the power management system which will start standby generators in the
unaffected engineroom and open the bustie when the process is complete. Thus
reducing the risk of a fire affecting both power systems.
IMCA
GUIDANCE
Figure 7-4 Typical CO2 fire fighting systems for large vessel
7.5 EFFECTS OF VENTILATION SYSTEM SHUTDOWN
7.5.1 Machinery Spaces
7.5.2 In spaces such as thruster rooms and auxiliary machinery spaces there should not
be an immediate effect on systems due to a spurious shutdown of ventilation but this
should be confirmed during FMEA proving trials.
7.5.3 Measures to mitigate the longer term effects can include alarms for unscheduled fan
stops, temperature monitoring of machinery and room temperature sensors. Trials
should check that the measures used give a reliable and timely warning of
ventilation failure well before machinery must be shut down to avoid damage.
7.5.4 Enginerooms
7.5.5 See also Section 2.3.6 for a discussion of engineroom ventilation shutdown.
Restriction of air flow into the engineroom can have a more serious effect on engine
operation and can also represent a safety hazard in relation to slamming of doors
etc.
7.5.6 Figure 7-5 shows a typical fire damper system for a large DP Class 2 vessel with
two enginerooms. The fire dampers are pneumatically controlled using two
independent sources of air. The dampers for each space are controlled by dedicated
F&G process stations. Due to the importance of maintaining combustion air to the
engines, the fire dampers for the enginerooms are arranged to fail to the open
position on loss of air supply or control signal. The fire dampers for other spaces fail
to the closed position.
IMCA
GUIDANCE
Figure 7-5 Fire damper controls
7.6 GROUP STOPS
7.6.1 Group Stops are used to simplify operation of multiple functions to shut down
equipment for an area. These should be split along the lines of the redundancy
concept with respect to both to the initiating buttons and the hardware (cables, cable
routes, relays, PLCs, field stations etc) used to act on the stop command. The type
of shutdown circuit used may be determined by class requirements including the
provision of line monitoring.
7.7 CONTROL ROOM LAYOUTS
7.7.1 Modern DP and vessel management systems have tended to locate the main
operator stations on the bridge, it is therefore sensible to install the matrix panels
and the controls for emergency shutdowns, fire and gas detection etc. at the same
location. This allows senior personnel to control and monitor all aspects of an
ongoing incident from one position. The ergonomics of this arrangement are
important to reduce the risks of shutting down the wrong systems. These facilities
will usually be duplicated in the ECR (Engine Control Room) where such a location
exists.
7.7.1.1 The arrangement of the VMS control may be set such that acknowledging
engineering alarms is the responsibility of personnel in the ECR and all safety
related (e.g. Fire and Gas alarms), DP and ballast control alarms are to be the
responsibility of the bridge, with two DPOs manning the DP and VMS desks .
IMCA
GUIDANCE
ESD Matrix and

Safety Panels
Figure 7-6 Positioning of ESD/Safety Systems
7.7.2 In the example above, the ESD Matrix and Safety system has been positioned so
that senior personnel in control of an emergency situation on the bridge can best
control the situation. Also routine false alarms, zone isolations etc can be dealt with
and monitored by the DP operators easily.
7.7.2.1 VMS system operations dealing with F&G alarms, hot work isolations, ballast control
etc. can be a full time task on a large rig therefore positioning the VMS desks near
to F&G / ESD panels makes this task easier.
IMCA
GUIDANCE
This report is intended for the sole use of the person or

company to whom it is addressed and no liability of any nature
whatsoever shall be assumed to any other party in respect
of its contents. As to the addressee, neither the Company
nor the undersigned shall (save as provided in the Company's
Conditions of Business dated 1st October 2005) be liable
for any loss or damage whatsoever suffered by virtue of any act,
omission or default (whether arising by negligence or otherwise)
by the undersigned, the Company or any of its servants.
GL NOBLE DENTON
Signed:
Steven Cargill
DP Technical Authority
Countersigned:
Bill Ireland
Assistant DP Operations Manager
Dated: Aberdeen, March 2010
IMCA
GUIDANCE
APPENDICES
IMCA
GUIDANCE
APPENDIX A LIST OF ABBREVIATIONS
IMCA
GUIDANCE
Master Abbreviations List

A
ABS American Bureau of Shipping
AC Alternating Current
ACB Air Circuit Breaker
ACCU Automatic Control Centralised Unmanned
AHU Air Handling Unit
AHV Anchor Handling Vessel
AMOT Name of valve manufacturer
AVR Automatic Voltage Regulator
B
BA Bus Arbiter
BTT Bow Tunnel Thruster
C
CA Certifying Authority
CB Circuit Breaker/Control Breaker
CCW Counter Clockwise
CD Carrier Detect/Collision Detect
CO2 Carbon Dioxide
CoS Chamber of Shipping
CPP Controlled Pitch Propeller
CPU Central Processing Unit
CR Close Relay
CRC Cyclic Redundancy Check
CSMA Carrier Sense Multiple Access
CT Current Transformer
CW Clockwise
D
DBR Dead Bus Relay
DBSR Dead Bus Slave Relay
DC Direct Current (dc in text - do not expand)
DCS Distributed Control System
DDC Deck Decompression Chamber
DG Diesel Generator
DGS Diesel Generator Set
DGPS Differential Global Positioning System
IMCA
GUIDANCE
DI Digital Input
DNV Det Norske Veritas
DO Diesel Oil
DP Dynamic Positioning
DPC Dynamic Positioning Console/Cabinet
DPO Dynamic Positioning Officer
DPS Dynamic Positioning System
DTE Data Terminating Equipment
E
ECR Engine Control Room
EG Emergency Generator
EGB Electric Governor – Backup
EPD Electrical Power Distribution
ER Engineroom
ESD Emergency Shut Down
F
F&G Fire and Gas
FIP Factory Interface Protocol
FMEA Failure Mode and Effect Analysis
FMECA Failure Modes and Effects Criticality Analysis
FO Fuel Oil
FS Field Station
FW Fresh Water
FWC Fresh Water Cooling
Fwd Forward
G
GPS Global Positioning System
GSD Generic Station Description
H
HF High Frequency
HFO Heavy Fuel Oil
HMI Human Machine Interface
HO Heavy Oil
HP High Pressure
HPP Hydraulic Power Pack
HPR Hydro-acoustic Position Reference
IMCA
GUIDANCE
HPU Hydraulic Power Unit

HT High Temperature
HTFW High Temperature Fresh Water
HV High Voltage
HVAC Heating, Ventilation and Air Conditioning
Hz Hertz
I
I/O Input/Output
IAS Integrated Automation System
ICMS Integrated Control and Monitoring System
ICS Integrated Control System
IMCA International Marine Contractors Association
IMO International Maritime Organisation
IP Internet Protocol
IP Industrial Protocol
ISM International Safety Management
ISO International Standards Organisation
J
JB Junction Box
K
kN Kilo Newton
kV Kilo Volt
kVA Kilo Volt Ampere
kVAr Kilo Volt Ampere Reactive
kW Kilowatt
L
LAL Low Level Alarms
LCR Inductance, Capacitance, Resistance
LED Light Emitting Diode
LHS Left Hand Side
LO Lube Oil
LOA Length Over All
LR Lloyds Register
LRC Longitudinal Redundancy Check
LS Load Sharing
LT Low Temperature
IMCA
GUIDANCE
LTFW Low Temperature Fresh Water

LV Low Voltage
M
mA milliAmps
MAC Medium Access Control
MAP Main Alarm Panel
MARPOL Merchant Shipping (Prevention of Oil Pollution) Regulations
MAU Media Access Unit
MBC Micro Biological Contamination
MCB Miniature Circuit Breaker
MCC Motor Control Centre
MCCB Moulded Case Current Breaker
MCOS Manual Changeover System
MCR Maximum Continuous Rating
MDO Marine Diesel Oil
MFR Multi Function Relay
MGE Main Generator Engine
MGP Multi Generator Protection
MMI Man Machine Interface
MMS Marine Management System
MODU Mobile Offshore Drilling Unit
MRU Motion Reference Unit
MS Main Switchboard
MSB Main Switchboard
MSC Maritime Safety Committee
MTC Manual Thruster Controls
MUX Multiplexer
MVA Mega Volt Ampere
MVAr Mega Volt Ampere Reactive
MVR Manual Voltage Regulator
MW Megawatt
N
NDE Non Drive End
NDU Network Distribution Unit
NIC Network Interface Connector/Card
NPS Negative Phase Sequence
IMCA
GUIDANCE
O
O2 Oxygen
O/C Open Circuit
OIM Offshore Installation Manager
OLE Object Linking and Embedding
OLM Optical Link Module
OPC Object Linking and Embedding for Process Control
OPLS Oil Pressure Low Shutdown
OS Operator Station/Outstation
OSV Offshore Supply Vessel
OT Operator Terminal
P
PA Power Available
PC Personal Computer
PCU Process Control Unit
PLC Programmable Logic Controller
PMG Permanent Magnet Generator
PMS Power Management System
PS Process Station
psi Pounds per Square Inch
PSU Power Supply Unit
PWM Pulse Width Modulation
Q
QC Quick Closing
QCV Quick Closing Valve
QoS Quality of Service
R
RAM Random Access Memory
RCS Remote Control System
RCU Remote Control Unit
RHS Right Hand Side
RMS Route Mean Squared
ROV Remotely Operated Vehicle
RP Reverse Power
RPM Revolutions Per Minute
RTD Resistance Temperature Device
IMCA
GUIDANCE
S
S Second(s)
S/C Short circuit
SCADA Supervision Control And Data Acquisition
SCR Silicon Control Rectifier
SLD Single Line Diagram
SMS Safety Management System
Stbd Starboard
STP Shielded Twisted Pair
SW Sea Water
SWBD Switchboard
SWG Standard Wire Gauge
T
TC Thruster Controller
TCP/IP Transmission Control Protocol/Internet Protocol
TDAVR Thyristor Divert Automatic Voltage Regulator
THD Total Harmonic Distortion
TMS Thruster Management System
TW Taut Wire
U
UHF Ultra High Frequency
UMS Unattended Machinery Space
UPS Uninterruptible Power Supply
V
VAr Volt Ampere Reactive
VAS Vessel Automation System
VCB Vacuum Circuit Breakers
VDU Visual Display Unit
VHF Very High Frequency
VFD Variable Frequency Drive
VMS Vessel Management System
VSD Variable Speed Drive
VT Voltage Transformer
W
WCFDI Worst Case Failure Design Intent

A7043-B IMCA Guidance DP Electrical Power and Control

Caricato da

Informazioni sul documento

Descrizione originale:

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

A7043-B IMCA Guidance DP Electrical Power and Control

Caricato da

Copyright:

Formati disponibili

No 1 The Exchange

Phone +44 1224 289100

DP ELECTRICAL POWER AND CONTROL

W/S No: 55/130502

File: a7043-b imca guidance dp electrical power and control

Noble Denton Consultants Ltd trading as GL Noble Denton

B 18/03/10 For client review JM/DT/SC JM BI

INSERTED DOCUMENT/FILE REGISTER

4 POWER DISTRIBUTION 108

5 VESSEL MANAGEMENT SYSTEMS 130

5.2 NETWORK TECHNOLOGY 136

6 THRUSTERS, DRIVES AND CONTROLS 152

7 SAFETY SYSTEMS 177

APPENDIX A LIST OF ABBREVIATIONS 188

Figure 2-21 Engine HT and LT Cooling Water System 40

Figure 6-6 Thruster hydraulic system 164

1.1 GENERAL INTRODUCTION AND SCOPE OF DOCUMENT

1.2 ELECTRIC PROPULSION

1.3 POWER STATION CONCEPT

1.3.2 The advantages of the power station concept include:-

1.3.3 The disadvantages of the power station concept include:-

1.4 CONVENTIONAL PROPULSION

1.5 CONCEPTS OF FAULT TOLERANCE AND CONTROL SYSTEMS

1.5.2 Key elements of fault tolerant systems

1.5.2.1 In DP vessel design, fault tolerance is generally achieved by redundancy.

Redundancy ‘The existence of more than one means of performing a required

1.6 DP CLASS 2 & 3 REDUNDANCY CONCEPTS

1.7 FAILURE MODES AND EFFECTS

1.7.4 Typical list of equipment and functions related to DP

2.1 GENERAL PRINCIPLES OF POWER GENERATION

2.1.1 Voltage, Current and Power

Equation 2-1 Ohm’s Law

2.1.1.2 Impedance is measured in Ohms (Ω) and may be resistive or reactive or a

1. Resistance (R) is also measured in Ohms,

2.1.1.3 By convention, inductive reactance is considered to be positive and capacitive

Figure 2-1 Impedance as the Combination of Resistance and Reactance

Equation 2-2 Impedance

Figure 2-2 Current and Voltage in Phase – Purely Resistive Load

Figure 2-3 Current Lagging Voltage by 30º - Slightly Inductive Load

Figure 2-4 Instantaneous Power for a Purely Resistive Load

Figure 2-5 Instantaneous Power for a slightly inductive load

Figure 2-6 Active, Reactive and Apparent Power

2.1.2 Generating electricity

4. l is the length of the conductor in metres,

Equation 2-3 EMF

Equation 2-4 Force

Figure 2-7 Conductor Passing Through a Magnetic Field Induces an EMF

Figure 2-8 Current Carrying Conductor in a Magnetic Field Experiences a Force

Figure 2-9 Cross-section of Four Pole, Salient Pole Alternator

Figure 2-10 Three-phase alternator with Wye (star) winding

Equation 2-6 Relationship between speed, frequency and number of poles

Engine Speed (rpm) Frequency (Hz) Number of Poles

Figure 2-12 Elementary Three-Phase Equivalent Circuit of Synchronous Alternator

Figure 2-13 Phasor diagram

2.1.4 Generator Capability

Figure 2-14 Generator Capability Plot

2.1.5 Alternator nameplate power factor and operating power factor

2.1.5.3 Typical nameplate data:-

P = 3 VLINE I LINE Cos Ø

Equation 2-7 Three Phase Power

(W) ACTIVE POWER

Figure 2-15 Generator Operating Point

2.2.1 Marine Engine Types